Sign in with your operator account. If this account has an authenticator enrolled, you will be asked for it next.
This surface is served on its own listener and is never mounted on the public
gateway port. Depending on the deployment it is reached either at its own
hostname behind the ingress, or on 127.0.0.1 over an SSH tunnel
(ssh -L 9443:127.0.0.1:9443 vps) as the break-glass path.
A password may not be the whole credential: once an authenticator is enrolled it
is required as well, and enrolling one needs a one-time code minted on the box
with adminctl operator enroll. There is no email recovery here,
deliberately — an emailed link would make the mailbox a credential for the most
privileged surface in the product.
The first operator is created on the box with
adminctl operator create -username <name>. Scripts and service 2
use an admin token instead — a different credential, still bound to a
client certificate, and never resolved from session_tokens.