Changelog

Access requests

You can now request time-boxed access to a customer deployment from the CLI, the dashboard, or Slack:

alien access-requests create --deployment customer-1/us-east-1 \
  --operation 'kubernetes/*' --max-risk read-only \
  --debug-tool kubectl --debug-namespace checkout \
  --duration 2h --reason "Checkout pods restarting"

alien access-requests wait ar_5k2m8q

One approved request covers a whole fix for up to 6 hours, so nobody approves each step. The requester can't approve their own request.

A request can cover one exact operation with its parameters, every operation in a plugin up to a risk cap, or a debug session with kubectl, aws, gcloud, or az. The approver sees the commands and the reason before deciding.

  • Approve in Slack: the approval card has Approve for 6 hours and Deny, and can go to a channel you share with the customer
  • Approve with kubectl: on Kubernetes, the customer can approve with one kubectl patch command
  • Run and wait: alien operations invoke --request-access creates the request, waits for approval, and runs
  • Revoke: alien access-requests revoke ends a grant early
  • Remote debugging: alien debug sessions use the same requests

Read the docs →