Private managers
A private manager runs the Alien manager, the server that talks to your deployments, in your own AWS, Google Cloud, or Azure account. Your customers' deployment traffic and logs stay in your cloud, with no new subprocessor for them to review.
Architecture diagram. Deployments (Push: native identity, Pull: Operator) exchanges traffic with the Private manager (Rollouts, Heartbeats, Logs, Commands), via https 443.
One command starts the setup:
alien managers create --cloud aws --region us-east-1 --openThe manager rolls out releases, receives heartbeats and logs, and delivers commands to your deployments. Alien runs one for you by default. With a private manager, Alien still builds releases and monitors the manager, but deployment traffic and logs go to your account.
New deployments connect to their cloud's default manager, so decide which one to use before the first customer deploys.
When to use one
- No new subprocessor. Your customers' deployments talk to your cloud, not to Alien's.
- Logs stay in your account. The manager stores deployment logs in your own bucket, and the browser reads them directly. The Logs page shows End-to-end encrypted.
- Your region and network. Choose the region, and give pull deployments a custom endpoint domain.
Private managers need the Pro plan.
Create one
Open Settings → Private Managers in your project and choose a cloud.
Pick a region and start setup. Each cloud uses its own method:
| Cloud | Setup |
|---|---|
| AWS | Launch CloudFormation stack in your account. |
| Google Cloud | Sign in with Google and choose the project to host the manager. |
| Azure | Run Terraform in your Azure subscription with the generated main.tf. |
Wait until the manager is Healthy. Alien deploys and updates it from then on.
The same from the CLI:
alien managers create --cloud aws --region us-east-1 --open
alien managers status mgr_9t4k2x --watchUse --setup cloudformation, google-oauth, or terraform to choose the method, and --network default to reuse the account's default network for a test manager.
Route deployments to it
Each project has a default manager per cloud. New deployments use it:
- Push deployments in the same cloud are reached through that cloud's native identity, such as an IAM role.
- Kubernetes pull deployments, Machines deployments, and Single machine pull deployments connect outbound to it over HTTPS.
Set the defaults on the same page, or from the CLI:
alien managers defaults set --cloud aws --manager mgr_9t4k2x
alien managers defaults showWhen a CLI command falls back to the Alien-hosted manager for a cloud, it prints a warning on stderr and continues. The warning never goes to stdout, so --json output stays parseable.
If you expected your private manager, run alien managers defaults show and set the default for that cloud.
Endpoint domain
Pull deployments reach the manager at its endpoint. Keep the Default manager endpoint, or select a verified domain from Settings → Domains. The endpoint shows Active once pull targets can use it.
Operate it
alien managers list
alien managers events mgr_9t4k2x --follow
alien managers retry mgr_9t4k2x
alien managers delete mgr_9t4k2xalien logs --manager mgr_9t4k2x searches the logs stored by one manager.