Docs

Remote Operator

Remote Operator is one container that runs next to your application in a customer's environment, so your team can diagnose and fix it without a VPN, a bastion, or a cross-account role. It only connects out, so there is no inbound access for the customer's security team to review.

alien operations invoke --deployment customer-1/us-east-1 \
  --operation kubernetes/restart-pod --params '{"namespace":"checkout","pod":"api-7c9d"}' \
  --request-access

Architecture diagram. Customer environment (Your application, Remote Operator) connects outbound to the Your team (Operations, Access requests, Debug sessions, Audit log), via https 443, outbound.

The Remote Operator container opens an outbound HTTPS connection and pulls its work. Nothing listens inbound.

Through it, your team and your agents:

  • inspect pods, workloads, databases, queues, and cloud resources
  • restart and scale workloads
  • open debug sessions with kubectl or a cloud CLI
  • roll out upgrades (Rollouts)

Approval rules decide what runs on its own and what waits for the customer's sign-off.

Alien pull deployments, which fetch releases from Alien instead of Alien pushing them in, include it. You can also add it on its own to a Helm chart or ECS task you already ship.

What it replaces

Without access, debugging means a screen share with the customer's on-call engineer while you dictate kubectl commands. Full access through a VPN or a bastion is something the customer's security team won't sign off on.

Remote Operator sits between the two: your team gets named operations, and the customer keeps control of what runs.

What it is

  • One container. Its permissions are one ServiceAccount (or ECS task role) plus the cloud identity you give it.
  • Outbound HTTPS only. It connects out to Alien on port 443. No inbound port, VPN, bastion, or cross-account role, and credentials never leave the customer's account.
  • Named operations, not a shell. Your team runs operations such as kubernetes/get-pods or kubernetes/restart-pod. Each has typed parameters and a risk tier: read-only, mutating, or destructive.
  • Time-boxed access. Operations that need approval run under an access request that lasts at most 6 hours. Each customer decides what runs on its own and what asks first.
  • Audited. Alien records every operation, access request, and debug session with who asked, who approved, and the result.

Built in or added on its own

Built into an Alien deploymentAdded to a product you already ship
Who deploys the applicationAlien, from your alien.ts releasesYour Helm chart, ECS task, or Terraform
How the Operator gets thereOn Kubernetes, included in the chart Alien builds, off until you enable it, and registered in its own setup step. On other pull deployments, the Alien Operator that already runs the deployment also runs operationsYou add one container to the chart or a CloudFormation stack next to the ECS service
Where operations are declared.operations() in alien.tsThe Helm value remoteOperator.operations
Releasesalien releaseVersionless releases: alien release --no-stack --version 1.4.0 records which version runs

Adding Remote Operator on its own doesn't replace your provisioning: your chart or stack stays the source of truth for the application. Enable it one customer at a time.

What it adds

  • Inventory and health: the workloads, pods, images, versions, and CPU and memory the Operator can see.
  • Operations: built-in diagnostics and repairs for Kubernetes, PostgreSQL, Redis, Kafka, S3, CloudWatch, and more, plus your own plugins. See Operations.
  • Access requests: time-boxed approval for operations and debug sessions. See Access requests.
  • Debug sessions: run kubectl, aws, gcloud, or az against the deployment, scoped and time-boxed. See Debug sessions.
  • Logs: Kubernetes logs from the Pods you select. See Logs and metrics.
  • Slack: approvals, rollout reports, and an AI agent that investigates. See Slack and the AI agent.

Turn it off

Deleting the release or stack cuts access at once. Remove it in this order:

  1. Delete the Helm release or the CloudFormation stack. The container stops, its permissions are removed, and the connection closes.
  2. Retire its registration from the Remote Operator setup page (Manage installations), which deletes its API key.
  3. Revoke any cloud identity or service credential created outside the release or stack.

See Uninstall.

What leaves the environment

Depending on what you enable, the Operator sends these to Alien:

  • deployment identity
  • workload inventory and health
  • operation inputs and results
  • Kubernetes logs

Logs and custom operation results are where application data most easily leaks. Test with representative workloads and inspect what comes back before you roll out to production.

Next

Troubleshooting

Find your symptom, learn what it means and who has to act, and fix stuck, failed, silent, or half-removed deployments.

Add to an existing product

Add Remote Operator to a Helm chart or Amazon ECS service you already ship, verify it with a read-only diagnostic, and record the version it runs.

On this page

What it replacesWhat it isBuilt in or added on its ownWhat it addsTurn it offWhat leaves the environmentNext