Security

Review Remote Operator as software running inside the customer’s cluster—not as a dashboard feature.

Local permissions

The operator can only perform Kubernetes actions allowed by its ServiceAccount and RBAC. Cloud and private-service actions require separate identity and network access.

Keep the installation namespace-scoped unless a reviewed operation truly needs more. Compare every write permission to a specific operation.

# Inspect the installed namespaced permissions.
kubectl get role,rolebinding,serviceaccount \
  --namespace <installation-namespace> \
  -o yaml

Installation secrets

Registration, encryption, and collector values are unique to an installation and shown once by the dashboard. Store them with the same care as other production Helm secrets. Never reuse one customer’s values for another.

Outbound data

Depending on what you enable, the operator can send deployment identity, workload inventory, health, operation inputs and results, and Kubernetes logs to Alien.

Logs and custom operation results are the easiest places to leak application data. Test with representative workloads and inspect what is returned before production rollout.

Removing access

Uninstalling Remote Operator or removing its local identity and network access stops that installation from connecting. Test the removal procedure in the same way you test installation.

remove the Helm release
        │
        ├── operator pod stops
        ├── its ServiceAccount and namespaced RBAC are removed
        └── its outbound connection closes

also revoke any cloud identity or external service credential
that your chart created outside the release

Do not claim that an action has approvals, an audit record, or a particular revocation guarantee unless you have verified that behavior in the exact Alien deployment and operator build you ship.