Operations

Configure operations before generating the Helm template. The selected set changes what the generated operator image can do and what access it needs.

Start with read-only diagnostics. Add a mutating operation only when there is a concrete support or maintenance task that needs it.

Good operations answer one question or perform one repair:

• read Kubernetes events for one workload;
• inspect pod status;
• check a private service;
• restart a specific workload; or
• run a product-specific repair with typed inputs.

Avoid general shell, arbitrary SQL, or an unrestricted Kubernetes proxy. Those interfaces are difficult to review and turn a narrow operator into broad remote access.

Access is additive

Selecting an operation is not enough by itself. It can only succeed when the local installation also has the required Kubernetes RBAC, cloud identity, network route, and service credentials.

Test each operation in a non-production installation. Check both success and denial. Keep returned results small and do not include customer records or secrets unless the operation explicitly requires them.

What is actually selected

Operations are named as plugin/operation. The current operator includes focused plugins for Kubernetes and services such as PostgreSQL, Redis, S3, RDS, CloudWatch, GCS, and Pub/Sub. Each plugin exposes a fixed set of operations with typed parameters.

For example, the S3 plugin exposes exactly these operations:

s3/head-bucket
s3/list-objects
s3/head-object

That is deliberately different from giving the operator a general AWS shell. Select the smallest operation that answers the support question, then grant its local identity only the corresponding IAM action.

question                  selected operation       local access still required
Can we reach the bucket?  s3/head-bucket           network + AWS identity
What objects are there?   s3/list-objects           s3:ListBucket
Does this object exist?   s3/head-object            s3:GetObject metadata access

Run an operation without an agent

List the catalog, then invoke an operation enabled for the project:

alien operations list

alien operations invoke \
  --deployment acme/production \
  --operation kubernetes/get-pods \
  --params '{"namespace":"default","maxResults":10}'

The CLI waits up to 60 seconds by default. Add --timeout <seconds> for a different limit. If policy requires approval, the command reports pending-approval instead of pretending that the operation ran.