Declarative
Pipelines, step order, Helm workspace, and hooks live in config — not one-off shell trees in application code.
v1.0.0
Declarative maintenance for Kubernetes
Versioned YAML playbooks for ordered down, up, and reset — with hooks, notifications, and dry-run by default.
$ curl -fsSL https://get.kzero.hermesrodriguez.com/install.sh | sh $ kzero --print-sample-config > ./kzero.yaml # adjust $ kzero analyze $ kzero down # dry-run when run.mode: dry-run
curl -fsSL https://get.kzero.hermesrodriguez.com/install.sh | sh
Safe defaults
dry-run and analyze before live runs; preflight checks; run.api_watchdog and pipeline.stalled catch API loss and frozen pipelines.
Operator-grade
Timestamped logs, Slack/webhook notify, Cosign-signed releases, and SBOMs — for bastions and CI, not magic buttons.
Bastion-first reset workflow
From sick API to orderly down → up / reset: declarative YAML on a host that can reach the cluster out-of-band.
Recent releases
v1.0.02026-07-15
Stable- Default run.execution is native when omitted; exit codes 0–4 for config, Kubernetes, executor, and notify
- Kind CI smoke (product testing/kind) plus PVC/StatefulSet data cookbook
- doctor, shell completion, kubectl-kzero, and bastion-first stable-contract docs
v0.9.22026-07-11
Operator tools- JSON Schema for editor autocomplete; kzero completion for bash/zsh/fish/powershell
- kubectl-kzero plugin binary and kzero doctor (config, API, RBAC hints)
- Live retry waits use full jitter so concurrent runs do not align
v0.9.12026-07-11
Security- oras-go v2.6.2 (Helm OCI) — Dependabot/CVE-2026-50163
- Go toolchain 1.26.5; distroless static-debian13:nonroot images
Stable contract in v1.0
kzero v1.0.1 patch — retry treats connection lost as transient on slow/remote APIs; v1.0.0 stable contract unchanged.kzero v1.0.0
- v1.0.1
Retry: connection lost
Live per-step retry and shell ErrTransient match connection lost / http2: client connection lost mid-stream drops.
- v1.0.0
Default run.execution: native
When omitted, workloads and Helm SDK use native. Keep .sh Helm releases with run.execution: shell or auto.
- v1.0.0
Exit codes 0–4
Config 1, Kubernetes 2, executor 3, notify delivery 4 — wrap-friendly for cron and CI.
- v1.0.0
Kind CI + PVC cookbook
Product testing/kind smoke for live down/up; PVC/StatefulSet data patterns documented for operators.
- v1.0.0
doctor · completion · kubectl-kzero
Preflight doctor, shell completion, and kubectl plugin binary ship in the same release set.
- v1.0.0
Out-of-band by design
Bastion/cron is the product path when the API is sick — not in-cluster automation as the primary model.
Also in 0.9.x
- v0.9.0
Graceful shutdown
SIGINT and SIGTERM cancel active down, up, reset, and probe — distinct from API watchdog pipeline.stalled.
- v0.9.0
notify.require_delivery
When true, failed pipeline.error or pipeline.stalled notify POST fails the pipeline.
- v0.8.0
API watchdog
run.api_watchdog polls the API during live runs; past fail_after, the active step is cancelled.
- v0.7.2
Helm SDK
release.* via helm.sh/helm/v3 without a host helm binary when execution is native or auto.
- v0.7.0
Signed releases
Cosign keyless signing for ghcr.io/hrodrig/kzero plus SPDX and CycloneDX SBOMs.
Quick start
Full platform reset example:kzero-selfhosted/full-reset-example
Repositories
| Repo | Role |
|---|---|
| hrodrig/kzero | CLI, engine, SPEC, releases, container image |
| hrodrig/kzero-selfhosted | Bastion, cron, examples, kind e2e (pin 0.1.13) |