Declarative
Pipelines, step order, Helm workspace, and hooks live in config — not one-off shell trees in application code.
v1.1.0
Declarative maintenance for Kubernetes
Versioned YAML playbooks for ordered down, up, and reset — with hooks, notifications, and dry-run by default.
$ curl -fsSL https://get.kzero.hermesrodriguez.com/install.sh | sh $ kzero --print-sample-config > ./kzero.yaml # adjust $ kzero analyze $ kzero down # dry-run when run.mode: dry-run
curl -fsSL https://get.kzero.hermesrodriguez.com/install.sh | sh
Safe defaults
dry-run and analyze before live runs; preflight checks; run.api_watchdog and pipeline.stalled catch API loss and frozen pipelines.
Operator-grade
Timestamped logs, Slack/webhook notify, Cosign-signed releases, and SBOMs — for bastions and CI, not magic buttons.
Bastion-first reset workflow
From sick API to orderly down → up / reset: declarative YAML on a host that can reach the cluster out-of-band.
Recent releases
v1.1.02026-08-01
Minor- kzero diff — desired vs live for --phase up|down; exit 2 on drift
- Native job/cronjob steps (Job lifecycle + CronJob suspend/resume)
- Helm SDK v4.2.3; grpc v1.82.1; drop GO-2026-5932 ignores
v1.0.22026-07-31
Patch- command.shell — opt-in interpreter for hooks, pre/post, custom, and shell-path release scripts (default /bin/sh)
- golang.org/x/crypto v0.54.0 pin and Grype ignore hygiene until Helm SDK v4
v1.0.12026-07-15
Patch- Retry / subprocess taxonomy: connection lost and http2: client connection lost treated as transient
v1.0.02026-07-15
Stable- Default run.execution is native when omitted; exit codes 0–4 for config, Kubernetes, executor, and notify
- Kind CI smoke (product testing/kind) plus PVC/StatefulSet data cookbook
- doctor, shell completion, kubectl-kzero, and bastion-first stable-contract docs
v0.9.22026-07-11
Operator tools- JSON Schema for editor autocomplete; kzero completion for bash/zsh/fish/powershell
- kubectl-kzero plugin binary and kzero doctor (config, API, RBAC hints)
- Live retry waits use full jitter so concurrent runs do not align
What is new in v1.1
kzero v1.1.0 — kzero diff, native job/cronjob steps, Helm SDK v4; v1.0 stable contract unchanged.kzero v1.1.0
- v1.1.0
kzero diff
Compare pipelines.up or pipelines.down desired state to the live cluster (--phase up|down). Exit 2 on drift.
- v1.1.0
job / cronjob steps
Always-native compact refs: CronJob suspend/resume; Job delete on down and create from manifest on up.
- v1.1.0
Helm SDK v4
Native Helm path uses helm.sh/helm/v4; host helm CLI v3 remains fine for run.execution: shell.
- v1.0.2
command.shell
Opt-in interpreter for phase hooks, per-step pre/post, custom, and shell-path release .sh scripts. Default remains /bin/sh; doctor checks the interpreter when hooks are configured.
- v1.0.1
Retry: connection lost
Live per-step retry and shell ErrTransient match connection lost / http2: client connection lost mid-stream drops.
- v1.0.0
Default run.execution: native
When omitted, workloads and Helm SDK use native. Keep .sh Helm releases with run.execution: shell or auto.
- v1.0.0
Exit codes 0–4
Config 1, Kubernetes 2, executor 3, notify delivery 4 — wrap-friendly for cron and CI.
- v1.0.0
Kind CI + PVC cookbook
Product testing/kind smoke for live down/up; PVC/StatefulSet data patterns documented for operators.
- v1.0.0
doctor · completion · kubectl-kzero
Preflight doctor, shell completion, and kubectl plugin binary ship in the same release set.
- v1.0.0
Out-of-band by design
Bastion/cron is the product path when the API is sick — not in-cluster automation as the primary model.
Also in 0.9.x
- v0.9.0
Graceful shutdown
SIGINT and SIGTERM cancel active down, up, reset, and probe — distinct from API watchdog pipeline.stalled.
- v0.9.0
notify.require_delivery
When true, failed pipeline.error or pipeline.stalled notify POST fails the pipeline.
- v0.8.0
API watchdog
run.api_watchdog polls the API during live runs; past fail_after, the active step is cancelled.
- v0.7.2
Helm SDK
release.* via helm.sh/helm/v3 without a host helm binary when execution is native or auto.
- v0.7.0
Signed releases
Cosign keyless signing for ghcr.io/hrodrig/kzero plus SPDX and CycloneDX SBOMs.
Quick start
Full platform reset example:kzero-selfhosted/full-reset-example
Repositories
| Repo | Role |
|---|---|
| hrodrig/kzero | CLI, engine, SPEC, releases, container image |
| hrodrig/kzero-selfhosted | Bastion, cron, examples, kind e2e (pin 0.1.15) |