v1.1.3

kubernetes // out-of-band

Declarative maintenance
for Kubernetes

Versioned YAML playbooks for ordered down, up, and reset — with hooks, notifications, and dry-run by default.

$ curl -fsSL https://get.kzero.hermesrodriguez.com/install.sh | sh
$ kzero --print-sample-config > ./kzero.yaml  # adjust
$ kzero analyze
$ kzero down    # dry-run when run.mode: dry-run
curl -fsSL https://get.kzero.hermesrodriguez.com/install.sh | sh
Install kzeroReleases

Declarative

Pipelines, step order, Helm workspace, and hooks live in config — not one-off shell trees in application code.

Safe defaults

dry-run and analyze before live runs; preflight checks; run.api_watchdog and pipeline.stalled catch API loss and frozen pipelines.

Operator-grade

Timestamped logs, Slack/webhook notify, Cosign-signed releases, and SBOMs — for bastions and CI, not magic buttons.

kzero at a glance

kzero v1.1.1 infographic: kzero diff, safe execution flow, native Job/CronJob steps, Helm SDK v4, and stable exit codes 0–4

Quick start

Operator examples: kzero-selfhosted/run/examples

Recent releases

v1.1.32026-09-27

Security
  • Transitive google.golang.org/grpc v1.83.2 (Dependabot #12 / GHSA-2v4p-qf9q-27wj)
  • Transitive go.opentelemetry.io/otel/sdk v1.45.0 (Dependabot #13 / GHSA-8wmf-6v46-5gfg)

v1.1.22026-09-26

Patch
  • Opt-in bastion pipeline log file (run.log_dir / --log-file)
  • grpc v1.83.1; Homebrew cask drop deprecated url.verified

v1.1.12026-09-02

Security
  • Go toolchain 1.26.6 (stdlib CVE fixes on 1.26.5 images)
  • GHCR ghcr.io/hrodrig/kzero:v1.1.1 passes release-check Grype gate

Engineering report v1.1.3 · Full changelog on GitHub

Repositories

RepoRole
hrodrig/kzeroCLI, engine, SPEC, releases, container image
hrodrig/kzero-selfhostedBastion, cron, examples, kind e2e (pin 0.1.16)
hrodrig/grootComplementary read-only diagnostics archive (groot collect → .tar.gz); see groot-selfhosted, groot-trigger, groot-share