v1.1.1

kubernetes // out-of-band

Declarative maintenance
for Kubernetes

Versioned YAML playbooks for ordered down, up, and reset — with hooks, notifications, and dry-run by default.

$ curl -fsSL https://get.kzero.hermesrodriguez.com/install.sh | sh
$ kzero --print-sample-config > ./kzero.yaml  # adjust
$ kzero analyze
$ kzero down    # dry-run when run.mode: dry-run
curl -fsSL https://get.kzero.hermesrodriguez.com/install.sh | sh
Install kzeroReleases

Declarative

Pipelines, step order, Helm workspace, and hooks live in config — not one-off shell trees in application code.

Safe defaults

dry-run and analyze before live runs; preflight checks; run.api_watchdog and pipeline.stalled catch API loss and frozen pipelines.

Operator-grade

Timestamped logs, Slack/webhook notify, Cosign-signed releases, and SBOMs — for bastions and CI, not magic buttons.

kzero at a glance

kzero v1.1.1 infographic: kzero diff, safe execution flow, native Job/CronJob steps, Helm SDK v4, and stable exit codes 0–4

Quick start

Operator examples: kzero-selfhosted/run/examples

Recent releases

v1.1.12026-09-02

Security
  • Go toolchain 1.26.6 (stdlib CVE fixes on 1.26.5 images)
  • GHCR ghcr.io/hrodrig/kzero:v1.1.1 passes release-check Grype gate

v1.1.02026-08-01

Minor
  • kzero diff — desired vs live for --phase up|down; exit 2 on drift
  • Native job/cronjob steps (Job lifecycle + CronJob suspend/resume)
  • Helm SDK v4.2.3; grpc v1.82.1; drop GO-2026-5932 ignores

v1.0.22026-07-31

Patch
  • command.shell — opt-in interpreter for hooks, pre/post, custom, and shell-path release scripts (default /bin/sh)
  • golang.org/x/crypto v0.54.0 pin and Grype ignore hygiene until Helm SDK v4

Engineering report v1.1.1 · Full changelog on GitHub

Repositories

RepoRole
hrodrig/kzeroCLI, engine, SPEC, releases, container image
hrodrig/kzero-selfhostedBastion, cron, examples, kind e2e (pin 0.1.16)
hrodrig/grootComplementary read-only diagnostics archive (groot collect → .tar.gz); see groot-selfhosted, groot-trigger, groot-share