v1.1.4

Cluster diagnostics
one archive.

groot is a read-only Kubernetes log and context collector — stable v1.0 contract with versioned config and archives. Preflight with validate, collect into one .tar.gz, inspect without cluster access.

GROOT — Kubernetes log collector 
$ groot validate --config groot.yml
$ groot collect --config groot.yml --summary
$ groot inspect ./groot-*.tar.gz
curl -fsSL https://get.groot.hermesrodriguez.com/install.sh | sh
All install methods Releases

Preflight checks

groot validate checks config, API reachability, RBAC, and disk space before a long collect — fewer surprises on call.

Incident-ready bundle

One reproducible .tar.gz with manifest, RCA TSVs, stable run_id, and archive_layout_version — attach to tickets or retain for compliance.

Operator-grade

kubectl plugin, shell completion, config profiles, signed releases; scheduled deploy in groot-selfhosted; on-demand collect via groot-trigger; VPS archive door via groot-share (gfs).

Incident response workflow

From alert to offline archive: validate RBAC before collect, bundle evidence into one .tar.gz, inspect without cluster access.

Kubernetes incident response workflow with GROOT: validate, collect, inspect, and share one archive

Recent releases

v1.1.4 2026-09-28

Security
  • grpc v1.83.2, golang.org/x/crypto v0.56.0 (SFTP / crypto/ssh), OpenTelemetry v1.45.0
  • No CLI or config contract changes — pull ghcr.io/hrodrig/groot:v1.1.4
  • Operator pin: groot-selfhosted v0.2.14

v1.1.3 2026-08-25

Naming
  • Positional archive naming — cluster is the absolute tail after the timestamp
  • Free-form --message and -since-<duration> precede the timestamp
  • Pair with gfs 0.7.0+ for positional cluster parsing

v1.1.2 2026-08-18

Security
  • Go 1.26.6 stdlib security patch (govulncheck-cleared CVEs)
  • golangci-lint v2.12.2 in make lint / CI
  • Groot family links: selfhosted, trigger, share (gfs)

Engineering report v1.1.4 · Full changelog on GitHub

Stable 1.1.4

Stable contract in v1.0

config_version: 1

Declare YAML schema version in groot.yml; legacy configs without it still load unchanged.

archive_layout_version

Every new archive records layout version in extras/manifest.json for downstream tools and automation.

collect --output json

Structured Summary JSON on successful collect — validate and inspect already support JSON from 0.9.x.

validate · collect · inspect

Three-command incident loop: preflight RBAC, one .tar.gz collect with --summary, offline archive review.

run_id + checksum

Stable run_id and archive_sha256 in manifest.json; notify webhooks and upload metadata can reference {{run_id}}.

Governance

CODEOWNERS, issue/PR templates, golden inspect fixture in CI — behavior contract tested every release. See SPECIFICATIONS.md.

Quick start

Helm CronJob deploy: groot-selfhosted/run/deploy

Groot family

Repo Role
hrodrig/groot CLI, SPEC, releases, container image
hrodrig/groot-selfhosted Helm CronJob, bastion, Docker — scheduled / operator deploy (pin image 1.1.4)
hrodrig/groot-trigger In-cluster HTTP → Job groot collect (on-demand)
hrodrig/groot-share (gfs) gfs — VPS web/API door for .tar.gz archives (auth, ingest, list, retention)
hrodrig/groot-share-selfhosted Compose, systemd, Helm deploy for gfs (vps / vps-s3)