v1.0.4

Cluster diagnostics
one archive.

groot is a read-only Kubernetes log and context collector — stable v1.0 contract with versioned config and archives. Preflight with validate, collect into one .tar.gz, inspect without cluster access.

GROOT — Kubernetes log collector 
$ groot validate --config groot.yml
$ groot collect --config groot.yml --summary
$ groot inspect ./groot-*.tar.gz
curl -fsSL https://get.groot.hermesrodriguez.com/install.sh | sh
All install methods Releases

Preflight checks

groot validate checks config, API reachability, RBAC, and disk space before a long collect — fewer surprises on call.

Incident-ready bundle

One reproducible .tar.gz with manifest, RCA TSVs, stable run_id, and archive_layout_version — attach to tickets or retain for compliance.

Operator-grade

kubectl plugin, shell completion, config profiles, signed releases, and Helm CronJob in groot-selfhosted v0.2.8.

Incident response workflow

From alert to offline archive: validate RBAC before collect, bundle evidence into one .tar.gz, inspect without cluster access.

Kubernetes incident response workflow with GROOT: validate, collect, inspect, and share one archive

Recent releases

v1.0.4 2026-07-29

Security
  • google.golang.org/grpc v1.82.1 (GHSA-hrxh-6v49-42gf)
  • go.opentelemetry.io/otel v1.44.0 (GO-2026-5158)
  • -v / --version no longer dumps empty Error + Usage after the version line

v1.0.3 2026-07-12

Maintenance
  • groot notify test — smoke email/Slack/webhooks without a cluster or collect
  • Docker: bare docker run prints --help instead of sample collect
  • Email notifier and GCS upload test coverage in CI; golang.org/x/crypto v0.54.0

Full changelog on GitHub

Stable 1.0.4

Stable contract in v1.0

config_version: 1

Declare YAML schema version in groot.yml; legacy configs without it still load unchanged.

archive_layout_version

Every new archive records layout version in extras/manifest.json for downstream tools and automation.

collect --output json

Structured Summary JSON on successful collect — validate and inspect already support JSON from 0.9.x.

validate · collect · inspect

Three-command incident loop: preflight RBAC, one .tar.gz collect with --summary, offline archive review.

run_id + checksum

Stable run_id and archive_sha256 in manifest.json; notify webhooks and upload metadata can reference {{run_id}}.

Governance

CODEOWNERS, issue/PR templates, golden inspect fixture in CI — behavior contract tested every release. See SPECIFICATIONS.md.

Quick start

Helm CronJob deploy: groot-selfhosted/run/deploy

Repositories

Repo Role
hrodrig/groot CLI, SPEC, releases, container image
hrodrig/groot-selfhosted Helm chart and CronJob patterns (pin 1.0.4)