A Kubernetes remediation engine, written in Go, that understands failures before it fixes them. It detects CrashLoopBackOff with full evidence and takes safe, bounded, truthful actions.
Preview everything first: kuberescue monitor -n default --once --dry-run
Evidence in, bounded action out, truthful report always.
Monitors pods in a namespace (optionally filtered by label selector), once or on an interval — in-cluster or via your local kubeconfig.
Finds containers stuck in CrashLoopBackOff and records why: restart count, last exit code, termination reason, and owning controller.
Restarts only controller-managed pods — bare pods are never deleted. --dry-run previews everything and --max-restarts caps actions per scan.
Versioned JSON reports on stdout, structured logs on stderr, CI-friendly exit codes — and a dry run is never counted as a remediation.
Every scan runs the same honest loop — watch the steps light up.
List pods in the namespace
Pure functions over pod state
Exit code, reason, owner
Budgeted, controller-only
Truthful, versioned JSON
Pick your path — build from source, run the Docker image, or try the crash-loop demo.
# Clone and build
git clone https://github.com/sameeralam3127/KubeRescue.git
cd KubeRescue
make build
# Preview what it would do — changes nothing
bin/kuberescue monitor -n default --once --dry-run
# Monitor continuously, at most 3 restarts per scan
bin/kuberescue monitor -n default --interval 30s --max-restarts 3Tries in-cluster config first, falls back to local kubeconfig (--kubeconfig, --context). Add -o json for automation — exit code 2 signals findings.
# Build the non-root distroless image
make docker
# Check the CLI
docker run --rm kuberescue:local --helpA single static Go binary inside a distroless base — small, fast, non-root.
# Create an intentional CrashLoopBackOff
kubectl create namespace kuberescue-test
kubectl apply -n kuberescue-test -f examples/crashloop-demo.yaml
# Observe first, then remediate
kuberescue monitor -n kuberescue-test --once --dry-run
kuberescue monitor -n kuberescue-test --once
# Clean up
kubectl delete namespace kuberescue-testWorks great with Docker Desktop's built-in Kubernetes (docker-desktop context).
Toward an intelligent, policy-gated remediation platform.
Safety-first remediation kernel: evidence-rich detection, controller-only restarts, dry-run, restart budgets, versioned JSON reports.
kuberescue diagnose / explain for the five most common failure classes, with events and log evidence.
Per-cause actions, policy gate with cooldowns and rate budgets, protected namespaces, simulate via server-side dry-run, audit history.
CRDs for policies and actions, informer-based controller, leader election, Prometheus metrics, approval workflow, Helm chart.
Slack and webhook notifications, Grafana dashboards, OpenTelemetry, signed releases with SBOM.
KubeRescue is open source and MIT licensed. Clone it, dry-run it against a dev cluster, and contribute back.