knit

A Kubernetes package manager with a diff you can trust, built on the Helm chart ecosystem.

Helm-compatible · Real diff preview · Revision history · Single static binary

Warning

Knit is alpha software (v0.1.0-alpha.5). What works today: installing, upgrading, diffing, rolling back and uninstalling existing Helm charts (local, OCI, and Helm repos), with a structural diff driven by server-side apply. The headline features still in progress (values schema validation, an end-to-end lockfile, first-class environments) are listed under Planned below and are not usable yet. Use it on clusters you can afford to break.

---

Why Knit?

Helm built the Kubernetes package ecosystem. Artifact Hub, Bitnami, every chart you depend on. That's a decade of work nobody should throw away, and Knit doesn't: every existing chart keeps working, and the helm install workflow you already know keeps working.

What Knit sets out to add is the parts the ecosystem has outgrown: a structural diff that reflects what the cluster will actually do, real revision history you can roll back to, and (on the roadmap) a values schema you can validate before applying and a lockfile that pins what you deploy.

The diff is the part that works today and the reason the project exists. Before anything touches the cluster, you see the change computed by the API server itself, not a text diff of rendered YAML.

Render-time content. Charts that generate content at render time (a TLS cert via genSelfSignedCert, a random password via randAlphaNum) produce a fresh value on every helm template, because a client-side render cannot run Helm's lookup. Knit detects these non-deterministic fields by rendering twice and carries the live value forward, so the diff stays clean and upgrades don't rotate them (#21, #22, shipped in v0.1.0-alpha.2). Charts that use lookup to read a different existing object are not yet reproduced.

---

What works today

✦ Real diff preview

See what will change before anything touches the cluster. Knit sends your desired state to the API server as a server-side apply dry-run and compares the result to live state, so the diff reflects what Kubernetes will actually do, including which fields other controllers own.

$ knit diff my-app --namespace production

~ apps/v1/Deployment/my-app
  ℹ externally managed fields not shown (managers: hpa-controller)
  ~ /spec/template/spec/containers/0/image: "v1.3.1" → "v1.4.0"

+ v1/ConfigMap/my-app-config

1 to create, 1 to update, 0 to delete, 14 unchanged

✦ Helm chart compatibility

Local chart directories, OCI references, and Helm repositories. Knit renders through Helm under the hood, so charts behave the way they already do.

knit install redis oci://registry-1.docker.io/bitnamicharts/redis --namespace cache
# same chart, same flags you already know

✦ Revision history and rollback

Every install and upgrade is snapshotted as its own Kubernetes Secret. knit rollback re-applies a previous revision (re-creating what changed, deleting what the target revision did not have) and records it as a new revision, Helm-style.

knit upgrade my-redis --set image.tag=7.2.5
knit rollback my-redis          # back to the previous revision
knit rollback my-redis 3        # or to a specific one

✦ Single static binary

No Tiller, no cluster-side components, no runtime dependencies. Download knit, run knit. State lives in Kubernetes Secrets in your namespaces, the same approach Helm v3 uses.

---

Planned for v0.1.0

These are designed and partly built, but not usable yet. They are why the project exists long-term; they are not in the alpha you can install today.

• Type-safe values. Validate values against the chart's values.schema.json at a knit validate step, so a missing or mistyped .Values.image.tag fails before render instead of at deploy time.
• True lockfile. knit.lock pinning every dependency to an exact version and digest for reproducible deploys. The format exists; it is not wired into install/upgrade yet.
• First-class environments. Typed, hierarchical environment overrides in knit.yaml, instead of values-prod.yaml, values-staging.yaml, values-prod-hotfix-2.yaml scattered around. The merge logic exists; the knit.yaml wiring does not.
• Dependency resolution. A real dependency graph resolved and locked across subcharts.

See the milestones for the order these land in.

---

Install

Alpha builds. Expect breaking changes between versions.

# macOS / Linux
curl -fsSL https://github.com/andreademurtas/knit/releases/latest/download/knit-k8s-installer.sh | sh

# Windows
powershell -ExecutionPolicy Bypass -c "irm https://github.com/andreademurtas/knit/releases/latest/download/knit-k8s-installer.ps1 | iex"

# Cargo
cargo install knit-k8s

Knit shells out to helm for rendering, so you need helm v3+ on your PATH, plus a reachable cluster (KUBECONFIG).

---

Quickstart

# Install a Helm chart
knit install my-redis oci://registry-1.docker.io/bitnamicharts/redis \
  --namespace cache \
  --set auth.enabled=false

# Preview what an upgrade would change, before applying
knit diff my-redis --namespace cache

# Apply the upgrade
knit upgrade my-redis --namespace cache --set image.tag=7.2.5

# Roll back if it went wrong
knit rollback my-redis --namespace cache

On upgrade, Knit follows Helm's values semantics: passing any -f/--set/--set-string resets to the chart defaults plus only the values you give on that invocation, while a bare knit upgrade reuses the previous revision's values. Force either mode with --reset-values or --reuse-values.

---

Knit vs Helm

	Helm	Knit
Chart ecosystem (Artifact Hub)	✅	✅
Real structural diff preview	❌	✅
SSA-aware field ownership	❌	✅
Revision history and rollback	✅	✅
Single static binary	✅	✅
No cluster-side components	✅	✅
Type-safe values schema	❌	🔜 planned
True lockfile with digests	❌	🔜 planned
Multi-env first class	❌	🔜 planned

---

Status

Knit is in active development. The release lifecycle works against real clusters; the type-safety and reproducibility features are still being wired up.

Component	Status
Helm chart compatibility (local chart paths)	✅ Done
Helm chart compatibility (OCI / helm repo refs)	✅ Done
Structural diff (SSA dry-run)	✅ Done
Render-time content stabilization (no cert churn on diff/upgrade)	✅ Done
Secret value redaction in diff (--show-secrets to reveal)	✅ Done
knit install / upgrade / diff / list / uninstall	✅ Done
Cluster-scoped & CRD resources (kube API discovery)	✅ Done
Helm-style --set (arrays, --set-string) and --create-namespace	✅ Done
knit rollback (per-revision history)	✅ Done
Foreign-field reporting in diff	🔨 Partial (manager name only)
Multi-environment values	🔨 Logic done, not wired
Lockfile	🔨 Format done, not wired
Dependency graph	🔨 Built, not wired
Helm hook execution (pre/post install, upgrade, delete)	✅ Done
Values schema validation (knit validate)	📅 Planned (v0.1)
KCL native package format	📅 v0.2
In-cluster controller (optional)	📅 v0.3

Watch the repo to get notified as these land.

---

Contributing

The codebase is Rust. The best place to start is the open issues.

git clone https://github.com/andreademurtas/knit
cd knit
cargo build
cargo test

---

License

Apache 2.0. See LICENSE.