{"slug": "srenix-self-healing-kubernetes-in-a-30mb-binary-apache-2-0", "title": "Srenix – self-healing Kubernetes in a 30MB binary (Apache-2.0)", "summary": "Srenix, an open-source self-healing Kubernetes tool released under Apache-2.0, diagnoses and fixes cluster faults using a 30MB Go binary with 16 Kubernetes probes, 14 read-only analyzers, 30 cloud probes, and 5 policy-bounded auto-fixers, all without relying on LLMs. The tool runs in a zero-trust offline mode or in-cluster via Helm, posts reports to Slack, and re-verifies every fix, targeting known-safe patterns like stale pods and secret mismatches.", "body_md": "**Your cluster breaks at 3 AM. Srenix finds the fault, applies a policy-bounded fix, re-verifies, and posts one report to Slack — no dashboard, no pager, no 30 MB of YAML archaeology.**\n\nOne ~30 MB Go binary on a distroless base. **16 Kubernetes probes · 14 read-only analyzers · 30 cloud probes (AWS / GCP / Azure) · 5 auto-fixers** — every fix policy-bounded, GitOps-aware, and re-verified after it runs. Apache-2.0.\n\n```\ngit clone https://github.com/srenix-ai/agentic-sre.git\ncd agentic-sre\ngo run ./cmd/srenix diagnose --snapshot examples/sample-cluster\n• Ceph Storage:     🟢 HEALTHY    1 cluster(s): rook-ceph@rook-ceph OK (11.5% used)\n• Cluster Nodes:    🟢 HEALTHY    All 4 nodes ready\n• PostgreSQL:       🟢 HEALTHY    1 CNPG cluster(s): main@data (3/3 ready, primary=main-1)\n• Storage Claims:   🟢 HEALTHY    All 3 PVCs bound\n\nDiagnostics (3):\n  🔎 Secret `billing/billing-svc-secrets` missing key `STRIPE_API_KEY` (referenced by\n     Deployment/billing-svc in ns billing). Owning ExternalSecret: `billing/billing-svc-secrets`\n     — add data/template entry exposing `STRIPE_API_KEY`, or remove the env reference if unused.\n  🔎 ExternalSecret `billing/billing-svc-secrets` not Ready: error processing spec.data[0]\n     (key: shared/billing/config), err: cannot find secret data for key: \"stripe_api_key\".\n  🔎 ExternalSecret `billing/old-payment-gateway` not Ready: error processing spec.data[0]\n     (key: shared/legacy/payments), err: vault path not found.\n```\n\nThat's the headline: a precise diagnosis — *which* Secret, *which* key, *which* Deployment, *which* Vault path — from a read-only snapshot, on your laptop.\n\nThen run it against your own cluster:\n\n```\nsrenix snapshot capture --out ./my-cluster   # read-only; never modifies state\nsrenix diagnose --snapshot ./my-cluster      # diagnose offline\nsrenix diagnose --live                       # or straight against the live cluster\nphp\nflowchart LR\n    A[🔍 Detect<br/>16 K8s probes<br/>30 cloud probes] --> B[🧠 Diagnose<br/>14 analyzers<br/>root cause + hint]\n    B --> C{Recognized &<br/>policy-allowed?}\n    C -->|yes| D[🔧 Remediate<br/>5 policy-bounded fixers<br/>GitOps-aware]\n    C -->|no| E[📋 Precise remediation<br/>hint for a human]\n    D --> F[✅ Re-verify<br/>probe again,<br/>prove the fix]\n    F --> G[📣 Report<br/>Slack / Alertmanager /<br/>OpenProject ticket]\n    E --> G\n```\n\nTwo ways to run it:\n\n**Zero-trust offline mode**— point it at a captured`kubectl get … -o json`\n\nsnapshot. No install, no RBAC, no write permissions.**In-cluster live mode**— Helm-installed CronJob with two narrowly-scoped ClusterRoles (read-only + tightly-bounded write); posts to Slack on a schedule. Optional operator (`AgenticSRE`\n\nCRD) manages the whole deployment.\n\n```\nhelm repo add srenix https://srenix-ai.github.io/agentic-sre\nhelm repo update\nhelm install srenix srenix/agentic-sre \\\n  --namespace agentic-sre --create-namespace \\\n  --set slackWebhookSecretName=srenix-slack-webhook\n```\n\nMost \"auto-remediation\" tools ask you to trust an LLM with kubectl. Srenix doesn't:\n\n**The hot path is LLM-free and deterministic.** Detection, diagnosis, and fixing are pure Go — same input, same output, every time.**Fixers only touch a closed catalog of known-safe patterns**(stale Error pods, stuck Jobs on renamed Secret keys, stale-revision RS pods, terminal CertificateRequests, TLS secret mismatch).**Never auto-applied:** edits to Secrets, ConfigMaps, or generic CRDs.**GitOps-aware:** fixers skip anything managed by Argo/Flux/Helm rather than fight a reconcile loop; paused/suspended workloads are respected.**Every fix is re-verified** by re-running the probe, and reported either way.**Narrow RBAC by construction:** two ClusterRoles you can read in one sitting; the container is distroless (`nonroot`\n\n, no shell, no package manager).\n\nFull catalog — every probe, analyzer, and fixer with symptom, root cause, and why the fix is safe: ** docs/FAILURE_MODES.md**.\n\n| Layer | Coverage |\n|---|---|\nK8s probes (16) |\nCeph, PostgreSQL (CNPG + Zalando), critical workloads, nodes, PVCs, external endpoints, node pressure, system DaemonSets, pending pods, CrashLoopBackOff, etcd, failed mounts, Kong, HPA, ArgoCD sync, Velero backups |\nAnalyzers (14) |\nSecret/key/ExternalSecret/image-pull/cert/TLS classes + drift: GitOps, workload-state, RBAC, config, capacity, security |\nCloud probes (30) |\n10 each for AWS / GCP / Azure — RDS, EBS, EKS, IAM, ALB, ACM, KMS, S3, VPC and equivalents. Off by default, opt-in per provider, per-probe toggles |\nFixers (5) |\nPolicy-bounded, GitOps-aware, re-verified. Opt-in for anything that mutates routing |\nInvestigator |\nOn CRITICAL findings, a read-only Layer-2 deep-dive (DNS, HTTP, TLS, describe, events) attaches a one-line root cause to the alert |\nSinks |\nSlack (3-channel routing, per-severity repeat intervals), Alertmanager, OpenProject tickets via MCP, 6 Grafana dashboards |\n\nCurrent version and the full shipped/planned matrix: ** STATUS.md** · What's next:\n\n[ROADMAP.md](/SRENIX-AI/agentic-sre/blob/main/ROADMAP.md)Everything above is **Apache-2.0 and works standalone** — probes, analyzers, fixers, cloud probes, deterministic investigator, Helm chart, operator.\n\n**Srenix Enterprise** (commercial binary) adds the AI layer on the same safety contract: an LLM-backed Investigator, T0 narration → T1 fix proposals → T2 multi-step planning → T3 dual-approval break-glass runbooks — every action policy-bounded, Ed25519-signed, hash-chain audited — plus a curated Verified Signature Library regression-tested monthly. Details: [docs/SRENIX_OVERVIEW.md](/SRENIX-AI/agentic-sre/blob/main/docs/SRENIX_OVERVIEW.md) · Contact: [srenix.ai/contact](https://srenix.ai/contact) or [info@srenix.ai](mailto:info@srenix.ai).\n\n| Start here | Deep dives |\n|---|---|\n|\n\n[FAILURE_MODES.md](/SRENIX-AI/agentic-sre/blob/main/docs/FAILURE_MODES.md)— full fix catalog[SETUP_GUIDE.md](/SRENIX-AI/agentic-sre/blob/main/docs/SETUP_GUIDE.md)— install, Helm values, RBAC[AI_TIERS.md](/SRENIX-AI/agentic-sre/blob/main/docs/AI_TIERS.md)— Layer-2 + T0–T3 spec[DEMO_GUIDE.md](/SRENIX-AI/agentic-sre/blob/main/docs/DEMO_GUIDE.md)— storyboarded failure scenarios[DASHBOARDS.md](/SRENIX-AI/agentic-sre/blob/main/docs/DASHBOARDS.md)— 6 Grafana dashboards[AI_USAGE.md](/SRENIX-AI/agentic-sre/blob/main/docs/AI_USAGE.md)— why the hot path is LLM-freeSrenix came out of the same on-call loop I kept living: a 3 AM page, twenty minutes of `kubectl`\n\narchaeology, and a root cause that was almost always mundane — a stale Secret key, a stuck ExternalSecret, a cert that didn't renew. I wanted something that did that triage for me *deterministically* — with a fix catalog narrow enough that I'd actually trust it to run unattended — and posted one honest report instead of paging a human. That's Srenix. If it catches something for you, I'd genuinely like to hear about it in [Discussions](https://github.com/SRENIX-AI/agentic-sre/discussions).\n\n— Salil, maintainer\n\nQuestions, war stories, and \"it flagged something weird\" reports: ** GitHub Discussions**. Bugs and feature requests:\n\n[Issues](https://github.com/SRENIX-AI/agentic-sre/issues). If Srenix saved you a page, a ⭐ helps other on-call engineers find it.\n\n[Apache License 2.0](/SRENIX-AI/agentic-sre/blob/main/LICENSE) for the engine and default signature library. The Verified Signature Library ships separately under a [commercial license](/SRENIX-AI/agentic-sre/blob/main/LICENSE-VERIFIED-LIBRARY.md). To report a vulnerability: ** security@srenix.ai** (\n\n[SECURITY.md](/SRENIX-AI/agentic-sre/blob/main/SECURITY.md)).", "url": "https://wpnews.pro/news/srenix-self-healing-kubernetes-in-a-30mb-binary-apache-2-0", "canonical_source": "https://github.com/SRENIX-AI/agentic-sre", "published_at": "2026-07-22 15:13:19+00:00", "updated_at": "2026-07-22 15:22:48.283400+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-tools", "developer-tools", "ai-infrastructure"], "entities": ["Srenix", "Kubernetes", "AWS", "GCP", "Azure", "Slack", "Argo", "Flux"], "alternates": {"html": "https://wpnews.pro/news/srenix-self-healing-kubernetes-in-a-30mb-binary-apache-2-0", "markdown": "https://wpnews.pro/news/srenix-self-healing-kubernetes-in-a-30mb-binary-apache-2-0.md", "text": "https://wpnews.pro/news/srenix-self-healing-kubernetes-in-a-30mb-binary-apache-2-0.txt", "jsonld": "https://wpnews.pro/news/srenix-self-healing-kubernetes-in-a-30mb-binary-apache-2-0.jsonld"}}