What is kubit-cli?

kubit-cli is Kubit's command-line tool for inspecting Helm chart output, performing specialized Pack operations, working with Vault, and running selected Pack Operator operations. Its executable and top-level command are both named kubit. See Helm and Helm charts for the relationship between charts, releases, and Packs.

The tool provides rendered Helm output, diffs, Pack-manifest migrations, exports, and commands for sensitive-data encryption. Use kubectl for general resource management and Kubchi for panel operations.

Before running the tool, prepare:

• A valid kubeconfig file or KUBECONFIG environment variable.
• Network access to the cluster API.
• Permission for the requested operation in the namespace.
• Pack Operator and its API service for remote commands.

kubit-cli uses the identity and context selected in kubeconfig. Before a mutating operation, specify the context and namespace explicitly to avoid changing the wrong cluster or project.

Download the latest published executable and install it:

curl -fL https://kubit.cloud/download/kubit -o kubit
chmod +x kubit
sudo install -m 0755 kubit /usr/local/bin/kubit

Verify the version and help output:

kubit --version
kubit --help

If you cannot write to ‎/usr/local/bin‎, put the executable in a personal directory already included in PATH. For an organization-provided build or artifact verification, ask Kubit support for the approved address and verification method.

Connection options can be placed on the root command or a child command:

For example:

kubit --context production -n my-project helm-template my-app

End-user commands include:

The operator group contains administrative and experimental operations such as clearing caches, refreshing repositories, and changing operator log levels. These commands are for cluster administrators, not routine end-user workflows.

Run ‎--help‎ after the same command path to see options for the installed version:

kubit --help
kubit helm-diff --help
kubit pack migrate --help
kubit vault encrypt --help

Most Helm and Pack commands accept one of two inputs:

• The name of a Pack in the cluster; ‎-n, --namespace‎ is also required.
• A local file with ‎-f, --packfile‎; the namespace may be in the manifest or supplied with ‎--namespace‎.

Do not send both a Pack name and ‎--packfile‎. These commands produce the same type of output from different inputs:

kubit -n my-project helm-template redis
kubit helm-template --packfile redis.pack.yaml

Shared output and development options are:

helm-values renders the effective Pack variables, templates, and values and prints the final YAML sent to Helm:

kubit -n my-project helm-values redis
kubit helm-values -f redis.pack.yaml -o redis.values.yaml

Inspect this output when troubleshooting organization, project, and Pack value precedence. Rendered data may contain sensitive values; review a file before committing it to Git or sharing it.

Use helm-template to generate final manifests without applying them:

kubit -n my-project helm-template redis
kubit helm-template -f redis.pack.yaml -o redis.rendered.yaml

‎--debug‎ also enables Helm template debug details. To test a local chart:

kubit helm-template -f redis.pack.yaml \
  --local-chartpath ../sabz-collection/charts-paas/redis

Use helm-diff to compare the desired state with the current Helm release:

kubit -n my-project helm-diff redis
kubit helm-diff -f redis.pack.yaml --color yes

Command-specific options are:

helm-export creates a directory containing the chart archive with a tgz extension, values, and a standalone Helm installation guide:

mkdir -p redis-export
kubit -n my-project helm-export redis --outdir redis-export

When ‎--outdir‎ is omitted, the Pack name or manifest filename becomes the directory name. Use the export for review, controlled transfer, or troubleshooting, and inspect values for sensitive data before sharing it.

helm-upgrade changes the Helm release directly from the user's machine:

kubit -n my-project helm-upgrade redis
kubit helm-upgrade -f redis.pack.yaml \
  --local-chartpath ../sabz-collection/charts-paas/redis

A chart can define information such as application version, service endpoint, or requested resources as exports in pack-metadata.yaml:

kubit -n my-project pack exports redis
kubit pack exports -f redis.pack.yaml --output dict

‎--output‎ selects simple, dict, or list. ‎--local-chartpath‎ renders exports from a local chart. Output may contain sensitive data; do not copy it into logs or tickets without review.

Run the Pack Operator Helm upgrade path again without changing the manifest:

kubit -n my-project pack force-upgrade redis

Restart workloads owned by the Pack:

kubit -n my-project pack rollout-restart redis

force-upgrade runs the Helm upgrade path again, while rollout-restart only restarts workloads. These operations may create new pods or cause a short outage.

Preview a migrated manifest without changing the source:

kubit -n my-project pack migrate redis --last-version
kubit pack migrate -f redis.pack.yaml --last-version

Target and development options are:

Do not use ‎--chart-version‎ and ‎--last-version‎ together.

See Write pack-migrations.yaml for migration chains, steps, and tags.

This section is the kubit-cli Vault command reference. See Use Vault in a Pack for encrypted-value placement and Pack Operator behavior.

Create a key in the namespace and read the master password from stdin:

printf %s "$VAULT_PASSWORD" | kubit -n my-project vault create \
  --vault-id app-vault \
  --vault-password-stdin

If neither ‎--vault-password‎, ‎--vault-salt‎, nor stdin is provided, required values are generated randomly. ‎--vault-password‎ and ‎--vault-password-stdin‎ cannot be used together. ‎--dry-run‎ returns only Secret YAML and does not create it in the cluster.

List keys in one namespace or all permitted namespaces:

kubit -n my-project vault list
kubit vault list --all-namespaces

Use only one of ‎--namespace‎ and ‎--all-namespaces‎ with vault list.

Text can be sent as an argument, through a pipe, or interactively. Send sensitive input through stdin so it is not recorded in shell history:

printf %s "$REDIS_PASSWORD" | kubit -n my-project vault encrypt \
  --vault-id app-vault

vault encrypt strips leading and trailing whitespace by default. Use ‎--no-strip‎ to preserve it exactly. ‎--vault-password‎ and ‎--vault-salt‎ also support encryption without reading a key from the namespace.

Decrypt from stdin:

kubit -n my-project vault decrypt < redis-password.vault

When the Vault key is not read from the cluster, pass the master password with ‎--vault-password‎. Decrypted text is printed to stdout and may also be copied to the clipboard when supported. Do not put it in logs, history, or tickets.

vault gen-password generates a 16-character password by default:

kubit vault gen-password
kubit vault gen-password --length 32

When you also provide ‎--vault-id‎ and a namespace, the result is encrypted with that key:

kubit -n my-project vault gen-password \
  --length 32 \
  --vault-id app-vault

The vault encrypt, vault decrypt, and vault gen-password commands write to stdout and also copy output to the clipboard when available.

Enable completion temporarily in bash:

source <(kubit completion bash)

Run kubit completion --help for supported shells. Namespace and Pack name completion may query the cluster and require read permission.