← INDEX

FLAGSHIP

DeployGuard

CLI Tool for Guarded Kubernetes Deployments

git init → safely-deployed k8s in 4 commands.

GITHUB ↗PYPI ↗

BRIEF

PROBLEM

Getting a service onto Kubernetes safely means manifest validation, cost sanity checks, staged rollout, and rollback discipline — guardrails teams normally assemble by hand, or skip under deadline pressure.

RESPONSE

DeployGuard packages those guardrails as a four-command workflow: init scaffolds a hardened service, cost prices the bill before the infrastructure exists, provision stands up the cluster, and deploy ships through a gated canary that rolls itself back on error spikes.

SCHEMATIC

spike → auto-rollbackdg inithardened FastAPI + Postgres scaffoldguard7 policy rules · kubeconform · trivydg cost8 cost rules · warn or hard-stopdg provisionminikube local · k3s on EC2 Spotdg deploysmoke test /readyz firstcanary 10 → 50 → 100Prometheus gate / stepliveaudit row → Postgres

REDRAWN FROM THE PROJECT README

DEMO

dg doctor — every prerequisite and config file checked before you run anything.
dg doctor — every prerequisite and config file checked before you run anything.
dg init — guard rules flag the scaffold's own violations before it's written to disk.
dg init — guard rules flag the scaffold's own violations before it's written to disk.
dg provision — brings up minikube or k3s on EC2 Spot, idempotent either way.
dg provision — brings up minikube or k3s on EC2 Spot, idempotent either way.
dg deploy — canary rollout with a live pre-check panel and a Prometheus error-rate gate at each step.
dg deploy — canary rollout with a live pre-check panel and a Prometheus error-rate gate at each step.

CAPABILITIES

01

Policy guard

7 custom safety rules plus kubeconform and Trivy run before anything ships; every failure explains what broke, why it matters, and the fix.

02

Cost gate

Terraform is parsed and priced before provisioning; 8 cost-policy rules warn at the soft threshold and hard-stop over budget.

03

Blue/green pre-check

The green side is smoke-tested on /readyz before any live traffic moves — a failed check aborts with production untouched.

04

Canary + auto-rollback

10% → 50% → 100% rollout with a Prometheus error-rate gate at each step; a spike triggers rollback and an audit record automatically.

05

Self-provisioning

One command stands up minikube locally or k3s on EC2 Spot via Terraform — the whole AWS environment runs about $6/mo.

06

More than a CLI

The guard layer is importable and doubles as a shareable Claude Code skill; every deploy decision lands as an audit row in Postgres.

07

Doctor + zero-friction install

`dg doctor` checks every prerequisite and config file before you run anything; a Homebrew tap and one-liner installer set up the whole toolchain (kubectl, helm, minikube, kubeconform, terraform, trivy) in one shot.

08

Extensible policy

Drop a `.py` file into `.deployguard/rules/` and it's auto-loaded — new guard rules ship without touching the CLI or waiting on a release.

STACK

  • Python
  • Typer
  • Rich
  • Kubernetes
  • k3s
  • Terraform
  • Prometheus
  • Trivy
  • AWS