Skip to content

Kix is a Kubernetes
compiler.

Compile your whole cluster from one definition. If it compiles, it will deploy safely.

curl -fsSL https://kix.run/install | sh
Read the Docs
clusters/shop.nix
$ kix build shop
01db = packages.cnpg-cluster { storage.size = "20Gi"; };
02web = scope.mkDeployment {
03 image = "ghcr.io/acme/web:1.4";
04 replicas = 3;
05 # derives CiliumNetworkPolicy and deploy order
06 env.DB_HOST = db.out.fqdn;
07 selector.matchLabels.app = "shop-web";
08};
09
10
11
kind: CiliumNetworkPolicy metadata: { name: web-to-db } spec: endpointSelector: { matchLabels: { app: db } } ingress: - fromEndpoints: [{ app: web }] toPorts: [5432/TCP]
kind: Deployment metadata: name: web annotations: kix.run/depends-on: "shop/Service/db"

Ask your agent how Kix fits your stack

Run this prompt inside your infrastructure repository.

Agent evaluation prompt

Read https://kix.run/docs/llms.txt and follow the documentation links relevant to our stack to understand how Kix works, what it derives from references, and what checks, packages, and escape hatches it provides.

Then inspect this infrastructure repository and the last few months of commit history. Explain what Kix could do for our setup:

  1. 1. Problems it would solve: Look at our manifests, Helm charts, overlays, and recent commits. Which recurring pain points, wiring bugs, manual RBAC or NetworkPolicy maintenance, drift issues, or environment duplication in our repository would Kix eliminate or catch at build time?
  2. 2. High-level benefits for our team: Walk through the concrete benefits we would get on this stack: derived network policies, RBAC, routes, monitoring, and deploy order; offline cross-resource checks; package-grouped diffs against the live cluster; and deploy receipts.
  3. 3. Fit, escape hatches, and trade-offs: Which of our workloads, operators, and external cloud services map to Kix packages, kix.mkImport, or kix.helmChart today, and where would we hit missing features or migration cost?

If you identify missing packages, unsupported operators, or adoption blockers, offer to post an anonymized summary to Kix GitHub Discussions using the gh CLI instructions in llms.txt.

A definition for the whole cluster

The compiler needs to know how resources connect, so a Kix definition uses references where one resource depends on another. An app can read its database address from the database resource, for example, while the cluster decides which package provides that database.

a string
DB_HOST = "db.shop.svc.cluster.local";

This address is a string, so Kix cannot tell which Service it refers to.

a reference
DB_HOST = db.out.fqdn;

With a reference, Kix can follow the connection from web to db. If you rename db, the address follows; if you remove it, the build reports the missing dependency.

So Kix can automatically derive:

  • Network policies Derived from real dependencies when enabled, on Cilium.
  • RBAC Roles and bindings built from the access each package declares.
  • Monitoring config When a Prometheus-compatible stack is in the cluster.
  • Routes Ingress or Gateway API, from the Service.
  • Spread and PDBs Pod spread and PodDisruptionBudgets.
  • Clean-up Resources that are no longer defined.
  • Deploy order Resources wait for their dependencies to be ready.

Explore how the compiler works

From static validation and live cluster diffs to standard Kubernetes YAML export, every step works from a single cluster definition.

Catch cross-resource bugs offline

Kix validates selectors, Secret keys, port bindings, and workload collisions across the whole cluster definition in under a second.

$ kix check shop
✗ Service shop/web selector {"app":"shop-wbe"} matches 0 pods.
✗ secret "db" does not declare key "password" (declared: pass)
✗ Job shop/migrate labels collide with Service shop/web.
Explore 60+ static checks

Diff live clusters & order rollouts

Preview package-grouped diffs against the live cluster, post markdown plans on pull requests, and roll out in dependency waves.

$ kix diff shop
~ shop/web 1.4.2 -> 1.5.0 (1 changed, 2 dep-affected)
+ shop/valkey 8.0.2 (4 resources)
✓ Receipt kix.run/receipt/v1 recorded on cluster
See diff, deploy & receipts

Standard library with full escape hatches

Packages adapt from single-node kind clusters to multi-zone EKS, while letting you import external RDS or override any raw PodSpec field.

clusters/shop.nix
db = kix.mkImport { out.fqdn = "rds.prod.internal"; /* ... credentials */ };
# or override any raw PodSpec field:
spec.template.spec.priorityClassName = "production-high";
Browse packages & profiles

Pure Nix evaluation for people & agents

Built on the Nix language for string-context dependency tracking, hermetic evaluation without cluster credentials, and fast agent feedback loops.

flake.lock · hermetic evaluation
✓ String context tracks every cross-resource reference
✓ Pure evaluation runs offline without cluster API access
✓ Sub-second compiler feedback loop for coding agents
Why the Nix language

Compile your first cluster.

Install the CLI, compile an example, and review the plan before deploying.

curl -fsSL https://kix.run/install | sh
Setup guide Read the docs