Skip to content

scrubctl Project Pages

scrubctl

Standalone Go CLI for namespace scan, resource classification, manifest sanitization, ZIP export, and Argo CD Application generation.

COMMAND REFERENCE REPOSITORY
License: Apache-2.0

A standalone Go CLI that scrubs Kubernetes and OpenShift manifests, scans namespaces, and exports GitOps-ready artifacts. Use it from the terminal or automation pipelines for inline scrubbing and clean GitOps export workflows.

Demo

Install

Build from source (requires Go 1.24+):

Shell
go build -o scrubctl ./cmd/scrubctl
sudo mv scrubctl /usr/local/bin/
scrubctl version

Or install directly:

Shell
go install github.com/turbra/scrubctl/cmd/scrubctl@latest

go install writes the binary to $(go env GOBIN) if set, otherwise $(go env GOPATH)/bin (typically ~/go/bin). It does not place scrubctl into /usr/local/bin or another system path automatically.

If that directory is not already on your PATH, add it before running scrubctl:

Shell
export PATH="$(go env GOPATH)/bin:$PATH"
hash -r
scrubctl version

Tagged releases are published automatically when a v*.*.* tag is pushed. The release matrix follows the same primary platform targets that the oc client ships today:

  • Linux: amd64, arm64, ppc64le, s390x
  • macOS: amd64, arm64
  • Windows: amd64

Linux and macOS release archives are published as .tar.gz; Windows archives are published as .zip on the GitHub Releases page. Each tagged release also includes SBOM JSON files for the published archives.

Install from a release archive

Download the archive matching your OS and architecture from the GitHub Releases page.

Linux:

Shell
tar -xzf scrubctl-<version>-linux-<arch>.tar.gz
sudo mv scrubctl /usr/local/bin/
scrubctl version

Windows:

POWERSHELL
Expand-Archive scrubctl-<version>-windows-<arch>.zip -DestinationPath .
move .\scrubctl.exe $env:USERPROFILE\AppData\Local\Microsoft\WindowsApps\
scrubctl.exe version

Quick Start

Shell
# Scrub a single resource file
scrubctl scrub -f deployment.yaml

# Pipe a live resource through scrubctl
oc get deploy/web -n my-app -o yaml | scrubctl

# Scan a namespace
scrubctl scan my-app

# Export a namespace as a ZIP archive
scrubctl export my-app -o ./out

# Generate an Argo CD Application manifest
scrubctl generate argocd my-app \
  --repo-url https://github.com/example/repo.git \
  --revision main \
  --path manifests/overlays/install

Reference

  • COMMAND REFERENCE for full command details, global flags, and examples
  • TESTING for how fixtures, parity tests, and sanitization quality checks work

scrubctl shares classification and sanitization logic with the GitOps Export OpenShift console plugin. Both tools produce identical output for the same input — verified by shared golden test fixtures.

Repository