CLI

The Mirops CLI is the pipeline gate of Mirops. The operator keeps a live mirror of your cluster — every workload, Service, volume and Ingress, what depends on what, and what is broken right now — and publishes it as a report. One command, mirops scan, reads that report and answers, before you deploy: does this change break anything that is running?

It runs three checks, picked by the inputs you give it:

Check	Input	What it answers	Blocks?
Impact of a change	-f / MIROPS_FILE	Does what I'm about to apply — manifests or a Terraform plan — break something in the cluster?	With --enforce
Namespaces' state	-n / MIROPS_NAMESPACE	What is at risk in my namespaces right now, and what depends on it?	Never
Upgrade gate	--upgrade / MIROPS_UPGRADE	Is the cluster ready for the Kubernetes upgrade the operator analysed?	With --enforce

It reads the mirror report, never the cluster: the pipeline needs no kubeconfig and adds no load on the API server.

Pipeline-friendly by design

Read the report; keep the decision explainable

The CLI presents current mirror state and can enforce an upgrade report's deterministic allow field. It does not make a gate from the health score.

How it works

This static illustration provides a quick visual summary of the same flow:

1. The operator rebuilds the mirror on an interval and writes its report somewhere the pipeline can read: s3://…, azure://…, http(s)://… or a file.
2. In the impact stage, mirops scan reads that report and the change.
3. It looks up every object the change touches in the mirror — what it mounts, routes to or uses, and who uses it.
4. With --enforce it exits 1 when the change breaks something: the job fails and the deploy doesn't run. Otherwise it exits 0 and prints the context. It exits 2 when it can't evaluate — never a silent pass.

A Deployment that mounts a volume the mirror shows as Pending:

$ mirops scan -f k8s/ -n demo-shop --enforce
MIROPS  mirror aws-test · cluster v1.35.8-eks · rebuilt 2026-09-28T04:57:27Z
Cluster now: 2 component(s) at risk in 1 of 6 namespaces

NAMESPACES — 1 of 1 with components at risk (informational, never blocks)
  demo-shop                  2 of 7 at risk                         High (70)
    deployment/payments-api  Down            → 1 depends on it      High (70)
    pvc/payments-db-data     Pending         nothing depends on it  Medium (50)

IMPACT — demo-shop
  read YAML: 1 Kubernetes change(s) → 1 evaluated

  ✗ BLOCK deployment/reports-worker mounts pvc/payments-db-data, which is Pending — pods that mount it won't start
$ echo $?
1

Sources

--source (the mirror report) and --upgrade-source (an analysis report) accept:

Scheme	Example
Local file	./default.mirops
HTTP	http://mirops-reports.mirops:8084/reports/default.mirops?kind=ClusterMirror
S3	s3://bucket/prod/default.mirops
Azure Blob	azure://account/container/default.mirops

Each is read with the pipeline's own credentials for its scheme — see Credentials.

Gating

Setting	Effect
(none)	Report only — exits 0 unless it couldn't evaluate.
--enforce	Exits 1 when the change breaks something, or the upgrade verdict is blocked (CRITICAL).
--enforce --enforce-level warning	Stricter upgrade gate — also fails on WARNING.

Exit 2 means it couldn't evaluate — never a pass. Every flag has an environment-variable equivalent (MIROPS_FILE, MIROPS_NAMESPACE, …): see the CLI reference.

Install

Download the release binary for your platform, make it executable, and put it on your PATH. No sudo required — the same steps work on a laptop or in a CI pipeline.

# 1. Download the binary for your platform (see the table below for the name)
curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/latest/download/mirops-darwin-arm64

# 2. Install it on a user-writable dir on your PATH
mkdir -p "$HOME/.local/bin"
cp mirops-darwin-arm64 "$HOME/.local/bin/mirops"
chmod +x "$HOME/.local/bin/mirops"

# 3. Ensure the dir is on your PATH (add to your shell rc to persist)
export PATH="$HOME/.local/bin:$PATH"

# 4. Verify
mirops --version

Platform binaries

Platform	Binary
macOS (Apple Silicon)	mirops-darwin-arm64
macOS (Intel)	mirops-darwin-amd64
Linux (x86_64)	mirops-linux-amd64
Linux (arm64)	mirops-linux-arm64
Windows (x86_64)	mirops-windows-amd64.exe

Latest, pinned, or beta

# Always the newest release
curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/latest/download/mirops-linux-amd64

# Pin a version (reproducible — recommended for CI)
curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/download/v0.3.0/mirops-linux-amd64

# Try a beta before it's released — vX.Y.Z-beta.N, never "latest"
curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/download/v0.3.0-beta.1/mirops-linux-amd64

Betas are published from the CLI's beta branch; the stable release follows when it reaches main. Every version is listed on Versions & compatibility.

Verify the checksum (optional)

curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/latest/download/checksums.txt
shasum -a 256 --check --ignore-missing checksums.txt   # macOS
sha256sum --check --ignore-missing checksums.txt        # Linux

Next: the impact check, then use it in CI/CD.

• Source: github.com/miropshq/mirops-cli