⚙️ Complete configuration reference

This page lists all 145 configuration keys accepted by the current kwatch release. It is generated from the versioned config-catalog.tsv shipped with kwatch.sh, so it stays aligned with the binary and guided setup.

For practical explanations and examples, start with General configuration. Apply configuration through kwatch.sh and validate it with kwatch lint.

The Catalog default column is the value shipped to the guided installer and Helm chart. A direct binary deployment can have a method-specific default; the main example is crd.enabled, which stays off until a CRD is installed while the chart and interactive installer enable it for you.

Secrets: any catalog field marked as sensitive by the provider catalog must use ${file:/absolute/path} from a mounted Kubernetes Secret. Do not put credentials, tokens, passwords, API keys, or webhook URLs directly in YAML.

Key	Type	Catalog default	Category	Description	Status	Replacement
workers	integer	1	Performance	Number of Kubernetes work queues processed in parallel.	active	—
resyncSeconds	integer	0	Performance	Periodic safety resync interval in seconds; zero keeps event-driven mode.	active	—
maxRecentLogLines	integer	50	Alerts	Maximum recent log lines attached to an incident.	active	—
containerRestartThreshold	integer	0	Alerts	Alert when a container reaches this cumulative restart count; zero disables it.	active	—
includeEvents	boolean	true	Alerts	Include recent Kubernetes events in incident messages.	active	—
includeLogs	boolean	true	Alerts	Include recent container logs in incident messages.	active	—
namespaces	list	all	Scope	Comma-separated namespaces to watch; leave empty to watch every namespace.	active	—
namespaceSelector	string	empty	Scope	Kubernetes label selector used to choose namespaces.	active	—
reasons	list	all	Scope	Comma-separated event reasons to allow or exclude with a leading !.	active	—
ignoreFailedGracefulShutdown	boolean	true	Noise reduction	Ignore forceful container termination during an intentional shutdown.	active	—
ignoreDisruptionTerminations	boolean	true	Noise reduction	Ignore pods being deliberately evicted, preempted, or disrupted.	active	—
adaptiveThresholds	boolean	true	Noise reduction	Add bounded grace during normal partial rollouts.	active	—
reportStartupBaseline	boolean	true	Noise reduction	Summarize issues that already existed when kwatch started.	active	—
correlation.window	integer	10	Incident memory	Minutes in which related signals are correlated.	active	—
correlation.lifecycleInterval	integer	1	Incident memory	Minutes between lifecycle and resolution sweeps.	active	—
correlation.resolveHoldDown	integer	300	Incident memory	Seconds a signal must stay healthy before resolving.	active	—
correlation.cooldownMinutes	integer	10	Incident memory	Minimum minutes before the same incident can notify again.	active	—
correlation.maxBaseline	integer	5000	Incident memory	Maximum persisted baseline entries.	active	—
correlation.escalation	json	{"enabled":true,"tiers":[3,10]}	Incident memory	JSON object controlling restart-count severity escalation.	active	—
correlation.renotify	json	{"maxPerIncident":3}	Incident memory	JSON object controlling periodic re-notification.	active	—
severityByOwnerKind	json	{}	Alerts	JSON map overriding severity by workload owner kind.	active	—
severityByReason	json	{}	Alerts	JSON map overriding severity by detected reason.	active	—
smartGrouping.windowSeconds	integer	60	Noise reduction	Seconds for grouping related failures into one notification.	active	—
smartGrouping.namespaceFanOutThreshold	integer	3	Noise reduction	Owners failing alike before a namespace fan-out incident is created.	active	—
inhibition.nodeSuppressesPods	boolean	true	Noise reduction	Suppress pod symptoms while their node has an active incident.	active	—
nodeMonitor.enabled	boolean	true	Monitors	Watch node readiness and pressure conditions.	active	—
nodeMonitor.sustainedMinutes	integer	3	Monitors	Minutes a node condition must persist before alerting.	active	—
pvcMonitor.enabled	boolean	true	Monitors	Watch mounted PVC usage and storage pressure.	active	—
pvcMonitor.interval	integer	5	Monitors	Minutes between PVC usage checks.	active	—
pvcMonitor.threshold	float	80	Monitors	PVC usage percentage that creates a warning.	active	—
pvcMonitor.criticalThreshold	float	90	Monitors	PVC usage percentage that creates a high-severity alert.	active	—
pvcMonitor.clearThreshold	float	75	Monitors	PVC usage percentage below which an alert resolves.	active	—
rolloutMonitor.enabled	boolean	true	Monitors	Watch Deployments for stuck rollouts.	active	—
rolloutMonitor.sustainedMinutes	integer	5	Monitors	Minutes a Deployment may remain unavailable before alerting.	active	—
statefulSetMonitor.enabled	boolean	true	Monitors	Watch StatefulSets for stuck updates.	active	—
statefulSetMonitor.sustainedMinutes	integer	5	Monitors	Minutes a StatefulSet may remain unavailable before alerting.	active	—
daemonSetMonitor.enabled	boolean	true	Monitors	Watch DaemonSets for unavailable pods and scheduling failures.	active	—
daemonSetMonitor.sustainedMinutes	integer	5	Monitors	Minutes a DaemonSet may remain unavailable before alerting.	active	—
jobMonitor.enabled	boolean	true	Monitors	Watch Jobs for failures and deadline problems.	active	—
cronJobMonitor.enabled	boolean	true	Monitors	Watch CronJobs for missed or suspended work.	active	—
cronJobMonitor.sustainedMinutes	integer	5	Monitors	Minutes a CronJob condition must persist before alerting.	active	—
hpaMonitor.enabled	boolean	true	Monitors	Watch HPAs that remain constrained or maxed out.	active	—
hpaMonitor.sustainedMinutes	integer	20	Monitors	Minutes an HPA must remain constrained before alerting.	active	—
serviceMonitor.enabled	boolean	true	Monitors	Watch Services with no ready backends.	active	—
ingressMonitor.enabled	boolean	true	Monitors	Watch Ingress backend availability.	active	—
networkPolicyMonitor.enabled	boolean	true	Monitors	Detect evidence of restrictive NetworkPolicies.	active	—
admissionWebhookMonitor.enabled	boolean	true	Monitors	Watch admission webhook availability and failures.	active	—
controlPlaneMonitor.enabled	boolean	true	Monitors	Watch API server and control-plane health signals.	active	—
clusterResourceMonitor.enabled	boolean	true	Monitors	Watch quota, namespace, and lease lifecycle failures.	active	—
clusterResourceMonitor.sustainedMinutes	integer	10	Monitors	Minutes a terminating namespace or quota condition must persist before alerting.	active	—
clusterResourceMonitor.nodeLeaseStaleSeconds	integer	90	Monitors	Seconds without a node lease renewal before reporting a stale heartbeat.	active	—
heartbeatMonitor.enabled	boolean	false	Monitors	Send a periodic external dead-man heartbeat.	active	—
heartbeatMonitor.interval	integer	300	Monitors	Seconds between heartbeat notifications.	active	—
scheduleMonitor.enabled	boolean	true	Monitors	Include scheduling delay and unschedulable diagnostics.	active	—
oomMonitor.enabled	boolean	true	Monitors	Track repeating OOM kills independently from current pod state.	active	—
oomMonitor.threshold	integer	3	Monitors	OOM kills within the window before raising a repeating-OOM incident.	active	—
oomMonitor.windowMinutes	integer	60	Monitors	Sliding window used for repeating OOM detection.	active	—
pendingPodMonitor.enabled	boolean	true	Monitors	Watch pods that remain Pending.	active	—
pendingPodMonitor.threshold	integer	300	Monitors	Seconds a pod may remain Pending before alerting.	active	—
notReadyMonitor.enabled	boolean	true	Monitors	Watch running pods that remain not ready.	active	—
pdbMonitor.enabled	boolean	true	Monitors	Watch PodDisruptionBudgets that block voluntary disruption.	active	—
pdbMonitor.sustainedMinutes	integer	5	Monitors	Minutes a PDB violation must persist before alerting.	active	—
nodeResourceMonitor.enabled	boolean	true	Monitors	Watch node overcommit and filesystem/inode pressure.	active	—
nodeResourceMonitor.intervalSeconds	integer	300	Monitors	Seconds between node resource checks.	active	—
nodeResourceMonitor.cpuWarning	float	2.0	Monitors	CPU requested-to-capacity ratio that raises a warning.	active	—
nodeResourceMonitor.cpuCritical	float	4.0	Monitors	CPU requested-to-capacity ratio that raises a critical alert.	active	—
nodeResourceMonitor.memWarning	float	2.0	Monitors	Memory requested-to-capacity ratio that raises a warning.	active	—
nodeResourceMonitor.memCritical	float	4.0	Monitors	Memory requested-to-capacity ratio that raises a critical alert.	active	—
nodeResourceMonitor.filesystemWarningPercent	float	90	Monitors	Node filesystem usage warning threshold.	active	—
nodeResourceMonitor.filesystemCriticalPercent	float	95	Monitors	Node filesystem usage critical threshold.	active	—
nodeResourceMonitor.inodeWarningPercent	float	90	Monitors	Node inode usage warning threshold.	active	—
nodeResourceMonitor.inodeCriticalPercent	float	95	Monitors	Node inode usage critical threshold.	active	—
runtimeMetricsMonitor.enabled	boolean	false	Monitors	Use metrics.k8s.io when available for workload usage diagnostics.	active	—
runtimeMetricsMonitor.intervalSeconds	integer	60	Monitors	Seconds between runtime metrics checks.	active	—
runtimeMetricsMonitor.memoryWarningPercent	integer	90	Monitors	Memory usage warning percentage when metrics.k8s.io is available.	active	—
runtimeMetricsMonitor.memoryCriticalPercent	integer	100	Monitors	Memory usage critical percentage when metrics.k8s.io is available.	active	—
runtimeMetricsMonitor.cpuWarningPercent	integer	90	Monitors	CPU usage warning percentage when metrics.k8s.io is available.	active	—
runtimeMetricsMonitor.cpuCriticalPercent	integer	100	Monitors	CPU usage critical percentage when metrics.k8s.io is available.	active	—
clusterAutoscalerMonitor.enabled	boolean	true	Monitors	Watch built-in cluster-autoscaler evidence from Kubernetes resources and events.	active	—
tlsMonitor.threshold	integer	30	Monitors	Days before certificate expiry to warn.	active	—
tlsMonitor.criticalThreshold	integer	3	Monitors	Days before certificate expiry for a high-severity alert.	active	—
controlPlaneMonitor.intervalSeconds	integer	30	Monitors	Seconds between API and control-plane health checks.	active	—
controlPlaneMonitor.apiServerLatencyWarningMs	integer	1000	Monitors	API readyz latency warning threshold in milliseconds.	active	—
controlPlaneMonitor.failureThreshold	integer	2	Monitors	Consecutive control-plane failures before alerting.	active	—
controlPlaneMonitor.recoveryThreshold	integer	2	Monitors	Consecutive successful checks before resolving.	active	—
kubeletTelemetryMonitor.enabled	boolean	true	Monitors	Read built-in kubelet telemetry without an agent.	active	—
kubeletTelemetryMonitor.intervalSeconds	integer	60	Monitors	Seconds between built-in kubelet telemetry sweeps.	active	—
kubeletTelemetryMonitor.persistState	boolean	true	Monitors	Persist telemetry counters across restarts.	active	—
kubeletTelemetryMonitor.failureThreshold	integer	2	Monitors	Consecutive kubelet telemetry failures before alerting.	active	—
kubeletTelemetryMonitor.recoveryThreshold	integer	2	Monitors	Consecutive successful telemetry checks before resolving.	active	—
kubeletTelemetryMonitor.memoryWarningPercent	float	90	Monitors	Kubelet memory usage warning threshold.	active	—
kubeletTelemetryMonitor.memoryCriticalPercent	float	100	Monitors	Kubelet memory usage critical threshold.	active	—
kubeletTelemetryMonitor.ephemeralStorageWarningPercent	float	90	Monitors	Ephemeral-storage usage warning threshold.	active	—
kubeletTelemetryMonitor.ephemeralStorageCriticalPercent	float	95	Monitors	Ephemeral-storage usage critical threshold.	active	—
kubeletTelemetryMonitor.cpuWarningPercent	float	90	Monitors	CPU usage warning threshold from kubelet telemetry.	active	—
kubeletTelemetryMonitor.cpuCriticalPercent	float	100	Monitors	CPU usage critical threshold from kubelet telemetry.	active	—
kubeletTelemetryMonitor.cpuThrottlingWarningPercent	float	25	Monitors	CPU throttling warning threshold.	active	—
kubeletTelemetryMonitor.cpuThrottlingCriticalPercent	float	50	Monitors	CPU throttling critical threshold.	active	—
kubeletTelemetryMonitor.psiWarningPercent	float	20	Monitors	Pressure stall warning threshold.	active	—
kubeletTelemetryMonitor.psiCriticalPercent	float	50	Monitors	Pressure stall critical threshold.	active	—
kubeletTelemetryMonitor.networkErrorRateWarning	float	1	Monitors	Network error rate warning threshold.	active	—
kubeletTelemetryMonitor.networkErrorRateCritical	float	10	Monitors	Network error rate critical threshold.	active	—
kubeletTelemetryMonitor.runtimeErrorRateWarning	float	1	Monitors	Container runtime error rate warning threshold.	active	—
kubeletTelemetryMonitor.runtimeErrorRateCritical	float	10	Monitors	Container runtime error rate critical threshold.	active	—
tlsMonitor.enabled	boolean	false	Monitors	Watch TLS certificates before expiry; reads certificate Secrets.	active	—
activeProbeMonitor.enabled	boolean	false	Monitors	Run explicitly configured application probes.	active	—
activeProbeMonitor.intervalSeconds	integer	30	Monitors	Seconds between active probe rounds.	active	—
activeProbeMonitor.timeoutSeconds	integer	5	Monitors	Timeout for each active probe.	active	—
activeProbeMonitor.failureThreshold	integer	3	Monitors	Consecutive probe failures before alerting.	active	—
activeProbeMonitor.recoveryThreshold	integer	2	Monitors	Consecutive successes before resolving a probe incident.	active	—
activeProbeMonitor.autoServices	boolean	false	Monitors	Probe discoverable Service ports automatically; opt in to avoid unexpected traffic.	active	—
activeProbeMonitor.http	json	[]	Monitors	JSON array of HTTP probe targets with optional paths, headers, and latency limits.	active	—
activeProbeMonitor.tcp	json	[]	Monitors	JSON array of TCP probe targets.	active	—
activeProbeMonitor.dns	json	[]	Monitors	JSON array of DNS probe targets.	active	—
upgrader.disableUpdateCheck	boolean	false	Operations	Disable the update notification.	active	—
telemetry.enabled	boolean	true	Operations	Send the adoption heartbeat.	active	—
maintenance.enabled	boolean	true	Operations	Honor maintenance annotations while preserving cluster-level alerts.	active	—
maintenance.annotation	string	kwatch.io/maintenance	Operations	Annotation that marks deliberate maintenance on a resource.	active	—
maintenance.untilAnnotation	string	kwatch.io/maintenance-until	Operations	Optional annotation containing the maintenance expiry timestamp.	active	—
healthCheck.diagnostics	boolean	false	Operations	Expose diagnostic endpoints such as incidents and test-alert.	active	—
healthCheck.pprof	boolean	false	Operations	Expose Go profiling endpoints; keep disabled in production.	active	—
app.clusterName	string	empty	Operations	Cluster name shown in notifications.	active	—
app.proxyURL	string	empty	Operations	Optional proxy for outbound provider requests.	active	—
app.disableStartupMessage	boolean	false	Operations	Disable the startup notification.	active	—
app.logFormatter	string	text	Operations	Log output format: text or json.	active	—
app.insecureSkipTLSVerify	boolean	false	Security	Skip TLS verification for outbound providers; strongly discouraged.	active	—
app.caBundlePath	string	empty	Security	Path to a mounted PEM bundle for outbound provider TLS.	active	—
healthCheck.enabled	boolean	true	Operations	Expose the built-in health endpoint.	active	—
healthCheck.port	integer	8060	Operations	Port for health and optional diagnostic endpoints.	active	—
crd.enabled	boolean	true	Operations	Watch KwatchConfig and supported CRD status conditions; restart kwatch when configuration changes; enabled by the interactive installer after installing the CRD.	active	—
crd.failureConditions	list	empty	Operations	Additional CRD condition rules such as Ready=False or Degraded=True.	active	—
crd.graphReferences	list	empty	Operations	Optional CRD references used by dependency and impact analysis.	active	—
auditLog.enabled	boolean	true	Operations	Write structured incident lifecycle records to the configured audit sink.	active	—
auditLog.output	string	stdout	Operations	Audit output: stdout or a supported output sink.	active	—
templates	json	{}	Operations	JSON map of optional reason-specific message templates.	active	—
runbooks	json	{}	Operations	JSON map of reason-to-runbook URLs.	active	—
silences	json	[]	Noise reduction	JSON array of scoped silence rules, including eventMessages substring matches for attached Kubernetes Events.	active	—
ignoreContainerNames	list	legacy	Compatibility	Legacy container suppression field.	deprecated	silences
ignorePodNames	list	legacy	Compatibility	Legacy pod-name suppression field.	deprecated	silences
ignoreLogPatterns	list	legacy	Compatibility	Legacy log suppression field.	deprecated	silences
ignoreContainerMessages	list	legacy	Compatibility	Legacy container-message suppression field.	deprecated	silences
ignoreNodeReasons	list	legacy	Compatibility	Legacy node-reason suppression field.	deprecated	silences
ignoreNodeMessages	list	legacy	Compatibility	Legacy node-message suppression field.	deprecated	silences
heartbeatMonitor.url	string	empty	Security	External dead-man heartbeat URL; stored only through a mounted Secret.	secret	—
healthCheck.diagnosticsToken	string	empty	Security	Bearer token for diagnostic endpoints; stored only through a mounted Secret.	secret	—