Editions
Free to run. Pro when you need the proof.
Detection and alerting are free forever. Pro adds the depth for production teams.
Community
For any cluster, forever.
Free forever
- Core pod, node and RBAC detection
- Root-cause headline on every incident
- Noise control and scope filters
- One alert provider
- No account, no key
Pro
For production clusters.
Free during early access
3 months per license, and we may renew it
- Everything in Community
- Workloads, storage, network, control plane and more
- Full root-cause proof and who changed what
- Unlimited alert providers, routing and threads
- State kept across restarts, standby replicas and flight recorder
Up to 2 clusters per account (per company domain for work emails). No payment details.
Licensed per cluster under ELv2.
| Feature | Community | Pro |
|---|---|---|
| Detection | ||
| Detect pod and container failures | ✓ | ✓ |
| Detect pod scheduling failures | ✓ | ✓ |
| Detect out-of-memory kills and repeated OOMs | ✓ | ✓ |
| Detect sustained pod readiness failures | — | ✓ |
| Detect crash loops and excessive restarts | ✓ | ✓ |
| Detect workload rollout and execution failures | — | ✓ |
| Detect stuck workload rollouts | — | ✓ |
| Detect failed Jobs and failed or missed CronJobs | — | ✓ |
| Detect PodDisruptionBudgets that block disruption | — | ✓ |
| Diagnose HorizontalPodAutoscaler failures | — | ✓ |
| Detect node readiness, pressure and draining | ✓ | ✓ |
| Detect node resource pressure from kubelet stats | — | ✓ |
| Detect claim, volume and attachment failures | — | ✓ |
| Detect volumes nearly full | — | ✓ |
| Detect Service, Ingress and NetworkPolicy failures | — | ✓ |
| Detect admission webhook and policy failures | — | ✓ |
| Detect expiring and invalid TLS certificates | — | ✓ |
| Detect exhausted ResourceQuotas and LimitRange rejections | — | ✓ |
| Detect failing conditions on custom and built-in resources | — | ✓ |
| Check API server, etcd, DNS, scheduler and controller-manager | — | ✓ |
| Run configured HTTP, TCP and DNS checks | — | ✓ |
| Quote configuration risks (no probe, no limit, mutable tag, single replica) when a failure shows their cost | — | ✓ |
| Report repeated Warning events kwatch has no detector for, quoting the event | — | ✓ |
| Analysis | ||
| Explain each incident by its most likely root cause | ✓ | ✓ |
| Suspect a node that workloads failing together share when nothing else explains them | — | ✓ |
| Relate incidents to recent changes and who made them | — | ✓ |
| Show which workloads and services an incident affects | — | ✓ |
| Attach a redacted log excerpt to announcements | — | ✓ |
| Root cause: headline vs full proof and who changed what | Headline | Full proof + who changed what |
| Incidents | ||
| Settle, merge symptoms and send only material changes | ✓ | ✓ |
| Recognise flapping and routine recurring incidents | — | ✓ |
| Summarise pre-existing incidents once at cold start | — | ✓ |
| Keep incidents and history on disk across restarts | — | ✓ |
| Report changes made while kwatch was down | — | ✓ |
| Policy | ||
| Filter by namespace, reason, selector and silences | ✓ | ✓ |
| Override severity by reason and owner kind | — | ✓ |
| Hold incidents for objects under maintenance | — | ✓ |
| Attach reason-aware runbook links | — | ✓ |
| Delivery | ||
| Route incidents to providers by scope | — | ✓ |
| Update one message thread per incident where supported | — | ✓ |
| Render operator-selected text templates | — | ✓ |
| Write a JSON line for every incident decision | — | ✓ |
| Alert providers | 1 | Unlimited |
| Security | ||
| Report missing permissions | ✓ | ✓ |
| Platform | ||
| /status JSON API | — | ✓ |
| Standby replicas (high availability) | — | ✓ |
| Flight recorder & replay export | — | ✓ |
Frequently asked questions
How does early access work?
kwatch is in early access, so Pro is free: every account gets 3 months of Pro for up to 2 clusters, with no payment details. Each license runs 3 months from the day you start it, and we may renew it. With a work email the limit is 2 clusters per company domain, shared by everyone using that domain.
What happens when my Pro license expires?
kwatch falls back to Community. Detection and alerting never stop, you simply lose the Pro features. Your cluster keeps running with no downtime and no data loss.
Does kwatch work offline?
Yes. A licensed kwatch renews in the background and keeps working for up to 7 days if it cannot reach the license service, for example in an air-gapped or firewalled cluster.
What does one license cover?
One license covers one cluster. Moving to a new cluster is self-serve: use Transfer to another cluster on your account page.
What does the license check send?
A hashed cluster id, the kwatch version and the node count. No workload names, logs, secrets or cluster contents. See the privacy policy for details.
Do I need an account for Community?
No. Community is free forever, needs no account, no key and no sign-up. Install it and go.