abahmed/kwatch v1.0.0 on GitHub

🎉 kwatch v1.0.0

kwatch (kwatch.dev, abahmed/kwatch; not the unrelated npm package) runs as one small pod in your Kubernetes cluster. When something breaks, it traces the failure to its cause and sends one message: what broke, why, and what to do next.

v1.0.0 is the first stable release since 0.10.5. It rebuilds kwatch around problems instead of single events, adds Community and Pro editions, and tightens security by default.

✨ Highlights

🎯 Root cause first. kwatch follows a failure upstream and names the one cause, so related symptoms arrive as one message, not fifty.
🔕 Quiet by default. One message, then silence until something new is true. Incidents resolve on their own and say so.
👤 Who changed what. Recent changes, and who made them, appear next to the cause (Pro).
👉 The next step. Every message ends with the command to run.
🛡️ Least-privilege RBAC by default. The Helm chart now grants list/watch only on the kinds kwatch understands (--set rbac.mode=full restores wildcard access for custom resources). RBAC is the set of Kubernetes permissions that decides what kwatch may read.
💾 State survives restarts (Pro). Open incidents are kept on a volume at /var/lib/kwatch (a 2Gi claim by default), so a restart no longer forgets what is already open. Community keeps state in memory and takes a fresh baseline after a restart.
✍️ Signed releases. Every release publishes SHA256SUMS for the installer files and the manifests, signed with Sigstore, plus an image signature and SBOMs.
🔍 Easier to debug. Logs now record the license sync result, when an incident opens, and a hint for kubelet certificate errors. Applying an unchanged KwatchConfig no longer triggers a reload. New kwatch test-alert and kwatch redact commands help you check delivery and share logs safely.

🆓 Community and Pro

Community is free, with no account and no key. Pro is free during early access and adds deeper detection, full root-cause proof, all alert channels (50+) and more. Get a key at app.kwatch.dev, then add it in the installer under License / Pro. If a license ends, kwatch falls back to Community and alerts keep flowing. Compare editions at kwatch.dev/pro.

🚀 Install

One command, and it walks you through it:

/bin/bash -c "$(curl -fsSL https://kwatch.dev/kwatch.sh)"

Already use Helm? The chart is an alternative; kubectl apply -f deploy/deploy.yaml also works.

⬆️ Upgrading from 0.10.x

Read Upgrading to 1.0 first. Things that change:

Credentials must live in a Secret and be referenced as ${file:/config/<name>}. Plain credentials in the config are rejected.
Removed or renamed config keys are logged at startup; run kwatch lint first.
Open alerts in keyed tools such as PagerDuty and Opsgenie are not closed automatically after the upgrade, because keys changed. Close them by hand.
Network: if you use your own NetworkPolicy, allow egress to TCP 10250 on nodes.
Installer finds a 0.10.x install and offers to recreate the Deployment, keeping your configuration and Secrets.
Helm accepts your old values file. With Helm 4 server-side apply, add --server-side=false.
kubectl apply needs the Deployment deleted first, because its selector changed.

🔐 Verify your download

sha256sum -c kwatch-v1.0.0-SHA256SUMS
cosign verify-blob --bundle kwatch-v1.0.0-SHA256SUMS.sigstore.json \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='^https://github.com/abahmed/kwatch/.github/workflows/publish.yml@' \
  kwatch-v1.0.0-SHA256SUMS

The image digest and its cosign verify command are in the Release integrity section below.

💬 Feedback welcome

Tell us what works and what does not in GitHub Discussions.

kwatch is source available under the Elastic License 2.0. 🙏 Thank you to everyone who starred, watched, filed issues and tried the release candidates, and to @Dessalines39394 for a contribution.

Upgrading from 0.10.x

Installer (recommended): run
/bin/bash -c "$(curl -fsSL https://kwatch.dev/kwatch.sh)". It
finds a 0.10.x install and offers to recreate the Deployment; your
configuration and Secrets are kept.
Helm: helm upgrade works with your 0.10.x values file. The old
service block is accepted and ignored. If you installed 0.10.x with Helm 4
(server-side apply), add --server-side=false to the upgrade, or
Kubernetes rejects the old RollingUpdate settings.
kubectl apply -f deploy/deploy.yaml: the Deployment selector
changed (it now also matches app.kubernetes.io/instance: kwatch),
and Kubernetes does not allow a selector to change. The configuration
also moved from the ConfigMap kwatch to the Secret kwatch. Create
the Secret from your config.yaml (credentials as described in the
upgrade guide), delete the old Deployment, then apply:
```
kubectl -n kwatch create secret generic kwatch \
  --from-file=config.yaml=config.yaml
kubectl delete deployment kwatch -n kwatch
kubectl apply -f deploy/deploy.yaml
```

See Upgrading to 1.0 for every configuration change.

Jitter cluster check-ins to spread load on the Worker (#563) (79a72b2)
Say check-ins run every 30 minutes in the config catalog (#562) (9b0978e)
Pre-rc.21: 0.10.5 upgrade path, expiry warnings, test-alert, redact, cluster check-ins (#561) (c3d7982)
Log license sync outcome, incident opens, kubelet cert hint; ignore no-op KwatchConfig applies (#560) (2d596d3)
fix(release): avoid SIGPIPE in changelog generation for long ranges (#559) (cafb222)
Publish signed installer checksums with every release (#558) (e728f9e)
Rewrite the README as a product overview (#557) (d3dcf26)
Make least-privilege the chart's default RBAC mode (#554) (9d37f27)
Run the licensetest-tagged tests in make ci (#556) (67c6305)
Drop the README price row and link editions to kwatch.dev/pro (#555) (4e84ec1)
Release charts to apps/web/public and use the site favicon as chart icon (#553) (87a13c5)
chore(deps): bump the github-actions group with 7 updates (#552) (2db548a)
chore(deps): bump github.com/prometheus/client_golang (#551) (f484ea8)
docs: use the new Junction logo in the README header (#550) (d0c6afa)
Point release workflow at the website workspace layout (#549) (4e5caaf)
Harden in-process edition rebuild: wait for release, retry transient reopen (#548) (dbabe6a)
Fix release publish, e2e Pro edition and trial wording (#547) (c30b75f)
Point license management at the installer's License / Pro menu (#546) (d84ca2d)
✨ Community/Pro editions with license keys (#545) (e2df306)
📝 Prepare 1.0: upgrade guide, KwatchConfig v1beta1, doc fixes (#544) (61fff45)
✨enhance coverage and engine (#543) (2c88f84)
✨enhance coverage and engine (#542) (60653f0)
🛡️ Harden scoring, bound shutdown contexts, and reconcile the scorecard (#541) (94c96bb)
🐛 Stronger root cause, built-in coverage and production fixes (#539) (a491aaa)
🐛 fixes (#537) (9aab6ee)
🐛 fixes (#536) (ab911b4)
✨ deeper root cause, smarter alerting (#535) (79c69b2)
✨ deeper cluster understanding, root cause and smart alerting (#534) (802d2dd)
🐛 fix e2e (#533) (85a159b)
✨ smarter incidents and shared-error grouping (#532) (97b82da)
🧠 Name a cause or the facts for every failure (#531) (4274f1e)
🐛 Fix E2E (#530) (54189fa)
🧠 Group symptoms under their shared cause and quiet the channel (#529) (3907d96)
🐛 Fix E2E regressions from the core rebuild (#528) (423e3ce)
🧠 Rebuild kwatch around a problem-centric core (#525) (3483373)
🛡️ Fix security, delivery, failover, and detection bugs from code audit (#523) (b69e688)
🧠 Make incident narratives case-specific and reduce alert noise (ecab565)
🧪 Fix Kind E2E audit matching (#520) (fb3bb7b)
🧪 Fix E2E configuration durations (#519) (6f5323b)
🛡️ Allow safe artifact file checks (#518) (1845a5e)
🧪 Preserve safe E2E diagnostics (#517) (e334180)
Add production incident intelligence and evidence-aware alerts (#516) (feb0f9f)
🐛 fix: apply Kwatch E2E deployment patch (#515) (c1e3eac)
🐛 fix: bootstrap Kind scenario dependencies (#514) (4585640)
🛡️ Improve production reliability and human-friendly alerts (#512) (9edfd22)
🐛 Fix Kind E2E installation bootstrap (#511) (37057ee)
🐛 Allow E2E overlay to load source manifests (499f63b)
🧪 Add scalable Kind E2E regression testing (#509) (53945e4)
🛡️ Improve reliability and telemetry (#508) (ca51953)
🐛 fix: prevent disabled control-plane panic (#507) (aa80dee)
fix: run checksum verification in release assets (#506) (cf2e5b8)
fix: provide token for provenance verification (#505) (38cd304)
fix: use valid Syft image in release evidence (#504) (a8490bf)
fix: use GHCR for scorecard action (#501) (5bb0062)
🚀 Refactor architecture (#500) (b2ae1d2)
🐛 fix deploy (440d4e8)
🧭 fix: validate iLert priority from provider catalog (#496) (52625e4)
🧭 feat: make provider choices catalog-driven (#495) (bbbf6c2)
🐛 fix: update release integrity notes endpoint (2d620d6)
📝 docs: align README and installation guidance (4841c13)
🛡️ Harden monitoring, configuration, providers, and release workflows (#489) (303bf8d)
chore: release v0.11.0-rc.7 - bump pinned versions (434c9ed)
🚀 Refactor & fixing bugs (#488) (30e8c78)
chore: release v0.11.0-rc.6 - bump pinned versions (80a0b97)
🚀 Refactor & fixing bugs (#485) (2b7b83e)
♻️ improve dockerfile (#480) (99d29ac)
chore: release v0.11.0-rc.5 - bump pinned versions (5542542)
🔧 fix releasing (#479) (cbdf037)
fix: release naming and docker (#478) (f5d846c)
fix: release naming and docker (#477) (0e51ae5)
fix: add GH_TOKEN to release workflow for GitHub CLI authentication (2032edd)
fix: add git user configuration to release workflow (1f9c728)
🚀 Refactor kwatch (#476) (9e28265)
fix: switch star history chart to a working data source (#473) (18bdea0)
fix: node field selector bug and migrate v1 Endpoints to EndpointSlice (9d2627c)
refactor: smart message format across all providers (7593af1)
refactor: clean LLM prompt — remove examples, tighten rules (ab75802)
feat: alert retry jitter, cluster-autoscaler monitor, audit logging, graph pruning, service endpoint debounce, LLM prompt fix, and various improvements (e149a41)
remove AGENTS.md (4f38cad)
100% handler coverage and remaining coverage gap closure (ac92518)
fix: set BaselineTTL in TestControllerPodEvent to prevent baseline suppression (ee79a55)
Fix hard-coded string lengths, severity for critical thresholds, filter nil guards, AddIndexers unchecked error, shutdown goroutine lifecycle, metrics dead code (0c3443b)
Add PVC edges to graph, configmap/secret/pvc impact reporting, tests; fix TestFirstKey flake; periodic graph rebuild (1480c3f)
Sustained checks for HPAScalingError, CronJobSuspended, node pressure; fix HighRestartCount bypassing DisruptionFilter; add ResolveByResource cooldown; container_killing_filter exact match; CLHF orphan migration; Evicted/Preempting back in obviousReasons (8e07264)
Refactor IncidentKey for consistent crash-loop handling (70c2d7b)
Refine system prompt for Kubernetes RCA assistant (9ed1a98)
Enhance system prompt for Kubernetes RCA assistant (27e7d55)
Update process_node.go (1e46b75)
Update Correlation config parameters (1d21e51)
Add cooldown cleanup for seen keys (155144c)
chore: stage and commit all pending changes (daada0b)
chore: update LLM image references and CI config (69bbe8c)
chore: add all missing config fields to example config (f52543d)
chore: replace real values with placeholders in example config (6714853)
chore: remove unused pendingPodThreshold from example config (39c1fb8)
docs: remove 'sidecar' from AI descriptions (1d9186b)
docs: note LLM sidecar only supports amd64/arm64 (9358156)
feat: add new hexagonal badge logo for kwatch brand identity (29bac52)
chore: update LLM model references and remove CHANGELOG (566b2af)
upgrade models (2771217)
...and 20 more commits.

See the full diff since v0.10.5.

Release integrity

Source tag: v1.0.0
Source commit: 994acaa7c7b0ce47e615e545526e5eb4cdc38724
Image: ghcr.io/abahmed/kwatch@sha256:073d737ea86b6eedbe1ff5a958fe290c3f23494c8320ea9baedfa5e3eba74201
Verification files: checksums, signed checksums, manifest, installer checksums (signed)
SBOMs: kwatch-v1.0.0-source-sbom.cdx.json and kwatch-v1.0.0-image-sbom.cdx.json

Verify the image with:

cosign verify \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='^https://github.com/abahmed/kwatch/.github/workflows/publish.yml@' \
  ghcr.io/abahmed/kwatch@sha256:073d737ea86b6eedbe1ff5a958fe290c3f23494c8320ea9baedfa5e3eba74201