Configuration

All configuration is environment variables, optionally loaded from a .env file. The tables below mirror the settings classes in src/kubedevaiops/config.py, with the actual defaults.

List-valued variables are parsed as JSON arrays, e.g. SAFETY_PROTECTED_NAMESPACES=["kube-system","kube-public"].

LLM

Variable	Default	Description
`LLM_PROVIDER`	`ollama`	One of `ollama`, `openai`, `azure_openai`, `anthropic`, `gemini`.
`LLM_MODEL`	`gpt-oss:20b`	Generic model name; used by the Ollama provider. Hosted providers use their own model variables below.
`LLM_TEMPERATURE`	`0.1`	Sampling temperature.
`LLM_MAX_TOKENS`	`4096`	Maximum tokens per completion.
`LLM_REQUEST_TIMEOUT`	`120`	LLM request timeout in seconds.

Providers

Variable	Default	Description
`OLLAMA_BASE_URL`	`http://localhost:11434`	Ollama server URL. There is no `OLLAMA_MODEL` variable — use `LLM_MODEL`.
`OPENAI_API_KEY`	(empty)	OpenAI API key.
`OPENAI_MODEL`	`gpt-4o`	OpenAI model.
`AZURE_OPENAI_ENDPOINT`	(empty)	Azure OpenAI endpoint URL.
`AZURE_OPENAI_API_KEY`	(empty)	Azure OpenAI API key.
`AZURE_OPENAI_DEPLOYMENT`	`gpt-4o`	Azure deployment name.
`AZURE_OPENAI_API_VERSION`	`2024-08-01-preview`	Azure API version.
`ANTHROPIC_API_KEY`	(empty)	Anthropic API key.
`ANTHROPIC_MODEL`	`claude-opus-5`	Anthropic model.
`GEMINI_API_KEY`	(empty)	Google AI API key.
`GEMINI_MODEL`	`gemini-2.5-flash`	Gemini model.

Kubernetes

Variable	Default	Description
`KUBECONFIG`	(empty)	Path to a kubeconfig. Empty uses in-cluster config or `~/.kube/config`.
`K8S_NAMESPACE`	`kubedevaiops`	Namespace the agent itself operates in.

API server

Variable	Default	Description
`API_HOST`	`0.0.0.0`	Bind address.
`API_PORT`	`8080`	Port.
`API_CORS_ORIGINS`	`[]`	CORS origin allowlist for browser clients. Empty disables CORS entirely; `*` is deliberately not the default.
`API_AUTH_TOKEN`	(empty)	Bearer token required on `/tasks`, `/tasks/history`, `/metrics`, and `/approvals` when set. Unset = open dev mode, with a startup warning.
`API_WEBHOOK_SECRET`	(empty)	HMAC-SHA256 shared secret for `POST /webhook`. Webhooks are disabled (403) when unset.

Slack

Variable	Default	Description
`SLACK_ENABLED`	`false`	Declared in settings but not currently consulted at startup — the bot starts whenever both tokens below are set.
`SLACK_BOT_TOKEN`	(empty)	Bot token (`xoxb-…`). The Socket Mode bot starts when this and `SLACK_APP_TOKEN` are both set.
`SLACK_APP_TOKEN`	(empty)	App-level token (`xapp-…`) for Socket Mode.
`SLACK_SIGNING_SECRET`	(empty)	Slack signing secret.
`SLACK_ALLOWED_USERS`	`[]`	Slack user IDs allowed to run tasks. Empty allows all workspace members — not recommended outside sandboxes.

Safety

Variable	Default	Description
`SAFETY_DRY_RUN_DEFAULT`	`false`	Prefer dry-run behaviour for structured actions.
`SAFETY_REQUIRE_APPROVAL_DESTRUCTIVE`	`true`	Gate destructive commands behind human approval. Turning this off removes the approval gate — do not do that on a cluster you care about.
`SAFETY_MAX_CONCURRENT_TASKS`	`5`	Concurrent task limit; excess API requests get 429.
`SAFETY_PROTECTED_NAMESPACES`	`["kube-system","kube-public","kube-node-lease"]`	Namespaces where destructive commands are refused outright (never approvable).
`SAFETY_READ_PATHS`	`["/etc/kubedevaiops"]`	Directories `read_resource` may read files from. Empty disables file reads.

Observability

Variable	Default	Description
`LOG_LEVEL`	`INFO`	Log level.
`LOG_FORMAT`	`json`	`json` (structured) or console rendering.
`METRICS_ENABLED`	`true`	Expose Prometheus metrics.
`METRICS_PORT`	`9090`	Metrics port used by the deployment manifests.

Skills

Variable	Default	Description
`ENABLED_SKILLS`	`["security","administration","networking","monitoring","troubleshooting","cost_optimization"]`	Skills to activate. A discovered skill YAML is ignored unless its name is listed here.
`SKILL_DIRS`	(empty)	Extra directories to scan for skill YAML files (colon-separated; semicolon on Windows). Read directly from the environment by the skill loader.