Coroot Reference¶
What this page covers
Look-up facts for Coroot: release history, editions and pricing, platform requirements, ports and endpoints, the main server flags and Coroot custom resource fields, node-agent flags, storage defaults, MCP tools, vendor benchmark results, and access-control tables. For tasks see How-to Guides. For how the parts fit together see Explanation.
Release History¶
Coroot ships a new minor release every two to five weeks and patch releases in between. There is no LTS line or published support window. The operator upgrades components to the latest version unless you pin image tags. Sources: GitHub releases and the helm-charts index.
| Version | Date | Headline change |
|---|---|---|
| v1.26.8 | 2026-09-24 | Service accounts and user API keys for the MCP endpoint and HTTP API |
| v1.26.6 | 2026-09-18 | OCI integration: MySQL HeatWave, PostgreSQL, OCI Cache discovery |
| v1.26.5 | 2026-09-17 | MCP response-size limits; full app and node ids required |
| v1.26.4 | 2026-09-16 | GCP Cloud SQL and Memorystore integration |
| v1.26.2 | 2026-09-15 | Better RDS and ElastiCache visibility; Valkey cluster support |
| v1.26.1 | 2026-09-14 | Postgres vacuum diagnostics; IAM role authentication for the cluster agent |
| v1.26.0 | 2026-09-07 | Deep MySQL monitoring (InnoDB, Galera, Group Replication, latency cause ranking) |
| v1.25.0 | 2026-08-27 | Deep MongoDB monitoring (query analysis, replication, WiredTiger, backups) |
| v1.24.0 | 2026-07-21 | Deep Postgres inspections (backups, replication lag, WAL, wraparound, autovacuum) |
| v1.23.2 | 2026-06-30 | Release images built on native arm64 runners |
| v1.23.0 | 2026-06-24 | Windows agent (ETW based, Windows Server 2016+) |
| v1.22.0 | 2026-06-03 | Argo CD monitoring next to Flux CD |
| v1.21.0 | 2026-05-26 | Inbound request instrumentation for external traffic |
| v1.20.2 | 2026-05-06 | MCP server endpoint; ClickHouse query optimizations |
| v1.19.3 | 2026-04-15 | Go runtime heap profiling from the node agent |
| v1.19.0 | 2026-04-03 | Java profiling with async-profiler |
| v1.18.7 | 2026-03-12 | Force-SSO option (disable password login) |
| v1.18.6 | 2026-03-06 | S3 storage for ClickHouse; deprecated coroot Helm chart removed from the docs |
| v1.18.0 | 2026-02-17 | Built-in alerting rules (checks, log patterns, Kubernetes events, PromQL) |
| v1.17.9 | 2026-01-13 | OIDC SSO |
| v1.17.7 | 2026-01-08 | Use another Coroot instance as a project's data source (remoteCoroot) |
| v1.17.0 | 2025-11-04 | Multi-cluster projects |
| v1.16.0 | 2025-10-16 | ClickHouse as metrics storage |
| v1.15.0 | 2025-09-30 | Flux CD support and Kubernetes events |
| v1.14.4 | 2025-09-15 | Issue propagation map for root cause analysis |
How the dates were derived
The release atom feed gives full timestamps for v1.25.0 and later. Older release pages show only month and day. The year comes from release order and from the deprecated coroot Helm chart, which pinned app version 1.14.3 in 2025-09.
| Component | Latest version (date) | Source |
|---|---|---|
| Coroot server (CE and EE) | v1.26.8 (2026-09-24) | Releases |
| coroot-operator | app 1.10.4, chart 0.10.4 (2026-09-24) | helm-charts |
coroot-ce / coroot-ee charts |
0.3.3 / 0.3.2 (2026-02-11) | helm-charts |
coroot chart (legacy) |
0.22.0, deprecated | helm-charts |
Editions and Pricing¶
| Capability | Community Edition | Enterprise Edition |
|---|---|---|
| License | Apache-2.0, free | Commercial subscription, license key |
| Price | Free | From $1 per CPU core per month |
| eBPF metrics, logs, traces, profiles | Yes | Yes |
| Service map, inspections, SLOs, alerting rules | Yes | Yes |
| Deployment tracking, cost monitoring | Yes | Yes |
| Multi-cluster projects | Yes | Yes |
| Roles | Admin, Editor, Viewer (fixed) | Custom roles with granular, per-project or per-app permissions |
| SSO (SAML 2.0, OIDC) | No | Yes |
| AI root cause analysis | Through Coroot Cloud (10 free investigations per month) | Yes, with your own LLM provider |
| MCP tools | All except list_anomalies, investigate_anomaly |
All |
| Support | Community Slack, GitHub | Priority support |
Sources: Kubernetes install, RBAC, AI overview, Coroot Cloud, pricing page.
Pricing details
The pricing page (as indexed in 2026-09) states no per-GB ingestion or retention charges and volume discounts at scale. Trial length and paid Coroot Cloud plans are TBD: the pages were not reachable for verification. Check coroot.com/pricing before you budget.
LLM providers for Enterprise AI RCA: Anthropic (Coroot recommends Claude Opus 4.6), OpenAI (GPT-5.2), or any OpenAI-compatible API such as DeepSeek or Google Gemini. The instance needs outbound access to the provider, for example api.anthropic.com:443. Source: AI configuration.
Platform Requirements¶
| Dimension | Support |
|---|---|
| Linux kernel | 5.1 or newer, built with CONFIG_BPF_EVENTS=y |
| eBPF CPU profiler | CO-RE: Ubuntu 20.10+, Debian 11+, RHEL 8.2+ |
| Container types | Kubernetes pods (Docker, containerd, CRI-O), standalone containers, Docker Swarm, systemd units |
| Orchestrators | Kubernetes (self-managed, EKS incl. basic Fargate, GKE, AKS, OKE), OpenShift, K3s, MicroK8s, Docker Swarm |
| Windows | Agent only: Windows Server 2016, 2019, 2022, 2025 on x64 or arm64 (since v1.23.0) |
| CPU architectures | amd64 and arm64 images |
| Not supported | Docker-in-Docker (for example Minikube), WSL1, the Coroot server on Windows |
| Metrics backends | Prometheus 2.25+ with the remote-write receiver, VictoriaMetrics, Thanos, Grafana Mimir, or ClickHouse |
| Log, trace, profile storage | ClickHouse (self-managed, operator-managed, or ClickHouse Cloud) |
| Configuration store | SQLite (default) or PostgreSQL (required when replicas > 1) |
Sources: Requirements, Windows, node agent README.
Ports and Endpoints¶
| Port / path | Component | Purpose |
|---|---|---|
8080 |
Coroot server | UI, HTTP API, agent ingestion (Remote Write, OTLP/HTTP, profiles), /mcp |
/v1/traces, /v1/logs on 8080 |
Coroot server | OTLP over HTTP from SDKs, collectors, and the node agent |
4317 |
Coroot server | OTLP over gRPC (disable with --grpc-disabled) |
--https-listen (no default) |
Coroot server | Optional HTTPS listener |
/mcp |
Coroot server | Model Context Protocol, streamable HTTP, OAuth 2.0 or API key |
0.0.0.0:80 |
node agent (Linux) | Prometheus metrics for pull mode |
127.0.0.1:10300 |
node agent (Windows) | Local metrics listener |
9000 / 8123 |
ClickHouse | Native protocol / HTTP |
9090 |
Prometheus | PromQL queries and remote write |
Agents authenticate with the project API key in the X-Api-Key header. API clients and MCP agents use Authorization: Bearer <key> with a user or service-account key.
Server Flags and Environment Variables¶
A selection of the most used flags. Precedence: command-line flag, then environment variable, then config file. Source: Configuration.
| Flag | Environment variable | Default | Purpose |
|---|---|---|---|
--listen |
LISTEN |
0.0.0.0:8080 |
HTTP listen address |
--https-listen |
HTTPS_LISTEN |
none | HTTPS listen address |
--grpc-listen |
GRPC_LISTEN |
:4317 |
OTLP gRPC listen address |
--tls-cert-file, --tls-key-file |
TLS_CERT_FILE, TLS_KEY_FILE |
none | Server TLS certificate and key |
--url-base-path |
URL_BASE_PATH |
/ |
Serve Coroot under a sub-path |
--data-dir |
DATA_DIR |
/data |
Metric cache and SQLite location |
--cache-ttl |
CACHE_TTL |
30d |
Metric cache retention |
--traces-ttl, --logs-ttl, --profiles-ttl, --metrics-ttl |
TRACES_TTL and so on |
7d each |
ClickHouse table TTLs, applied at table creation |
--pg-connection-string |
PG_CONNECTION_STRING |
none | Use PostgreSQL instead of SQLite |
--auth-anonymous-role |
AUTH_ANONYMOUS_ROLE |
none | Disable login, give everyone this role |
--auth-bootstrap-admin-password |
AUTH_BOOTSTRAP_ADMIN_PASSWORD |
none | Initial admin password |
--license-key |
LICENSE_KEY |
none | Enterprise Edition license |
--global-prometheus-url |
GLOBAL_PROMETHEUS_URL |
none | Prometheus for all projects |
--global-refresh-interval |
GLOBAL_REFRESH_INTERVAL |
15s |
Metric refresh interval |
--global-prometheus-use-clickhouse |
GLOBAL_PROMETHEUS_USE_CLICKHOUSE |
false |
Store metrics in ClickHouse |
--global-clickhouse-address |
GLOBAL_CLICKHOUSE_ADDRESS |
none | ClickHouse for all projects |
--clickhouse-space-manager-usage-threshold |
CLICKHOUSE_SPACE_MANAGER_USAGE_THRESHOLD |
70 |
Disk usage percent that triggers partition cleanup |
--disable-builtin-alerts |
DISABLE_BUILTIN_ALERTS |
false |
Turn off built-in alerting rules |
--disable-usage-statistics |
DISABLE_USAGE_STATISTICS |
false |
Turn off anonymous usage statistics |
The config file (--config) adds settings that have no flag: projects (API keys, memberProjects, remoteCoroot, notification integrations, application categories, alerting rules, inspection overrides), auth.serviceAccounts, sso, ai, and corootCloud.
Coroot Custom Resource Fields¶
The coroot-ce and coroot-ee Helm charts render their values straight into spec of a Coroot resource (apiVersion: coroot.com/v1), so these keys also work with --set. Source: Kubernetes Operator.
| Field | Default | Purpose |
|---|---|---|
metricsRefreshInterval |
15s |
Metric resolution |
cacheTTL |
30d |
Metric cache retention |
replicas |
1 |
Coroot server pods (more than 1 needs postgres) |
storage.size |
10Gi |
Coroot server volume |
service.port / service.grpcPort |
8080 / 4317 |
Service ports |
ingress.host, ingress.tls |
none | Ingress for the UI |
tls.certSecret, tls.keySecret |
none | Server TLS from Secrets |
storeMetricsInClickhouse |
false |
Store metrics in ClickHouse, skip Prometheus |
metricsTTL, tracesTTL, logsTTL, profilesTTL |
7d |
ClickHouse TTLs at table creation |
agentsOnly.corootURL |
none | Install only the agents and send to a remote Coroot |
apiKey / apiKeySecret |
none | API key the agents use |
nodeAgent.resources |
100m / 200Mi request, 500m / 1Gi limit | Node agent resources |
nodeAgent.trackPublicNetworks |
["0.0.0.0/0"] |
Public networks to track |
nodeAgent.logCollector.collectLogEntries |
true |
Store log entries in ClickHouse |
nodeAgent.ebpfTracer.enabled / .sampling |
true / "1.0" |
eBPF span capture and sampling |
nodeAgent.ebpfProfiler.enabled |
true |
eBPF CPU profiler |
clusterAgent.aws, .gcp, .oci |
none | Managed-database discovery settings |
clusterAgent.databases |
none | Extra databases with credentials from Secrets |
prometheus.retention |
2d |
Operator-managed Prometheus retention |
externalPrometheus.url |
none | Use your own Prometheus (remote-write receiver required) |
clickhouse.shards / .replicas |
1 / 1 |
Operator-managed ClickHouse layout |
clickhouse.storage.size |
10Gi (CR), 100Gi (coroot-ce chart) |
Volume per ClickHouse instance |
clickhouse.s3.mode |
none | tiered or s3only object storage |
clickhouse.keeper.replicas |
3 |
ClickHouse Keeper replicas (set once) |
externalClickhouse.address |
none | Use your own ClickHouse |
postgres.host |
none | PostgreSQL for configuration |
projects[] |
none | Projects, API keys, integrations, alerting rules, SLO overrides |
serviceAccounts[] |
none | Password-less accounts with API keys |
sso, ai |
none | Enterprise SSO and AI provider |
corootCloud.apiKey |
none | Coroot Cloud AI RCA for Community Edition |
enterpriseEdition.licenseKey |
none | Enterprise license |
The operator pulls images from ghcr.io/coroot unless you set registry.url and registry.pullSecret on the operator chart.
Node Agent Flags¶
Source: coroot-node-agent flags. Every flag also reads an environment variable of the same name in upper case (with a COROOT_ prefix on Windows).
| Flag | Default | Purpose |
|---|---|---|
--collector-endpoint |
none | Base URL of Coroot for metrics, logs, traces, and profiles |
--api-key |
none | Project API key (X-Api-Key header) |
--scrape-interval |
15s |
Metric collection interval |
--cgroupfs-root |
/sys/fs/cgroup |
Host cgroupfs mount point |
--wal-dir |
/tmp/coroot-node-agent |
Write-ahead log and spool directory |
--max-spool-size |
500MB |
On-disk buffer while Coroot is unreachable |
--min-container-age |
30s |
Skip short-lived containers |
--track-public-network |
0.0.0.0/0 |
Public networks to track |
--ephemeral-port-range |
32768-60999 |
Ports skipped as ephemeral |
--traces-sampling |
1.0 |
eBPF trace sampling rate |
--disable-l7-tracing |
false |
Turn off L7 request capture |
--disable-log-parsing |
false |
Turn off log collection |
--log-pattern-extraction-limit |
100 |
Messages per second per container used for pattern extraction |
--profiles-prune-fraction |
0.0025 |
Drop profile paths under 0.25% of the total |
--enable-java-tls |
false |
Java TLS instrumentation through dynamic agent loading |
--enable-java-async-profiler |
false |
Java CPU, allocation, and lock profiles |
--go-heap-profiler |
enabled |
Go heap profiles: disabled, enabled, or force |
--container-allowlist / --container-denylist |
none | Regex filters for containers |
L7 protocols parsed by the eBPF tracer: HTTP, HTTP/2 (gRPC), Postgres, MySQL, Redis, Memcached, MongoDB, Kafka, Cassandra, RabbitMQ, NATS, Dubbo2, DNS, ClickHouse, ZooKeeper, and FoundationDB (from the node-agent L7 protocol list).
Storage Defaults¶
| Setting | Default | Notes |
|---|---|---|
| Metric cache TTL | 30d |
On the Coroot server disk |
| Metric refresh interval | 15s |
Prometheus to cache |
| ClickHouse TTLs (traces, logs, profiles, metrics) | 7d |
Applied only when tables are created |
| ClickHouse space manager | Enabled, 70% threshold, keep 1 partition | Drops the oldest partitions; disabled automatically with S3 storage |
S3 moveFactor (tiered mode) |
"0.1" |
Move data to S3 when less than 10% of local disk is free |
| Operator-managed Prometheus retention | 2d |
Coroot keeps its own cache |
| Compression in ClickHouse | About 10x or more | Vendor figure |
MCP Tools¶
The endpoint is https://<coroot>/mcp (streamable HTTP). Source: MCP overview.
| Tool | Edition | Purpose |
|---|---|---|
list_projects, select_project |
CE | Find and select a project (cluster) |
list_applications, get_application_status |
CE | Application health and failing inspections |
list_alerts, resolve_alerts |
CE | Firing alerts; resolve them (Editor or higher) |
list_incidents, get_incident_details |
CE | SLO incidents with any persisted RCA |
list_nodes, get_node_details |
CE | Host health |
traces_summary, traces_errors, traces_outliers, get_trace |
CE | Endpoint stats, error reasons, latency flame graph, one trace |
query_metrics, list_metric_names |
CE | PromQL and metric discovery |
query_logs |
CE | Log search |
list_anomalies |
EE | SLO violations and sub-SLO spikes across the fleet |
investigate_anomaly |
EE | Run the RCA engine on one application |
List results are capped at about 50 KB and other responses at 80 KB. Application ids use the form cluster_id:namespace:Kind:name.
Vendor Benchmark Results¶
All figures come from the Performance Impact page. They are vendor-run tests, not independent benchmarks.
| Test | Setup | Result |
|---|---|---|
| node agent, eBPF | AWS m5.2xlarge, Go HTTP server (5 ms, 1 KB), wrk2 at 10,000 RPS for 5 minutes, pinned CPU cores |
Latency difference within measurement error; agent used about 200m CPU |
| cluster agent, MySQL 8.4 | 8 vCPU, 32 GB; 100 DBs x 100 tables; 10,000 QPS; agent 1.11.3 | No measurable latency impact; MySQL +0.07 cores (+2%); agent about 0.01 cores, under 120 MB |
| cluster agent, Postgres 18 | 8 vCPU, 32 GB; 100 DBs x 100 tables; 16,000 QPS | No measurable latency impact; Postgres CPU within noise (6.6 s of agent queries per minute); agent about 0.05 cores, under 310 MB |
| cluster agent, MongoDB 8.0 | 8 vCPU, 32 GB; 100 DBs x 100 collections; 7,200 ops/s | No measurable latency impact; mongod CPU within noise; agent about 0.015 cores, under 60 MB |
Sizing guidance (unverified)¶
Not from Coroot documentation
These tables are rough planning estimates carried over from earlier notes. Coroot does not publish them. Validate on your own workload.
| Cluster size | Coroot server CPU | Coroot server RAM |
|---|---|---|
| Fewer than 50 services | 1 vCPU | 2 GB |
| 50-200 services | 2 vCPU | 4 GB |
| More than 200 services | 4+ vCPU | 8+ GB |
| Storage backend | Scenario | Resources |
|---|---|---|
| Prometheus | Fewer than 1M series | 2 CPU, 8 GB RAM, 100 GB SSD |
| VictoriaMetrics | 1-10M series | 2 CPU, 4 GB RAM, 200 GB SSD |
| ClickHouse | 100 GB/day of logs and traces | 4 CPU, 16 GB RAM, 500 GB SSD |
Access Control¶
Node agent privileges¶
| Requirement | Detail |
|---|---|
| Privileged container | securityContext.privileged: true (operator default) |
| Host PID namespace | hostPID: true to see processes in all containers |
| Host mounts | /sys/fs/cgroup read-only at /host/sys/fs/cgroup, /sys/kernel/tracing, /sys/kernel/debug |
| Pod Security Standards | The namespace needs pod-security.kubernetes.io/enforce=privileged where PSS is enforced (for example Talos) |
| Docker Swarm | Swarm cannot run privileged services, so run the agent with docker run on each node |
Authentication modes¶
| Mode | Configuration | Behavior |
|---|---|---|
| Anonymous | auth.anonymous_role: Admin, Editor, or Viewer |
No login; everyone gets that role |
| Password | bootstrap_admin_password, then users added in the UI |
Admins manage users; coroot set-admin-password resets the admin password |
| Service accounts | auth.serviceAccounts[].apiKeys or the UI |
Password-less accounts for API and MCP; only the SHA-256 hash of a key is stored |
| MCP OAuth 2.0 | Automatic for interactive MCP clients | Agent runs with the signed-in user's permissions |
| SSO (Enterprise) | sso.saml or sso.oidc; forceSSO disables passwords |
Delegated to an identity provider |
Network flows¶
| Direction | Source | Destination | Port | Purpose |
|---|---|---|---|---|
| Egress | Node or cluster agent | Coroot server | 8080 (HTTP/HTTPS) | Metrics, logs, traces, profiles |
| Egress | OTel SDK or Collector | Coroot server | 4317 (gRPC) or 8080 (HTTP) | OTLP logs and traces |
| Egress | Coroot server | ClickHouse | 9000 | Native protocol |
| Egress | Coroot server | Prometheus | 9090 | PromQL and remote write |
| Egress | Coroot server (EE) | LLM provider | 443 | Findings for the AI summary |
| Ingress | Browser, API client, MCP agent | Coroot server | 8080 | UI, API, /mcp |
Notification integrations¶
| Integration | Incidents | Deployments | Alerts |
|---|---|---|---|
| Slack | Yes | Yes | Yes |
| Microsoft Teams (multiple channels) | Yes | Yes | Yes |
| PagerDuty | Yes | No | Yes |
| Opsgenie | Yes | No | Yes |
| Webhook (templated) | Yes | Yes | Yes |