Configuration

The flags and environment variables the Dorgu CLI reads

​

Configuration

The CLI has no configuration file. Every cluster command reads your kubeconfig through kubectl, and the few things you can change are global flags and environment variables.

CLI v0.13.0 removed .dorgu.yaml, ~/.config/dorgu/config.yaml, the global --config flag, and the init and config commands. They only configured manifest generation, which was removed with them. If you still have those files you can delete them; the CLI ignores them. See the CLI migration guide.

​

Choosing the cluster

Setting	Where	Effect
--context	Global flag	kube-context for every kubectl call the command makes. Defaults to the kubeconfig’s current-context.
--kubeconfig	Flag on every cluster command	Path to the kubeconfig. Defaults to kubectl’s own resolution: $KUBECONFIG, then ~/.kube/config.
KUBECONFIG	Environment	Read by kubectl itself when --kubeconfig is not set. The CLI does not read it directly.

Every kubectl call goes through one helper that adds --kubeconfig and --context when you set them. A command therefore never reads from one cluster and writes to another, which matters most for remediation approve and heal, the two commands that patch a workload.

# Review and approve against a specific context without switching kubectl's current one
dorgu remediation list --context kind-dorgu-dev
dorgu remediation approve fix-oom-api-server -n default --context kind-dorgu-dev

​

Environment variables

Variable	Purpose	Default
DORGU_PROTECTED_CONTEXTS	Comma-separated, case-insensitive substrings of kube-context names that approve and heal refuse to patch a workload through. An unset or blank value falls back to the default rather than disabling the guard.	prod
DORGU_DEBUG	Any non-empty value shows kubectl’s raw output in error messages, including the klog lines the CLI normally strips.	unset

# Refuse contexts whose names contain "production" or "live", instead of "prod"
export DORGU_PROTECTED_CONTEXTS=production,live

# See exactly what kubectl said when a command fails
DORGU_DEBUG=1 dorgu health

DORGU_PROTECTED_CONTEXTS is a name check. It stops you healing the wrong cluster by accident; it is not a security boundary, because a context with a different name passes it. See protected contexts for exactly what is checked and when.

​

Output

Setting	Where	Effect
--json	Global flag	Structured output for scripts, CI, and agents
--no-color	Global flag	Disable colored output

The CLI detects whether stdout is a terminal and drops colors and spinners when it is piped.

​

AI keys live in the operator, not the CLI

The CLI makes no calls to a model provider and reads no API key. OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY and OLLAMA_HOST are ignored since v0.13.0.

AI diagnosis and AI remediation plans are produced by the operator, inside your cluster, with a key you put in a Secret, and only when you turn them on in the chart. See AI setup.