PrometheusRuleMetadata

Resource name.

Key-value labels for the resource. Dash0 recognizes the following labels:

• dash0.com/idCopy: Internal ID (read-only, server-set).
• dash0.com/originCopy: External identifier for API-managed resources.
• dash0.com/versionCopy: Version for optimistic concurrency (required on update, server-set on create).
• dash0.com/datasetCopy: Dataset this resource belongs to (defaults to the default dataset).
• dash0.com/sourceCopy: Origin source — "ui", "terraform", "operator", "dash0-cli", "platform", or "api" (read-only, derived from origin).

Key-value annotations for the resource. Dash0 recognizes the following annotations:

• dash0.com/enabledCopy: Set to "false" to disable evaluation. Defaults to "true" when absent.
• dash0.com/folder-pathCopy: UI folder path for organising resources (e.g., "/infrastructure/hosts"). Nesting is expressed with "/" separators.
• dash0.com/sharingCopy: Comma-separated list of principals to grant read access to. Supported formats: "team:<team_id>" and "user:<email>". Honored only on rules that declare a dash0.com/origin (for example those managed by Terraform, the operator, the CLI, or the API); setting it on a rule that declares no dash0.com/origin is rejected with a 400.
• dash0.com/created-atCopy: Creation timestamp (read-only, server-set).
• dash0.com/updated-atCopy: Last update timestamp (read-only, server-set).
• dash0.com/deleted-atCopy: Soft-delete timestamp (read-only, server-set).
• dash0.com/first-evaluation-atCopy: First evaluation timestamp (recording rules only, read-only, server-set).
• dash0.com/runtime-disabled-atCopy: Timestamp when the recorder took the group out of evaluation because a rule was too expensive (it exceeded the query sample limit). Recording rules only, read-only, server-set. Independent of dash0.com/enabledCopy. Cleared only when a cost-determining field changes (the rules or the interval) — a dash0.com/enabledCopy toggle, a cosmetic edit, or a blind re-apply of the identical manifest does not re-enable the group.
• dash0.com/runtime-disabled-reasonCopy: Why the recorder runtime-disabled the group (currently only "max_samples"). Recording rules only, read-only, server-set.
• dash0.com/baseline-directionCopy: Anomaly detector baseline direction — "above", "below", or "both". Check rules only. Lifted into the rule's thresholds.baselineCopy.
• dash0.com/baseline-spread-floorCopy: Optional minimum spread as a fraction of the baseline prediction. Check rules only; use with dash0.com/baseline-directionCopy.
• dash0.com/volume-floorCopy: Optional minimum predicted or windowed recent level required for a detector to evaluate. Check rules only.
• dash0.com/change-gate-comparisonCopy: Change gate comparison — "absolute_delta" or "relative_factor". Check rules only. Set together with the two keys below.
• dash0.com/change-gate-valueCopy: The minimum change the change gate requires, interpreted according to the comparison. Check rules only.
• dash0.com/change-gate-baseline-windowCopy: The window the change gate derives the recent level from (e.g. "1h"). Check rules only.

The detector keys are the only way to configure an anomaly detector from Kubernetes: check rules are a flat resource whose body has no thresholdsCopy field. All three change-gate keys must be present and parseable for a change gate to be created; a partial or unparseable set is left in the annotations and creates no detector, rather than rejecting the rule and breaking the reconcile loop. A typed thresholdsCopy field on the body always wins over the matching annotation.

New annotation keys use the dash0.com/Copy prefix. The legacy dash0-threshold-degradedCopy / dash0-threshold-criticalCopy forms (and their unprefixed variants) are still lifted for compatibility but are not extended.