diff --git a/cmd/karma/tests/testscript/059_log_full_config_env.txt b/cmd/karma/tests/testscript/059_log_full_config_env.txt
index 1c45c4ea9..15ab66c43 100644
--- a/cmd/karma/tests/testscript/059_log_full_config_env.txt
+++ b/cmd/karma/tests/testscript/059_log_full_config_env.txt
@@ -87,25 +87,25 @@ level=info msg="    silences: \"\""
 level=info msg="alertmanager:"
 level=info msg="  interval: 10s"
 level=info msg="  servers:"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: ro"
-level=info msg="    uri: http://127.0.0.1:9093"
-level=info msg="    external_uri: http://127.0.0.1:9093"
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 10s"
-level=info msg="    proxy: false"
-level=info msg="    readonly: true"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: ro"
+level=info msg="      uri: http://127.0.0.1:9093"
+level=info msg="      external_uri: http://127.0.0.1:9093"
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 10s"
+level=info msg="      proxy: false"
+level=info msg="      readonly: true"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
 level=info msg="alertAcknowledgement:"
 level=info msg="  enabled: true"
 level=info msg="  duration: 5m0s"
@@ -115,19 +115,19 @@ level=info msg="annotations:"
 level=info msg="  default:"
 level=info msg="    hidden: true"
 level=info msg="  hidden:"
-level=info msg="  - help"
-level=info msg="  - summary"
+level=info msg="    - help"
+level=info msg="    - summary"
 level=info msg="  visible:"
-level=info msg="  - visible"
+level=info msg="    - visible"
 level=info msg="  keep:"
-level=info msg="  - keep"
+level=info msg="    - keep"
 level=info msg="  strip:"
-level=info msg="  - strip1"
-level=info msg="  - strip2"
-level=info msg="  - strip3"
+level=info msg="    - strip1"
+level=info msg="    - strip2"
+level=info msg="    - strip3"
 level=info msg="  order:"
-level=info msg="  - summary"
-level=info msg="  - help"
+level=info msg="    - summary"
+level=info msg="    - help"
 level=info msg="  actions: []"
 level=info msg="custom:"
 level=info msg="  css: /custom.css"
@@ -135,8 +135,8 @@ level=info msg="  js: /custom.js"
 level=info msg="debug: false"
 level=info msg="filters:"
 level=info msg="  default:"
-level=info msg="  - '@receiver=by-cluster-service'"
-level=info msg="  - '@state=active'"
+level=info msg="    - '@receiver=by-cluster-service'"
+level=info msg="    - '@state=active'"
 level=info msg="grid:"
 level=info msg="  sorting:"
 level=info msg="    order: label"
@@ -148,19 +148,19 @@ level=info msg="karma:"
 level=info msg="  name: karma-demo"
 level=info msg="labels:"
 level=info msg="  keep:"
-level=info msg="  - keep1"
-level=info msg="  - keep2"
+level=info msg="    - keep1"
+level=info msg="    - keep2"
 level=info msg="  strip:"
-level=info msg="  - strip1"
-level=info msg="  - strip2"
+level=info msg="    - strip1"
+level=info msg="    - strip2"
 level=info msg="  color:"
 level=info msg="    custom: {}"
 level=info msg="    static:"
-level=info msg="    - job"
+level=info msg="      - job"
 level=info msg="    unique:"
-level=info msg="    - '@receiver'"
-level=info msg="    - instance"
-level=info msg="    - cluster"
+level=info msg="      - '@receiver'"
+level=info msg="      - instance"
+level=info msg="      - cluster"
 level=info msg="listen:"
 level=info msg="  address: 127.0.0.1"
 level=info msg="  timeout:"
@@ -179,11 +179,11 @@ level=info msg="  requests: false"
 level=info msg="  timestamp: false"
 level=info msg="receivers:"
 level=info msg="  keep:"
-level=info msg="  - keep1"
-level=info msg="  - keep2"
+level=info msg="    - keep1"
+level=info msg="    - keep2"
 level=info msg="  strip:"
-level=info msg="  - strip1"
-level=info msg="  - strip2"
+level=info msg="    - strip1"
+level=info msg="    - strip2"
 level=info msg="sentry:"
 level=info msg="  private: https://examplePublicKey@o0.ingest.sentry.io/0"
 level=info msg="  public: https://examplePublicKey@o0.ingest.sentry.io/1"
@@ -194,9 +194,9 @@ level=info msg="      rules: []"
 level=info msg="silenceForm:"
 level=info msg="  strip:"
 level=info msg="    labels:"
-level=info msg="    - job"
-level=info msg="    - severity"
-level=info msg="    - region"
+level=info msg="      - job"
+level=info msg="      - severity"
+level=info msg="      - region"
 level=info msg="ui:"
 level=info msg="  refresh: 10s"
 level=info msg="  hideFiltersWhenIdle: false"
diff --git a/cmd/karma/tests/testscript/060_log_full_config_file.txt b/cmd/karma/tests/testscript/060_log_full_config_file.txt
index 4d9f5686b..1d6314f29 100644
--- a/cmd/karma/tests/testscript/060_log_full_config_file.txt
+++ b/cmd/karma/tests/testscript/060_log_full_config_file.txt
@@ -13,107 +13,107 @@ level=info msg="    name: \"\""
 level=info msg="    value_re: \"\""
 level=info msg="  basicAuth:"
 level=info msg="    users:"
-level=info msg="    - username: number"
-level=info msg="      password: '***'"
-level=info msg="    - username: string"
-level=info msg="      password: '***'"
+level=info msg="      - username: number"
+level=info msg="        password: '***'"
+level=info msg="      - username: string"
+level=info msg="        password: '***'"
 level=info msg="authorization:"
 level=info msg="  groups:"
-level=info msg="  - name: admins"
-level=info msg="    members:"
-level=info msg="    - alice"
-level=info msg="    - bob"
+level=info msg="    - name: admins"
+level=info msg="      members:"
+level=info msg="        - alice"
+level=info msg="        - bob"
 level=info msg="  acl:"
 level=info msg="    silences: \"\""
 level=info msg="alertmanager:"
 level=info msg="  interval: 10s"
 level=info msg="  servers:"
-level=info msg="  - cluster: HA"
-level=info msg="    name: ha1"
-level=info msg="    uri: http://127.0.0.1:9093"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 10s"
-level=info msg="    proxy: true"
-level=info msg="    readonly: false"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
-level=info msg="  - cluster: HA"
-level=info msg="    name: ha2"
-level=info msg="    uri: http://127.0.0.1:9094"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 10s"
-level=info msg="    proxy: false"
-level=info msg="    readonly: true"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: omit"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: local"
-level=info msg="    uri: http://foo:xxx@127.0.0.1:9095"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 40s"
-level=info msg="    proxy: true"
-level=info msg="    readonly: false"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers:"
-level=info msg="      X-Auth-Test: '***'"
-level=info msg="    cors:"
-level=info msg="      credentials: same-origin"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters:"
-level=info msg="        prom1:"
-level=info msg="        - alertname=DeadMansSwitch"
-level=info msg="        - instance=prom1"
-level=info msg="        prom2:"
-level=info msg="        - alertname=DeadMansSwitch"
-level=info msg="        - instance=prom2"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: client-auth"
-level=info msg="    uri: https://127.0.0.1:9096"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 10s"
-level=info msg="    proxy: false"
-level=info msg="    readonly: false"
-level=info msg="    tls:"
-level=info msg="      ca: ca.pem"
-level=info msg="      cert: cert.pem"
-level=info msg="      key: key.pem"
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: true"
-level=info msg="      filters:"
-level=info msg="        prom1:"
-level=info msg="        - alertname=DeadMansSwitch"
-level=info msg="        - instance=prom1"
+level=info msg="    - cluster: HA"
+level=info msg="      name: ha1"
+level=info msg="      uri: http://127.0.0.1:9093"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 10s"
+level=info msg="      proxy: true"
+level=info msg="      readonly: false"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
+level=info msg="    - cluster: HA"
+level=info msg="      name: ha2"
+level=info msg="      uri: http://127.0.0.1:9094"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 10s"
+level=info msg="      proxy: false"
+level=info msg="      readonly: true"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: omit"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: local"
+level=info msg="      uri: http://foo:xxx@127.0.0.1:9095"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 40s"
+level=info msg="      proxy: true"
+level=info msg="      readonly: false"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers:"
+level=info msg="        X-Auth-Test: '***'"
+level=info msg="      cors:"
+level=info msg="        credentials: same-origin"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters:"
+level=info msg="          prom1:"
+level=info msg="            - alertname=DeadMansSwitch"
+level=info msg="            - instance=prom1"
+level=info msg="          prom2:"
+level=info msg="            - alertname=DeadMansSwitch"
+level=info msg="            - instance=prom2"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: client-auth"
+level=info msg="      uri: https://127.0.0.1:9096"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 10s"
+level=info msg="      proxy: false"
+level=info msg="      readonly: false"
+level=info msg="      tls:"
+level=info msg="        ca: ca.pem"
+level=info msg="        cert: cert.pem"
+level=info msg="        key: key.pem"
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: true"
+level=info msg="        filters:"
+level=info msg="          prom1:"
+level=info msg="            - alertname=DeadMansSwitch"
+level=info msg="            - instance=prom1"
 level=info msg="alertAcknowledgement:"
 level=info msg="  enabled: true"
 level=info msg="  duration: 7m0s"
@@ -123,19 +123,19 @@ level=info msg="annotations:"
 level=info msg="  default:"
 level=info msg="    hidden: true"
 level=info msg="  hidden:"
-level=info msg="  - help"
-level=info msg="  - summary"
+level=info msg="    - help"
+level=info msg="    - summary"
 level=info msg="  visible:"
-level=info msg="  - visible"
+level=info msg="    - visible"
 level=info msg="  keep:"
-level=info msg="  - keep"
+level=info msg="    - keep"
 level=info msg="  strip:"
-level=info msg="  - strip1"
-level=info msg="  - strip2"
-level=info msg="  - strip3"
+level=info msg="    - strip1"
+level=info msg="    - strip2"
+level=info msg="    - strip3"
 level=info msg="  order:"
-level=info msg="  - summary"
-level=info msg="  - help"
+level=info msg="    - summary"
+level=info msg="    - help"
 level=info msg="  actions: []"
 level=info msg="custom:"
 level=info msg="  css: /custom.css"
@@ -143,7 +143,7 @@ level=info msg="  js: /custom.js"
 level=info msg="debug: false"
 level=info msg="filters:"
 level=info msg="  default:"
-level=info msg="  - '@receiver=by-cluster-service'"
+level=info msg="    - '@receiver=by-cluster-service'"
 level=info msg="grid:"
 level=info msg="  sorting:"
 level=info msg="    order: label"
@@ -163,29 +163,29 @@ level=info msg="karma:"
 level=info msg="  name: karma-demo"
 level=info msg="labels:"
 level=info msg="  keep:"
-level=info msg="  - keep1"
-level=info msg="  - keep2"
+level=info msg="    - keep1"
+level=info msg="    - keep2"
 level=info msg="  strip:"
-level=info msg="  - strip1"
-level=info msg="  - strip2"
+level=info msg="    - strip1"
+level=info msg="    - strip2"
 level=info msg="  color:"
 level=info msg="    custom:"
 level=info msg="      region:"
-level=info msg="      - value_re: .*"
-level=info msg="        color: '#736598'"
+level=info msg="        - value_re: .*"
+level=info msg="          color: '#736598'"
 level=info msg="      severity:"
-level=info msg="      - value: info"
-level=info msg="        color: '#87c4e0'"
-level=info msg="      - value: warning"
-level=info msg="        color: '#ffae42'"
-level=info msg="      - value: critical"
-level=info msg="        color: '#ff220c'"
+level=info msg="        - value: info"
+level=info msg="          color: '#87c4e0'"
+level=info msg="        - value: warning"
+level=info msg="          color: '#ffae42'"
+level=info msg="        - value: critical"
+level=info msg="          color: '#ff220c'"
 level=info msg="    static:"
-level=info msg="    - job"
+level=info msg="      - job"
 level=info msg="    unique:"
-level=info msg="    - cluster"
-level=info msg="    - instance"
-level=info msg="    - '@receiver'"
+level=info msg="      - cluster"
+level=info msg="      - instance"
+level=info msg="      - '@receiver'"
 level=info msg="listen:"
 level=info msg="  address: \"\""
 level=info msg="  timeout:"
@@ -204,11 +204,11 @@ level=info msg="  requests: false"
 level=info msg="  timestamp: false"
 level=info msg="receivers:"
 level=info msg="  keep:"
-level=info msg="  - keep1"
-level=info msg="  - keep2"
+level=info msg="    - keep1"
+level=info msg="    - keep2"
 level=info msg="  strip:"
-level=info msg="  - strip1"
-level=info msg="  - strip2"
+level=info msg="    - strip1"
+level=info msg="    - strip2"
 level=info msg="sentry:"
 level=info msg="  private: https://examplePublicKey@o0.ingest.sentry.io/0"
 level=info msg="  public: https://examplePublicKey@o0.ingest.sentry.io/1"
@@ -216,14 +216,14 @@ level=info msg="silences:"
 level=info msg="  comments:"
 level=info msg="    linkDetect:"
 level=info msg="      rules:"
-level=info msg="      - regex: (DEVOPS-[0-9]+)"
-level=info msg="        uriTemplate: https://jira.example.com/browse/$1"
+level=info msg="        - regex: (DEVOPS-[0-9]+)"
+level=info msg="          uriTemplate: https://jira.example.com/browse/$1"
 level=info msg="silenceForm:"
 level=info msg="  strip:"
 level=info msg="    labels:"
-level=info msg="    - job"
-level=info msg="    - severity"
-level=info msg="    - region"
+level=info msg="      - job"
+level=info msg="      - severity"
+level=info msg="      - region"
 level=info msg="ui:"
 level=info msg="  refresh: 10s"
 level=info msg="  hideFiltersWhenIdle: true"
diff --git a/cmd/karma/tests/testscript/065_proxy-with-readonly.txt b/cmd/karma/tests/testscript/065_proxy-with-readonly.txt
index acff4194e..a76b76c56 100644
--- a/cmd/karma/tests/testscript/065_proxy-with-readonly.txt
+++ b/cmd/karma/tests/testscript/065_proxy-with-readonly.txt
@@ -20,25 +20,25 @@ level=info msg="    silences: \"\""
 level=info msg="alertmanager:"
 level=info msg="  interval: 1m0s"
 level=info msg="  servers:"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: failed"
-level=info msg="    uri: http://127.0.0.1"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 40s"
-level=info msg="    proxy: true"
-level=info msg="    readonly: true"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: failed"
+level=info msg="      uri: http://127.0.0.1"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 40s"
+level=info msg="      proxy: true"
+level=info msg="      readonly: true"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
 level=info msg="alertAcknowledgement:"
 level=info msg="  enabled: false"
 level=info msg="  duration: 15m0s"
diff --git a/cmd/karma/tests/testscript/066_proxy.txt b/cmd/karma/tests/testscript/066_proxy.txt
index ce35e6628..a5fcf37a2 100644
--- a/cmd/karma/tests/testscript/066_proxy.txt
+++ b/cmd/karma/tests/testscript/066_proxy.txt
@@ -20,25 +20,25 @@ level=info msg="    silences: \"\""
 level=info msg="alertmanager:"
 level=info msg="  interval: 1m0s"
 level=info msg="  servers:"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: proxied"
-level=info msg="    uri: http://127.0.0.1"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 40s"
-level=info msg="    proxy: true"
-level=info msg="    readonly: false"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: proxied"
+level=info msg="      uri: http://127.0.0.1"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 40s"
+level=info msg="      proxy: true"
+level=info msg="      readonly: false"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
 level=info msg="alertAcknowledgement:"
 level=info msg="  enabled: false"
 level=info msg="  duration: 15m0s"
diff --git a/cmd/karma/tests/testscript/067_readonly.txt b/cmd/karma/tests/testscript/067_readonly.txt
index 81f23bfd6..38f060d46 100644
--- a/cmd/karma/tests/testscript/067_readonly.txt
+++ b/cmd/karma/tests/testscript/067_readonly.txt
@@ -20,25 +20,25 @@ level=info msg="    silences: \"\""
 level=info msg="alertmanager:"
 level=info msg="  interval: 1m0s"
 level=info msg="  servers:"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: readonly"
-level=info msg="    uri: http://127.0.0.1"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 40s"
-level=info msg="    proxy: false"
-level=info msg="    readonly: true"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: readonly"
+level=info msg="      uri: http://127.0.0.1"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 40s"
+level=info msg="      proxy: false"
+level=info msg="      readonly: true"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
 level=info msg="alertAcknowledgement:"
 level=info msg="  enabled: false"
 level=info msg="  duration: 15m0s"
diff --git a/cmd/karma/tests/testscript/068_sentry.txt b/cmd/karma/tests/testscript/068_sentry.txt
index 0a2befd7b..002df5902 100644
--- a/cmd/karma/tests/testscript/068_sentry.txt
+++ b/cmd/karma/tests/testscript/068_sentry.txt
@@ -22,25 +22,25 @@ level=info msg="    silences: \"\""
 level=info msg="alertmanager:"
 level=info msg="  interval: 1m0s"
 level=info msg="  servers:"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: default"
-level=info msg="    uri: http://127.0.0.1:9093"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 40s"
-level=info msg="    proxy: false"
-level=info msg="    readonly: false"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: default"
+level=info msg="      uri: http://127.0.0.1:9093"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 40s"
+level=info msg="      proxy: false"
+level=info msg="      readonly: false"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
 level=info msg="alertAcknowledgement:"
 level=info msg="  enabled: false"
 level=info msg="  duration: 15m0s"
diff --git a/cmd/karma/tests/testscript/070_upper_case_keys.txt b/cmd/karma/tests/testscript/070_upper_case_keys.txt
index cfca1183d..e84a1af83 100644
--- a/cmd/karma/tests/testscript/070_upper_case_keys.txt
+++ b/cmd/karma/tests/testscript/070_upper_case_keys.txt
@@ -20,25 +20,25 @@ level=info msg="    silences: \"\""
 level=info msg="alertmanager:"
 level=info msg="  interval: 1m0s"
 level=info msg="  servers:"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: am"
-level=info msg="    uri: https://127.0.0.1:9093"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: \"\""
-level=info msg="    timeout: 40s"
-level=info msg="    proxy: false"
-level=info msg="    readonly: false"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: am"
+level=info msg="      uri: https://127.0.0.1:9093"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: \"\""
+level=info msg="      timeout: 40s"
+level=info msg="      proxy: false"
+level=info msg="      readonly: false"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
 level=info msg="alertAcknowledgement:"
 level=info msg="  enabled: false"
 level=info msg="  duration: 15m0s"
@@ -74,15 +74,15 @@ level=info msg="  strip: []"
 level=info msg="  color:"
 level=info msg="    custom:"
 level=info msg="      region:"
-level=info msg="      - value_re: .*"
-level=info msg="        color: '#736598'"
+level=info msg="        - value_re: .*"
+level=info msg="          color: '#736598'"
 level=info msg="      severity:"
-level=info msg="      - value: P3"
-level=info msg="        color: '#87c4e0'"
-level=info msg="      - value: P2"
-level=info msg="        color: '#ffae42'"
-level=info msg="      - value: P1"
-level=info msg="        color: '#ff220c'"
+level=info msg="        - value: P3"
+level=info msg="          color: '#87c4e0'"
+level=info msg="        - value: P2"
+level=info msg="          color: '#ffae42'"
+level=info msg="        - value: P1"
+level=info msg="          color: '#ff220c'"
 level=info msg="    static: []"
 level=info msg="    unique: []"
 level=info msg="listen:"
diff --git a/cmd/karma/tests/testscript/097_proxy_url_config.txt b/cmd/karma/tests/testscript/097_proxy_url_config.txt
index 7eae3358b..69e10a1ee 100644
--- a/cmd/karma/tests/testscript/097_proxy_url_config.txt
+++ b/cmd/karma/tests/testscript/097_proxy_url_config.txt
@@ -20,25 +20,25 @@ level=info msg="    silences: \"\""
 level=info msg="alertmanager:"
 level=info msg="  interval: 1m0s"
 level=info msg="  servers:"
-level=info msg="  - cluster: \"\""
-level=info msg="    name: socks5_proxy"
-level=info msg="    uri: http://127.0.0.1"
-level=info msg="    external_uri: \"\""
-level=info msg="    proxy_url: socks5://local.proxy:1080"
-level=info msg="    timeout: 40s"
-level=info msg="    proxy: false"
-level=info msg="    readonly: false"
-level=info msg="    tls:"
-level=info msg="      ca: \"\""
-level=info msg="      cert: \"\""
-level=info msg="      key: \"\""
-level=info msg="      insecureSkipVerify: false"
-level=info msg="    headers: {}"
-level=info msg="    cors:"
-level=info msg="      credentials: include"
-level=info msg="    healthcheck:"
-level=info msg="      visible: false"
-level=info msg="      filters: {}"
+level=info msg="    - cluster: \"\""
+level=info msg="      name: socks5_proxy"
+level=info msg="      uri: http://127.0.0.1"
+level=info msg="      external_uri: \"\""
+level=info msg="      proxy_url: socks5://local.proxy:1080"
+level=info msg="      timeout: 40s"
+level=info msg="      proxy: false"
+level=info msg="      readonly: false"
+level=info msg="      tls:"
+level=info msg="        ca: \"\""
+level=info msg="        cert: \"\""
+level=info msg="        key: \"\""
+level=info msg="        insecureSkipVerify: false"
+level=info msg="      headers: {}"
+level=info msg="      cors:"
+level=info msg="        credentials: include"
+level=info msg="      healthcheck:"
+level=info msg="        visible: false"
+level=info msg="        filters: {}"
 level=info msg="alertAcknowledgement:"
 level=info msg="  enabled: false"
 level=info msg="  duration: 15m0s"
diff --git a/go.mod b/go.mod
index 0833ee354..87c062c12 100644
--- a/go.mod
+++ b/go.mod
@@ -34,5 +34,5 @@ require (
 	golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57 // indirect
 	golang.org/x/text v0.3.6 // indirect
 	gopkg.in/go-playground/colors.v1 v1.2.0
-	gopkg.in/yaml.v2 v2.4.0
+	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
 )
diff --git a/internal/config/acl.go b/internal/config/acl.go
index 9f9215ad8..badacb274 100644
--- a/internal/config/acl.go
+++ b/internal/config/acl.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"os"
 
-	yaml "gopkg.in/yaml.v2"
+	yaml "gopkg.in/yaml.v3"
 )
 
 type SilenceMatcher struct {
@@ -47,12 +47,14 @@ type silencesACLSchema struct {
 func ReadSilenceACLConfig(path string) (*silencesACLSchema, error) {
 	cfg := silencesACLSchema{}
 
-	f, err := os.ReadFile(path)
+	f, err := os.Open(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load silence ACL configuration file %q: %v", path, err)
 	}
 
-	err = yaml.UnmarshalStrict(f, &cfg)
+	d := yaml.NewDecoder(f)
+	d.KnownFields(true)
+	err = d.Decode(&cfg)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse silence ACL configuration file %q: %v", path, err)
 	}
diff --git a/internal/config/config.go b/internal/config/config.go
index f1d5c27af..0cd0f218c 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -22,7 +22,7 @@ import (
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/pflag"
 
-	yaml "gopkg.in/yaml.v2"
+	yaml "gopkg.in/yaml.v3"
 )
 
 var (
@@ -131,13 +131,15 @@ func SetupFlags(f *pflag.FlagSet) {
 }
 
 func validateConfigFile(path string) error {
-	f, err := os.ReadFile(path)
+	f, err := os.Open(path)
 	if err != nil {
 		return err
 	}
 
 	cfg := configSchema{}
-	err = yaml.UnmarshalStrict(f, &cfg)
+	d := yaml.NewDecoder(f)
+	d.KnownFields(true)
+	err = d.Decode(&cfg)
 	if err != nil {
 		return err
 	}
@@ -427,9 +429,13 @@ func (config *configSchema) LogValues() {
 		config.Sentry.Private = uri.SanitizeURI(config.Sentry.Private)
 	}
 
-	out, _ := yaml.Marshal(cfg)
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	_ = enc.Encode(cfg)
+
 	log.Info().Msg("Parsed configuration:")
-	scanner := bufio.NewScanner(bytes.NewReader(out))
+	scanner := bufio.NewScanner(&buf)
 	for scanner.Scan() {
 		log.Info().Msg(scanner.Text())
 	}
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 001beae38..edde22152 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -1,6 +1,8 @@
 package config
 
 import (
+	"bytes"
+	"io"
 	"os"
 	"testing"
 	"time"
@@ -12,7 +14,7 @@ import (
 
 	"github.com/pmezard/go-difflib/difflib"
 
-	yaml "gopkg.in/yaml.v2"
+	yaml "gopkg.in/yaml.v3"
 )
 
 func resetEnv() {
@@ -33,25 +35,25 @@ authorization:
 alertmanager:
   interval: 1s
   servers:
-  - cluster: ""
-    name: default
-    uri: http://localhost
-    external_uri: http://example.com
-    proxy_url: ""
-    timeout: 40s
-    proxy: false
-    readonly: false
-    tls:
-      ca: ""
-      cert: ""
-      key: ""
-      insecureSkipVerify: false
-    headers: {}
-    cors:
-      credentials: include
-    healthcheck:
-      visible: false
-      filters: {}
+    - cluster: ""
+      name: default
+      uri: http://localhost
+      external_uri: http://example.com
+      proxy_url: ""
+      timeout: 40s
+      proxy: false
+      readonly: false
+      tls:
+        ca: ""
+        cert: ""
+        key: ""
+        insecureSkipVerify: false
+      headers: {}
+      cors:
+        credentials: include
+      healthcheck:
+        visible: false
+        filters: {}
 alertAcknowledgement:
   enabled: false
   duration: 15m0s
@@ -62,7 +64,7 @@ annotations:
     hidden: true
   hidden: []
   visible:
-  - summary
+    - summary
   keep: []
   strip: []
   order: []
@@ -73,8 +75,8 @@ custom:
 debug: true
 filters:
   default:
-  - '@state=active'
-  - foo=bar
+    - '@state=active'
+    - foo=bar
 grid:
   sorting:
     order: startsAt
@@ -86,20 +88,20 @@ karma:
   name: another karma
 labels:
   keep:
-  - foo
-  - bar
+    - foo
+    - bar
   strip:
-  - abc
-  - def
+    - abc
+    - def
   color:
     custom: {}
     static:
-    - a
-    - bb
-    - ccc
+      - a
+      - bb
+      - ccc
     unique:
-    - f
-    - gg
+      - f
+      - gg
 listen:
   address: 0.0.0.0
   timeout:
@@ -142,10 +144,14 @@ ui:
   multiGridSortReverse: false
 `
 
-	configDump, err := yaml.Marshal(Config)
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	err := enc.Encode(Config)
 	if err != nil {
 		t.Error(err)
 	}
+	configDump, _ := io.ReadAll(&buf)
 
 	if string(configDump) != expectedConfig {
 		diff := difflib.UnifiedDiff{