Skip to main content

Detect Kubernetes crashes with kwatch and Slack

· 3 min read
Andrew Attallah
Andrew Attallah
Maintainer of kwatch

When a Kubernetes workload restarts, a Slack notification is useful only if it helps you decide what to do next. kwatch turns crash signals, events, and recent logs into a focused incident message.

This guide shows how to connect Slack and install kwatch with the supported interactive manager. The manager keeps the webhook in a Kubernetes Secret; do not paste it directly into config.yaml.

1. Create a Slack incoming webhook​

Create or choose the channel where you want incidents to arrive, then create an incoming webhook from the Slack API app settings. The screenshots below follow the Slack setup flow used by the original guide.

Create a Slack channel

Create a Slack app

Enable an incoming webhook

Choose the Slack channel for the webhook

Copy the webhook URL. Treat it as a credential and keep it out of shell history, Git, and plain YAML files.

2. Install kwatch with kwatch.sh​

Run the manager from a machine with kubectl access to your cluster:

/bin/bash -c "$(curl -fsSL https://kwatch.dev/kwatch.sh)"

Choose Configure notification, select Slack, and paste the webhook when the manager asks for it. It writes a Secret-backed file reference such as:

alert:
  slack:
    webhook: "${file:/config/slack-webhook}"

The manager then installs the release, waits for the workload to become ready, and sends a startup notification. Run the interactive manager again whenever you want to inspect or manage the installation.

3. Test the notification​

Use kwatch lint --check for provider validation where supported. For a real message, enable healthCheck.diagnostics in the configuration and call the /test-alert endpoint. See the Slack channel guide for bot-token mode, routing, retry, and fallback options.

kwatch startup notification in Slack

When a workload fails, kwatch sends the incident reason and available evidence to the configured channel:

kwatch Kubernetes crash alert in Slack

Next steps​

Add routes if Slack should receive only production or high-severity incidents, or configure a fallback provider for delivery failures. The complete provider reference lists every supported alert field.

If you like kwatch, give it a star on GitHub and share feedback in Discord or the issue tracker.