Skip to main content

What is kwatch? Kubernetes incidents, explained

· 2 min read
Abdelrahman Ahmed
Abdelrahman Ahmed
Owner of kwatch

See what broke. Understand why. Know what to do next. 👀🧠⚡

Kubernetes gives teams a powerful way to run applications, but a failed pod or stalled rollout can leave you with a short status such as CrashLoopBackOff and not enough context to act quickly.

kwatch watches Kubernetes resources, events, and recent logs. When something needs attention, it groups related symptoms and sends an alert with the likely cause, impact, evidence, and a practical next step.

What kwatch watches​

  • Pod crashes, restart loops, and containers that are not ready
  • Nodes, scheduling delays, rollouts, StatefulSets, DaemonSets, Jobs, and CronJobs
  • HPA pressure, PVC usage, service endpoints, ingress backends, and control-plane signals
  • Optional TLS expiry checks, active probes, heartbeat notifications, and runtime telemetry

It runs as a small workload inside your cluster. You do not need Prometheus or a separate dashboard to receive the first useful alert.

What an alert contains​

Instead of only receiving OOMKilled, a notification can explain which workload was affected, include recent evidence, connect related symptoms, and point to the next thing to check. Alerts can be delivered to Slack, PagerDuty, Discord, email, webhooks, and dozens of other providers.

Try it​

The supported installation path is the interactive kwatch.sh manager. It creates the Kubernetes Secret, configures the selected provider, and installs the matching release resources:

/bin/bash -c "$(curl -fsSL https://kwatch.dev/kwatch.sh)"

Read the getting started guide for the shortest path to a working cluster, or explore the complete configuration reference when you want to tune monitors and alert routing.