Skip to main content

Kubernetes incidents, explained

Early access: kwatch Pro is free

See what broke.Understand why.Know what to do next.

kwatch is the on-call teammate for your Kubernetes cluster. It finds the one thing that caused a failure and tells your team in plain words, with the command to run next.

Install with kwatch.sh Get Pro free (early access) 
/bin/bash -c "$(curl -fsSL https://kwatch.dev/kwatch.sh)"
Runs in your cluster50+ alert providersSource available
Example incidentHigh severity

OOMKilled

production / orders-api

Pod: orders-api-7ffc9d4f9-x9p4t · Node: worker-3

Likely cause

The container exceeded its 512Mi memory limit.

Next step

Increase limits.memory or reduce memory usage.

Recent logs and Kubernetes events add context to the alert.

How it works

Understand the incident without piecing it together yourself

Kubernetes shows symptoms. kwatch connects the story so your team can decide what needs attention.

01

Watch

kwatch keeps a live map of your cluster: every object, how they connect, and what changed.

02

Detect

It spots crash loops, unready nodes, stuck workloads and other unhealthy signals.

03

Explain

It follows each failure upstream to the one cause that explains the rest.

04

Tell

One message per cause, in the channel you already use. Updated only on news, closed once fixed.

Coverage

Start with common failures. Add checks as you grow.

Community covers the everyday incidents. Pro adds the wider detectors, and opt-in heartbeat, TLS checks and active probes.

Pods and scheduling

Crashes, OOM kills, restarts and pending Pods in Community. Readiness checks in Pro.

Workloads

Rollouts, Jobs, CronJobs, autoscaling and availability. Part of Pro.

Infrastructure and storage

Node NotReady in Community. Node pressure, persistent storage and the control plane in Pro.

Networking and security

RBAC findings in Community. Services, Ingress, webhooks, TLS and quota in Pro.

Explore everything kwatch monitors

What you receive

One message with the cause, not twenty alerts.

Real messages, written for people. One emoji tells you how urgent it is: 🔴 page · 🟠 notify · 🟡 low · ✅ resolved.

A bad release, in one messagePro
🔴 api is down in shop (prod-eu-1)
after the 14:02 release of api:2.3. alice
released it; the previous image was
api:2.2. Only pods of the new
revision fail. Service api and
ingress storefront can't serve traffic.
checkout is affected as well. Rolling
back fixes it (changes the cluster):
kubectl rollout undo deployment/api
-n shop --to-revision=13

Twenty crash-loop and readiness alerts become one incident that names the release, who shipped it, what else is hit and the fix.

A database outside the clusterPro
🟠 api in shop (prod-eu-1) keeps crashing
because external endpoint
db.example.com:5432 refuses connections.
It fails with "dial tcp
db.example.com:5432: connect: connection
refused". Every error mentions it.
cart, search, auth and one other are
affected as well. To read the output of
the last crash, run
kubectl logs api-6d4f-0 -c app -n shop --previous

When five apps fail because the database is down, kwatch blames the database, not the apps.

A lost nodeCommunity
🔴 Node n1 (prod-eu-1) has not reported
for about two minutes. It reports
"Kubelet stopped posting node status".
To check the node's conditions and
recent events, run
kubectl describe node n1

Community names the failure and the command to check it.

When it is fixed you hear about it once: ✅ api in shop (prod-eu-1) is healthy again. It was down for eight minutes.

See how alerts are built
Early access: kwatch Pro is free

Free to run. Pro when you need the proof.

Community covers the failures that page you most and is free forever. Pro adds the depth for production teams and is free during early access.

Community

Free forever. No account, no key.

  • Pod crashes, OOM kills and Pending pods
  • Node NotReady
  • Root-cause headline on every incident
  • Dedup, namespace filters and silences
  • 1 alert provider
Install kwatch

Pro

Free during early access. 3-month licenses, may be renewed.

  • Everything in Community
  • Rollouts, storage, network, certificates, control plane and more
  • Full proof, who changed what, impact and log excerpts
  • Routing, threads, templates and runbooks
  • State kept across restarts, standby replicas, flight recorder
Get Pro free
Compare Community and Pro

Get started

From command to useful alerts.

The interactive kwatch.sh manager guides installation, channel setup, and verification. You need Bash, curl, kubectl, and cluster install permissions.

Install kwatchRecommended

Run the manager on a machine with access to your cluster.

/bin/bash -c "$(curl -fsSL https://kwatch.dev/kwatch.sh)"

Run it again to change settings, upgrade, check status, or uninstall.

01

Choose your cluster

The manager shows the current kubectl context before installing.

02

Connect a channel

It stores credentials in a Kubernetes Secret.

03

Verify the install

It checks the deployment before you start monitoring.

04

Add Pro (optional)

Choose License / Pro and paste your free early-access key.

Read the installation guide
Built for production

One small pod with read-only access and its state on a volume. If it or its node fails, Kubernetes restarts it and kwatch resumes. Standby replicas for high availability are part of Pro.

How recovery works

Notifications

Send alerts where your team works.

Connect a familiar destination first. Choose from 50+ integrations when your team needs more routes.

See all channels
Slack Discord Microsoft Teams PagerDuty Email Webhook

Why teams trust it

Built to be safe to leave running.

  • Runs in your cluster

    One small pod with read-only access. There is no hosted service to sign up for.

  • Nothing leaves but alerts

    Cluster data goes only to the providers you configure. A Pro key adds one hashed license check: a hashed cluster id, the version and the node count.

    Privacy policy

  • 50+ alert providers

    Slack, Teams, Discord, PagerDuty, Opsgenie, email, webhooks and more.

    All channels

  • Source available

    Read and change the code under the Elastic License 2.0. Releases up to v1.0.0-rc.10 are MIT.

    Licensing

Questions, answered

Is kwatch open source?

kwatch is source available under the Elastic License 2.0. You can run it for free in your own clusters, read and change the code, and share it. You may not offer it as a hosted service. Releases up to v1.0.0-rc.10 are MIT.

What does Community include?

Pod crash, OOM and Pending detection, node NotReady, a root-cause headline, basic dedup, namespace filters and silences, and one alert provider. It is free forever and needs no account.

Is Pro really free?

During early access, yes. Each license runs 3 months and may be renewed, for up to 2 clusters per account (per company domain for work emails). We ask for no payment details. When a license ends, kwatch falls back to Community and alerting never stops.

What leaves my cluster?

Alerts, to the providers you configure. With a Pro key kwatch also renews its license by sending a hashed cluster id, its version and the node count. A Community install without a key makes no license calls.

How do I install it?

Run the kwatch.sh installer. It asks which cluster and channel to use, stores credentials in a Kubernetes Secret and checks the install. See the installation guide.

More in the editions page and the license docs.

Know what to do next, in about five minutes.

Run one command, pick a channel, and the next time something breaks you get the cause and the fix.

Install with kwatch.sh Get Pro free (early access)