Build a Slack ChatOps Bot for Kubernetes Alerts Using Claude API (2026)

mkdir k8s-alertbot && cd k8s-alertbot
npm init -y
npm install @slack/web-api @anthropic-ai/sdk express @kubernetes/client-node

const express = require('express')
const { WebClient } = require('@slack/web-api')
const Anthropic = require('@anthropic-ai/sdk')
const k8s = require('@kubernetes/client-node')
 
const app = express()
app.use(express.json())
 
const slack = new WebClient(process.env.SLACK_BOT_TOKEN)
const claude = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY })
 
// Kubernetes client (in-cluster config when running in K8s)
const kc = new k8s.KubeConfig()
kc.loadFromDefault()   // uses in-cluster ServiceAccount if in K8s, else ~/.kube/config
const coreApi = kc.makeApiClient(k8s.CoreV1Api)
 
// Fetch pod details for context
async function getPodContext(namespace, podName) {
  try {
    const pod = await coreApi.readNamespacedPod(podName, namespace)
    const p = pod.body
    return {
      name: p.metadata.name,
      namespace: p.metadata.namespace,
      phase: p.status.phase,
      containers: p.status.containerStatuses?.map(c => ({
        name: c.name,
        ready: c.ready,
        restartCount: c.restartCount,
        state: JSON.stringify(c.state)
      })) || [],
      conditions: p.status.conditions?.map(c => `${c.type}=${c.status}`).join(', ') || 'none',
      nodeName: p.spec.nodeName
    }
  } catch (e) {
    return { error: `Could not fetch pod: ${e.message}` }
  }
}
 
// Ask Claude to explain alert and suggest fixes
async function explainAlert(alertName, labels, annotations, podContext) {
  const prompt = `
You are a Kubernetes SRE assistant. An alert just fired.
 
Alert: ${alertName}
Labels: ${JSON.stringify(labels, null, 2)}
Annotations: ${JSON.stringify(annotations, null, 2)}
 
${podContext.error ? `Pod fetch failed: ${podContext.error}` : `
Pod context:
- Phase: ${podContext.phase}
- Node: ${podContext.nodeName}
- Containers: ${JSON.stringify(podContext.containers, null, 2)}
- Conditions: ${podContext.conditions}
`}
 
Provide:
1. **What happened** — 1-2 sentence plain English explanation
2. **Most likely causes** — top 3 causes with probability
3. **Immediate fix commands** — exact kubectl commands to diagnose and fix
4. **Escalate if** — when to wake up a senior engineer
 
Keep it concise. Use code blocks for commands.
`
 
  const response = await claude.messages.create({
    model: 'claude-opus-4-6',
    max_tokens: 800,
    messages: [{ role: 'user', content: prompt }]
  })
 
  return response.content[0].text
}
 
// Alertmanager webhook handler
app.post('/webhook', async (req, res) => {
  res.sendStatus(200)  // respond immediately to Alertmanager
 
  const { alerts } = req.body
  
  for (const alert of alerts) {
    if (alert.status !== 'firing') continue
 
    const { alertname, namespace, pod } = alert.labels
    const channel = process.env.SLACK_CHANNEL || '#alerts'
 
    try {
      // Get pod context if available
      let podContext = {}
      if (namespace && pod) {
        podContext = await getPodContext(namespace, pod)
      }
 
      // Get Claude's analysis
      const analysis = await explainAlert(
        alertname,
        alert.labels,
        alert.annotations,
        podContext
      )
 
      // Post to Slack with rich formatting
      await slack.chat.postMessage({
        channel,
        text: `🚨 Alert: ${alertname}`,
        blocks: [
          {
            type: 'header',
            text: { type: 'plain_text', text: `🚨 ${alertname}` }
          },
          {
            type: 'section',
            fields: [
              { type: 'mrkdwn', text: `*Namespace:*\n${namespace || 'N/A'}` },
              { type: 'mrkdwn', text: `*Pod:*\n${pod || 'N/A'}` },
              { type: 'mrkdwn', text: `*Severity:*\n${alert.labels.severity || 'unknown'}` },
              { type: 'mrkdwn', text: `*Started:*\n${new Date(alert.startsAt).toLocaleString()}` }
            ]
          },
          {
            type: 'divider'
          },
          {
            type: 'section',
            text: { type: 'mrkdwn', text: `*🤖 AI Analysis:*\n${analysis}` }
          },
          {
            type: 'context',
            elements: [
              { type: 'mrkdwn', text: `📊 <${alert.generatorURL}|View in Prometheus>` }
            ]
          }
        ]
      })
 
      console.log(`Alert ${alertname} sent to ${channel}`)
    } catch (err) {
      console.error('Error processing alert:', err)
    }
  }
})
 
app.get('/health', (req, res) => res.json({ status: 'ok' }))
 
app.listen(3000, () => console.log('Alert bot listening on :3000'))

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8s-alertbot
  namespace: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app: k8s-alertbot
  template:
    metadata:
      labels:
        app: k8s-alertbot
    spec:
      serviceAccountName: alertbot-sa
      containers:
      - name: alertbot
        image: your-registry/k8s-alertbot:latest
        ports:
        - containerPort: 3000
        env:
        - name: SLACK_BOT_TOKEN
          valueFrom:
            secretKeyRef:
              name: alertbot-secrets
              key: slack-token
        - name: ANTHROPIC_API_KEY
          valueFrom:
            secretKeyRef:
              name: alertbot-secrets
              key: anthropic-key
        - name: SLACK_CHANNEL
          value: "#ops-alerts"
        resources:
          limits:
            cpu: 200m
            memory: 256Mi
 
---
apiVersion: v1
kind: Service
metadata:
  name: k8s-alertbot
  namespace: monitoring
spec:
  selector:
    app: k8s-alertbot
  ports:
  - port: 3000
    targetPort: 3000
 
---
# RBAC: bot needs to read pods
apiVersion: v1
kind: ServiceAccount
metadata:
  name: alertbot-sa
  namespace: monitoring
 
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: alertbot-reader
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "nodes", "events"]
  verbs: ["get", "list"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list"]
 
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: alertbot-reader
subjects:
- kind: ServiceAccount
  name: alertbot-sa
  namespace: monitoring
roleRef:
  kind: ClusterRole
  name: alertbot-reader
  apiGroup: rbac.authorization.k8s.io

# Create secrets
kubectl create secret generic alertbot-secrets \
  --from-literal=slack-token=xoxb-your-token \
  --from-literal=anthropic-key=sk-ant-your-key \
  -n monitoring
 
kubectl apply -f deployment.yaml

# alertmanager.yaml
route:
  receiver: 'slack-bot'
  group_by: ['alertname', 'namespace']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 4h
 
receivers:
- name: 'slack-bot'
  webhook_configs:
  - url: 'http://k8s-alertbot.monitoring:3000/webhook'
    send_resolved: false

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --production
COPY bot.js .
EXPOSE 3000
CMD ["node", "bot.js"]

docker build -t your-registry/k8s-alertbot:latest .
docker push your-registry/k8s-alertbot:latest