Kubernetes Incident Triage with Claude + Slack Approval Workflow

Automate Kubernetes incident triage with Claude + Slack approvals

This n8n workflow turns incoming Kubernetes failure alerts into structured diagnostics, asks Anthropic Claude for a remediation proposal, and—when risk requires it—routes the action to Slack for approval before executing. It then verifies recovery and closes or escalates the incident.

What this workflow does

• Receives Kubernetes failure alerts via a webhook (or supports manual runs for testing). It normalizes the target cluster, namespace, and resource details.
• Collects diagnostics using a kubectl wrapper API, including recent events, logs, resource usage, and workload state for the affected resource.
• Uses Claude to propose remediation by sending the diagnostic snapshot to Anthropic Claude, which returns a root-cause hypothesis and a single proposed remediation action with a Safe vs NeedsApproval risk level.
• Executes or seeks approval: if the remediation is marked Safe and is on the allowlist, the workflow executes it via a Kubernetes action wrapper API. Otherwise, it posts the proposal to Slack and waits for an approval response.
• Verifies stabilization after execution by waiting, re-collecting diagnostics, and asking Claude to confirm whether the original symptoms are resolved.
• Closes or escalates: logs resolution to an incident log API when the cluster is healthy, or escalates the full context to a Slack escalation channel when it isn’t.

Use cases

• Reduce MTTR by converting Alertmanager/Kubernetes alerts into actionable remediation steps with guardrails.
• Require human approval for NeedsApproval actions to prevent unsafe cluster changes.
• Provide consistent incident closure by re-checking health and symptom resolution after remediation.

Technical details

• n8n nodes: if, set, code, wait, slack, webhook
• Integrations: Slack for approval and escalation, kubectl wrapper API for diagnostics, Kubernetes action wrapper API for remediation execution, incident log API for closure
• AI: Anthropic Claude (configure the Claude credential and model selection if needed)
• Auth: create HTTP Header Auth as required