AutomationFlowsAI & RAG › Kubernetes Rca and Alerting Using Gemini, Loki, Prometheus, Slack

Kubernetes Rca and Alerting Using Gemini, Loki, Prometheus, Slack

ByJohn Pranay Kumar Reddy @johnpranay on n8n.io

This n8n workflow automates Kubernetes root cause analysis (RCA) and incident alerting by integrating with Loki, Prometheus, and Slack. It streamlines log collection, cluster health monitoring, and AI-driven RCA with Gemini, saving DevOps teams hours of manual troubleshooting.…

Cron / scheduled trigger★★★★★ complexity36 nodesHTTP RequestSsh
AI & RAG Trigger: Cron / scheduled Nodes: 36 Complexity: ★★★★★ Added:

This workflow corresponds to n8n.io template #7953 — we link there as the canonical source.

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

Download .json
{
  "id": "6Xz3moSgARolXX0F",
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "name": "RCA Final Kubs",
  "tags": [],
  "nodes": [
    {
      "id": "894f382a-75d5-437a-a8f3-e7516114833f",
      "name": "Schedule Trigger1",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        -340,
        460
      ],
      "parameters": {},
      "typeVersion": 1.2
    },
    {
      "id": "37e8b6c4-33a5-486a-8b6f-7e6a73406894",
      "name": "Google Gemini1",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        2080,
        460
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "1b2c607c-c3e1-4657-b8cc-8efd7cffa20f",
      "name": "\ud83d\udce4 Send Alerts to Slack",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        3400,
        460
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "4a8399c9-4c08-4148-a805-414ae254e7b4",
      "name": "Kubernetes Documentation",
      "type": "n8n-nodes-base.code",
      "position": [
        2440,
        460
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "ae4170c7-6dbb-46de-a816-60d00e62400a",
      "name": "Loki",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        40,
        -20
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "1c535983-cdff-4f55-b4e7-a619d1ce71cb",
      "name": "Formatting the Output to send to Slack",
      "type": "n8n-nodes-base.code",
      "position": [
        2760,
        460
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "990281d4-f853-45b8-aaa9-1cd571f7ce14",
      "name": "SSH1",
      "type": "n8n-nodes-base.ssh",
      "onError": "continueRegularOutput",
      "position": [
        260,
        -20
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "92977804-5cae-41f9-b2bb-6ffe1ce024a2",
      "name": "PromQL: Current endpoints",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        40,
        280
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "81fc6a84-f7f4-4f9c-beae-89b2cbba68d4",
      "name": "PromQL: Endpoints 5m ago",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        40,
        520
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "71af4d47-27c4-41b6-b535-aed367a53305",
      "name": "Merge",
      "type": "n8n-nodes-base.merge",
      "position": [
        740,
        420
      ],
      "parameters": {},
      "typeVersion": 3.2
    },
    {
      "id": "f85addc7-0a1c-4d54-baf3-729b286ae6b7",
      "name": "Pods Not Ready",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        60,
        940
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "24d1403c-0c83-402d-8f22-eafdb2875d42",
      "name": "Pod Restart Spike (last 5m)",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        60,
        1420
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "0cf309d2-44cd-4535-b2c5-60e6bb8c11fb",
      "name": "Map Prometheus results into namespace/service",
      "type": "n8n-nodes-base.code",
      "position": [
        380,
        280
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "9d7427c6-6e80-4af3-b20a-8004bb096ba9",
      "name": "Map Prometheus results into namespace/service1",
      "type": "n8n-nodes-base.code",
      "position": [
        380,
        520
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "83e336f2-ceec-4826-a5d4-3e233d972cef",
      "name": "Merge2",
      "type": "n8n-nodes-base.merge",
      "position": [
        1380,
        400
      ],
      "parameters": {},
      "typeVersion": 3.2
    },
    {
      "id": "1f3ef621-87d9-4b79-be7a-348b3e76cbf1",
      "name": "Batch",
      "type": "n8n-nodes-base.code",
      "position": [
        3080,
        460
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "24df9266-1e37-4a6f-9f07-124d1b027d40",
      "name": "Pods Pending",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        40,
        720
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "6a6adf6e-1534-4f7c-9959-6fc8a127ebd8",
      "name": "Pods Pending State",
      "type": "n8n-nodes-base.code",
      "position": [
        380,
        720
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "93e63303-24a0-4345-a7aa-510a1d4f187a",
      "name": "Endpoints",
      "type": "n8n-nodes-base.code",
      "position": [
        960,
        420
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "27337d2a-9323-4d0f-b857-10076f573714",
      "name": "If(Excludes Pods which are terminated already)",
      "type": "n8n-nodes-base.if",
      "position": [
        540,
        -20
      ],
      "parameters": {},
      "typeVersion": 2.2
    },
    {
      "id": "0615fd51-2ab4-46c7-931c-b9a7c1131a99",
      "name": "Loki Error Logs",
      "type": "n8n-nodes-base.code",
      "position": [
        920,
        100
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "3f5c4994-492a-4bab-aa1a-a1fef6770d35",
      "name": "Pods Not Ready State",
      "type": "n8n-nodes-base.code",
      "position": [
        380,
        940
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "05b42569-3de4-42fb-8787-7e41a28d2a68",
      "name": "Termination State",
      "type": "n8n-nodes-base.code",
      "position": [
        380,
        1160
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "8ea5f243-3d9f-496a-99d9-68c13bad3d2e",
      "name": "CrashLoopBackOff",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        80,
        1160
      ],
      "parameters": {},
      "typeVersion": 4.2
    },
    {
      "id": "ee720f0d-7388-4ab9-bf05-86f181d63fff",
      "name": "Build Prompt for Gemini",
      "type": "n8n-nodes-base.code",
      "position": [
        1700,
        460
      ],
      "parameters": {},
      "typeVersion": 2
    },
    {
      "id": "9ca008ac-9635-4114-9bf9-86f9467f731d",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -480,
        660
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "93acc0af-3a40-45ab-a361-245332d300e9",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -60,
        -200
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "1a61eca7-a13e-4171-87f3-52a3d08699d6",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        260,
        -220
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "196db7ab-678e-4a59-81c4-96502eeb0cd1",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1640,
        660
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "7fb88515-a6cf-499d-8bfc-05915a2525e9",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2020,
        660
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "54885f27-44b7-4edf-ba75-2d75decbf88a",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2360,
        660
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "4ad6e136-35f1-4411-b77f-2d75a89b32e3",
      "name": "Sticky Note6",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2700,
        660
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "b8593d6d-a1ed-4beb-84aa-5ec26ecfaf08",
      "name": "Sticky Note7",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        3020,
        660
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "aa542446-9a34-40b4-bbcc-3a0c015ec03f",
      "name": "Sticky Note8",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        3360,
        660
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "6374494a-9f96-4ed5-aff9-72548a376749",
      "name": "Sticky Note9",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1280,
        740
      ],
      "parameters": {
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "961e83f7-7807-46a3-bd19-d6033dbe99a8",
      "name": "Pod Restart Count State",
      "type": "n8n-nodes-base.code",
      "position": [
        400,
        1420
      ],
      "parameters": {},
      "typeVersion": 2
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "c8226a72-20d4-4f35-9e9e-8eaa5e818ff6",
  "connections": {
    "Loki": {
      "main": [
        [
          {
            "node": "SSH1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "SSH1": {
      "main": [
        [
          {
            "node": "If(Excludes Pods which are terminated already)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Batch": {
      "main": [
        [
          {
            "node": "\ud83d\udce4 Send Alerts to Slack",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge": {
      "main": [
        [
          {
            "node": "Endpoints",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge2": {
      "main": [
        [
          {
            "node": "Build Prompt for Gemini",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Endpoints": {
      "main": [
        [
          {
            "node": "Merge2",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Pods Pending": {
      "main": [
        [
          {
            "node": "Pods Pending State",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Google Gemini1": {
      "main": [
        [
          {
            "node": "Kubernetes Documentation",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Pods Not Ready": {
      "main": [
        [
          {
            "node": "Pods Not Ready State",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Loki Error Logs": {
      "main": [
        [
          {
            "node": "Merge2",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "CrashLoopBackOff": {
      "main": [
        [
          {
            "node": "Termination State",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Schedule Trigger1": {
      "main": [
        [
          {
            "node": "Loki",
            "type": "main",
            "index": 0
          },
          {
            "node": "PromQL: Current endpoints",
            "type": "main",
            "index": 0
          },
          {
            "node": "PromQL: Endpoints 5m ago",
            "type": "main",
            "index": 0
          },
          {
            "node": "Pods Not Ready",
            "type": "main",
            "index": 0
          },
          {
            "node": "CrashLoopBackOff",
            "type": "main",
            "index": 0
          },
          {
            "node": "Pod Restart Spike (last 5m)",
            "type": "main",
            "index": 0
          },
          {
            "node": "Pods Pending",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Termination State": {
      "main": [
        [
          {
            "node": "Merge2",
            "type": "main",
            "index": 4
          }
        ]
      ]
    },
    "Pods Pending State": {
      "main": [
        [
          {
            "node": "Merge2",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Pods Not Ready State": {
      "main": [
        [
          {
            "node": "Merge2",
            "type": "main",
            "index": 3
          }
        ]
      ]
    },
    "Build Prompt for Gemini": {
      "main": [
        [
          {
            "node": "Google Gemini1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Pod Restart Count State": {
      "main": [
        [
          {
            "node": "Merge2",
            "type": "main",
            "index": 5
          }
        ]
      ]
    },
    "Kubernetes Documentation": {
      "main": [
        [
          {
            "node": "Formatting the Output to send to Slack",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "PromQL: Endpoints 5m ago": {
      "main": [
        [
          {
            "node": "Map Prometheus results into namespace/service1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "PromQL: Current endpoints": {
      "main": [
        [
          {
            "node": "Map Prometheus results into namespace/service",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Pod Restart Spike (last 5m)": {
      "main": [
        [
          {
            "node": "Pod Restart Count State",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Formatting the Output to send to Slack": {
      "main": [
        [
          {
            "node": "Batch",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Map Prometheus results into namespace/service": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "If(Excludes Pods which are terminated already)": {
      "main": [
        [
          {
            "node": "Loki Error Logs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Map Prometheus results into namespace/service1": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    }
  }
}
Pro

For the full experience including quality scoring and batch install features for each workflow upgrade to Pro

About this workflow

This n8n workflow automates Kubernetes root cause analysis (RCA) and incident alerting by integrating with Loki, Prometheus, and Slack. It streamlines log collection, cluster health monitoring, and AI-driven RCA with Gemini, saving DevOps teams hours of manual troubleshooting.…

Source: https://n8n.io/workflows/7953/ — original creator credit. Request a take-down →

More AI & RAG workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.

AI & RAG

Automate UniFi Controller updates on self-hosted instances. This workflow checks the official UniFi Debian repo for a fresh release in the last 24 hours and, if found, upgrades the package via SSH. It

HTTP Request, Ssh, OpenAI +1
AI & RAG

Free Support: Setting up and getting the workflow tailord to your needs. One small free adjustment included.

HTTP Request, Google Cloud Storage, YouTube +2
AI & RAG

This workflow aims to help you and your team track your expenses with OpenAI It automatically collects your OpenAI organization’s API usage and cost data every few days and saves it to a ready-to-use

HTTP Request, Google Sheets
AI & RAG

Keep your leadership team informed with a data-driven, automated morning briefing. This workflow pulls live metrics from HubSpot, Zendesk, and Pipedrive, then uses AI and Neural TTS to generate a prof

HTTP Request, N8N Nodes Uploadtourl
AI & RAG

Automatically fetch, rank, and summarize the top financial stories from curated RSS feeds each day, then deliver a concise AI-written digest to Telegram and log the run to Google Sheets. Runs on a dai

Google Sheets, HTTP Request, RSS Feed Read