RobustaDev

Comprehensive guide for Robusta - the SRE agent that transforms Kubernetes alerts into actionable insights using playbooks, AI investigation, and automated remediation.

Quick Reference

Workflow Routing

Installation Quick Start

Prerequisites

• Kubernetes cluster
• Helm 3.x installed
• kubectl configured

All-in-One Installation (Robusta + Prometheus)

# Generate configuration
pipx run robusta-cli gen-config --enable-prometheus-stack

# Or using Docker
curl -fsSL -o robusta https://docs.robusta.dev/master/_static/robusta
chmod +x robusta
./robusta gen-config --enable-prometheus-stack

# Install via Helm
helm repo add robusta https://robusta-charts.storage.googleapis.com
helm repo update
helm install robusta robusta/robusta \
  -f ./generated_values.yaml \
  --set clusterName=<YOUR_CLUSTER_NAME>

# Verify installation
kubectl get pods -A | grep robusta

Standalone Installation (Existing Prometheus)

pipx run robusta-cli gen-config
helm install robusta robusta/robusta -f ./generated_values.yaml

Playbook Structure

# Example playbook in generated_values.yaml
customPlaybooks:
  - triggers:
      - on_prometheus_alert:
          alert_name: KubePodCrashLooping
    actions:
      - logs_enricher: {}
      - pod_events_enricher: {}
    sinks:
      - slack

Trigger Types

Common Actions

Sink Configuration

Slack

sinksConfig:
  - slack_sink:
      name: main_slack
      slack_channel: alerts
      api_key: xoxb-your-token

Microsoft Teams

sinksConfig:
  - ms_teams_sink:
      name: teams_alerts
      webhook_url: https://outlook.office.com/webhook/...

PagerDuty

sinksConfig:
  - pagerduty_sink:
      name: pagerduty
      api_key: your-integration-key

Webhook (Generic)

sinksConfig:
  - webhook_sink:
      name: custom_webhook
      url: https://your-endpoint.com/alerts

Examples

Example 1: Install Robusta with Prometheus

User: "Install Robusta on my AKS cluster"
-> Generate config with gen-config --enable-prometheus-stack
-> Add Helm repo and install with cluster name
-> Verify pods are running

Example 2: Create crash loop enrichment playbook

User: "Add pod logs to CrashLoopBackOff alerts"
-> Create playbook with on_prometheus_alert trigger
-> Add logs_enricher and pod_events_enricher actions
-> Configure Slack sink for notifications

Example 3: Configure Slack notifications

User: "Send Robusta alerts to #k8s-alerts Slack channel"
-> Add slack_sink to sinksConfig
-> Set channel name and API key
-> Optionally filter by severity or namespace

Example 4: Debug missing alerts

User: "Robusta isn't sending alerts to Slack"
-> Check robusta-runner pod logs
-> Verify sink configuration in generated_values.yaml
-> Test with manual trigger: robusta playbooks trigger

Key Concepts

Alert Flow

Prometheus Alert -> AlertManager -> Robusta -> Playbook -> Actions -> Sinks

Playbook Components

1. Triggers - What events activate the playbook
2. Actions - What to do when triggered (enrich, remediate)
3. Sinks - Where to send the result

Smart Grouping

Robusta groups related alerts using Slack threads to reduce notification spam.

AI Investigation (HolmesGPT)

Optional AI-powered root cause analysis available with Robusta Pro or self-hosted HolmesGPT.

Reference Documentation

• references/Installation.md - Detailed installation guide
• references/Playbooks.md - Complete playbook reference
• references/Triggers.md - All trigger types
• references/Actions.md - Available actions
• references/Sinks.md - Sink configuration
• references/Troubleshooting.md - Common issues and fixes

External Resources

• Official Docs
• GitHub
• Robusta Platform (SaaS UI)

Gotchas

• customPlaybooks order matters — first match wins for the same trigger: A catch-all onprometheusalert without alert_name: filter at the top swallows every alert, and the specific-alert playbooks below never fire. Always put specific-alert playbooks first, generic last.
• apikey in slacksink is the bot token (xoxb-), not the webhook URL: Pasting a webhook URL there silently fails — Robusta logs "auth failed" once and stops. Use slackchannel + apikey for bot mode, or switch to a different sink type for webhook delivery.
• deletepod auto-remediation has no rate limit: A misconfigured CrashLoopBackOff playbook with deletepod action against a flapping deployment will hot-loop pod deletions and exhaust pod IPs in the subnet. Always pair with onprometheusalert + a firing filter, not pod-state triggers.
• gen-config --enable-prometheus-stack installs a full kube-prometheus-stack: Running it on a cluster that already has Prometheus produces two Prometheus instances scraping each other. Use plain gen-config (no flag) when integrating with existing monitoring.
• msteamssink webhook URLs were deprecated in 2024 — connectors retire: Existing webhook URLs keep working briefly then return 410. Migrate to Power Automate workflows or the new Teams sink format before the deprecation cliff hits.
• Smart Grouping uses Slack threads — breaks if the channel has threading disabled or webhook-only: Alerts post but the "group" collapses into individual messages, creating notification spam exactly when the feature is supposed to prevent it. Verify channel threading is enabled and you're using bot mode, not webhooks.