Skip to main content
This page covers the situations you will use Kepler for most, each with a starting prompt and what to expect back. Every example works in Observe, the read-only default. Where a step changes something, it says so.
To run one of these on a schedule, when an alert arrives, or from a /command in a chat, make it an automation.
A Kepler answer in Observe: a row for each kubectl command it ran, a Not run row for a patch Observe refused, then a Finding about a misnamed ConfigMap key, an Evidence list quoting the pod log and the deployment's change cause, and a safe remediation.

​
Triage an alert

Suppose a page just came in for the payments service and you need to know in two minutes whether it is real and how bad it is.
Kepler checks the service’s pods, recent events and logs, reads whatever dashboards it has access to, and answers with severity, blast radius and a first hypothesis. Each command it ran is a card in the chat, so you can see the evidence rather than take its word.
Say what “normal” looks like if Kepler has not seen this service before. “Normally under 200 ms p99” turns a vague answer into a precise one. Kepler remembers it for next time.

​
Investigate a failing pod or service

Suppose checkout pods are crashlooping and the logs are not obvious.
Kepler works the problem the way you would: describe the pod, read the termination reason, pull the previous logs, compare the mounted config against the last change. On long investigations a checklist appears above the composer and ticks itself off as it goes. When it reaches a real fork it stops and asks you, in a card over the composer, rather than guessing.

​
Get a root cause write-up

Suppose the incident is over and you owe a postmortem.
Kepler assembles the write-up from the investigation in the thread, the commands it ran and what it already knows about the service. Ask for it as an artifact and it lands in the Artifacts tab of the Memory panel under a stable name, versioned each time you ask for a revision.

​
Review a deploy, or roll one back

Suppose errors started right after a release and you want to know whether the deploy is to blame before you touch anything.
Both of those are read-only. When you are ready to act, switch to Assist with Shift+Tab and ask:
Kepler works out the rollback and proposes it step by step in the approval dock over the composer. Nothing runs until you approve it. Any step on the always-blocked list, such as a rollout undo, Kepler hands to you to run yourself in the terminal panel, with the checks to do before and after.
Deleting, scaling, draining and restarting rollouts stay blocked in every posture. Kepler will tell you when it hits that floor and give you the command to run yourself. See Permissions.

​
Read a dashboard in the browser panel

Suppose the answer is on a Grafana board and you would rather not describe the graph in words.
Paste a dashboard URL and the browser panel opens beside the chat. Log in once and Kepler can read that dashboard from then on. It reads the page, takes screenshots when it needs to, and quotes what it saw.

​
Bring terminal output into the chat

Suppose you already ran the command yourself and want Kepler to interpret the output. Open the terminal with Cmd+J (Ctrl+J on Windows and Linux). Everything you and Kepler run appears here. Click any command in the scrollback and Kepler receives the command together with its output. Then ask:
You can also type ! at the start of the composer to run a shell command yourself without leaving the chat.

​
Find or write a runbook

Suppose you need the procedure for something you do twice a year.
Kepler searches its memory for a matching runbook and summarizes it. If there is none, it drafts one from the current thread and saves it, so the next person who asks gets a real answer.

​
Hand off to the next shift

Suppose your on-call shift ends in ten minutes and two things are still open.
Kepler writes the handoff from the sessions of the day: what happened, what is still open, what to watch, and where the evidence is. Paste it into your team channel, or keep it in the thread for the next person to open.

​
Ask what happened last time

Suppose the symptom looks familiar.
Kepler answers from memory and from its map of your infrastructure. The more incidents you work through it, the better this gets. See Memory.

​
Get a plan before anything runs

Suppose the fix is several steps and you want to read the whole thing before the first command.
Kepler writes the change out as a plan you can read and edit. Nothing runs while you review it. When you approve, the plan sits above the composer and ticks off each step as it lands. /plan works in every posture, including Observe.

​
Where to go next

War rooms

When one investigation needs several angles at once.

Watchers

Ask Kepler to keep an eye on something and wake you.

Postures

Observe, Assist and Yolo, and the approval dock.

Commands and shortcuts

Every slash command used on this page.