If you are using Slack, you can forward alerts from Red Hat Advanced Cluster Security for Kubernetes to Slack.
The following steps represent a high-level workflow for integrating Red Hat Advanced Cluster Security for Kubernetes with Slack:
Create a new Slack app, enable incoming webhooks, and get a webhook URL.
Use the webhook URL to integrate Slack with Red Hat Advanced Cluster Security for Kubernetes.
Identify policies for which you want to send notifications, and update the notification settings for those policies.
Start by creating a new Slack app, and get the webhook URL.
You need an administrator account or a user account with permissions to create webhooks.
Create a new Slack app:
If you want to use an existing Slack app, go to https://api.slack.com/apps and select an app.
Navigate to https://api.slack.com/apps/new.
Enter the App Name and choose a Development Slack Workspace to install your app.
Click Create App.
On the settings page, Basic Information section, select Incoming Webhooks (under Add features and functionality).
Turn on the Activate Incoming Webhooks toggle.
Select Add New Webhook to Workspace.
Choose a channel that the app will post to, and then select Authorize. The page refreshes and you are sent back to your app settings page.
Copy the webhook URL located in the Webhook URLs for Your Workspace section.
For more details, see the Slack documentation topic, Getting started with Incoming Webhooks.
You can configure Red Hat Advanced Cluster Security for Kubernetes to send notifications to different Slack channels so that they directly go to the right team.
After you configure incoming webhooks, add an annotation similar to the following in your deployment YAML file:
Use the annotation key
example.com/slack-webhook in the Label/Annotation Key For Slack Webhook field when you configure Red Hat Advanced Cluster Security for Kubernetes.
After the configuration is complete, if a deployment has the annotation that you configured in the YAML file, Red Hat Advanced Cluster Security for Kubernetes sends the alert to the webhook URL you specified for that annotation. Otherwise, it sends the alert to the default webhook URL.
Create a new integration in Red Hat Advanced Cluster Security for Kubernetes by using the webhook URL.
On the RHACS portal, navigate to Platform Configuration → Integrations.
Scroll down to the Notifier Integrations section and select Slack.
Click New Integration (
Enter a name for Integration Name.
Enter the generated webhook URL in the Default Slack Webhook field.
Select Test (
checkmark icon) to test that the integration with Slack is working.
Select Create (
save icon) to create the configuration.
Enable alert notifications for system policies.
On the RHACS portal, navigate to Platform Configuration → Policies.
Select the policy for which you want to send alerts.
Select Actions → Edit Policy.
In the Attach Notifiers section, select the check box for the Slack notifier.
If you have not configured any integrations, the system displays a message that no notifiers are configured.
Click Next until you reach Review Policy, then click Save.