Integrations
Everything RunLore plugs into: what can trigger an investigation, which LLMs run it, the data sources it reads for signal, where notifications land, and the Git forge it writes findings back to. Each page below is short by design — the minimal config to wire the integration, how to verify it locally, and the gotchas that would otherwise cost you a debugging session.
Presence is enablement. A key under sources.<name> — or the equivalent notifier / data-source
block — is what turns that integration on; there is no separate enabled: true flag to hunt for.
Leave a data source out and RunLore simply runs without the tool it would have unlocked: no source,
notifier, or data source is required, and none is assumed. See
Configuration for the exhaustive key
reference every page here deep-links into.
Triggers
What starts an investigation.
Alertmanager
Prometheus/VMAlert webhook — the primary trigger.
GitOps failures
React to Flux or Argo CD Ready=False, not just alerts.
PagerDuty
Trigger investigations from PagerDuty incidents.
Custom webhook
Map any vendor’s alert JSON with dot-path field extraction — no code.
LLM providers
What runs the investigation loop.
OpenAI-compatible
vLLM, Ollama, OpenAI, OpenRouter — any endpoint that supports forced tool_choice.
Anthropic
Native Claude, keyed or in-cluster via a compatible gateway.
Gemini
Google’s models over the OpenAI-compatible endpoint — version caveats apply.
Local / keyless
In-cluster vLLM or Ollama — no API key, no egress.
Data sources
What the agent reads for signal — every one is optional; an unset data source just disables the tool it would have unlocked.
Prometheus / VictoriaMetrics
PromQL metrics — the query_metrics tools.
VictoriaLogs
LogsQL — the default logs backend.
Grafana Loki
LogQL, auto-detected at startup.
Kubernetes
Pod status, events, controller and pod logs — client-go, in-cluster.
Cilium Hubble
eBPF flow visibility with rich drop reasons.
AWS VPC Flow Logs
Network drops on any AWS VPC, Cilium or not.
GCP Firewall Logs
DENIED connections on any GCP VPC, including GKE.
AWS cloud control plane
CloudTrail + EC2/ASG/EKS — what changed outside GitOps.
Source repos
Turns a manifest bump into the actual code diff behind it.
MCP
Extend the agent’s own toolbox with remote MCP tools — no Go required.
Notifications
Where findings are delivered.
Slack
Incoming webhook or bot token, with optional Approve/Reject buttons.
Matrix
Deliver to any Matrix room via an access token.
Webhook
Generic outgoing webhook — plug in anything that takes JSON.
Templated
Named instances with your own Go-template payload, e.g. Microsoft Teams.
Forge
Where the Learn loop writes findings back to.