Host agent
A small binary and systemd unit that discovers jobs on Linux hosts.
- crontab
- systemd timers
- Proxmox vzdump
- any command via exec
Push-based job monitoring
Monitor anything.
From agents or by hand.
LastPulse is dead man's switch monitoring for Kubernetes CronJobs, backups, certificate renewals and host cron jobs. An agent finds them for you, and silence past the grace period is the alert.
helm install · 5 minutes · alerts to Telegram or Slack, no server needed
Today · hetzner-prodlogs end-to-end encrypted
2need attention
1slow
47healthy
3agents online
| Status | Job |
|---|---|
| FAILED | db/pg-backupOOMKilled · exit 137 · image changed 1.4.2 → 1.5.0 |
| MISSED | velero/nightlyshould have run 02:30, nothing started |
| SLOW | billing/export14m 02s, usual 3m 10s |
| OK | kube-system/etcd-snapshot |
| OK | pve-01/vzdump |
| OK | ingress/wildcard-cert |
Kubernetes auto-discovery
No ping lines in your CronJobs.
Install one Helm chart. The agent watches the cluster and starts monitoring every scheduled thing it finds, including the ones added next month.
- CronJobs and Jobs
- Velero backups
- CloudNativePG backups
- Longhorn backups
- k3s etcd snapshots
- cert-manager certificates
The usual way, in every job
command:
- sh
- -c
- |
./backup.sh && \
curl -fsS https://hc.example/ping/8f2c…LastPulse, once per cluster
helm install jobwatch-agent \
oci://ghcr.io/…/charts/jobwatch-agent \
-n jobwatch -f values.yamlLastPulse03:02
🔴 FAILED · pg-backup
db/pg-backup · CronJob · hetzner-prod
- Why
- OOMKilled (exit 137)
- Image
pg-backup:1.4.2 → 1.5.0, changed since the last success- Duration
2m 14s, usual6m 05s- Where
- node worker-2 · memory limit 256Mi
connecting to postgres://backup:***@pg-rw.db.svc:5432/app
pg_dump: dumping contents of table "public.rounds"
pg_dump: dumping contents of table "public.sessions"
KilledAcknowledgeSnooze 1hResolve
db/pg-backup · incident 7f3a9c
Alerts that say why
The reason, not just a red dot.
Every alert carries what you would otherwise go and look up: the failure reason and exit code, the last log lines with secrets masked, what changed since the last good run, and how long it took against the usual.
- Failed: OOMKilled, exit codes, image pull errors, deadline exceeded.
- Missed: should have run and nothing started. With the server, even when the agent itself is gone.
- Slow: finished, but far outside its usual duration.
Outside Kubernetes too
Hosts, CI and anything with an exit code.
Report CLI
Wrap any command on Windows, macOS, CI runners or serverless. One static binary.
jobwatch-report run --check billing/export \
--schedule "0 3 * * *" --grace 30m \
-- /opt/billing/export.shReport API
One authenticated POST /v1/report from anything that can make an HTTPS call, with report-only API keys.
Trust you can check
Built to be installed in a production cluster.
The agent, the contracts and the deploy files are Apache-2.0. The threat model and the release checks are public.
Read-only by default
The agent's RBAC is get, list and watch. Reruns need an opt-in runner role.
Outbound only
Agents push over HTTPS. Nothing in your cluster opens a port.
Signed messages
Every agent batch is signed with the agent's own Ed25519 key.
End-to-end encrypted logs
Agents seal logs with your organization's public key. Only members' devices can decrypt.
Secrets masked at the source
Passwords, tokens, keys and credentials in URLs are masked before a line leaves the pod.
Verifiable releases
Images and charts are signed with cosign keyless, with SBOMs and build provenance.
Notifications
Send it where your team already is.
Events become incidents, a router picks the route, and channel adapters render one neutral message per platform. Acknowledge, snooze or resolve from the alert itself.
- Telegram
- Slack
- Discord
- Webhook
- Apprise
Teams
One place for every cluster.
Organizations own their agents, clusters, routes and keys. Members are Owner, Admin, Operator or Viewer, and any role can be limited to some clusters, so a second team sees only its own.
How it works
Push in, alerts out.
- 01
Agent
Watches the cluster or host, detects failed, missed and slow runs, masks and seals logs, signs the batch.
- 02
Server
Verifies signatures, keeps status and timing, stores logs as ciphertext, catches silent agents.
- 03
You
Alerts in your channels, history in the web app, logs decrypted locally on your device.
The agent also runs on its own with no server: alerts go straight from your cluster to your channels.
FAQ
Questions people ask first.
What is dead man's switch monitoring for cron jobs?
Instead of only watching for errors, the monitor expects a signal every time a job is due. If the signal doesn't arrive within the grace period, that silence is the alert. LastPulse applies this to every CronJob, backup and host job it finds.
Do I have to change my Kubernetes CronJobs?
No. The agent watches the Kubernetes API with read-only RBAC and discovers CronJobs, Jobs, Velero, CloudNativePG and Longhorn backups, k3s etcd snapshots and cert-manager certificates. Optional annotations such as jobwatch.dev/grace or jobwatch.dev/ignore tune or skip a job.
Does LastPulse need a server?
No. The agent runs standalone and sends alerts straight from your cluster to Telegram, Slack, Discord or a webhook. The server adds history, the web app, server-side missed-run checks, teams and the Report API.
Can it monitor cron jobs outside Kubernetes?
Yes. The host agent discovers crontab entries, systemd timers and Proxmox vzdump backups on Linux. For Windows, macOS, CI runners or serverless, the jobwatch-report CLI wraps a command, or anything can call the Report API with a report-only API key.
What can the server see?
Status and timing, so it can detect failed, missed and slow runs. In sealed mode, agents encrypt log lines with your organization's public key and the server stores only ciphertext; only members' devices can decrypt them. A metadata-only mode sends no logs at all.
Is LastPulse open source?
The agent, the message contracts and the deployment files (Helm chart, manifests) are Apache-2.0. Release images and the chart are signed with cosign keyless and ship with SBOMs and build provenance.
Five minutes to the first alert.
Install the agent with Helm, point it at Telegram or Slack, and break a job to see it work.