Data Sources

Kwirth Providers

Providers inject new data sources into Kwirth — from Kafka topics and OpenTelemetry collectors to any custom backend system. They run alongside Kwirth's core and feed data into the same channel and sender pipeline.

What is a provider?

A provider is a backend-only extension that connects Kwirth to an external data source and streams data into the Kwirth pipeline. Unlike plugins (which add UI channels), providers are pure data adapters: they receive messages from an external system and forward them to Kwirth channels, senders, or both.

Providers run in the same Node.js process as the Kwirth backend. They are hot-reloadable and packaged as a .tgz file containing a CJS bundle (back.js) and a package.json manifest.

External system (Kafka, OTLP, custom API, IoT, ...) │ ▼ Provider → receives ClusterInfo, senders, channel context │ ▼ Kwirth channels & senders (alerts, email, log files, ...)

Available providers

⏱️

Tick Provider

Fires a periodic heartbeat event to all subscribing channels. Useful for time-driven logic, polling patterns, and testing channel subscriptions.

Available
📣

Events Provider

Streams a Kwirth event whenever a Kubernetes cluster event occurs — Pod created, Deployment scaled, node condition changed, and more.

Built-in
🛡️

Validating Provider

Intercepts Kubernetes admission webhook calls and exposes them as Kwirth events, enabling channels to inspect or react to every resource creation and update in real time.

Available
📊

Metrics Provider

Polls the Kubernetes cAdvisor API on a configurable interval and distributes cluster-wide CPU, memory, network, and disk metrics to all subscribing channels.

Built-in
📨

Kafka Provider

Consume messages from one or more Kafka topics and stream them into Kwirth channels. Configurable topic list, consumer group, and Kafka broker URL.

Available
📡

OpenTelemetry Provider

Receive OTLP traces, metrics, and logs over HTTP (OTLP/JSON). Acts as a lightweight collector endpoint inside your cluster — no Collector sidecar needed.

Available
🖥️

Syslog Provider

Receives RFC 3164 / RFC 5424 syslog messages over UDP and TCP and streams them into subscribing channels — with optional relaying onward. Ideal for appliances, network gear and legacy apps.

Available
🔄

HTTP Pull-Push Provider

Polls remote HTTP endpoints on a schedule and pushes each result to the subscribing channels. For data sources that cannot push into Kwirth by themselves: third-party APIs, RSS feeds, health endpoints, legacy systems.

Available
🛡️

Trivy Provider

Watches the Trivy Operator CRDs (vulnerability, config-audit and secret reports) and streams the findings into channels — this is what backs the Trivy channel.

Available
🧪

Sample Provider

A minimal reference implementation. Generates synthetic events on a configurable interval. Use it as a scaffold for building your own provider.

Dev / Reference
💹

Business Provider

Ingests external business data via HTTP POST. Events carry a space and type label; channels subscribe to the combinations they need. Enables AI channels to react to business signals alongside Kubernetes events.

Built-in
🗄️

Database Provider

Poll or stream change events from PostgreSQL, MySQL, or MongoDB. Surface slow queries, replication lag, and table-level metrics as Kwirth signals.

Planned
⚙️

Your Provider

Connect any data source that has a Node.js SDK or HTTP API. The provider interface is intentionally simple: start, send, stop.

Build your own

Provider interface

Every provider must implement the IProvider interface from @kwirthmagnify/kwirth-common-back:

id: stringUnique identifier (e.g. "kafka", "otel")
startProvider(context)Called once at startup — begins consuming or listening for data
stopProvider()Called on graceful shutdown — disconnect and clean up
addConfig(config)Register a named configuration (connection params, topic list, etc.)
removeConfig(name)Remove a previously registered config
getConfigSchema?()Optional — field definitions for the management UI config form

Build your own provider

A provider is a single CJS bundle compiled with esbuild. The project structure mirrors the plugin layout:

providers/my-provider/
  src/
    back/index.ts     ← implements IProvider, exports as default
  build.mjs           ← esbuild script (node platform, CJS format)
  package.json        ← includes id, displayName, version, description

Minimal scaffold — a provider that polls an HTTP endpoint and forwards data as sender messages:

import { IProvider, IProviderContext, ISenderAccess } from '@kwirthmagnify/kwirth-common-back'

export class MyProvider implements IProvider {
    readonly id = 'my-provider'
    private senders!: ISenderAccess
    private timer?: NodeJS.Timeout

    async startProvider(context: IProviderContext): Promise {
        this.senders = context.senders
        this.timer = setInterval(() => this.poll(), 30_000)
    }

    async stopProvider(): Promise {
        clearInterval(this.timer)
    }

    private async poll(): Promise {
        const data = await fetch('https://my-api/events').then(r => r.json())
        await this.senders.send('console', 'default', { body: JSON.stringify(data) })
    }
}

export default MyProvider

Register it for local development in kwirth-dev.json:

{
  "providers": {
    "my-provider": "../providers/my-provider/dist"
  }
}

Ready to build a provider?

Full interface reference, context object documentation, and the sample provider source are in the developer docs.

Provider docs → Sample provider source