Reference

Every page in this section is generated by dev/tools/gen-site-docs from the same declarations that produce --help, the MCP schemas, and the skill reference stubs (one source of truth, generated outward). A drift test fails CI when a committed page differs from regeneration.

The sentinel

• lookout watch — the resident per-cluster sentinel: full flag table.
• Signal kinds — the frozen signal-schema v1 kind catalog.
• Prometheus metrics — the --metrics-addr surface.

Read-path commands

• Finding kinds — the whole vocabulary these commands emit, in one table.

Composed entry points:

• lookout bundle — The first call of every incident: one correlated snapshot of a workload — sanitized spec, everything abnormal, broken dependency edges, blast radius, distilled logs — sectioned into a single payload instead of 4–5 separate reads.
• lookout health — “Any issues with this cluster?” in one call: a ten-category scorecard (control-plane, nodes, crash loops, pending, rollouts, storage, add-ons, quotas, certs, webhooks) — every category answers healthy|degraded|unavailable, degraded ones with details. With —store, findings merge the sentinel’s open triage-status records: a scan mid-incident reports the diagnosis and the agent’s severity judgment, not a fresh unknown.
• lookout scan — Start here when you know something is wrong but not what: one call runs every target-free incident check across the cluster — broken workloads, dead admission webhooks, stuck volumes and PVCs, rejected Gateway routes, config drift — then drills into the dependency edges of whatever it flagged. Needs no target; --include=audit adds the posture sweep.

lookout audit

best-practice posture: the absence of a safety net around a workload or cluster that is currently healthy — a different claim from the incident groups, which is why it is a different group

• lookout audit cluster — Cluster-level security configuration posture, read from the cloud provider: Workload Identity off cluster-wide or bypassed by a node pool, node pools still serving the legacy metadata endpoints, and a control-plane endpoint the internet can reach with nothing narrowing it. Reads the provider’s cluster record, not Kubernetes objects, so it takes no —namespace/-A/—workload; scanned counts the cluster plus its node pools. Without a provider capability it reports an explicit unavailable rather than silence.
• lookout audit exemptions — Audit the exemption file itself: which reviewed exemptions have lapsed (and are therefore no longer annotating anything) and which are about to. The mechanism that keeps an exemption file from becoming a permanent, unread list of things nobody checks any more.
• lookout audit hardening — Workload security posture: containers running privileged or holding node-root capabilities, pods sharing the host network/PID/IPC namespaces, hostPath mounts, default-ServiceAccount tokens that something actually uses, and namespaces with no Pod Security Admission enforcement. Judges every pod-template owner in scope — Deployments, StatefulSets, DaemonSets, CronJobs, unowned Jobs and unowned Pods — plus the namespaces around them. Scope with —namespace or -A; scanned counts pod templates examined, the namespaces note counts namespaces.
• lookout audit netpol — NetworkPolicy coverage posture: namespaces where nothing restricts ingress or egress at all, and individual workloads that fell through the selectors of the policies covering their neighbours. Coverage means isolation — some policy selects the pod and names the direction — not that the rules it then applies are tight. hostNetwork templates are excluded, since NetworkPolicy cannot constrain them. Scope with —namespace or -A; scanned counts pod templates examined.
• lookout audit upgrades — Upgrade and patch readiness, read from the cloud provider: how far the control plane and its node pools are behind what the provider publishes, and whether anything is set up to close that gap on its own — release channel, node auto-upgrade and auto-repair, a maintenance window, active maintenance exclusions, node images on the removed Docker runtime, and upgrade notifications. Reads the provider’s cluster record, not Kubernetes objects, so it takes no —namespace/-A/—workload; scanned counts the cluster plus its node pools. Without a provider capability it reports an explicit unavailable rather than silence.
• lookout audit workloads — Workload reliability posture for workloads that are healthy right now: no PodDisruptionBudget, only one replica, no readiness/liveness probe, no spread across nodes, placement pinned to too few nodes, autoscalers that structurally cannot scale, and CronJobs left suspended long enough to have skipped runs. Answers “what has no safety net”, as against stab drain, which answers “what breaks if I drain THIS node now”. Scope with —namespace, -A, or —workload; scanned counts workloads examined.

lookout cloud

GCP-side reads: stockouts, orphaned resources, IP space, quota

• lookout cloud ipspace — Pod/Service/node CIDR utilization per subnet, judged: warning at 80%, critical at 95% — IP space is incompressible, an exhausted range fails the next node or pod block outright. Consumption rate/ETA lives in the sentinel’s capacity source.
• lookout cloud orphans — Billing-active cloud leftovers: unattached GCE disks older than —min-age and forwarding rules/LBs routing to zero endpoints — cost and hygiene sweep, not an incident read.
• lookout cloud quota — Per-project cloud quota usage vs limit, ranked nearest-to-exhaustion: findings from —quota-warn (default 80%), critical at 95% — quota is incompressible (scale-ups fail at the limit) and increases need lead time. Trend/ETA lives in the quota source.
• lookout cloud stockout — GCE capacity stockouts (ZONE_RESOURCE_POOL_EXHAUSTED) per zone/machine-type over —since (default 24h), with event-derived reroute candidates — the cloud-side why behind pods stuck Pending on failed scale-ups.

lookout findings

run-to-run finding state: diff two scans into transitions (new/ongoing/escalated/resolved), ack a subject for a window

• lookout findings ack — Suppress one finding for a window after an operator has taken it — later diffs report it suppressed instead of re-raising it, and it comes back on its own when the window expires; the “I’m on this, stop paging me until lunch” surface.
• lookout findings diff — Diff a health report against the previous run and report what CHANGED — new, ongoing, escalated, resolved, suppressed — instead of re-listing every open finding; the command that makes a scheduled scan produce a digest an operator will keep reading.

lookout net

active DNS/TCP/HTTP probes from inside the cluster

• lookout net probe — Actively confirm a network hypothesis — resolve DNS names, open TCP connections, GET HTTP(S) URLs — from wherever lookout runs (in a pod = the in-cluster view); zero cluster mutation, no pods spawned.

lookout perf

control-plane and startup performance via Cloud Monitoring query packs

• lookout perf probe — Control-plane and startup performance via metrics query packs: —pack=apiserver (p99 latency by verb/resource), apf (queue saturation + 429 rejects), etcd (WAL fsync p99 + DB size), startup (pod-first-ready p95 trend); apf/etcd need GKE control-plane metrics enabled — absence degrades to an explicit pack_unavailable finding.

lookout stab

stability reads: GitOps drift, node-drain blockers

• lookout stab drain — Before draining a node, list everything that will block the drain (PDBs at disruptionsAllowed=0) or be destroyed by it (bare pods, emptyDir data, single-replica workloads); —node details one node, -A means all nodes here (pods are always examined across all namespaces); scanned counts pods examined after the standard-drain skips (mirror/DaemonSet/completed pods).
• lookout stab drift — Find spec fields of Deployments/StatefulSets/DaemonSets owned by a manager other than the GitOps controller (managedFields) — out-of-band kubectl edits and rogue co-managers. Reports manager strings (tool names, not people); —identity additionally resolves each drift write to the audited principal via the cloud provider’s audit trail (GKE Cloud Audit Logs), reporting an explicit unavailable on clusters without one. Default scope: all namespaces; scanned counts workload objects examined.

lookout state

dependency + configuration verification: edges, webhooks, workload identity, volumes

• lookout state edges — Verify every dependency edge of one workload — ConfigMap/Secret keys, imagePullSecrets, Service selectors and endpoints, Ingress backends and class, StatefulSet governing Service and volume classes, ServiceAccount/RBAC references, TLS expiry — reporting only the broken ones. —workload also accepts Service/<namespace>/<name> to enter from the service side, which is the direction the evidence arrives from when a service has no endpoints: it reports that service’s selector, endpoints, ingresses and certificates, and names the workload the selector was probably meant for.
• lookout state gateway — When traffic through the Gateway API does not arrive — walk GatewayClass → Gateway → listener → HTTPRoute → Service and report every hop that is rejected, unprogrammed, or points at something that is not there. Silent, and cheap, on clusters without the Gateway API installed.
• lookout state storage — When a PersistentVolumeClaim sits Pending and the pod behind it will not schedule — name the reason: a StorageClass that does not exist, no class and no cluster default, a static-only class with nothing pre-provisioned, plus the default-class ambiguity and stranded volumes behind it.
• lookout state volumes — When pods hang in ContainerCreating with Multi-Attach or FailedAttachVolume events — join VolumeAttachment + PV/PVC + pods to name the exact conflict: RWO claims wanted on two nodes, attachments stuck in error, cross-zone PV locks, orphaned attachments.
• lookout state webhooks — When creates/updates hang or fail cluster-wide with “failed calling webhook”, or before relying on a policy engine: audit every admission webhook — dead backends × failurePolicy (Fail + dead backend rejects every matching admission), the namespace/rule blast radius, timeout stall risk, CA-bundle expiry. The full check; health’s webhooks category delegates here.
• lookout state wi — When a GKE pod gets 403s or metadata-server errors calling GCP APIs, verify the Workload Identity chain — KSA annotation (iam.gke.io/gcp-service-account) → roles/iam.workloadIdentityUser binding on the GSA — reporting only the broken links; vanilla clusters report an explicit unavailable.

lookout triage

incident reads: everything abnormal, condensed logs/events, blast radius, what changed

• lookout triage changes — What changed around one workload in the window before onset — rollouts, config/secret updates, rescales, node ops — chronological, scoped to the target’s graph neighborhood; full fidelity from a sentinel store, best-effort live otherwise.
• lookout triage delta — Every abnormal object in one scan — the first call for “anything wrong in this cluster?”: broken/pending pods, stalled rollouts, workloads blocked from creating pods at all, node pressure/NPD/preemption, gridlocked PDBs, degraded kube-system add-ons, quotas at their limits.
• lookout triage events — Deduped chronological event timeline: kubectl get events, but collapsed by (object, reason family) over a workload’s whole owner-reference tree, with HPA rescale-oscillation (thrash) detection.
• lookout triage list — List what EXISTS in a namespace — kubectl get across every kind at once, one line per object, leading with the <Kind>/<namespace>/<name> target the other read tools take. The first call for a namespace you have not enumerated: the health scans report only what is abnormal and name nothing when a namespace is clean, so they cannot tell you what is in one. An inventory, not a diagnosis — never guess an object’s name, list the namespace.
• lookout triage logs — kubectl logs, distilled: Drain-clusters raw lines into templates with counts (probe noise stripped, stack traces collapsed to top frames) — reach for this instead of reading logs whole.
• lookout triage radius — Blast radius of one pod/workload — who is upstream (routes/owns/governs it), lateral (same node, shared config/volume), downstream (it depends on); —at answers it as of incident onset from a sentinel store.
• lookout triage spec — Read ONE resource’s spec: kubectl describe, but token-dense, secret-safe, and default-elided — healthy conditions are omitted.
• lookout triage status — Write (or read back) the triage-status record for an incident — diagnosis, action taken, and your severity judgment — so health scans stop reporting it as a fresh unknown and the sentinel stops re-paging followups; the incident playbooks’ closing move.
• lookout triage top — Point-in-time CPU/memory saturation vs limits: kubectl top, but judged — usage-vs-limit percent per container with the OOM asymmetry built in (memory ≥95% of limit is critical, CPU caps at warning: it throttles, it does not kill); -A adds node usage vs allocatable. Trends/ETAs live in the sentinel’s saturation source; —history adds window stats via the cloud provider.