lookout audit cluster

Cluster-level security configuration posture, read from the cloud provider: Workload Identity off cluster-wide or bypassed by a node pool, node pools still serving the legacy metadata endpoints, and a control-plane endpoint the internet can reach with nothing narrowing it. Reads the provider’s cluster record, not Kubernetes objects, so it takes no —namespace/-A/—workload; scanned counts the cluster plus its node pools. Without a provider capability it reports an explicit unavailable rather than silence.

MCP tool: k8s_audit_cluster (MCP profile: audit)

Usage

lookout audit cluster [flags]

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
audit.workload_identity_off	warning	Workload Identity is off cluster-wide, or a node pool bypasses it — pods authenticate to the cloud as the node
audit.legacy_metadata	warning	a node pool still serves the pre-v1 instance-metadata endpoints, which any pod can read
audit.public_control_plane	warning, info	the control-plane endpoint is reachable from the internet; info when authorized networks narrow it
cloud.unavailable	info	the cloud capability this check needs is unavailable, so nothing was examined — an explicit degradation record, never silence

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
cluster	on a node-pool finding: the cluster the pool belongs to, so the record stands alone
workload_pool	the cluster-wide workload identity pool that this node pool’s pods bypass
metadata_mode	how the node pool exposes instance metadata to pods: node-identity means any pod can mint tokens for the node’s service account
disable_legacy_endpoints	the pool’s legacy-metadata setting as the provider records it: enabled when someone turned the pre-v1 endpoints back on, unset when the pool was never configured either way
node_pools	summary note: node pools examined — the cluster itself is the other unit scanned counts
endpoint	the control plane’s internet-facing address
authorized_networks	how many source ranges the allow-list permits
authorized_network_cidrs	those ranges, sorted as the provider returned them and capped at 8 with a +N more tail
gcp_public_cidrs	whether the provider’s own public ranges are admitted in addition to the allow-list
capability	cloud.unavailable: the provider capability this command needed (cluster-config)
provider	cloud.unavailable: the provider that was asked
unavailable	summary-line note: why the cloud read could not be served

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout audit cluster
lookout audit cluster --format=json
lookout audit cluster --exemptions=exemptions.yaml