lookout audit upgrades

Upgrade and patch readiness, read from the cloud provider: how far the control plane and its node pools are behind what the provider publishes, and whether anything is set up to close that gap on its own — release channel, node auto-upgrade and auto-repair, a maintenance window, active maintenance exclusions, node images on the removed Docker runtime, and upgrade notifications. Reads the provider’s cluster record, not Kubernetes objects, so it takes no —namespace/-A/—workload; scanned counts the cluster plus its node pools. Without a provider capability it reports an explicit unavailable rather than silence.

MCP tool: k8s_audit_upgrades (MCP profile: audit)

Usage

lookout audit upgrades [flags]

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
audit.version_behind	warning, info	the control plane or a node pool is behind what the provider publishes, or a node pool has skewed from the control plane; info while the gap is still within the supported skew
audit.upgrade_unmanaged	warning	nothing will close that gap on its own: no release channel, or node auto-upgrade/auto-repair off
audit.upgrade_blocked	warning, info	an active maintenance exclusion, or a node image on the removed Docker runtime, will stop the upgrade when it comes
audit.upgrade_unattended	info	upgrades will happen with nobody watching: no maintenance window, or no upgrade notifications
cloud.unavailable	info	the cloud capability this check needs is unavailable, so nothing was examined — an explicit degradation record, never silence

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
cluster	on a node-pool finding: the cluster the pool belongs to, so the record stands alone
version	the current version of the finding’s subject — the control plane’s, or the node pool’s
target_version	the version the provider would move this cluster to: its channel’s upgrade target where one is published, otherwise the channel’s default
control_plane_version	on a node-pool skew finding: the control-plane version the pool is measured against
minor_versions_behind	how many minor releases separate the two versions
channel	the release channel the cluster is subscribed to, and the one whose published versions the comparison used; none when it is subscribed to no channel
image_type	the provider’s name for the node image the pool runs
exclusion	the operator’s name for the maintenance exclusion currently in force
scope	how much of the upgrade stream that exclusion holds back: all-upgrades, minor-upgrades or minor-and-node-upgrades
ends	when the exclusion lifts, or end-of-support for one that runs until the cluster’s version leaves support
days_remaining	how much longer the exclusion has left to run
node_pools	summary note: node pools examined — the cluster itself is the other unit scanned counts
capability	cloud.unavailable: the provider capability this command needed (cluster-config)
provider	cloud.unavailable: the provider that was asked
unavailable	summary-line note: why the cloud read could not be served

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout audit upgrades
lookout audit upgrades --format=json
lookout audit upgrades --exemptions=exemptions.yaml