lookout findings ack

Suppress one finding for a window after an operator has taken it — later diffs report it suppressed instead of re-raising it, and it comes back on its own when the window expires; the “I’m on this, stop paging me until lunch” surface.

MCP tool: k8s_findings_ack

Usage

lookout findings ack <subject-key> [flags]

<subject-key> — the subject key from a findings diff record’s subject_key field: <cluster>/<namespace>/<kind_of_object>/<normalized-name>/<canonical-reason>. Must name a currently-open subject — a resolved subject has no row to ack

Flags

Flag	Type	Default	Meaning
--store	string	—	path to the sentinel’s SQLite store (its —store file). Required: finding state lives in the sentinel’s —store SQLite file; a diff with nowhere to persist would report everything new on every run
--store-cluster	string	—	read/write the store for THIS cluster, treating —store as the multi-cluster stem the sentinel was given: —store=/var/lib/lookout/lookout.db —store-cluster=prod-us opens /var/lib/lookout/lookout-prod-us.db (issue #410). Set it only against a sentinel running —clusters/—clusters-from; a single-cluster sentinel writes the literal —store path
--for	duration	4h0m0s	how long to suppress the subject. The window is absolute from now and always expires; to end one early use —clear
--by	string	—	who took the ack, recorded verbatim on the row and echoed in later suppressed records. Lookout does not authenticate this: the caller (mast) owns identity and the audit trail, lookout owns the state
--clear	bool	—	end the ack window now instead of opening one; the subject goes back to being classified normally on the next diff

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
findings.ack	info	the receipt for the ack this call took or cleared — what was acked, by whom, and until when

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
subject_key	the acked subject’s key, as stored
ack_until	when the window expires, RFC 3339; absent after —clear
ack_by	who took the ack, as given by —by
first_seen	when the acked subject was first observed, RFC 3339 — the “broken since” timestamp, so an operator can see what they are taking
last_seen	when the acked subject was last observed, RFC 3339

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout findings ack prod-east/prod/Pod/payment-backend/CrashLoopBackOff --store=/var/lib/lookout/lookout.db --for=4h --by=gari
lookout findings ack prod-east/prod/Pod/payment-backend/CrashLoopBackOff --store=/var/lib/lookout/lookout.db --clear