lookout net probe

Actively confirm a network hypothesis — resolve DNS names, open TCP connections, GET HTTP(S) URLs — from wherever lookout runs (in a pod = the in-cluster view); zero cluster mutation, no pods spawned.

MCP tool: k8s_net_probe

Usage

lookout net probe [flags]

Flags

Flag	Type	Default	Meaning
--dns	string	—	comma-separated names to resolve (e.g. api.prod.svc.cluster.local,db.example.com)
--tcp	string	—	comma-separated host:port endpoints to connect to (e.g. api.prod.svc:8080,10.0.0.5:5432)
--http	string	—	comma-separated http(s) URLs to GET; redirects are reported (3xx), not followed, and response bodies are never read into findings
--probe-timeout	duration	5s	per-probe timeout; raise —timeout too when probing many slow targets (it caps the whole invocation)

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
probe.dns	critical, warning, info	the result of one DNS resolution: info when it resolved, warning on timeout, critical otherwise — a probe result is always emitted, success included, because the answer to “can this be reached” is the point of the command
probe.tcp	critical, warning, info	the result of one TCP connect: info when it connected, warning on timeout, critical otherwise
probe.http	critical, warning, info	the result of one HTTP GET (redirects reported, not followed): info on success, warning on timeout or 4xx, critical otherwise

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
ips	probe.dns: resolved addresses, sorted, comma-separated
latency	how long the probe took: DNS resolution / TCP connect / full HTTP exchange
status	probe.http: HTTP status code of the (unfollowed) response
content_length	probe.http: Content-Length the server declared (body is discarded unread; omitted when unknown)
error_class	failed probes: nxdomain|timeout|refused|unreachable|reset|cert|http_4xx|http_5xx|error

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout net probe --dns=api.prod.svc.cluster.local
lookout net probe --tcp=db.prod.svc:5432 --probe-timeout=2s
lookout net probe --http=https://api.prod.svc/healthz --format=json
lookout net probe --dns=api.prod.svc --tcp=api.prod.svc:8080 --http=http://api.prod.svc:8080/readyz