lookout triage changes

What changed around one workload in the window before onset — rollouts, config/secret updates, rescales, node ops — chronological, scoped to the target’s graph neighborhood; full fidelity from a sentinel store, best-effort live otherwise.

MCP tool: k8s_recent_changes

Usage

lookout triage changes <Kind>/[<namespace>/]<name> [flags]

<Kind>/[<namespace>/]<name> — the pod or workload at the center of the question: <Kind>/<namespace>/<name>, <Kind>/<name> (namespace from —namespace, else “default”), or a bare pod name; kinds are case-insensitive with the usual short forms (po, deploy, rs, sts, ds, cj). —workload=<Kind>/<ns>/<name> is the flag-shaped alternative.

Flags

Flag	Type	Default	Meaning
--depth	int	2	neighborhood radius: graph edges followed per direction to decide which objects’ changes are in scope

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Point-in-time flags (graph-backed commands)

This command answers from the topology graph and accepts the point-in-time flags:

Flag	Type	Default	Meaning
--at	string	—	answer as of this instant instead of live: RFC3339 (2026-07-25T10:00:00Z) or a duration ago (20m). Requires —store.
--store	string	—	path to a sentinel’s SQLite store (its —store file); source for —at point-in-time topology
--store-cluster	string	—	read/write the store for THIS cluster, treating —store as the multi-cluster stem the sentinel was given: —store=/var/lib/lookout/lookout.db —store-cluster=prod-us opens /var/lib/lookout/lookout-prod-us.db (issue #410). Set it only against a sentinel running —clusters/—clusters-from; a single-cluster sentinel writes the literal —store path

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
change.rollout	info	a workload’s pod template changed — a new image, container or mount, or a controller churn event
change.scale	info	a workload’s replica count changed
change.config	info	a ConfigMap in the neighborhood changed
change.secret	info	a Secret in the neighborhood changed (names and shortened hashes only, never values —)
change.node	info	a Node in the neighborhood changed
change.label	info	only labels changed on a neighborhood object — enough to move it in or out of a selector
change.topology	info	a neighborhood object appeared, disappeared, or changed in a way none of the other classes name

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
at	when the change happened, RFC 3339 (also the summary-line note for the resolved —at instant)
relation	the changed object’s place in the target’s neighborhood: self (the target or its pods), upstream, lateral, downstream
fields	changed fields as path=from→to pairs — names, counts, and shortened hashes only, never values
origin	where the change was seen: log (delta log), event (Kubernetes Event), api (reconstructed from current API state)
revision	deployment.kubernetes.io/revision of a rollout’s ReplicaSet (live approximation)
image	first container image of a rollout’s new pod template (live approximation)
window	summary-line note: the (from, to] window the answer covers, RFC 3339
source	summary-line note: history (delta log from —store) or live-approximation (no store; see the fidelity gap in —help)

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout triage changes Deployment/prod/api --store=/var/lib/lookout/lookout.db
lookout triage changes Deployment/prod/api --since=1h --at=2026-07-25T10:00:00Z --store=/var/lib/lookout/lookout.db
lookout triage changes payments-api-7d9c4b-x2n8p --namespace=prod