lookout triage list

List what EXISTS in a namespace — kubectl get across every kind at once, one line per object, leading with the <Kind>/<namespace>/<name> target the other read tools take. The first call for a namespace you have not enumerated: the health scans report only what is abnormal and name nothing when a namespace is clean, so they cannot tell you what is in one. An inventory, not a diagnosis — never guess an object’s name, list the namespace.

MCP tool: k8s_list_resources (MCP profile: triage)

Usage

lookout triage list [flags]

Flags

Flag	Type	Default	Meaning
--kinds	string	—	comma-separated resource kinds to list, spelled as kubectl spells them (pods, deploy, certificates.cert-manager.io); empty lists the default set — deployments,statefulsets,daemonsets,cronjobs,jobs,pods,services,endpoints,ingresses,configmaps,secrets,persistentvolumeclaims,horizontalpodautoscalers,poddisruptionbudgets,serviceaccounts,networkpolicies,resourcequotas,limitranges — which is every namespaced kind an incident normally involves EXCEPT replicasets (one per Deployment revision; ask for them explicitly)
--max	int	500	stop after this many objects; the summary line reports how many were left out (pass —kinds to narrow instead)

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
inventory.object	info	one object in scope, rendered as kubectl’s default columns for its kind — an aggregated kubectl get, so every row is emitted, healthy or not

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
target	the object as <Kind>/<namespace>/<name> (<Kind>/<name> when cluster-scoped) — paste it into triage spec, state edges, triage radius or triage workload unchanged
ready	ready over desired, as kubectl’s READY column: containers for a Pod, replicas for a workload
status	kubectl’s STATUS column verbatim: a Pod’s phase or its blocking container reason, a Job’s condition, a Node’s readiness
restarts	total container restarts of a Pod
up_to_date	replicas on the current revision
available	replicas counted available
completions	a Job’s succeeded over requested completions
schedule	a CronJob’s cron expression
timezone	a CronJob’s spec.timeZone, when it sets one
suspend	“true” on a suspended CronJob (omitted otherwise)
active	a CronJob’s currently running Jobs
last_schedule	how long ago a CronJob last created a Job
type	a Service’s type or a Secret’s type
cluster_ip	a Service’s cluster IP (“None” for a headless Service)
external_ip	a Service’s provisioned load-balancer address, or “pending” for a LoadBalancer that has none yet
ports	a Service’s ports as port[:nodePort]/protocol
addresses	how many endpoint addresses an Endpoints object holds (0 means nothing is behind the Service)
class	an Ingress’s ingressClassName or a PVC/PV’s storage class
hosts	an Ingress’s rule hosts
address	an Ingress’s provisioned load-balancer address
keys	how many keys a ConfigMap or Secret holds — Secret VALUES are never read, only counted
phase	status.phase of a PVC, PV or Namespace
volume	the PersistentVolume a PVC is bound to
capacity	a PVC’s or PV’s storage capacity
access_modes	a PVC’s or PV’s access modes, kubectl-abbreviated (RWO, ROX, RWX, RWOP)
claim	the PVC a PersistentVolume is bound to, as <namespace>/<name>
scale_target	an HPA’s scaleTargetRef as <Kind>/<name>
min	an HPA’s minimum replicas
max	an HPA’s maximum replicas
replicas	an HPA’s current replica count
min_available	a PDB’s spec.minAvailable (count or percentage)
max_unavailable	a PDB’s spec.maxUnavailable (count or percentage)
allowed_disruptions	how many pods a PDB currently allows to be evicted
pod_selector	a NetworkPolicy’s spec.podSelector; “all” when it is empty, which selects every pod in the namespace
roles	a Node’s node-role.kubernetes.io/* labels, or “none”
version	a Node’s kubelet version
age	time since metadata.creationTimestamp, kubectl-style (45s, 3h20m, 12d)
kinds	summary-line note: how many kinds the listing covered
truncated	summary-line note: how many objects —max left out; they are the LAST kinds of the listing, which is ordered workloads → routing → configuration for this reason
skipped	summary-line note: kinds that could not be listed and why, as <Kind>:<reason> (forbidden = the caller may not list it, so its absence from the output is a blind spot, not a fact)
namespace_absent	summary-line note: “true” when the listing was empty because the namespace does not exist, which an empty listing alone cannot distinguish from an empty namespace

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout triage list --namespace=storefront
lookout triage list --namespace=prod --kinds=pods,services,endpoints
lookout triage list --namespace=prod --kinds=replicasets
lookout triage list -A --kinds=ingresses --format=json