lookout triage spec

Read ONE resource’s spec: kubectl describe, but token-dense, secret-safe, and default-elided — healthy conditions are omitted.

MCP tool: k8s_resource_spec

Usage

lookout triage spec <Kind>/[<namespace>/]<name> [flags]

<Kind>/[<namespace>/]<name> — the resource to read; Kind is case-insensitive, accepts the aliases po=Pod, deploy=Deployment, rs=ReplicaSet, sts=StatefulSet, ds=DaemonSet, svc=Service, cm=ConfigMap, pvc=PersistentVolumeClaim, ing=Ingress, netpol=NetworkPolicy, no=Node, and unlisted kinds (CRDs) resolve via API discovery (qualify as <Kind>.<group> if ambiguous). Omit <namespace> for cluster-scoped kinds, or to use —namespace (falling back to “default”). —workload=<Kind>/<ns>/<name> is the flag-shaped alternative.

Flags

Flag	Type	Default	Meaning
--diff	bool	—	diff against the previous graph-history revision — requires a sentinel store; not yet implemented

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
spec.resource	info	the object itself: metadata, owner, and the kind-specific highlights (one per target)
spec.container	info	one container of the target: image, resources, ports, probes, env (one per container)
spec.condition	warning	a status condition of the target that is not in its nominal state

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
labels	resource labels as sorted k=v pairs
owner	controlling owner as Kind/name
phase	status.phase, only when abnormal for the kind (zero nominal state)
node	node the pod is scheduled on
service_account	pod’s service account
volumes	pod volumes as name:source (source names its referent, never its payload)
container	container name (one spec.container finding per container)
init	“true” when the container is an init container
image	container image reference
requests	resource requests as sorted k=v pairs
limits	resource limits as sorted k=v pairs
ports	container or service ports, compact ([name:]port[->target][/proto])
liveness	liveness probe one-liner (kind, target, non-default timings)
readiness	readiness probe one-liner
env	env vars; literal credential values are [REDACTED], valueFrom entries render as named references
env_from	envFrom sources as kind:name
replicas	desired replica count
strategy	rollout strategy summary (type + non-default knobs)
selector	workload/service selector as sorted k=v pairs
type	Service or Secret type, only when non-default
external_name	ExternalName service target
session_affinity	service session affinity, only when not None
keys	ConfigMap/Secret data KEYS with byte sizes — values are never rendered
condition	abnormal status condition as Type=Status
since	the condition’s lastTransitionTime
spec	kinds without a dedicated renderer: sanitized spec flattened to path=value pairs

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout triage spec Deployment/prod/api
lookout triage spec po/payments-api-7d9c4b-x2n8p --namespace=prod
lookout triage spec Node/gke-prod-pool-1-8f2a
lookout triage spec Certificate/prod/api-tls --format=json
lookout triage spec --workload=Deployment/prod/api