Skip to content

Everyday commands

Terminal window
rtz get pods -n payments # po, deploy, sts, ds, svc, ing, no — or "all"
rtz get deploy -o wide # adds KIND and IMAGE
rtz get pods -l app=web # equality selectors
rtz describe payments/checkout # workload + pods + events + services in one screen
rtz search checkout # substring match over workload names
rtz ns / rtz counts # namespaces, resource counts by kind
rtz fleet # org-wide rollup across every cluster

The server caps a listing at 5000 rows with no pagination. When that cap is hit, rtz says the list is truncated rather than presenting it as the whole cluster.

Terminal window
rtz risk # scored workloads, worst first (0-100, higher is worse)
rtz risk workload payments/checkout # why this one scored what it did
rtz risk security | cve | compliance
rtz rca # what is degraded right now, and why
rtz rca payments/checkout # evidence: restarts, events, log tail, dependencies
rtz rca explain payments/checkout # narrative root cause
rtz signals # slowest operations by p99
rtz signals traces # slowest individual traces
rtz changes --since 24 # what changed, newest first
rtz changes payments/checkout # one workload's history

These commands distinguish “nothing is wrong” from “we could not see”, because a clean score computed from missing evidence is the most dangerous output the tool could produce:

  • risk warns when it scored without metrics, CVE data, runtime or network signals.
  • risk security / cve say when a cluster has never been scanned, rather than reporting zero findings as clean.
  • rca prints “no trace data for this workload” instead of a fabricated 0% error rate.
  • rca explain states whether the answer came from a model, a cache replay, or a deterministic gate.

Every command supports -o table|wide|json|yaml. The JSON is the unwrapped payload — never the API envelope — so jq needs no .data prefix:

Terminal window
rtz cluster ls -o json | jq -r '.[] | select(.status != "CONNECTED") | .name'