Everyday commands
Inventory
Section titled “Inventory”rtz get pods -n payments # po, deploy, sts, ds, svc, ing, no — or "all"rtz get deploy -o wide # adds KIND and IMAGErtz get pods -l app=web # equality selectorsrtz describe payments/checkout # workload + pods + events + services in one screenrtz search checkout # substring match over workload namesrtz ns / rtz counts # namespaces, resource counts by kindrtz fleet # org-wide rollup across every clusterThe server caps a listing at 5000 rows with no pagination. When that cap is hit, rtz says
the list is truncated rather than presenting it as the whole cluster.
Reliability
Section titled “Reliability”rtz risk # scored workloads, worst first (0-100, higher is worse)rtz risk workload payments/checkout # why this one scored what it didrtz risk security | cve | compliancertz rca # what is degraded right now, and whyrtz rca payments/checkout # evidence: restarts, events, log tail, dependenciesrtz rca explain payments/checkout # narrative root causertz signals # slowest operations by p99rtz signals traces # slowest individual tracesrtz changes --since 24 # what changed, newest firstrtz changes payments/checkout # one workload's historyWhen it cannot tell you
Section titled “When it cannot tell you”These commands distinguish “nothing is wrong” from “we could not see”, because a clean score computed from missing evidence is the most dangerous output the tool could produce:
riskwarns when it scored without metrics, CVE data, runtime or network signals.risk security/cvesay when a cluster has never been scanned, rather than reporting zero findings as clean.rcaprints “no trace data for this workload” instead of a fabricated 0% error rate.rca explainstates whether the answer came from a model, a cache replay, or a deterministic gate.
Output
Section titled “Output”Every command supports -o table|wide|json|yaml. The JSON is the unwrapped payload — never
the API envelope — so jq needs no .data prefix:
rtz cluster ls -o json | jq -r '.[] | select(.status != "CONNECTED") | .name'