Guides

Each of these is a job rather than a command: find what’s broken, see what a workload owns, get a credential out, check images for CVEs, get a shell, take a node out of service, run any of it in a pipeline. The command reference has the flags; these pages have the shape of the work.

Triage a namespace kx diag ranks what is unhealthy, and the rows are indexed so you can drill in. Scan images for CVEs kx scan resolves a workload's unique images and scans each one, with Docker Scout, Trivy or Grype. Read a Secret in plaintext kx secret --decode, and -k for a single value that drops straight into a shell. See what owns what kx tree walks ownership references from controllers down to containers. Reports in the browser --html renders the same analysis as a page, served from memory on localhost. Get a shell in a workload kx exec takes a Deployment as readily as a Pod, so you don't have to list pods first. Take a node out of service Diagnose a node, stop the scheduler using it, and evict what is already there. Use kx in CI --json prints the analysis as a document, --fail-on turns it into a gate that exits 2.