Skip to content

Sveltos Visibility

Sveltoctl Visibility

sveltosctl nicely displays the add-ons deployed in every Sveltos managed Kubernetes cluster.

show addons

show addons can be used to display a list of Kubernetes add-ons deployed in each clusters by Sveltos.

The displayed information are:

  • The CAPI/Sveltos Cluster in the form namespace/name;
  • Resource/helm chart information;
  • Time resource/helm chart was deployed;
  • ClusterProfiles that caused resource/helm chart to be deployed in the cluster.
$ sveltosctl show addons
+-------------------------------------+---------------+-----------+----------------+---------+-------------------------------+------------------+
|               CLUSTER               | RESOURCE TYPE | NAMESPACE |      NAME      | VERSION |             TIME              | CLUSTER PROFILE |
+-------------------------------------+---------------+-----------+----------------+---------+-------------------------------+------------------+
| default/sveltos-management-workload | helm chart    | kyverno   | kyverno-latest | v2.5.0  | 2022-09-30 11:48:45 -0700 PDT | clusterprofile1   |
| default/sveltos-management-workload | :Pod          | default   | nginx          | N/A     | 2022-09-30 13:41:05 -0700 PDT | clusterprofile2   |
+-------------------------------------+---------------+-----------+----------------+---------+-------------------------------+------------------+

show addons command allows filtering by:

  • clusters' namespace
  • clusters' name
  • ClusterProfile
  • resource type (Helm releases only, or Kubernetes resources only)
$ sveltosctl show addons --help
Usage:
  sveltosctl show features [options] [--namespace=<name>] [--cluster=<name>] [--clusterprofile=<name>] [--helm-charts] [--resources] [--verbose]

     --namespace=<name>      Show features deployed in clusters in this namespace. If not specified all namespaces are considered.
     --cluster=<name>        Show features deployed in cluster with name. If not specified all cluster names are considered.
     --clusterprofile=<name> Show features deployed because of this clusterprofile. If not specified all clusterprofile names are considered.
     --helm-charts           Show only Helm releases. Cannot be combined with --resources.
     --resources             Show only Kubernetes resources. Cannot be combined with --helm-charts.

show resources

Using Projectsveltos can facilitate the display of information about resources in managed clusters.

Checkout the observability section for more details.

$ sveltosctl show resources --kind=pod --namespace=nginx
+-----------------------------+---------------+-----------+-----------------------------------+-------------------+
|           CLUSTER           |      GVK      | NAMESPACE |               NAME                |      MESSAGE      |
+-----------------------------+---------------+-----------+-----------------------------------+-------------------+
| default/clusterapi-workload | /v1, Kind=Pod | nginx     | nginx-deployment-85996f8dbd-7tctq | Deployment: nginx |
|                             |               | nginx     | nginx-deployment-85996f8dbd-tz4gd | Deployment: nginx |
| gke/pre-production          |               | nginx     | nginx-deployment-c4f7848dc-6jtwg  | Deployment: nginx |
|                             |               | nginx     | nginx-deployment-c4f7848dc-trllk  | Deployment: nginx |
| gke/production              |               | nginx     | nginx-deployment-676cf9b46d-k84pb | Deployment: nginx |
|                             |               | nginx     | nginx-deployment-676cf9b46d-mmbl4 | Deployment: nginx |
+-----------------------------+---------------+-----------+-----------------------------------+-------------------+

show usage

show usage displays below information:

  • Which clusters are currently a match for a ClusterProfile;
  • For ConfigMap/Secret list of clusters where their content is currently deployed.

Such information is useful to see what clusters would be affected by a change before making such a change.

$ sveltosctl show usage
+----------------+--------------------+----------------------------+-------------------------------------+
| RESOURCE KIND  | RESOURCE NAMESPACE |       RESOURCE NAME        |              CLUSTERS               |
+----------------+--------------------+----------------------------+-------------------------------------+
| ClusterProfile |                    | kyverno                    | default/sveltos-management-workload |
| ConfigMap      | default            | kyverno-disallow-gateway   | default/sveltos-management-workload |
+----------------+--------------------+----------------------------+-------------------------------------+

show classifier-labels

show classifier-labels displays labels that Classifier and ManagementClusterClassifier instances are actively managing on each cluster, along with the name of the instance that owns each label.

The displayed information are:

  • The CAPI/Sveltos Cluster in the form namespace/name;
  • Label key and value;
  • The name of the Classifier or ManagementClusterClassifier instance managing the label;
  • The type (Classifier or ManagementClusterClassifier).
$ sveltosctl show classifier-labels
+-----------------------------+-------------+------------+-------------------------+----------------------------+
|           CLUSTER           |     KEY     |   VALUE    |      CLASSIFIER/MCC     |           TYPE             |
+-----------------------------+-------------+------------+-------------------------+----------------------------+
| capi-clusters/prod-eu1      | env         | production | tag-production-clusters | ManagementClusterClassifier|
| capi-clusters/prod-eu1      | cost-centre | platform   | tag-production-clusters | ManagementClusterClassifier|
| capi-clusters/staging-eu1   | gatekeeper  | v3-10      | deploy-gatekeeper-3-10  | Classifier                 |
+-----------------------------+-------------+------------+-------------------------+----------------------------+

show classifier-labels allows filtering by:

  • clusters' namespace
  • clusters' name

Pass --warnings to display only label conflicts, where two instances are competing to own the same label key on the same cluster:

$ sveltosctl show classifier-labels --warnings
+-----------------------------+------+------------------+------------+----------------------------------------------+
|           CLUSTER           | KEY  |    WANTED BY     |    TYPE    |                   CONFLICT                   |
+-----------------------------+------+------------------+------------+----------------------------------------------+
| capi-clusters/prod-eu1      | env  | other-classifier | Classifier | label already managed by tag-production-...  |
+-----------------------------+------+------------------+------------+----------------------------------------------+

show admin-rbac

show admin-rbac can be used to display permissions granted to tenant admins in each managed clusters by the platform admin.

If we have two clusters, a ClusterAPI powered one and a SveltosCluster, both matching label selector env=internal and we post RoleRequests, we get:

$ sveltosctl show admin-rbac
+---------------------------------------------+-------+----------------+------------+-----------+----------------+-------+
|                   CLUSTER                   | ADMIN |   NAMESPACE    | API GROUPS | RESOURCES | RESOURCE NAMES | VERBS |
+---------------------------------------------+-------+----------------+------------+-----------+----------------+-------+
| Cluster:default/sveltos-management-workload | eng   | build          | *          | *         | *              | *     |
| Cluster:default/sveltos-management-workload | eng   | ci-cd          | *          | *         | *              | *     |
| Cluster:default/sveltos-management-workload | hr    | human-resource | *          | *         | *              | *     |
| SveltosCluster:gke/prod-cluster             | eng   | build          | *          | *         | *              | *     |
| SveltosCluster:gke/prod-cluster             | eng   | ci-cd          | *          | *         | *              | *     |
| SveltosCluster:gke/prod-cluster             | hr    | human-resource | *          | *         | *              | *     |
+---------------------------------------------+-------+----------------+------------+-----------+----------------+-------+

show helm-updates

show helm-updates displays, for every Helm release Sveltos manages in a cluster, whether a newer version or a newer same-minor patch is currently published upstream, based on addon-controller's periodic check (see Detecting Newer Helm Chart Versions).

The displayed information are:

  • The CAPI/Sveltos Cluster in the form namespace/name;
  • Release namespace;
  • Release name;
  • Currently deployed version;
  • Newer version, if one is published upstream;
  • Newer same-minor patch version, if one is published upstream.
$ sveltosctl show helm-updates --namespace=default --cluster=clusterapi-workload
┌─────────────────────────────┬──────────────────────┬────────────────┬─────────────────┬───────────────┬─────────────────────┐
│           CLUSTER           │      NAMESPACE       │  RELEASE NAME  │ CURRENT VERSION │ NEWER VERSION │ NEWER PATCH VERSION │
├─────────────────────────────┼──────────────────────┼────────────────┼─────────────────┼───────────────┼─────────────────────┤
│ default/clusterapi-workload │ nats                 │ nats           │ 1.2.9           │ 2.14.2        │ 1.2.11              │
│ default/clusterapi-workload │ prometheus           │ prometheus     │ 26.0.0          │ 29.18.0       │ 26.0.1              │
│ default/clusterapi-workload │ grafana              │ grafana        │ 11.3.6          │ 12.8.0        │ 11.3.8              │
│ default/clusterapi-workload │ cert-manager         │ cert-manager   │ v1.19.4         │ 1.21.0        │ 1.19.6              │
└─────────────────────────────┴──────────────────────┴────────────────┴─────────────────┴───────────────┴─────────────────────┘

A release with no entry in NEWER VERSION or NEWER PATCH VERSION is confirmed up to date as of the last check; a release Sveltos hasn't checked yet simply doesn't appear.

show helm-updates allows filtering by:

  • clusters' namespace
  • clusters' name
  • clusters' type (Capi or Sveltos)
$ sveltosctl show helm-updates --help
Usage:
  sveltosctl show helm-updates [options] [--namespace=<name>] [--cluster=<name>] [--cluster-type=<type>] [--verbose]

     --namespace=<name>      Show outdated helm charts deployed in clusters in this namespace.
                             If not specified all namespaces are considered.
     --cluster=<name>        Show outdated helm charts deployed in cluster with name.
                             If not specified all cluster names are considered.
     --cluster-type=<type>   Show outdated helm charts deployed in cluster with this type
                          (Capi or Sveltos). If not specified all cluster types are considered.

show drift-history

show drift-history displays the resources that drifted from the configuration Sveltos deployed, and when each drift was detected. Drift is only detected for profiles with syncMode set to ContinuousWithDriftDetection (see Configuration Drift).

The displayed information are:

  • The CAPI/Sveltos Cluster in the form namespace/name;
  • The (Cluster)Profile in the form kind/name;
  • The feature that deployed the resource (Helm, Resources or Kustomize);
  • The kind of the drifted resource, in the form Kind.group (just Kind for resources in the core group);
  • The namespace and name of the drifted resource;
  • When the latest drift of the resource was detected. Times are RFC3339, in UTC;
  • The Helm release that deployed the resource (only for the Helm feature).
$ sveltosctl show drift-history --namespace=civo --cluster=civo-cluster1
┌────────────────────┬───────────────────────────────────┬───────────┬─────────────────┬───────────────┬──────────────────────────────────┬──────────────────────┬───────────────────────┐
│      CLUSTER       │              PROFILE              │  FEATURE  │      KIND       │   NAMESPACE   │               NAME               │       DETECTED       │     HELM RELEASE      │
├────────────────────┼───────────────────────────────────┼───────────┼─────────────────┼───────────────┼──────────────────────────────────┼──────────────────────┼───────────────────────┤
│ civo/civo-cluster1 │ ClusterProfile/civo-baseline-app  │ Resources │ ConfigMap       │ demo-app      │ app-config                       │ 2026-10-10T10:58:56Z │ -                     │
│ civo/civo-cluster1 │ ClusterProfile/civo-nginx-ingress │ Helm      │ ServiceAccount  │ ingress-nginx │ ingress-nginx-ingress            │ 2026-10-10T10:58:56Z │ ingress-nginx/ingress │
│ civo/civo-cluster1 │ ClusterProfile/civo-nginx-ingress │ Helm      │ Deployment.apps │ ingress-nginx │ ingress-nginx-ingress-controller │ 2026-10-10T10:28:36Z │ ingress-nginx/ingress │
└────────────────────┴───────────────────────────────────┴───────────┴─────────────────┴───────────────┴──────────────────────────────────┴──────────────────────┴───────────────────────┘

For each feature, the most recently drifted resources are displayed first. A resource that drifts again is displayed once, with the time of its latest drift. Sveltos keeps at most 20 resources for each feature, dropping the oldest ones.

When a drift was detected but the resources that changed were not reported, the KIND column displays (not reported). When the latest drift involved more resources than could be reported, a note below the table says the list is incomplete.

show drift-history allows filtering by:

  • clusters' namespace
  • clusters' name
  • clusters' type (Capi or Sveltos)
  • profile name
  • feature (Helm, Resources or Kustomize)
$ sveltosctl show drift-history --help
Usage:
  sveltosctl show drift-history [options] [--namespace=<name>] [--cluster=<name>] [--cluster-type=<type>] [--profile=<name>] [--feature=<name>] [--verbose]

     --namespace=<name>      Show drift history of clusters in this namespace.
                             If not specified all namespaces are considered.
     --cluster=<name>        Show drift history of cluster with name.
                             If not specified all cluster names are considered.
     --cluster-type=<type>   Show drift history of clusters with this type
                             (Capi or Sveltos). If not specified all cluster types are considered.
     --profile=<name>        Show drift history of resources deployed by the (Cluster)Profile with this name.
                             If not specified all profiles are considered.
     --feature=<name>        Show drift history of resources deployed by this feature
                             (Helm, Resources or Kustomize). If not specified all features are considered.

show unhealthy-resources

show unhealthy-resources displays the resources that health monitoring found not healthy. Health monitoring is enabled with spec.healthMonitoring in a ClusterProfile or Profile.

The displayed information are:

  • The CAPI/Sveltos Cluster in the form namespace/name;
  • The (Cluster)Profile that owns the HealthCheck that reported the resource, in the form kind/name. When no profile owns the HealthCheck, the HealthCheck is displayed instead, in the form HealthCheck/name;
  • The kind of the resource, in the form Kind.group (just Kind for resources in the core group);
  • The namespace and name of the resource;
  • The status of the resource (Degraded, Progressing or Suspended);
  • Why the resource is not healthy.
$ sveltosctl show unhealthy-resources --namespace=civo --cluster=civo-cluster1
┌────────────────────┬───────────────────────────────────┬───────────────────────┬───────────────┬──────────────────────────┬─────────────┬──────────────────────────────────────────────────────────────────────┐
│      CLUSTER       │              PROFILE              │         KIND          │   NAMESPACE   │           NAME           │   STATUS    │                               MESSAGE                                │
├────────────────────┼───────────────────────────────────┼───────────────────────┼───────────────┼──────────────────────────┼─────────────┼──────────────────────────────────────────────────────────────────────┤
│ civo/civo-cluster1 │ ClusterProfile/civo-nginx-ingress │ Deployment.apps       │ ingress-nginx │ ingress-nginx-controller │ Degraded    │ Deployment "ingress-nginx-controller" exceeded its progress deadline │
│ civo/civo-cluster1 │ ClusterProfile/civo-baseline-app  │ Job.batch             │ demo-app      │ db-migrate               │ Degraded    │ Job failed: BackoffLimitExceeded                                     │
│ civo/civo-cluster1 │ ClusterProfile/civo-baseline-app  │ PersistentVolumeClaim │ demo-app      │ data                     │ Progressing │ PersistentVolumeClaim is not bound yet                               │
│ civo/civo-cluster1 │ HealthCheck/crashloop-pods        │ Pod                   │ demo-app      │ worker-7d9f6             │ Degraded    │ container worker is in CrashLoopBackOff                              │
└────────────────────┴───────────────────────────────────┴───────────────────────┴───────────────┴──────────────────────────┴─────────────┴──────────────────────────────────────────────────────────────────────┘
Note: civo/civo-cluster2: no unhealthy resources.

The resources owned by a profile are displayed first, the worst status first. The ones no profile owns follow.

Only the resources that are not healthy are displayed. When nothing is displayed for a cluster, a note below the table says why, so that an empty table is never mistaken for a healthy cluster:

  • health monitoring is not enabled;
  • health monitoring is enabled but no health report has been received yet;
  • there are no unhealthy resources.

show unhealthy-resources allows filtering by:

  • clusters' namespace
  • clusters' name
  • clusters' type (Capi or Sveltos)
  • profile name. Only the resources reported through that profile are displayed, and the ones no profile owns are not. The note under the table, if any, is about that profile.
$ sveltosctl show unhealthy-resources --help
Usage:
  sveltosctl show unhealthy-resources [options] [--namespace=<name>] [--cluster=<name>] [--cluster-type=<type>] [--profile=<name>] [--verbose]

     --namespace=<name>      Show unhealthy resources of clusters in this namespace.
                             If not specified all namespaces are considered.
     --cluster=<name>        Show unhealthy resources of cluster with name.
                             If not specified all cluster names are considered.
     --cluster-type=<type>   Show unhealthy resources of clusters with this type
                             (Capi or Sveltos). If not specified all cluster types are considered.
     --profile=<name>        Show only the unhealthy resources reported through the (Cluster)Profile with this name.
                             Resources no profile owns are not displayed. If not specified all profiles are considered.