Workloads

The Workloads screen shows every workload Riptides is observing across your connected hosts. A workload is a process running on a host, and Riptides observes each one together with the environment it runs in. The screen shows whether each has been matched to an identity. It is the observe-side counterpart to Identities: Identities is what you configure, Workloads is what Riptides actually sees running.

Open it from Observe → Workloads in the sidebar (/ui/workloads).

What you see

A table of observed workloads, with these columns:

Status: Active or Inactive.
Name: the process name, with an icon indicating the environment it runs in (a plain host process, a container, or a Kubernetes pod).
Identity: the workload identity that matches it. A warning icon appears when more than one identity matches (overlapping identities).
Node: the host (daemon) it runs on, with cloud provider and instance shown where known.
Last Seen: when it was last observed.

Search by name, and filter by Status, Type, Identity (whether it has one), and Node. A Show System Processes toggle brings in operating-system processes, which are hidden by default.

A workload versus an identity

A workload is a process running on one of your hosts, observed live (with a status and last-seen time). Riptides records the environment it runs in as metadata: the container or Kubernetes pod when there is one, or plain host facts otherwise. A workload identity is what you configure to give that process a cryptographic identity. The Identity column links an observed workload to the identity that matches it. A workload can have no identity yet, exactly one, or several overlapping ones.

Opening a workload

Click a row to open its detail panel:

Workload Identity: the identity matching it, and any overlapping or conflicting identities.
Environment: node, region, and instance type.
Key Metadata: the facts Riptides collected about the process and its environment (for example the process name and user, plus Kubernetes namespace, service account, and image, or Docker container name and image, depending on where it runs).
Inbound and Outbound connections: what talks to it and what it talks to, with encryption and peer identity.
The full workload and daemon metadata.

The panel also has a Create identity action that opens the identity form prefilled from this workload’s metadata: a quick way to turn something you are observing into a configured identity.

Next steps

Identities: configure the identities workloads are matched to.
Connections: see the traffic between workloads.