fix: correct RBAC verb and WebSocket fallback for pods/exec
This commit fixes three related issues that prevented exec collectors from
working with minimal RBAC permissions:
1. RBAC preflight check used wrong verb for pods/exec
Changed from "get" to "create" in v1beta1 and v1beta2 AccessReviewSpecs.
The pods/exec subresource requires "create" to execute commands.
2. WebSocket fallback used wrong httpstream package import
The fallback executor checked IsUpgradeFailure using the apimachinery
httpstream package, but the roundtripper creates UpgradeFailureError using
the streaming httpstream package. These are different Go types, so
errors.As always returned false and fallback to SPDY never triggered.
Changed import to k8s.io/streaming/pkg/httpstream.
3. Stdin mismatch caused SPDY fallback to hang
PodExecOptions always set Stdin:true but StreamOptions always passed
Stdin:nil. When WebSocket failed and fell back to SPDY, the server
waited for stdin data that never arrived. Changed Stdin to false in
PodExecOptions for exec, copy, and copy_from_host collectors.
* docs: add design spec for SPDY executor removal
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: add implementation plan for SPDY executor removal
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(k8sutil): add NewFallbackExecutor helper
* fix(k8sutil): rename url param to u to avoid shadowing net/url
* refactor(collect): use fallback executor in exec collector
* refactor(collect): use fallback executor in copy collector
* refactor(collect): use fallback executor in copy_from_host collector
* refactor(collect): use fallback executor in sonobuoy_results collector
* refactor(collect): use fallback executor in etcd collector
* refactor(collect): use fallback executor in longhorn collector
* refactor(supportbundle): use fallback executor in collect
* chore(k8sutil): delete unused PortForward function
* fix(k8sutil): use GET for WebSocket executor and broaden fallback predicate
WebSocket upgrade requires GET per RFC 6455. Also add IsHTTPSProxyError to
the fallback predicate so HTTPS proxy environments fall back to SPDY correctly,
matching kubectl's implementation. Remove method param from NewFallbackExecutor
since the methods are now transport-specific and not caller-controlled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: remove superpowers docs artifacts
* fix(collect): enable stdout capture in exec collector
* fix(collect): enable stdout capture in copy collectors
PodExecOptions.Stdout: false causes the WebSocket API server to discard
stdout entirely, silently breaking tar output for file copy operations.
With SPDY this mismatch was harmless; WebSocket strictly respects the field.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Importing k8s.io/kubernetes causes any go modules that depend on this one to
have some issues. For example, the following happens in a module that depends on
troubleshoot:
```shell
$ go list -modfile=./go.mod -m -json -mod=mod all
go: k8s.io/cloud-provider@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/cluster-bootstrap@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/controller-manager@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/cri-client@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/csi-translation-lib@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/dynamic-resource-allocation@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/endpointslice@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/externaljwt@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/kube-controller-manager@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/kube-proxy@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/kube-scheduler@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/mount-utils@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/pod-security-admission@v0.0.0: invalid version: unknown revision v0.0.0
go: k8s.io/sample-apiserver@v0.0.0: invalid version: unknown revision v0.0.0
```
The only thing being used from k8s.io/kubernetes is a simple utility function,
`TaintExists`. Copy it into pkg/k8sutil to eliminate the need for the import.
Signed-off-by: Adam Wolfe Gordon <awg@upbound.io>
Co-authored-by: Andrew Lavery <laverya@umich.edu>
* fix: Discover specs from namespaces user is allowed
If a user has limited access to read secrets and config maps
from certain namespaces in a cluster, we'd need to gracefully
fail when forbidden errors are caught. We'll log them and continue
searching for specs in other namespaces.
Ethan Mosbaugh
Adam Wolfe GordonandAndrew Lavery
ada mancini
Benjamin Yang
Dexter Yan
Evans Mungai
deepsource-autofix[bot]
Simon Croome
Andrew Reed
Marc Campbell