fix: correct RBAC verb and WebSocket fallback for pods/exec
This commit fixes three related issues that prevented exec collectors from
working with minimal RBAC permissions:
1. RBAC preflight check used wrong verb for pods/exec
Changed from "get" to "create" in v1beta1 and v1beta2 AccessReviewSpecs.
The pods/exec subresource requires "create" to execute commands.
2. WebSocket fallback used wrong httpstream package import
The fallback executor checked IsUpgradeFailure using the apimachinery
httpstream package, but the roundtripper creates UpgradeFailureError using
the streaming httpstream package. These are different Go types, so
errors.As always returned false and fallback to SPDY never triggered.
Changed import to k8s.io/streaming/pkg/httpstream.
3. Stdin mismatch caused SPDY fallback to hang
PodExecOptions always set Stdin:true but StreamOptions always passed
Stdin:nil. When WebSocket failed and fell back to SPDY, the server
waited for stdin data that never arrived. Changed Stdin to false in
PodExecOptions for exec, copy, and copy_from_host collectors.
* docs: add design spec for SPDY executor removal
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: add implementation plan for SPDY executor removal
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(k8sutil): add NewFallbackExecutor helper
* fix(k8sutil): rename url param to u to avoid shadowing net/url
* refactor(collect): use fallback executor in exec collector
* refactor(collect): use fallback executor in copy collector
* refactor(collect): use fallback executor in copy_from_host collector
* refactor(collect): use fallback executor in sonobuoy_results collector
* refactor(collect): use fallback executor in etcd collector
* refactor(collect): use fallback executor in longhorn collector
* refactor(supportbundle): use fallback executor in collect
* chore(k8sutil): delete unused PortForward function
* fix(k8sutil): use GET for WebSocket executor and broaden fallback predicate
WebSocket upgrade requires GET per RFC 6455. Also add IsHTTPSProxyError to
the fallback predicate so HTTPS proxy environments fall back to SPDY correctly,
matching kubectl's implementation. Remove method param from NewFallbackExecutor
since the methods are now transport-specific and not caller-controlled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: remove superpowers docs artifacts
* fix(collect): enable stdout capture in exec collector
* fix(collect): enable stdout capture in copy collectors
PodExecOptions.Stdout: false causes the WebSocket API server to discard
stdout entirely, silently breaking tar output for file copy operations.
With SPDY this mismatch was harmless; WebSocket strictly respects the field.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: record skipped collectors in bundle and improve CLI warnings
- Write `skipped-collectors.json` to the support bundle and preflight bundle recording which collectors were skipped (RBAC permissions or spec exclusion), with reason, errors, and timestamp
- Surface RBAC errors and skipped-collector messages as `klog.Warningf` in non-interactive mode so they're visible without `-v` flags
- Exec collector file naming now falls back to the resolved container name (from the pod spec) when `collectorName` is not set, instead of only checking `containerName` from the spec
Signed-off-by: Evans Mungai <evans@replicated.com>
* Address comment
Signed-off-by: Evans Mungai <evans@replicated.com>
* fix bugbot comment
Signed-off-by: Evans Mungai <evans@replicated.com>
* Remove unused var
Signed-off-by: Evans Mungai <evans@replicated.com>
* Address comment
Signed-off-by: Evans Mungai <evans@replicated.com>
* Use results.SaveResult and add automated tests
Signed-off-by: Evans Mungai <evans@replicated.com>
* Improvements
Signed-off-by: Evans Mungai <evans@replicated.com>
* Fix bugbot
Signed-off-by: Evans Mungai <evans@replicated.com>
* Handle bugbot
Signed-off-by: Evans Mungai <evans@replicated.com>
---------
Signed-off-by: Evans Mungai <evans@replicated.com>
* fix: document .tar.gz auto-append in --output flag help text
The --output flag silently appends .tar.gz to the provided path, which
was not mentioned in the help text, causing confusion for users who
expected the exact filename they specified.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: exec collector falls back to containerName for file naming
When collectorName is not set, the exec collector now uses containerName
as the output file prefix instead of producing bare -stdout.txt filenames.
This makes output files identifiable without requiring collectorName to
be explicitly set.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: goldpinger analyser
Analyser to generate a report from goldpinger results
* Add goldpinger testdata
* Goldpinger collector
* Improvements after running tests
* More minor updates after further testing
* Better error message if a container fails to start
* A few more updates
* Add goldpinger e2e test
* Update schemas
* Clean up help installs in e2e tests
* Add resource limits to goldpinger pods
* Some minor improvements
* Some more changes noted when writing docs
* Update schemas
* A few more updates when testing with kURL
* Log goldpinger tests
* Tests before exit code
add redact type, and begin wiring global redactors
use per-collector redactors
add a test of the 'data' collector and redaction
handle literal string replacements
remove redundant types and redact calls
add proper redactor type, foundations of global redactors
accept global redactors from the CLI, include sample redaction spec
Ethan Mosbaugh
Evans Mungai
Gerard Nguyen
Diamon Wiggins
divolgin
Marc Campbell
Andrew Lavery