fix: correct RBAC verb and WebSocket fallback for pods/exec
This commit fixes three related issues that prevented exec collectors from
working with minimal RBAC permissions:
1. RBAC preflight check used wrong verb for pods/exec
Changed from "get" to "create" in v1beta1 and v1beta2 AccessReviewSpecs.
The pods/exec subresource requires "create" to execute commands.
2. WebSocket fallback used wrong httpstream package import
The fallback executor checked IsUpgradeFailure using the apimachinery
httpstream package, but the roundtripper creates UpgradeFailureError using
the streaming httpstream package. These are different Go types, so
errors.As always returned false and fallback to SPDY never triggered.
Changed import to k8s.io/streaming/pkg/httpstream.
3. Stdin mismatch caused SPDY fallback to hang
PodExecOptions always set Stdin:true but StreamOptions always passed
Stdin:nil. When WebSocket failed and fell back to SPDY, the server
waited for stdin data that never arrived. Changed Stdin to false in
PodExecOptions for exec, copy, and copy_from_host collectors.
* docs: add design spec for SPDY executor removal
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: add implementation plan for SPDY executor removal
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(k8sutil): add NewFallbackExecutor helper
* fix(k8sutil): rename url param to u to avoid shadowing net/url
* refactor(collect): use fallback executor in exec collector
* refactor(collect): use fallback executor in copy collector
* refactor(collect): use fallback executor in copy_from_host collector
* refactor(collect): use fallback executor in sonobuoy_results collector
* refactor(collect): use fallback executor in etcd collector
* refactor(collect): use fallback executor in longhorn collector
* refactor(supportbundle): use fallback executor in collect
* chore(k8sutil): delete unused PortForward function
* fix(k8sutil): use GET for WebSocket executor and broaden fallback predicate
WebSocket upgrade requires GET per RFC 6455. Also add IsHTTPSProxyError to
the fallback predicate so HTTPS proxy environments fall back to SPDY correctly,
matching kubectl's implementation. Remove method param from NewFallbackExecutor
since the methods are now transport-specific and not caller-controlled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: remove superpowers docs artifacts
* fix(collect): enable stdout capture in exec collector
* fix(collect): enable stdout capture in copy collectors
PodExecOptions.Stdout: false causes the WebSocket API server to discard
stdout entirely, silently breaking tar output for file copy operations.
With SPDY this mismatch was harmless; WebSocket strictly respects the field.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Ethan Mosbaugh
