update cluster creation action in regression-test.yaml

* Bump Go to version from 1.24.6 to 1.25.4

* fix: use net.JoinHostPort for IPv6 compatibility

Fix IPv6 address formatting in namespace-pinger.go by replacing
fmt.Sprintf with net.JoinHostPort, which correctly handles both
IPv4 and IPv6 addresses.

Changes:
- PingTCP: Use net.JoinHostPort for client connections
- startTCPEchoServer: Use net.JoinHostPort for server listener

This fixes go vet errors introduced by Go 1.25's stricter checks:
  address format "%s:%d" does not work with IPv6

IPv4 example: 192.168.1.1:8080
IPv6 example: [::1]:8080 (brackets added automatically)

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Nicholas Mullen <nwmullen@gmail.com>

.github/workflows/build-test-deploy.yaml

@@ -59,7 +59,7 @@ jobs:
         with:
           go-version-file: 'go.mod'
       - run: make generate preflight
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: preflight
           path: bin/preflight
@@ -74,7 +74,7 @@ jobs:
         with:
           version: v1.31.2-k3s1
       - name: Download preflight binary
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: preflight
           path: bin/
@@ -89,7 +89,7 @@ jobs:
         with:
           go-version-file: 'go.mod'
       - run: make generate support-bundle
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: support-bundle
           path: bin/support-bundle
@@ -104,7 +104,7 @@ jobs:
         with:
           version: v1.31.2-k3s1
       - name: Download support bundle binary
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: support-bundle
           path: bin/
@@ -118,13 +118,13 @@ jobs:
      steps:
       - uses: actions/checkout@v5
       - name: Download support bundle binary
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: support-bundle
           path: bin/
       - run: chmod +x bin/support-bundle
       - name: Download preflight binary
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: preflight
           path: bin/

.github/workflows/build-test.yaml

@@ -92,7 +92,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-go
       - run: make build
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: binaries
           path: bin/
@@ -126,7 +126,7 @@ jobs:
         with:
           version: v1.31.2-k3s1
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v6
         with:
           name: binaries
           path: bin/

.github/workflows/regression-test.yaml

@@ -14,13 +14,14 @@ on:
 
 jobs:
   regression-test:
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-22.04
     timeout-minutes: 25
 
     steps:
       # 1. SETUP
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0  # Fetch all history for git describe to work
 
@@ -28,25 +29,16 @@ jobs:
         run: mkdir -p test/output
 
       - name: Create k3s cluster
-        id: create-cluster
-        uses: replicatedhq/compatibility-actions/create-cluster@v1
+        id: k3s
+        uses: replicatedhq/action-k3s@main
         with:
-          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
-          kubernetes-distribution: k3s
-          cluster-name: regression-${{ github.run_id }}-${{ github.run_attempt }}
-          ttl: 25m
-          timeout-minutes: 5
-
-      - name: Configure kubeconfig
-        run: |
-          echo "${{ steps.create-cluster.outputs.cluster-kubeconfig }}" > $GITHUB_WORKSPACE/kubeconfig.yaml
-          echo "KUBECONFIG=$GITHUB_WORKSPACE/kubeconfig.yaml" >> $GITHUB_ENV
+          version: v1.31.2-k3s1
 
       - name: Verify cluster access
         run: kubectl get nodes -o wide
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache: true
@@ -60,7 +52,7 @@ jobs:
           ./bin/support-bundle version
 
       - name: Setup Python for comparison
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
@@ -200,7 +192,7 @@ jobs:
 
       - name: Upload test artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: regression-test-results-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -283,10 +275,4 @@ jobs:
           git push
 
       # 6. CLEANUP
-      - name: Remove cluster
-        if: always()
-        uses: replicatedhq/compatibility-actions/remove-cluster@v1
-        continue-on-error: true
-        with:
-          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
-          cluster-id: ${{ steps.create-cluster.outputs.cluster-id }}
+      # Note: k3s cluster cleanup is handled automatically by the action

.github/workflows/upgrade-go.yaml

@@ -0,0 +1,24 @@
+name: Upgrade Go Version
+
+on:
+  # Run manually when needed
+  workflow_dispatch:
+  # Run weekly on Mondays at 8am UTC
+  schedule:
+    - cron: "0 8 * * MON"
+
+jobs:
+  upgrade-go:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Check for Go updates
+        uses: StefMa/Upgrade-Go-Action@v1
+        with:
+          base-branch: 'main'
+          gh-token: ${{ secrets.TROUBLESHOOT_GH_PAT }}

.gitignore

@@ -50,9 +50,9 @@ sbom/
 !testdata/supportbundle/*.tar.gz
 !test/baselines/**/baseline.tar.gz
 
-# Ignore built binaries
-troubleshoot
-troubleshoot-test
+# Ignore built binaries (use / prefix to avoid catching source files)
+/troubleshoot
+/troubleshoot-test
 cmd/troubleshoot/troubleshoot
 cmd/*/troubleshoot
-support-bundle
+/support-bundle

cmd/preflight/cli/docs.go

@@ -88,7 +88,7 @@ func extractDocs(templateFiles []string, valuesFiles []string, setValues []strin
 		if err != nil {
 			return errors.Wrapf(err, "failed to load values file %s", valuesFile)
 		}
-		values = mergeMaps(values, fileValues)
+		values = preflight.MergeMaps(values, fileValues)
 	}
 
 	// Normalize maps for Helm set merging
@@ -331,25 +331,6 @@ func setNestedValue(m map[string]interface{}, keys []string, value interface{})
 	}
 }
 
-func mergeMaps(base, overlay map[string]interface{}) map[string]interface{} {
-	result := make(map[string]interface{})
-	for k, v := range base {
-		result[k] = v
-	}
-	for k, v := range overlay {
-		if baseVal, exists := result[k]; exists {
-			if baseMap, ok := baseVal.(map[string]interface{}); ok {
-				if overlayMap, ok := v.(map[string]interface{}); ok {
-					result[k] = mergeMaps(baseMap, overlayMap)
-					continue
-				}
-			}
-		}
-		result[k] = v
-	}
-	return result
-}
-
 func renderTemplate(templateContent string, values map[string]interface{}) (string, error) {
 	tmpl := template.New("preflight").Funcs(sprig.FuncMap())
 	tmpl, err := tmpl.Parse(templateContent)

cmd/preflight/cli/lint.go

@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/lint"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func LintCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lint [spec-files...]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Lint v1beta2/v1beta3 preflight specs for syntax and structural errors",
+		Long: `Lint v1beta2/v1beta3 preflight specs for syntax and structural errors.
+
+This command validates v1beta2/v1beta3 preflight specs and checks for:
+- YAML syntax errors
+- Missing required fields (apiVersion, kind, metadata, spec)
+- Invalid template syntax ({{ .Values.* }})
+- Missing analyzers or collectors
+- Common structural issues
+- Missing docStrings (warning)
+
+Examples:
+  # Lint a single spec file
+  preflight lint my-preflight.yaml
+
+  # Lint multiple spec files
+  preflight lint spec1.yaml spec2.yaml spec3.yaml
+
+  # Lint with automatic fixes
+  preflight lint --fix my-preflight.yaml
+
+  # Lint and output as JSON for CI/CD integration
+  preflight lint --format json my-preflight.yaml
+
+Notes:
+- v1beta2 does not support templating; template syntax in v1beta2 files will be flagged as errors.
+- v1beta3 supports templating and is linted with template-awareness.
+
+Exit codes:
+  0 - No errors found
+  2 - Validation errors found`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			opts := lint.LintOptions{
+				FilePaths:   args,
+				Fix:         v.GetBool("fix"),
+				Format:      v.GetString("format"),
+				ValuesFiles: v.GetStringSlice("values"),
+				SetValues:   v.GetStringSlice("set"),
+			}
+
+			return runLint(opts)
+		},
+	}
+
+	cmd.Flags().Bool("fix", false, "Automatically fix issues where possible")
+	cmd.Flags().String("format", "text", "Output format: text or json")
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files with template values (required for v1beta3 specs)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values via command line (e.g., --set key=value)")
+
+	return cmd
+}
+
+func runLint(opts lint.LintOptions) error {
+	// Validate file paths exist
+	for _, filePath := range opts.FilePaths {
+		if _, err := os.Stat(filePath); err != nil {
+			return errors.Wrapf(err, "file not found: %s", filePath)
+		}
+	}
+
+	// Run linting
+	results, err := lint.LintFiles(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to lint files")
+	}
+
+	// Format and print results
+	output := lint.FormatResults(results, opts.Format)
+	fmt.Print(output)
+
+	// Return appropriate exit code
+	if lint.HasErrors(results) {
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES, nil)
+	}
+
+	return nil
+}

cmd/preflight/cli/root.go

@@ -89,6 +89,7 @@ that a cluster meets the requirements to run an application.`,
 	cmd.AddCommand(TemplateCmd())
 	cmd.AddCommand(DocsCmd())
 	cmd.AddCommand(ConvertCmd())
+	cmd.AddCommand(LintCmd())
 
 	preflight.AddFlags(cmd.PersistentFlags())
 

cmd/troubleshoot/cli/lint.go

@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/lint"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func LintCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lint [spec-files...]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Lint v1beta2/v1beta3 troubleshoot specs for syntax and structural errors",
+		Long: `Lint v1beta2/v1beta3 troubleshoot specs (both preflight and support-bundle) for syntax and structural errors.
+
+This command validates v1beta2/v1beta3 troubleshoot specs and checks for:
+- YAML syntax errors
+- Missing required fields (apiVersion, kind, metadata, spec)
+- Invalid template syntax ({{ .Values.* }})
+- Missing collectors or hostCollectors
+- Common structural issues
+- Missing docStrings (warning)
+
+Examples:
+  # Lint a single spec file
+  support-bundle lint my-spec.yaml
+
+  # Lint multiple spec files
+  support-bundle lint spec1.yaml spec2.yaml spec3.yaml
+
+  # Lint with automatic fixes
+  support-bundle lint --fix my-spec.yaml
+
+  # Lint and output as JSON for CI/CD integration
+  support-bundle lint --format json my-spec.yaml
+
+Notes:
+- v1beta2 does not support templating; template syntax in v1beta2 files will be flagged as errors.
+- v1beta3 supports templating and is linted with template-awareness.
+
+Exit codes:
+  0 - No errors found
+  2 - Validation errors found`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			opts := lint.LintOptions{
+				FilePaths:   args,
+				Fix:         v.GetBool("fix"),
+				Format:      v.GetString("format"),
+				ValuesFiles: v.GetStringSlice("values"),
+				SetValues:   v.GetStringSlice("set"),
+			}
+
+			return runLint(opts)
+		},
+	}
+
+	cmd.Flags().Bool("fix", false, "Automatically fix issues where possible")
+	cmd.Flags().String("format", "text", "Output format: text or json")
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files with template values (required for v1beta3 specs)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values via command line (e.g., --set key=value)")
+
+	return cmd
+}
+
+func runLint(opts lint.LintOptions) error {
+	// Validate file paths exist
+	for _, filePath := range opts.FilePaths {
+		if _, err := os.Stat(filePath); err != nil {
+			return errors.Wrapf(err, "file not found: %s", filePath)
+		}
+	}
+
+	// Run linting
+	results, err := lint.LintFiles(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to lint files")
+	}
+
+	// Format and print results
+	output := lint.FormatResults(results, opts.Format)
+	fmt.Print(output)
+
+	// Return appropriate exit code
+	if lint.HasErrors(results) {
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES, nil)
+	}
+
+	return nil
+}

cmd/troubleshoot/cli/root.go

@@ -5,10 +5,14 @@ import (
 	"os"
 	"strings"
 
+	"errors"
+
 	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
 	"github.com/replicatedhq/troubleshoot/internal/traces"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
 	"github.com/replicatedhq/troubleshoot/pkg/updater"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -108,6 +112,7 @@ If no arguments are provided, specs are automatically loaded from the cluster by
 	cmd.AddCommand(Diff())
 	cmd.AddCommand(Schedule())
 	cmd.AddCommand(UploadCmd())
+	cmd.AddCommand(LintCmd())
 	cmd.AddCommand(util.VersionCmd())
 
 	cmd.Flags().StringSlice("redactors", []string{}, "names of the additional redactors to use")
@@ -132,6 +137,12 @@ If no arguments are provided, specs are automatically loaded from the cluster by
 	cmd.Flags().Bool("dry-run", false, "print support bundle spec without collecting anything")
 	cmd.Flags().Bool("auto-update", true, "enable automatic binary self-update check and install")
 
+	// Upload flags
+	cmd.Flags().Bool("auto-upload", false, "automatically upload resulting bundle to replicated.app")
+	cmd.Flags().String("license-id", "", "license ID for authentication when uploading (auto-detected from bundle if not provided)")
+	cmd.Flags().String("app-slug", "", "application slug when uploading (auto-detected from bundle if not provided)")
+	cmd.Flags().String("upload-domain", "", "custom domain for upload (default: replicated.app)")
+
 	// Auto-discovery flags
 	cmd.Flags().Bool("auto", false, "enable auto-discovery of foundational collectors. When used with YAML specs, adds foundational collectors to YAML collectors. When used alone, collects only foundational data")
 	cmd.Flags().Bool("include-images", false, "include container image metadata collection when using auto-discovery")
@@ -161,7 +172,16 @@ If no arguments are provided, specs are automatically loaded from the cluster by
 }
 
 func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
+	cmd := RootCmd()
+	if err := cmd.Execute(); err != nil {
+		var exitErr types.ExitError
+		if errors.As(err, &exitErr) {
+			if exitErr.ExitStatus() != constants.EXIT_CODE_FAIL && exitErr.ExitStatus() != constants.EXIT_CODE_WARN {
+				cmd.PrintErrln("Error:", err.Error())
+			}
+			os.Exit(exitErr.ExitStatus())
+		}
+		cmd.PrintErrln("Error:", err.Error())
 		os.Exit(1)
 	}
 }

cmd/troubleshoot/cli/run.go

@@ -242,6 +242,26 @@ func runTroubleshoot(v *viper.Viper, args []string) error {
 		}
 	}
 
+	// Attempt auto-upload before any early returns
+	if v.GetBool("auto-upload") && !response.FileUploaded {
+		licenseID := v.GetString("license-id")
+		appSlug := v.GetString("app-slug")
+		uploadDomain := v.GetString("upload-domain")
+
+		targetDomain := uploadDomain
+		if targetDomain == "" {
+			targetDomain = "replicated.app"
+		}
+
+		fmt.Fprintf(os.Stderr, "Auto-uploading bundle to %s...\n", targetDomain)
+		if err := supportbundle.UploadBundleAutoDetect(response.ArchivePath, licenseID, appSlug, uploadDomain); err != nil {
+			fmt.Fprintf(os.Stderr, "Auto-upload failed: %v\n", err)
+			fmt.Fprintf(os.Stderr, "You can manually upload the bundle using: support-bundle upload %s\n", response.ArchivePath)
+		} else {
+			response.FileUploaded = true
+		}
+	}
+
 	if !response.FileUploaded {
 		if appName := mainBundle.Labels["applicationName"]; appName != "" {
 			f := `A support bundle for %s has been created in this directory
@@ -269,11 +289,12 @@ the %s Admin Console to begin analysis.`
 		fmt.Printf("\r%s\r", cursor.ClearEntireLine())
 	}
 	if response.FileUploaded {
-		fmt.Printf("A support bundle has been created and uploaded to your cluster for analysis. Please visit the Troubleshoot page to continue.\n")
+		fmt.Printf("A support bundle has been created and uploaded to replicated.app for analysis.\n")
 		fmt.Printf("A copy of this support bundle was written to the current directory, named %q\n", response.ArchivePath)
 	} else {
 		fmt.Printf("A support bundle has been created in the current directory named %q\n", response.ArchivePath)
 	}
+
 	return nil
 }
 
@@ -497,7 +518,7 @@ func (a *analysisOutput) FormattedAnalysisOutput() (outputJson string, err error
 
 	formatted, err := json.MarshalIndent(o, "", "    ")
 	if err != nil {
-		return "", fmt.Errorf("\r * Failed to format analysis: %v\n", err)
+		return "", fmt.Errorf("\r * Failed to format analysis: %v", err)
 	}
 	return string(formatted), nil
 }

cmd/troubleshoot/cli/upload.go

@@ -26,7 +26,10 @@ Examples:
   support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID
 
   # Specify both license and app
-  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID --app-slug my-app`,
+  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID --app-slug my-app
+
+  # Upload to a custom domain (e.g., development environment)
+  support-bundle upload bundle.tar.gz --upload-domain replicated-app-dev.example.com`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 			bundlePath := args[0]
@@ -39,9 +42,10 @@ Examples:
 			// Get upload parameters
 			licenseID := v.GetString("license-id")
 			appSlug := v.GetString("app-slug")
+			uploadDomain := v.GetString("upload-domain")
 
 			// Use auto-detection for uploads
-			if err := supportbundle.UploadBundleAutoDetect(bundlePath, licenseID, appSlug); err != nil {
+			if err := supportbundle.UploadBundleAutoDetect(bundlePath, licenseID, appSlug, uploadDomain); err != nil {
 				return errors.Wrap(err, "upload failed")
 			}
 
@@ -51,6 +55,7 @@ Examples:
 
 	cmd.Flags().String("license-id", "", "license ID for authentication (auto-detected from bundle if not provided)")
 	cmd.Flags().String("app-slug", "", "application slug (auto-detected from bundle if not provided)")
+	cmd.Flags().String("upload-domain", "", "custom domain for upload (default: replicated.app)")
 
 	return cmd
 }

deploy/.goreleaser.yaml

@@ -8,7 +8,7 @@ builds:
   - id: preflight
     main: ./cmd/preflight/main.go
     env: [CGO_ENABLED=0]
-    goos: [linux, darwin]
+    goos: [linux, darwin, windows]
     goarch: [amd64, arm, arm64]
     ignore:
       - goos: windows
@@ -31,7 +31,7 @@ builds:
   - id: support-bundle
     main: ./cmd/troubleshoot/main.go
     env: [CGO_ENABLED=0]
-    goos: [linux, darwin]
+    goos: [linux, darwin, windows]
     goarch: [amd64, arm, arm64]
     ignore:
       - goos: windows

examples/collect/v1beta3-bundle-secrets.yaml

@@ -0,0 +1,59 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: test-v1beta3-secretref
+spec:
+  collectors:
+    # Test 1: PostgreSQL with URI from secret
+    - postgres:
+        collectorName: postgres-with-secret
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: test-database-credentials
+              key: postgres-uri
+        # This will fail to connect (fake server) but that's OK -
+        # we're testing secret resolution, not actual DB connectivity
+
+    # Test 2: PostgreSQL with TLS certs from secret
+    - postgres:
+        collectorName: postgres-with-tls
+        uri:
+          value: "postgresql://testuser:testpass@localhost:5432/testdb"
+        tls:
+          cacert:
+            valueFrom:
+              secretKeyRef:
+                name: test-database-credentials
+                key: ca.crt
+          clientCert:
+            valueFrom:
+              secretKeyRef:
+                name: test-database-credentials
+                key: client.crt
+          clientKey:
+            valueFrom:
+              secretKeyRef:
+                name: test-database-credentials
+                key: client.key
+
+    # Test 3: MySQL with URI from secret
+    - mysql:
+        collectorName: mysql-with-secret
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: test-database-credentials
+              key: mysql-uri
+
+    # Test 4: Redis with URI from secret
+    - redis:
+        collectorName: redis-with-secret
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: test-database-credentials
+              key: redis-uri
+
+    # Test 5: Literal value (no secret) for comparison
+    - clusterInfo: {}

examples/collect/v1beta3-secret.yaml

@@ -0,0 +1,39 @@
+---
+# Secret containing database credentials
+apiVersion: v1
+kind: Secret
+metadata:
+  name: test-database-credentials
+  namespace: default
+type: Opaque
+stringData:
+  # PostgreSQL connection URI
+  postgres-uri: "postgresql://testuser:supersecret@postgres.example.com:5432/testdb?sslmode=require"
+
+  # MySQL connection URI
+  mysql-uri: "mysql://testuser:supersecret@mysql.example.com:3306/testdb"
+
+  # Redis connection URI
+  redis-uri: "redis://:supersecret@redis.example.com:6379"
+
+  # TLS certificates (example data)
+  ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIICpDCCAYwCCQDU+pQ3ZUD30jANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
+    b2NhbGhvc3QwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjAUMRIwEAYD
+    VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+    VJTUt9Us8cKjMzEfYyjiWA4R4/M2bS1+fWIcPm15A8IgC0qC1J3xGhE=
+    -----END CERTIFICATE-----
+
+  client.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIICpDCCAYwCCQDU+pQ3ZUD30jANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
+    b2NhbGhvc3QwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjAUMRIwEAYD
+    VQQDDA5jbGllbnQtY2VydA==
+    -----END CERTIFICATE-----
+
+  client.key: |
+    -----BEGIN PRIVATE KEY-----
+    MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKj
+    MzEfYyjiWA4R4/M2bS1+fWIcPm15A8IgC0qC1J3xGhE=
+    -----END PRIVATE KEY-----

examples/preflight/e2e.yaml

@@ -92,7 +92,7 @@ spec:
     - nodeResources:
         checkName: Must have 1 node with 2Gi (available) memory and at least 2 cores (on a single node)
         filters:
-          allocatableMemory: 2Gi
+          memoryAllocatable: 2Gi
           cpuCapacity: "2"
         outcomes:
           - pass:

examples/preflight/node-resources.yaml

@@ -28,7 +28,7 @@ spec:
     - nodeResources:
         checkName: Must have 1 node with 16 GB (available) memory and 10 cores (on a single node)
         filters:
-          allocatableMemory: 16Gi
+          memoryAllocatable: 16Gi
           cpuCapacity: "10"
         outcomes:
           - fail:
@@ -39,7 +39,7 @@ spec:
     - nodeResources:
         checkName: Must have 1 node with 16 GB (available) memory and 4 cores of amd64 arch (on a single node)
         filters:
-          allocatableMemory: 16Gi
+          memoryAllocatable: 16Gi
           cpuArchitecture: amd64
           cpuCapacity: "4"
         outcomes:
@@ -54,7 +54,7 @@ spec:
           selector:
             matchLabel:
               node-role.kubernetes.io/master: ""
-          allocatableMemory: 16Gi
+          memoryAllocatable: 16Gi
           cpuArchitecture: amd64
           cpuCapacity: "6"
         outcomes:

examples/support-bundle/e2e.yaml

@@ -77,7 +77,7 @@ spec:
     - nodeResources:
         checkName: Must have 1 node with 2Gi (available) memory and at least 2 cores (on a single node)
         filters:
-          allocatableMemory: 2Gi
+          memoryAllocatable: 2Gi
           cpuCapacity: "2"
         outcomes:
           - pass:

examples/support-bundle/v1beta3/README.md

@@ -0,0 +1,236 @@
+# v1beta3 Support Bundle Examples
+
+This directory contains example Support Bundle specs using the v1beta3 API, which introduces `StringOrValueFrom` support for securely referencing Kubernetes Secrets and ConfigMaps in collector fields.
+
+## Features
+
+### StringOrValueFrom Pattern
+
+The v1beta3 API introduces a Kubernetes-native pattern for referencing sensitive values:
+
+```yaml
+uri:
+  valueFrom:
+    secretKeyRef:
+      name: my-secret
+      key: connection-uri
+```
+
+or
+
+```yaml
+uri: "postgresql://localhost:5432/db"  # Literal value
+```
+
+### Supported Collectors
+
+Currently, v1beta3 supports `StringOrValueFrom` for:
+
+- **Database collectors**: `postgres`, `mysql`, `redis`, `mssql`
+  - `uri` field - Connection strings from secrets
+  - `tls` fields - CA cert, client cert, and client key from secrets
+
+## Examples
+
+### 1. postgres-with-secret.yaml
+Basic PostgreSQL collector with connection URI from a secret.
+
+**Use case**: Securely store database credentials without hardcoding them in the spec.
+
+```bash
+kubectl apply -f postgres-with-secret.yaml
+```
+
+### 2. postgres-with-tls.yaml
+PostgreSQL with TLS configuration from secrets.
+
+**Use case**: Secure database connections with mutual TLS, storing certificates in secrets.
+
+```bash
+kubectl apply -f postgres-with-tls.yaml
+```
+
+### 3. multiple-databases.yaml
+Multiple database collectors (PostgreSQL, MySQL, Redis, MSSQL) with various configurations.
+
+**Use case**: Collect diagnostics from multiple databases in your application stack.
+
+```bash
+kubectl apply -f multiple-databases.yaml
+```
+
+### 4. cross-namespace-secrets.yaml
+Accessing secrets from different namespaces.
+
+**Use case**: Centralized credential management in a shared namespace.
+
+```bash
+kubectl apply -f cross-namespace-secrets.yaml
+```
+
+**RBAC Requirements**: The support bundle service account needs `get` permission on secrets in the referenced namespaces.
+
+### 5. optional-secrets.yaml
+Using the `optional` field for graceful degradation.
+
+**Use case**: Collect diagnostics even when some credentials are unavailable (e.g., optional secondary databases).
+
+```bash
+kubectl apply -f optional-secrets.yaml
+```
+
+### 6. configmap-example.yaml
+Using ConfigMaps for non-sensitive configuration.
+
+**Use case**: Store non-sensitive connection strings (e.g., development databases) in ConfigMaps.
+
+```bash
+kubectl apply -f configmap-example.yaml
+```
+
+## Key Concepts
+
+### Secret vs ConfigMap
+
+- **Secrets**: Use for sensitive data (passwords, tokens, certificates)
+- **ConfigMaps**: Use for non-sensitive configuration (development endpoints, feature flags)
+
+### Optional Field
+
+```yaml
+uri:
+  valueFrom:
+    secretKeyRef:
+      name: my-secret
+      key: uri
+      optional: true  # Returns empty string if secret/key doesn't exist
+```
+
+- `optional: false` (default): Collection fails if secret is missing
+- `optional: true`: Returns empty string if secret/key is missing
+
+### Cross-Namespace Access
+
+```yaml
+uri:
+  valueFrom:
+    secretKeyRef:
+      name: shared-secret
+      key: uri
+      namespace: other-namespace  # Access secrets in different namespaces
+```
+
+If `namespace` is not specified, uses the support bundle's namespace.
+
+### Backward Compatibility
+
+v1beta3 maintains backward compatibility with v1beta2 TLS configuration:
+
+```yaml
+tls:
+  secret:  # v1beta2 style
+    name: tls-secret
+    namespace: default
+```
+
+## RBAC Configuration
+
+Support bundles need appropriate RBAC permissions to read secrets:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: troubleshoot-secret-reader
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["postgres-connection", "redis-creds"]  # Restrict to specific secrets
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: troubleshoot-secret-reader-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: troubleshoot-secret-reader
+subjects:
+- kind: ServiceAccount
+  name: troubleshoot
+  namespace: default
+```
+
+## Migration from v1beta2
+
+### Before (v1beta2):
+```yaml
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  collectors:
+    - postgres:
+        uri: "postgresql://user:password@host:5432/db"  # Hardcoded
+```
+
+### After (v1beta3):
+```yaml
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+spec:
+  collectors:
+    - postgres:
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-connection
+              key: connection-uri
+```
+
+## Limitations
+
+1. **No value composition**: Cannot combine multiple secrets into a single value
+   ```yaml
+   # NOT SUPPORTED
+   uri: "postgresql://$(USERNAME):$(PASSWORD)@host:5432/db"
+   ```
+   Store the complete connection string in a single secret key.
+
+2. **Collector scope**: Only database collectors support `StringOrValueFrom` initially
+   - Future versions will extend to HTTP, Data, and other collectors
+
+3. **No templating**: The entire field value comes from one source
+
+## Security Best Practices
+
+1. **Use resourceNames in RBAC**: Restrict access to specific secrets
+2. **Separate secrets**: Don't reuse secrets across applications
+3. **Rotate credentials**: Update secrets regularly
+4. **Audit access**: Monitor secret access logs
+5. **Redact output**: Ensure connection strings are redacted in bundle output
+
+## Troubleshooting
+
+### Error: "failed to get secret default/my-secret"
+
+- **Cause**: Secret doesn't exist or RBAC denied access
+- **Solution**: Verify secret exists: `kubectl get secret my-secret`
+- **Solution**: Check RBAC: `kubectl auth can-i get secret/my-secret`
+
+### Error: "key 'uri' not found in secret"
+
+- **Cause**: Secret exists but doesn't contain the specified key
+- **Solution**: Check secret keys: `kubectl get secret my-secret -o jsonpath='{.data}'`
+
+### Error: "cannot specify both 'value' and 'valueFrom'"
+
+- **Cause**: Both literal value and secret reference provided
+- **Solution**: Use only one: either `value: "string"` or `valueFrom: {...}`
+
+## Additional Resources
+
+- [Troubleshoot Documentation](https://troubleshoot.sh)
+- [v1beta3 API Reference](https://troubleshoot.sh/docs/v1beta3/)
+- [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/)
+- [RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)

examples/support-bundle/v1beta3/configmap-example.yaml

@@ -0,0 +1,57 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: configmap-example
+spec:
+  collectors:
+    # Database URI from ConfigMap (non-sensitive connection string)
+    - postgres:
+        collectorName: dev-database
+        uri:
+          valueFrom:
+            configMapKeyRef:
+              name: database-config
+              key: dev-connection-uri
+
+    # Redis URI from ConfigMap
+    - redis:
+        collectorName: dev-redis
+        uri:
+          valueFrom:
+            configMapKeyRef:
+              name: cache-config
+              key: redis-uri
+
+    # Mixed: URI from ConfigMap, password from Secret
+    # Note: This shows the limitation - you can't compose values from multiple sources
+    # The full connection string must be in one place
+    - mysql:
+        collectorName: staging-mysql
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: mysql-secret
+              key: complete-connection-string
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: database-config
+data:
+  dev-connection-uri: "postgresql://devuser@dev-postgres.default.svc:5432/devdb"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cache-config
+data:
+  redis-uri: "redis://dev-redis.default.svc:6379/0"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mysql-secret
+type: Opaque
+stringData:
+  # Complete connection string with password included
+  complete-connection-string: "mysql://staging:stagingpass@staging-mysql:3306/stagingdb"

examples/support-bundle/v1beta3/cross-namespace-secrets.yaml

@@ -0,0 +1,45 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: cross-namespace-example
+spec:
+  collectors:
+    # Database in one namespace, secret in another
+    - postgres:
+        collectorName: shared-database
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: shared-postgres-connection
+              key: uri
+              namespace: shared-services  # Secret is in a different namespace
+
+    # Redis accessing centralized credentials
+    - redis:
+        collectorName: shared-cache
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: shared-redis-creds
+              key: uri
+              namespace: platform-credentials
+---
+# This secret would be in the 'shared-services' namespace
+apiVersion: v1
+kind: Secret
+metadata:
+  name: shared-postgres-connection
+  namespace: shared-services
+type: Opaque
+stringData:
+  uri: "postgresql://shared:password@shared-postgres.shared-services.svc:5432/shared_db"
+---
+# This secret would be in the 'platform-credentials' namespace
+apiVersion: v1
+kind: Secret
+metadata:
+  name: shared-redis-creds
+  namespace: platform-credentials
+type: Opaque
+stringData:
+  uri: "redis://shared-redis.shared-services.svc:6379/0"

examples/support-bundle/v1beta3/multiple-databases.yaml

@@ -0,0 +1,78 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: multi-database-support-bundle
+spec:
+  collectors:
+    # PostgreSQL with secret reference
+    - postgres:
+        collectorName: primary-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-primary
+              key: connection-uri
+
+    # PostgreSQL replica with secret reference
+    - postgres:
+        collectorName: replica-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-replica
+              key: connection-uri
+
+    # Redis cache with secret reference
+    - redis:
+        collectorName: cache
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: redis-creds
+              key: uri
+
+    # MySQL with literal value (for development/testing)
+    - mysql:
+        collectorName: local-mysql
+        uri: "mysql://root:password@localhost:3306/testdb"
+
+    # MSSQL with secret reference
+    - mssql:
+        collectorName: legacy-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: mssql-connection
+              key: dsn
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-primary
+type: Opaque
+stringData:
+  connection-uri: "postgresql://app:secret123@postgres-primary.default.svc:5432/appdb"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-replica
+type: Opaque
+stringData:
+  connection-uri: "postgresql://app:secret123@postgres-replica.default.svc:5432/appdb"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: redis-creds
+type: Opaque
+stringData:
+  uri: "redis://:cachesecret@redis.default.svc:6379/0"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mssql-connection
+type: Opaque
+stringData:
+  dsn: "sqlserver://sa:Str0ngP@ssw0rd@mssql.default.svc:1433?database=legacy"

examples/support-bundle/v1beta3/optional-secrets.yaml

@@ -0,0 +1,58 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: optional-secrets-example
+spec:
+  collectors:
+    # Required database - collection will fail if secret doesn't exist
+    - postgres:
+        collectorName: required-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: required-postgres
+              key: uri
+              optional: false  # Default behavior - secret must exist
+
+    # Optional database - collection continues if secret doesn't exist
+    - postgres:
+        collectorName: optional-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: optional-postgres
+              key: uri
+              optional: true  # Gracefully degrades if secret is missing
+
+    # Mixed required and optional TLS
+    - postgres:
+        collectorName: partially-optional
+        uri: "postgresql://localhost:5432/db"
+        tls:
+          cacert:
+            valueFrom:
+              secretKeyRef:
+                name: tls-certs
+                key: ca.crt
+                optional: false  # CA cert is required
+          clientCert:
+            valueFrom:
+              secretKeyRef:
+                name: tls-certs
+                key: client.crt
+                optional: true  # Client cert is optional (cert-only TLS)
+          clientKey:
+            valueFrom:
+              secretKeyRef:
+                name: tls-certs
+                key: client.key
+                optional: true  # Client key is optional
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: required-postgres
+type: Opaque
+stringData:
+  uri: "postgresql://user:pass@required-postgres:5432/db"
+# Note: optional-postgres secret intentionally not created

examples/support-bundle/v1beta3/postgres-with-secret.yaml

@@ -0,0 +1,21 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: postgres-support-bundle
+spec:
+  collectors:
+    - postgres:
+        collectorName: main-database
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-connection
+              key: connection-uri
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-connection
+type: Opaque
+stringData:
+  connection-uri: "postgresql://myuser:mypassword@postgres.default.svc:5432/mydb?sslmode=require"

examples/support-bundle/v1beta3/postgres-with-tls.yaml

@@ -0,0 +1,47 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: postgres-tls-support-bundle
+spec:
+  collectors:
+    - postgres:
+        collectorName: secure-database
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-connection
+              key: connection-uri
+        tls:
+          cacert:
+            valueFrom:
+              secretKeyRef:
+                name: postgres-tls
+                key: ca.crt
+          clientCert:
+            valueFrom:
+              secretKeyRef:
+                name: postgres-tls
+                key: tls.crt
+          clientKey:
+            valueFrom:
+              secretKeyRef:
+                name: postgres-tls
+                key: tls.key
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-connection
+type: Opaque
+stringData:
+  connection-uri: "postgresql://myuser:mypassword@postgres.default.svc:5432/mydb?sslmode=verify-full"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-tls
+type: kubernetes.io/tls
+data:
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi4uLgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi4uLgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi4uLgotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t

examples/test-error-messages/helm-builtins-v1beta3.yaml

@@ -0,0 +1,33 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: helm-builtins-example
+  labels:
+    release: {{ .Release.Name }}
+spec:
+  analyzers:
+    - docString: |
+        Title: Example using Helm builtin objects
+        Requirement: Demonstrates .Values, .Release, .Chart, etc.
+
+        Supported Helm builtin objects:
+        - .Values.* - User-provided values
+        - .Release.Name - Release name (default: "preflight")
+        - .Release.Namespace - Release namespace (default: "default")
+        - .Release.IsInstall - Whether this is an install (true)
+        - .Release.IsUpgrade - Whether this is an upgrade (false)
+        - .Release.Revision - Release revision (1)
+        - .Chart.Name - Chart name
+        - .Chart.Version - Chart version
+        - .Capabilities.KubeVersion - Kubernetes version capabilities
+      clusterVersion:
+        checkName: Kubernetes version check in {{ .Release.Namespace }}
+        outcomes:
+          - fail:
+              when: '< {{ .Values.minVersion | default "1.19.0" }}'
+              message: |
+                Release {{ .Release.Name }} requires Kubernetes {{ .Values.minVersion | default "1.19.0" }} or later.
+                Chart: {{ .Chart.Name }}
+          - pass:
+              when: '>= {{ .Values.minVersion | default "1.19.0" }}'
+              message: Kubernetes version is supported for release {{ .Release.Name }}

examples/test-error-messages/invalid-collectors-analyzers.yaml

@@ -0,0 +1,19 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: invalid-collectors
+spec:
+  collectors:
+    # Unknown collector type
+    - notACollector: {}
+    # Known collector but missing required fields (e.g., ceph requires namespace)
+    - ceph: {}
+  # Field exists but wrong type (should be a list)
+  hostCollectors: "not-a-list"
+  analyzers:
+    # Unknown analyzer type
+    - notAnAnalyzer: {}
+    # Known analyzer missing required 'outcomes'
+    - cephStatus:
+        namespace: default
+

examples/test-error-messages/invalid-yaml-v1beta3.yaml

@@ -0,0 +1,8 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata
+  name: invalid-yaml
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version

examples/test-error-messages/missing-apiversion-v1beta3.yaml

@@ -0,0 +1,11 @@
+kind: Preflight
+metadata:
+  name: missing-apiversion
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported

examples/test-error-messages/missing-metadata-v1beta3.yaml

@@ -0,0 +1,10 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported

examples/test-error-messages/no-analyzers-v1beta3.yaml

@@ -0,0 +1,7 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: no-analyzers
+spec:
+  collectors:
+    - clusterInfo: {}

examples/test-error-messages/simple-no-template-v1beta3.yaml

@@ -0,0 +1,18 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: simple-no-template
+spec:
+  analyzers:
+    - docString: |
+        Title: Kubernetes Version Check
+        Requirement: Kubernetes 1.19.0 or later
+      clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - fail:
+              when: '< 1.19.0'
+              message: Kubernetes version must be at least 1.19.0
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported

examples/test-error-messages/support-bundle-no-collectors-v1beta3.yaml

@@ -0,0 +1,12 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: no-collectors
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported

examples/test-error-messages/support-bundle-valid-v1beta3.yaml

@@ -0,0 +1,15 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: valid-support-bundle
+spec:
+  collectors:
+    - clusterInfo: {}
+    - clusterResources: {}
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported

examples/test-error-messages/valid-v1beta3.yaml

@@ -0,0 +1,15 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: valid-preflight
+spec:
+  analyzers:
+    - docString: |
+        Title: Test Analyzer
+        Requirement: Test requirement
+      clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported

examples/test-error-messages/values-empty.yaml

@@ -0,0 +1,2 @@
+# Empty values file for v1beta3 specs without templates
+{}

examples/test-error-messages/values-helm-builtins.yaml

@@ -0,0 +1 @@
+minVersion: "1.19.0"

examples/test-error-messages/wrong-apiversion-v1beta3.yaml

@@ -0,0 +1,12 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: Preflight
+metadata:
+  name: wrong-version
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported

go.mod

@@ -1,6 +1,6 @@
 module github.com/replicatedhq/troubleshoot
 
-go 1.24.6
+go 1.25.4
 
 require (
 	github.com/Masterminds/sprig/v3 v3.3.0
@@ -8,9 +8,8 @@ require (
 	github.com/apparentlymart/go-cidr v1.1.0
 	github.com/blang/semver/v4 v4.0.0
 	github.com/casbin/govaluate v1.10.0
-	github.com/cilium/ebpf v0.19.0
-	github.com/containerd/cgroups/v3 v3.0.5
-	github.com/containers/image/v5 v5.36.2
+	github.com/cilium/ebpf v0.20.0
+	github.com/containerd/cgroups/v3 v3.1.1
 	github.com/distribution/distribution/v3 v3.0.0
 	github.com/fatih/color v1.18.0
 	github.com/go-logr/logr v1.4.3
@@ -21,7 +20,7 @@ require (
 	github.com/google/gofuzz v1.2.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/handlers v1.5.2
-	github.com/hashicorp/go-getter v1.8.2
+	github.com/hashicorp/go-getter v1.8.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/jackc/pgx/v5 v5.7.6
 	github.com/longhorn/go-iscsi-helper v0.0.0-20210330030558-49a327fb024e
@@ -33,7 +32,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/replicatedhq/termui/v3 v3.1.1-0.20200811145416-f40076d26851
 	github.com/segmentio/ksuid v1.0.4
-	github.com/shirou/gopsutil/v4 v4.25.9
+	github.com/shirou/gopsutil/v4 v4.25.10
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
@@ -41,12 +40,13 @@ require (
 	github.com/tj/go-spin v1.1.0
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
-	github.com/vmware-tanzu/velero v1.17.0
+	github.com/vmware-tanzu/velero v1.17.1
 	go.opentelemetry.io/otel v1.38.0
 	go.opentelemetry.io/otel/sdk v1.38.0
+	go.podman.io/image/v5 v5.38.0
 	golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67
-	golang.org/x/mod v0.28.0
-	golang.org/x/sync v0.17.0
+	golang.org/x/mod v0.29.0
+	golang.org/x/sync v0.18.0
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.34.1
 	k8s.io/apiextensions-apiserver v0.34.1
@@ -56,8 +56,8 @@ require (
 	k8s.io/client-go v0.34.1
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kubernetes v1.34.1
-	oras.land/oras-go v1.2.6
-	sigs.k8s.io/controller-runtime v0.22.2
+	oras.land/oras-go v1.2.7
+	sigs.k8s.io/controller-runtime v0.22.4
 	sigs.k8s.io/e2e-framework v0.6.0
 )
 
@@ -120,7 +120,7 @@ require (
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/go-containerregistry v0.20.3 // indirect
+	github.com/google/go-containerregistry v0.20.6 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
@@ -134,7 +134,7 @@ require (
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
-	github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
+	github.com/mistifyio/go-zfs/v3 v3.1.0 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
@@ -152,7 +152,7 @@ require (
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/sylabs/sif/v2 v2.21.1 // indirect
+	github.com/sylabs/sif/v2 v2.22.0 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/vladimirvivien/gexe v0.4.1 // indirect
@@ -165,9 +165,10 @@ require (
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
+	go.podman.io/storage v1.61.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/tools v0.36.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
@@ -191,17 +192,16 @@ require (
 	github.com/c9s/goprocinfo v0.0.0-20170724085704-0010a05ce49f // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/containerd/containerd v1.7.28 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
+	github.com/containerd/containerd v1.7.29 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.17.0 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
 	github.com/containers/ocicrypt v1.2.1 // indirect
-	github.com/containers/storage v1.59.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v28.3.2+incompatible // indirect
-	github.com/docker/docker v28.3.3+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/cli v28.5.1+incompatible // indirect
+	github.com/docker/docker v28.5.1+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.4 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
@@ -244,7 +244,7 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nsf/termbox-go v0.0.0-20190121233118-02980233997d // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/runtime-spec v1.2.1
+	github.com/opencontainers/runtime-spec v1.3.0
 	github.com/opencontainers/selinux v1.12.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
@@ -262,18 +262,17 @@ require (
 	github.com/vbatts/tar-split v0.12.1 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/crypto v0.42.0 // indirect
-	golang.org/x/net v0.44.0
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sys v0.36.0
-	golang.org/x/term v0.35.0 // indirect
-	golang.org/x/text v0.29.0
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0
+	golang.org/x/oauth2 v0.32.0 // indirect
+	golang.org/x/sys v0.38.0
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0
 	golang.org/x/time v0.12.0 // indirect
 	google.golang.org/api v0.241.0 // indirect
 	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
 	google.golang.org/grpc v1.73.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/protobuf v1.36.9 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	helm.sh/helm/v3 v3.19.0

go.sum

@@ -1,6 +1,5 @@
 cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
 cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.121.1 h1:S3kTQSydxmu1JfLRLpKtxRPA7rSrYPRPEUmL/PavVUw=
 cloud.google.com/go v0.121.1/go.mod h1:nRFlrHq39MNVWu+zESP2PosMWA0ryJw8KUBZ2iZpxbw=
 cloud.google.com/go/auth v0.16.2 h1:QvBAGFPLrDeoiNjyfVunhQ10HKNYuOwZ5noee0M5df4=
@@ -39,9 +38,8 @@ github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 h1:bFWuo
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1/go.mod h1:Vih/3yc6yac2JzU4hzpaDupBJP0Flaia9rXXrU8xyww=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
 github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
@@ -130,7 +128,6 @@ github.com/casbin/govaluate v1.10.0 h1:ffGw51/hYH3w3rZcxO/KcaUIDOLP84w7nsidMVgaD
 github.com/casbin/govaluate v1.10.0/go.mod h1:G/UnbIjZk/0uMNaLwZZmFQrR72tYRZWQkO70si/iR7A=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
@@ -144,16 +141,14 @@ github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObk
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
 github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
-github.com/cilium/ebpf v0.19.0 h1:Ro/rE64RmFBeA9FGjcTc+KmCeY6jXmryu6FfnzPRIao=
-github.com/cilium/ebpf v0.19.0/go.mod h1:fLCgMo3l8tZmAdM3B2XqdFzXBpwkcSTroaVqN08OWVY=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cilium/ebpf v0.20.0 h1:atwWj9d3NffHyPZzVlx3hmw1on5CLe9eljR8VuHTwhM=
+github.com/cilium/ebpf v0.20.0/go.mod h1:pzLjFymM+uZPLk/IXZUL63xdx5VXEo+enTzxkZXdycw=
 github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f h1:C5bqEmzEPLsHm9Mv73lSE9e9bKV23aB1vxOsmZrkl3k=
 github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
-github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=
-github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
-github.com/containerd/containerd v1.7.28 h1:Nsgm1AtcmEh4AHAJ4gGlNSaKgXiNccU270Dnf81FQ3c=
-github.com/containerd/containerd v1.7.28/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
+github.com/containerd/cgroups/v3 v3.1.1 h1:ASZmQGfOHbRj43/1aMn5QcWIsv0R/AuHHDNCguRY0p0=
+github.com/containerd/cgroups/v3 v3.1.1/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
+github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
+github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
 github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=
 github.com/containerd/continuity v0.4.4/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -164,18 +159,14 @@ github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
-github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
+github.com/containerd/stargz-snapshotter/estargz v0.17.0 h1:+TyQIsR/zSFI1Rm31EQBwpAA1ovYgIKHy7kctL3sLcE=
+github.com/containerd/stargz-snapshotter/estargz v0.17.0/go.mod h1:s06tWAiJcXQo9/8AReBCIo/QxcXFZ2n4qfsRnpl71SM=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
-github.com/containers/image/v5 v5.36.2 h1:GcxYQyAHRF/pLqR4p4RpvKllnNL8mOBn0eZnqJbfTwk=
-github.com/containers/image/v5 v5.36.2/go.mod h1:b4GMKH2z/5t6/09utbse2ZiLK/c72GuGLFdp7K69eA4=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
 github.com/containers/ocicrypt v1.2.1 h1:0qIOTT9DoYwcKmxSt8QJt+VzMY18onl9jUXsxpVhSmM=
 github.com/containers/ocicrypt v1.2.1/go.mod h1:aD0AAqfMp0MtwqWgHM1bUwe1anx0VazI108CRrSKINQ=
-github.com/containers/storage v1.59.1 h1:11Zu68MXsEQGBBd+GadPrHPpWeqjKS8hJDGiAHgIqDs=
-github.com/containers/storage v1.59.1/go.mod h1:KoAYHnAjP3/cTsRS+mmWZGkufSY2GACiKQ4V3ZLQnR0=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -195,16 +186,16 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/cli v28.3.2+incompatible h1:mOt9fcLE7zaACbxW1GeS65RI67wIJrTnqS3hP2huFsY=
-github.com/docker/cli v28.3.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.5.1+incompatible h1:ESutzBALAD6qyCLqbQSEf1a/U8Ybms5agw59yGVc+yY=
+github.com/docker/cli v28.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
-github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
-github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/docker v28.5.1+incompatible h1:Bm8DchhSD2J6PsFzxC35TZo4TLGR2PdW/E69rU45NhM=
+github.com/docker/docker v28.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.9.4 h1:76ItO69/AP/V4yT9V4uuuItG0B1N8hvt0T0c0NN/DzI=
+github.com/docker/docker-credential-helpers v0.9.4/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
@@ -217,16 +208,12 @@ github.com/ebitengine/purego v0.9.0 h1:mh0zpKBIXDceC63hpvPuGLiJ8ZAa3DfrFTudmfi8A
 github.com/ebitengine/purego v0.9.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
 github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
 github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
 github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
 github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
@@ -298,38 +285,23 @@ github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0kt
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
 github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
 github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
-github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
+github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
+github.com/google/go-containerregistry v0.20.6/go.mod h1:T0x8MuoAoKX/873bkeSfLD2FAkwCDf9/HZgsFJ02E2Y=
 github.com/google/go-intervals v0.0.2 h1:FGrVEiUnTRKR8yE04qzXYaJMtnIYqobR5QbblK3ixcM=
 github.com/google/go-intervals v0.0.2/go.mod h1:MkaR3LNRfeKLPmqgJYs4E66z5InYjmCjbbr4TQlcT6Y=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -341,7 +313,6 @@ github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgY
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -368,8 +339,8 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-getter v1.8.2 h1:CGCK+bZQLl44PYiwJweVzfpjg7bBwtuXu3AGcLiod2o=
-github.com/hashicorp/go-getter v1.8.2/go.mod h1:CUTt9x2bCtJ/sV8ihgrITL3IUE+0BE1j/e4n5P/GIM4=
+github.com/hashicorp/go-getter v1.8.3 h1:gIS+oTNv3kyYAvlUVgMR46MiG0bM0KuSON/KZEvRoRg=
+github.com/hashicorp/go-getter v1.8.3/go.mod h1:CUTt9x2bCtJ/sV8ihgrITL3IUE+0BE1j/e4n5P/GIM4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
@@ -447,8 +418,8 @@ github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzp
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
-github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
+github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
@@ -458,8 +429,8 @@ github.com/microsoft/go-mssqldb v1.9.3 h1:hy4p+LDC8LIGvI3JATnLVmBOLMJbmn5X400mr5
 github.com/microsoft/go-mssqldb v1.9.3/go.mod h1:GBbW9ASTiDC+mpgWDGKdm3FnFLTUsLYN3iFL90lQ+PA=
 github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
 github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
-github.com/mistifyio/go-zfs/v3 v3.0.1 h1:YaoXgBePoMA12+S1u/ddkv+QqxcfiZK4prI6HPnkFiU=
-github.com/mistifyio/go-zfs/v3 v3.0.1/go.mod h1:CzVgeB0RvF2EGzQnytKVvVSDwmKJXxkOTUGbNrTja/k=
+github.com/mistifyio/go-zfs/v3 v3.1.0 h1:FZaylcg0hjUp27i23VcJJQiuBeAZjrC8lPqCGM1CopY=
+github.com/mistifyio/go-zfs/v3 v3.1.0/go.mod h1:CzVgeB0RvF2EGzQnytKVvVSDwmKJXxkOTUGbNrTja/k=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -481,8 +452,8 @@ github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCnd
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
-github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
-github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
 github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
@@ -520,8 +491,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
-github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
+github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
 github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
@@ -552,7 +523,6 @@ github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/
 github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
@@ -585,14 +555,14 @@ github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDc
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
-github.com/sebdah/goldie/v2 v2.5.5 h1:rx1mwF95RxZ3/83sdS4Yp7t2C5TCokvWP4TBRbAyEWY=
-github.com/sebdah/goldie/v2 v2.5.5/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
+github.com/sebdah/goldie/v2 v2.7.1 h1:PkBHymaYdtvEkZV7TmyqKxdmn5/Vcj+8TpATWZjnG5E=
+github.com/sebdah/goldie/v2 v2.7.1/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
 github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
 github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
-github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
-github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
-github.com/shirou/gopsutil/v4 v4.25.9 h1:JImNpf6gCVhKgZhtaAHJ0serfFGtlfIlSC08eaKdTrU=
-github.com/shirou/gopsutil/v4 v4.25.9/go.mod h1:gxIxoC+7nQRwUl/xNhutXlD8lq+jxTgpIkEf3rADHL8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/shirou/gopsutil/v4 v4.25.10 h1:at8lk/5T1OgtuCp+AwrDofFRjnvosn0nkN2OLQ6g8tA=
+github.com/shirou/gopsutil/v4 v4.25.10/go.mod h1:+kSwyC8DRUD9XXEHCAFjK+0nuArFJM0lva+StQAcskM=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -616,23 +586,18 @@ github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8W
 github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/sylabs/sif/v2 v2.21.1 h1:GZ0b5//AFAqJEChd8wHV/uSKx/l1iuGYwjR8nx+4wPI=
-github.com/sylabs/sif/v2 v2.21.1/go.mod h1:YoqEGQnb5x/ItV653bawXHZJOXQaEWpGwHsSD3YePJI=
+github.com/sylabs/sif/v2 v2.22.0 h1:Y+xXufp4RdgZe02SR3nWEg7S6q4tPWN237WHYzkDSKA=
+github.com/sylabs/sif/v2 v2.22.0/go.mod h1:W1XhWTmG1KcG7j5a3KSYdMcUIFvbs240w/MMVW627hs=
 github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=
 github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
 github.com/tj/go-spin v1.1.0 h1:lhdWZsvImxvZ3q1C5OIB7d72DuOwP4O2NdBg9PyzNds=
@@ -651,8 +616,8 @@ github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zd
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/vladimirvivien/gexe v0.4.1 h1:W9gWkp8vSPjDoXDu04Yp4KljpVMaSt8IQuHswLDd5LY=
 github.com/vladimirvivien/gexe v0.4.1/go.mod h1:3gjgTqE2c0VyHnU5UOIwk7gyNzZDGulPb/DJPgcw64E=
-github.com/vmware-tanzu/velero v1.17.0 h1:b+KLlBG+v1YKogP81nAFix2pgJBTmUrnVlXg+OfB5ao=
-github.com/vmware-tanzu/velero v1.17.0/go.mod h1:BJRFKei89hSqrazQKiwv5YhhX871X1W1qPyo5OP09zw=
+github.com/vmware-tanzu/velero v1.17.1 h1:ldKeiTuUwkThOw7zrUucNA1NwnLG66zl13YetWAoE0I=
+github.com/vmware-tanzu/velero v1.17.1/go.mod h1:3KTxuUN6Un38JzmYAX+8U6j2k6EexGoNNxa8jrJML8U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
@@ -715,6 +680,10 @@ go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJr
 go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
 go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.podman.io/image/v5 v5.38.0 h1:aUKrCANkPvze1bnhLJsaubcfz0d9v/bSDLnwsXJm6G4=
+go.podman.io/image/v5 v5.38.0/go.mod h1:hSIoIUzgBnmc4DjoIdzk63aloqVbD7QXDMkSE/cvG90=
+go.podman.io/storage v1.61.0 h1:5hD/oyRYt1f1gxgvect+8syZBQhGhV28dCw2+CZpx0Q=
+go.podman.io/storage v1.61.0/go.mod h1:A3UBK0XypjNZ6pghRhuxg62+2NIm5lcUGv/7XyMhMUI=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -729,45 +698,34 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 h1:1UoZQm6f0P/ZO0w1Ri+f+ifG/gXhegadRdwBIXEFWDo=
 golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
-golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
-golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
+golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -786,62 +744,39 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
-golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
-golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.241.0 h1:QKwqWQlkc6O895LchPEDUSYr22Xp3NCxpQRiWTB6avE=
 google.golang.org/api v0.241.0/go.mod h1:cOVEm2TpdAGHL2z+UwyS+kmlGr3bVWQQ6sYEqkKje50=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 h1:1tXaIXCracvtsRxSBsYDiSBN0cuJvM7QYW+MrpIRY78=
 google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:49MsLSx0oWMOZqcpB3uL8ZOkAh1+TndpJ8ONoCBWiZk=
 google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
 google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=
 google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
+google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20160105164936-4f90aeace3a2/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -867,8 +802,6 @@ gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 helm.sh/helm/v3 v3.19.0 h1:krVyCGa8fa/wzTZgqw0DUiXuRT5BPdeqE/sQXujQ22k=
 helm.sh/helm/v3 v3.19.0/go.mod h1:Lk/SfzN0w3a3C3o+TdAKrLwJ0wcZ//t1/SDXAvfgDdc=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
 k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
 k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
@@ -897,14 +830,14 @@ k8s.io/metrics v0.34.1 h1:374Rexmp1xxgRt64Bi0TsjAM8cA/Y8skwCoPdjtIslE=
 k8s.io/metrics v0.34.1/go.mod h1:Drf5kPfk2NJrlpcNdSiAAHn/7Y9KqxpRNagByM7Ei80=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-oras.land/oras-go v1.2.6 h1:z8cmxQXBU8yZ4mkytWqXfo6tZcamPwjsuxYU81xJ8Lk=
-oras.land/oras-go v1.2.6/go.mod h1:OVPc1PegSEe/K8YiLfosrlqlqTN9PUyFvOw5Y9gwrT8=
+oras.land/oras-go v1.2.7 h1:KF9rBAtKYMGB5gjgHV5XquUfYDER3ecQBEXjdI7KZWI=
+oras.land/oras-go v1.2.7/go.mod h1:WVpIPbm82xjWT/GJU3TqZ0y9Ctj3DGco4wLYvGdOVvA=
 oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
 oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 periph.io/x/host/v3 v3.8.5 h1:g4g5xE1XZtDiGl1UAJaUur1aT7uNiFLMkyMEiZ7IHII=
 periph.io/x/host/v3 v3.8.5/go.mod h1:hPq8dISZIc+UNfWoRj+bPH3XEBQqJPdFdx218W92mdc=
-sigs.k8s.io/controller-runtime v0.22.2 h1:cK2l8BGWsSWkXz09tcS4rJh95iOLney5eawcK5A33r4=
-sigs.k8s.io/controller-runtime v0.22.2/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
+sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A=
+sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
 sigs.k8s.io/e2e-framework v0.6.0 h1:p7hFzHnLKO7eNsWGI2AbC1Mo2IYxidg49BiT4njxkrM=
 sigs.k8s.io/e2e-framework v0.6.0/go.mod h1:IREnCHnKgRCioLRmNi0hxSJ1kJ+aAdjEKK/gokcZu4k=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=

internal/specs/specs.go

@@ -191,7 +191,9 @@ func LoadFromCLIArgs(ctx context.Context, client kubernetes.Interface, args []st
 
 				// load URL spec first to remove URI key from the spec
 				urlSpec, err := loader.LoadSpecs(ctx, loader.LoadOptions{
-					RawSpec: rawURLSpec,
+					RawSpec:   rawURLSpec,
+					Client:    client,
+					Namespace: vp.GetString("namespace"),
 				})
 				if err != nil {
 					fmt.Println(color.YellowString("failed to load spec from URI %q: %v\n", v, err))
@@ -209,7 +211,9 @@ func LoadFromCLIArgs(ctx context.Context, client kubernetes.Interface, args []st
 	}
 
 	kinds, err := loader.LoadSpecs(ctx, loader.LoadOptions{
-		RawSpecs: rawSpecs,
+		RawSpecs:  rawSpecs,
+		Client:    client,
+		Namespace: vp.GetString("namespace"),
 	})
 	if err != nil {
 		return nil, err
@@ -363,7 +367,9 @@ func LoadFromCluster(ctx context.Context, client kubernetes.Interface, selectors
 
 	// Load troubleshoot specs from the raw specs
 	return loader.LoadSpecs(ctx, loader.LoadOptions{
-		RawSpecs: rawSpecs,
+		RawSpecs:  rawSpecs,
+		Client:    client,
+		Namespace: ns,
 	})
 }
 

pkg/analyze/ollama_helper.go

@@ -146,7 +146,7 @@ func (h *OllamaHelper) downloadAndInstallWindows() error {
 		return errors.Wrap(err, "failed to create temporary file")
 	}
 	defer os.Remove(tmpFile.Name())
-	defer tmpFile.Close()
+	defer tmpFile.Close() // Ensures file is closed in error paths
 
 	// Download installer
 	resp, err := http.Get(h.downloadURL)
@@ -165,6 +165,13 @@ func (h *OllamaHelper) downloadAndInstallWindows() error {
 		return errors.Wrap(err, "failed to write installer")
 	}
 
+	// Close the file before executing it (required on Windows)
+	// Note: This will be called twice (here and via defer), but that's safe
+	// The defer ensures cleanup on error paths, this ensures closure before execution
+	if err := tmpFile.Close(); err != nil {
+		return errors.Wrap(err, "failed to close installer file")
+	}
+
 	// Run installer
 	klog.Info("Running Ollama installer...")
 	cmd := exec.Command(tmpFile.Name())

pkg/apis/troubleshoot/v1beta3/collector_shared.go

@@ -0,0 +1,78 @@
+package v1beta3
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/multitype"
+)
+
+// CollectorMeta contains metadata for collectors
+type CollectorMeta struct {
+	CollectorName string `json:"collectorName,omitempty" yaml:"collectorName,omitempty"`
+	// +optional
+	Exclude *multitype.BoolOrString `json:"exclude,omitempty" yaml:"exclude,omitempty"`
+}
+
+// Database represents database collectors (PostgreSQL, MySQL, Redis, MSSQL)
+// In v1beta3, URI and TLS fields support valueFrom references
+type Database struct {
+	CollectorMeta `json:",inline" yaml:",inline"`
+	// URI can be a literal value or reference to a Secret/ConfigMap
+	URI StringOrValueFrom `json:"uri" yaml:"uri"`
+	// Parameters for the database connection
+	Parameters []string `json:"parameters,omitempty"`
+	// TLS configuration with support for valueFrom references
+	TLS *TLSParams `json:"tls,omitempty" yaml:"tls,omitempty"`
+}
+
+// TLSParams contains TLS configuration
+// In v1beta3, certificate fields support valueFrom references
+type TLSParams struct {
+	// SkipVerify disables TLS verification
+	SkipVerify bool `json:"skipVerify,omitempty" yaml:"skipVerify,omitempty"`
+	// Secret references a Kubernetes Secret containing TLS materials (v1beta2 compatibility)
+	Secret *TLSSecret `json:"secret,omitempty" yaml:"secret,omitempty"`
+	// CACert can be a literal value or reference to a Secret/ConfigMap
+	CACert StringOrValueFrom `json:"cacert,omitempty" yaml:"cacert,omitempty"`
+	// ClientCert can be a literal value or reference to a Secret/ConfigMap
+	ClientCert StringOrValueFrom `json:"clientCert,omitempty" yaml:"clientCert,omitempty"`
+	// ClientKey can be a literal value or reference to a Secret/ConfigMap
+	ClientKey StringOrValueFrom `json:"clientKey,omitempty" yaml:"clientKey,omitempty"`
+}
+
+// TLSSecret references a Kubernetes Secret containing TLS materials
+// Maintained for backward compatibility
+type TLSSecret struct {
+	Name      string `json:"name" yaml:"name"`
+	Namespace string `json:"namespace" yaml:"namespace"`
+}
+
+// Temporary placeholder types for minimal v1beta3 implementation
+// These will be properly defined as we expand v1beta3 support
+type AfterCollection struct {
+	CollectorMeta `json:",inline" yaml:",inline"`
+	// TODO: Add fields as needed
+}
+
+type Analyze struct {
+	// TODO: Add fields as needed
+}
+
+type HostAnalyze struct {
+	// TODO: Add fields as needed
+}
+
+type HostCollect struct {
+	// TODO: Add fields as needed
+}
+
+// Collect contains all collector definitions
+// For phase 1, we're focusing on Database collectors with StringOrValueFrom support
+type Collect struct {
+	// Database collectors with v1beta3 StringOrValueFrom support
+	Postgres *Database `json:"postgres,omitempty" yaml:"postgres,omitempty"`
+	Mssql    *Database `json:"mssql,omitempty" yaml:"mssql,omitempty"`
+	Mysql    *Database `json:"mysql,omitempty" yaml:"mysql,omitempty"`
+	Redis    *Database `json:"redis,omitempty" yaml:"redis,omitempty"`
+
+	// TODO: Add remaining collector types as we expand v1beta3 support
+	// For now, these are placeholders to make the types compile
+}

pkg/apis/troubleshoot/v1beta3/converter.go

@@ -0,0 +1,162 @@
+package v1beta3
+
+import (
+	"context"
+	"fmt"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"k8s.io/client-go/kubernetes"
+)
+
+// ConvertToV1Beta2WithResolution converts a v1beta3 SupportBundleSpec to v1beta2
+// by resolving all StringOrValueFrom fields to their actual values
+func ConvertToV1Beta2WithResolution(
+	ctx context.Context,
+	v3spec *SupportBundleSpec,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (*troubleshootv1beta2.SupportBundleSpec, error) {
+	v2spec := &troubleshootv1beta2.SupportBundleSpec{
+		Uri:                    v3spec.Uri,
+		RunHostCollectorsInPod: v3spec.RunHostCollectorsInPod,
+	}
+
+	// Convert collectors
+	if v3spec.Collectors != nil {
+		v2collectors := make([]*troubleshootv1beta2.Collect, 0, len(v3spec.Collectors))
+		for _, v3collector := range v3spec.Collectors {
+			v2collector, err := convertCollector(ctx, v3collector, client, defaultNamespace)
+			if err != nil {
+				return nil, fmt.Errorf("failed to convert collector: %w", err)
+			}
+			v2collectors = append(v2collectors, v2collector)
+		}
+		v2spec.Collectors = v2collectors
+	}
+
+	// TODO: Convert AfterCollection, HostCollectors, Analyzers, HostAnalyzers when v1beta3 support is expanded
+
+	return v2spec, nil
+}
+
+// convertCollector converts a v1beta3 Collect to v1beta2 Collect
+func convertCollector(
+	ctx context.Context,
+	v3collector *Collect,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (*troubleshootv1beta2.Collect, error) {
+	v2collector := &troubleshootv1beta2.Collect{}
+
+	// Convert database collectors
+	if v3collector.Postgres != nil {
+		db, err := convertDatabase(ctx, v3collector.Postgres, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert postgres collector: %w", err)
+		}
+		v2collector.Postgres = db
+	}
+
+	if v3collector.Mysql != nil {
+		db, err := convertDatabase(ctx, v3collector.Mysql, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert mysql collector: %w", err)
+		}
+		v2collector.Mysql = db
+	}
+
+	if v3collector.Mssql != nil {
+		db, err := convertDatabase(ctx, v3collector.Mssql, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert mssql collector: %w", err)
+		}
+		v2collector.Mssql = db
+	}
+
+	if v3collector.Redis != nil {
+		db, err := convertDatabase(ctx, v3collector.Redis, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert redis collector: %w", err)
+		}
+		v2collector.Redis = db
+	}
+
+	// TODO: Add conversion for other collector types as v1beta3 support expands
+
+	return v2collector, nil
+}
+
+// convertDatabase converts a v1beta3 Database to v1beta2 Database
+func convertDatabase(
+	ctx context.Context,
+	v3db *Database,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (*troubleshootv1beta2.Database, error) {
+	// Resolve URI
+	uri, err := ResolveStringOrValueFrom(ctx, v3db.URI, client, defaultNamespace)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve database URI: %w", err)
+	}
+
+	v2db := &troubleshootv1beta2.Database{
+		CollectorMeta: troubleshootv1beta2.CollectorMeta{
+			CollectorName: v3db.CollectorName,
+			Exclude:       v3db.Exclude,
+		},
+		URI:        uri,
+		Parameters: v3db.Parameters,
+	}
+
+	// Convert TLS params if present
+	if v3db.TLS != nil {
+		tlsParams, err := convertTLSParams(ctx, v3db.TLS, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert TLS params: %w", err)
+		}
+		v2db.TLS = tlsParams
+	}
+
+	return v2db, nil
+}
+
+// convertTLSParams converts v1beta3 TLSParams to v1beta2 TLSParams
+func convertTLSParams(
+	ctx context.Context,
+	v3tls *TLSParams,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (*troubleshootv1beta2.TLSParams, error) {
+	v2tls := &troubleshootv1beta2.TLSParams{
+		SkipVerify: v3tls.SkipVerify,
+	}
+
+	// Preserve v1beta2 Secret reference if present (backward compatibility)
+	if v3tls.Secret != nil {
+		v2tls.Secret = &troubleshootv1beta2.TLSSecret{
+			Name:      v3tls.Secret.Name,
+			Namespace: v3tls.Secret.Namespace,
+		}
+	}
+
+	// Resolve v1beta3 StringOrValueFrom fields
+	caCert, err := ResolveStringOrValueFrom(ctx, v3tls.CACert, client, defaultNamespace)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve CA cert: %w", err)
+	}
+	v2tls.CACert = caCert
+
+	clientCert, err := ResolveStringOrValueFrom(ctx, v3tls.ClientCert, client, defaultNamespace)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve client cert: %w", err)
+	}
+	v2tls.ClientCert = clientCert
+
+	clientKey, err := ResolveStringOrValueFrom(ctx, v3tls.ClientKey, client, defaultNamespace)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve client key: %w", err)
+	}
+	v2tls.ClientKey = clientKey
+
+	return v2tls, nil
+}

pkg/apis/troubleshoot/v1beta3/converter_test.go

@@ -0,0 +1,386 @@
+package v1beta3
+
+import (
+	"context"
+	"testing"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+func TestConvertToV1Beta2WithResolution_PostgresWithLiteralValue(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	uri := "postgresql://user:pass@localhost:5432/db"
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						Value: &uri,
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	assert.Equal(t, "postgresql://user:pass@localhost:5432/db", v2spec.Collectors[0].Postgres.URI)
+}
+
+func TestConvertToV1Beta2WithResolution_PostgresWithSecretRef(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "db-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("postgresql://user:secret-pass@db.example.com:5432/mydb"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "db-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	assert.Equal(t, "postgresql://user:secret-pass@db.example.com:5432/mydb", v2spec.Collectors[0].Postgres.URI)
+}
+
+func TestConvertToV1Beta2WithResolution_PostgresWithTLS(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "tls-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"ca.crt":     []byte("-----BEGIN CERTIFICATE-----\nCA_CERT_DATA\n-----END CERTIFICATE-----"),
+			"client.crt": []byte("-----BEGIN CERTIFICATE-----\nCLIENT_CERT_DATA\n-----END CERTIFICATE-----"),
+			"client.key": []byte("-----BEGIN PRIVATE KEY-----\nCLIENT_KEY_DATA\n-----END PRIVATE KEY-----"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+	uri := "postgresql://user:pass@localhost:5432/db"
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						Value: &uri,
+					},
+					TLS: &TLSParams{
+						CACert: StringOrValueFrom{
+							ValueFrom: &ValueFromSource{
+								SecretKeyRef: &SecretKeyRef{
+									Name: "tls-secret",
+									Key:  "ca.crt",
+								},
+							},
+						},
+						ClientCert: StringOrValueFrom{
+							ValueFrom: &ValueFromSource{
+								SecretKeyRef: &SecretKeyRef{
+									Name: "tls-secret",
+									Key:  "client.crt",
+								},
+							},
+						},
+						ClientKey: StringOrValueFrom{
+							ValueFrom: &ValueFromSource{
+								SecretKeyRef: &SecretKeyRef{
+									Name: "tls-secret",
+									Key:  "client.key",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	require.NotNil(t, v2spec.Collectors[0].Postgres.TLS)
+
+	assert.Equal(t, "-----BEGIN CERTIFICATE-----\nCA_CERT_DATA\n-----END CERTIFICATE-----", v2spec.Collectors[0].Postgres.TLS.CACert)
+	assert.Equal(t, "-----BEGIN CERTIFICATE-----\nCLIENT_CERT_DATA\n-----END CERTIFICATE-----", v2spec.Collectors[0].Postgres.TLS.ClientCert)
+	assert.Equal(t, "-----BEGIN PRIVATE KEY-----\nCLIENT_KEY_DATA\n-----END PRIVATE KEY-----", v2spec.Collectors[0].Postgres.TLS.ClientKey)
+}
+
+func TestConvertToV1Beta2WithResolution_MultipleDatabases(t *testing.T) {
+	pgSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "postgres-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("postgresql://user:pass@pg.example.com:5432/db"),
+		},
+	}
+
+	mysqlSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mysql-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("mysql://user:pass@mysql.example.com:3306/db"),
+		},
+	}
+
+	redisSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "redis-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("redis://redis.example.com:6379"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(pgSecret, mysqlSecret, redisSecret)
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "postgres-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+			{
+				Mysql: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "mysql-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+			{
+				Redis: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "redis-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 3)
+
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	assert.Equal(t, "postgresql://user:pass@pg.example.com:5432/db", v2spec.Collectors[0].Postgres.URI)
+
+	require.NotNil(t, v2spec.Collectors[1].Mysql)
+	assert.Equal(t, "mysql://user:pass@mysql.example.com:3306/db", v2spec.Collectors[1].Mysql.URI)
+
+	require.NotNil(t, v2spec.Collectors[2].Redis)
+	assert.Equal(t, "redis://redis.example.com:6379", v2spec.Collectors[2].Redis.URI)
+}
+
+func TestConvertToV1Beta2WithResolution_SecretNotFound(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "nonexistent-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	_, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to convert collector")
+	assert.Contains(t, err.Error(), "failed to resolve database URI")
+}
+
+func TestConvertToV1Beta2WithResolution_PreservesCollectorMeta(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	uri := "postgresql://user:pass@localhost:5432/db"
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					CollectorMeta: CollectorMeta{
+						CollectorName: "my-postgres-collector",
+					},
+					URI: StringOrValueFrom{
+						Value: &uri,
+					},
+					Parameters: []string{"sslmode=require"},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+
+	assert.Equal(t, "my-postgres-collector", v2spec.Collectors[0].Postgres.CollectorName)
+	assert.Equal(t, []string{"sslmode=require"}, v2spec.Collectors[0].Postgres.Parameters)
+}
+
+func TestConvertToV1Beta2WithResolution_TLSBackwardCompatibility(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	uri := "postgresql://user:pass@localhost:5432/db"
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						Value: &uri,
+					},
+					TLS: &TLSParams{
+						SkipVerify: true,
+						Secret: &TLSSecret{
+							Name:      "old-tls-secret",
+							Namespace: "default",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	require.NotNil(t, v2spec.Collectors[0].Postgres.TLS)
+
+	assert.True(t, v2spec.Collectors[0].Postgres.TLS.SkipVerify)
+	require.NotNil(t, v2spec.Collectors[0].Postgres.TLS.Secret)
+	assert.Equal(t, "old-tls-secret", v2spec.Collectors[0].Postgres.TLS.Secret.Name)
+	assert.Equal(t, "default", v2spec.Collectors[0].Postgres.TLS.Secret.Namespace)
+}
+
+func TestConvertToV1Beta2WithResolution_EmptySpec(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	v3spec := &SupportBundleSpec{}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	assert.Nil(t, v2spec.Collectors)
+}
+
+func TestConvertDatabase_AllDatabaseTypes(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "db-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("test-uri"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	v3db := &Database{
+		URI: StringOrValueFrom{
+			ValueFrom: &ValueFromSource{
+				SecretKeyRef: &SecretKeyRef{
+					Name: "db-secret",
+					Key:  "uri",
+				},
+			},
+		},
+	}
+
+	// Test that the same database struct works for all DB types
+	ctx := context.Background()
+
+	pgDB, err := convertDatabase(ctx, v3db, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "test-uri", pgDB.URI)
+
+	mysqlDB, err := convertDatabase(ctx, v3db, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "test-uri", mysqlDB.URI)
+
+	mssqlDB, err := convertDatabase(ctx, v3db, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "test-uri", mssqlDB.URI)
+
+	redisDB, err := convertDatabase(ctx, v3db, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "test-uri", redisDB.URI)
+}
+
+// Helper function to convert v2spec back to ensure type compatibility
+func ensureV2SpecCompatibility(v2spec *troubleshootv1beta2.SupportBundleSpec) {
+	// This function just exists to ensure the types are compatible
+	// If this compiles, we know the conversion produces valid v1beta2 types
+	_ = v2spec.Uri
+	_ = v2spec.Collectors
+	_ = v2spec.Analyzers
+}

pkg/apis/troubleshoot/v1beta3/doc.go

@@ -0,0 +1,6 @@
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=troubleshoot.sh
+
+// Package v1beta3 is the v1beta3 version of the API.
+package v1beta3

pkg/apis/troubleshoot/v1beta3/register.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2019 Replicated, Inc..
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// NOTE: Boilerplate only.  Ignore this file.
+
+// Package v1beta3 contains API Schema definitions for the troubleshoot v1beta3 API group
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package,register
+// +k8s:conversion-gen=github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=troubleshoot.sh
+package v1beta3
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// SchemeGroupVersion is group version used to register these objects
+	SchemeGroupVersion = schema.GroupVersion{Group: "troubleshoot.sh", Version: "v1beta3"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
+
+	// AddToScheme is required by pkg/client/...
+	AddToScheme = SchemeBuilder.AddToScheme
+)
+
+// Resource is required by pkg/client/listers/...
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}

pkg/apis/troubleshoot/v1beta3/resolver.go

@@ -0,0 +1,117 @@
+package v1beta3
+
+import (
+	"context"
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+// ResolveStringOrValueFrom resolves a StringOrValueFrom to its actual string value
+// by fetching from Secrets or ConfigMaps as needed.
+//
+// Parameters:
+//   - ctx: Context for the resolution operation
+//   - sov: The StringOrValueFrom to resolve
+//   - client: Kubernetes client for fetching Secrets/ConfigMaps
+//   - defaultNamespace: Namespace to use when not specified in the reference
+//
+// Returns:
+//   - The resolved string value
+//   - An error if resolution fails (unless Optional is true)
+func ResolveStringOrValueFrom(
+	ctx context.Context,
+	sov StringOrValueFrom,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (string, error) {
+	// If Value is directly specified, use it
+	if sov.Value != nil {
+		return *sov.Value, nil
+	}
+
+	// If ValueFrom is not specified, return empty string
+	if sov.ValueFrom == nil {
+		return "", nil
+	}
+
+	// Resolve from SecretKeyRef
+	if sov.ValueFrom.SecretKeyRef != nil {
+		return resolveSecretKeyRef(ctx, sov.ValueFrom.SecretKeyRef, client, defaultNamespace)
+	}
+
+	// Resolve from ConfigMapKeyRef
+	if sov.ValueFrom.ConfigMapKeyRef != nil {
+		return resolveConfigMapKeyRef(ctx, sov.ValueFrom.ConfigMapKeyRef, client, defaultNamespace)
+	}
+
+	return "", nil
+}
+
+// resolveSecretKeyRef fetches a value from a Kubernetes Secret
+func resolveSecretKeyRef(
+	ctx context.Context,
+	ref *SecretKeyRef,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (string, error) {
+	namespace := ref.Namespace
+	if namespace == "" {
+		namespace = defaultNamespace
+	}
+
+	secret, err := client.CoreV1().Secrets(namespace).Get(ctx, ref.Name, metav1.GetOptions{})
+	if err != nil {
+		if isOptional(ref.Optional) {
+			return "", nil
+		}
+		return "", fmt.Errorf("failed to get secret %s/%s: %w", namespace, ref.Name, err)
+	}
+
+	value, ok := secret.Data[ref.Key]
+	if !ok {
+		if isOptional(ref.Optional) {
+			return "", nil
+		}
+		return "", fmt.Errorf("key %q not found in secret %s/%s", ref.Key, namespace, ref.Name)
+	}
+
+	return string(value), nil
+}
+
+// resolveConfigMapKeyRef fetches a value from a Kubernetes ConfigMap
+func resolveConfigMapKeyRef(
+	ctx context.Context,
+	ref *ConfigMapKeyRef,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (string, error) {
+	namespace := ref.Namespace
+	if namespace == "" {
+		namespace = defaultNamespace
+	}
+
+	configMap, err := client.CoreV1().ConfigMaps(namespace).Get(ctx, ref.Name, metav1.GetOptions{})
+	if err != nil {
+		if isOptional(ref.Optional) {
+			return "", nil
+		}
+		return "", fmt.Errorf("failed to get configmap %s/%s: %w", namespace, ref.Name, err)
+	}
+
+	value, ok := configMap.Data[ref.Key]
+	if !ok {
+		if isOptional(ref.Optional) {
+			return "", nil
+		}
+		return "", fmt.Errorf("key %q not found in configmap %s/%s", ref.Key, namespace, ref.Name)
+	}
+
+	return value, nil
+}
+
+// isOptional checks if the optional flag is set to true
+func isOptional(optional *bool) bool {
+	return optional != nil && *optional
+}

pkg/apis/troubleshoot/v1beta3/resolver_test.go

@@ -0,0 +1,333 @@
+package v1beta3
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+func TestResolveStringOrValueFrom_LiteralValue(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	value := "literal-value"
+
+	sov := StringOrValueFrom{
+		Value: &value,
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "literal-value", result)
+}
+
+func TestResolveStringOrValueFrom_EmptyValue(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	sov := StringOrValueFrom{}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"password": []byte("super-secret-password"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name: "test-secret",
+				Key:  "password",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "super-secret-password", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_WithNamespace(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "custom-namespace",
+		},
+		Data: map[string][]byte{
+			"password": []byte("secret-from-custom-ns"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name:      "test-secret",
+				Key:       "password",
+				Namespace: "custom-namespace",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "secret-from-custom-ns", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_NotFound(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name: "nonexistent-secret",
+				Key:  "password",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to get secret")
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_KeyNotFound(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"password": []byte("secret-value"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name: "test-secret",
+				Key:  "nonexistent-key",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "key \"nonexistent-key\" not found")
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_Optional(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	optional := true
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name:     "nonexistent-secret",
+				Key:      "password",
+				Optional: &optional,
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_OptionalKeyNotFound(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"password": []byte("secret-value"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+	optional := true
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name:     "test-secret",
+				Key:      "nonexistent-key",
+				Optional: &optional,
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef(t *testing.T) {
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-configmap",
+			Namespace: "default",
+		},
+		Data: map[string]string{
+			"config-key": "config-value",
+		},
+	}
+
+	client := fake.NewSimpleClientset(configMap)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name: "test-configmap",
+				Key:  "config-key",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "config-value", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_WithNamespace(t *testing.T) {
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-configmap",
+			Namespace: "custom-namespace",
+		},
+		Data: map[string]string{
+			"config-key": "config-from-custom-ns",
+		},
+	}
+
+	client := fake.NewSimpleClientset(configMap)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name:      "test-configmap",
+				Key:       "config-key",
+				Namespace: "custom-namespace",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "config-from-custom-ns", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_NotFound(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name: "nonexistent-configmap",
+				Key:  "config-key",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to get configmap")
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_KeyNotFound(t *testing.T) {
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-configmap",
+			Namespace: "default",
+		},
+		Data: map[string]string{
+			"config-key": "config-value",
+		},
+	}
+
+	client := fake.NewSimpleClientset(configMap)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name: "test-configmap",
+				Key:  "nonexistent-key",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "key \"nonexistent-key\" not found")
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_Optional(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	optional := true
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name:     "nonexistent-configmap",
+				Key:      "config-key",
+				Optional: &optional,
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_OptionalKeyNotFound(t *testing.T) {
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-configmap",
+			Namespace: "default",
+		},
+		Data: map[string]string{
+			"config-key": "config-value",
+		},
+	}
+
+	client := fake.NewSimpleClientset(configMap)
+	optional := true
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name:     "test-configmap",
+				Key:      "nonexistent-key",
+				Optional: &optional,
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}

pkg/apis/troubleshoot/v1beta3/string_or_valuefrom.go

@@ -0,0 +1,64 @@
+package v1beta3
+
+// StringOrValueFrom represents a string value that can either be specified
+// directly or sourced from a Kubernetes Secret or ConfigMap
+type StringOrValueFrom struct {
+	// Value is a literal string value
+	// +optional
+	Value *string `json:"value,omitempty" yaml:"value,omitempty"`
+
+	// ValueFrom is a reference to a value in a Secret or ConfigMap
+	// +optional
+	ValueFrom *ValueFromSource `json:"valueFrom,omitempty" yaml:"valueFrom,omitempty"`
+}
+
+// ValueFromSource represents the source of a value from a Secret or ConfigMap
+type ValueFromSource struct {
+	// SecretKeyRef references a key in a Secret
+	// +optional
+	SecretKeyRef *SecretKeyRef `json:"secretKeyRef,omitempty" yaml:"secretKeyRef,omitempty"`
+
+	// ConfigMapKeyRef references a key in a ConfigMap
+	// +optional
+	ConfigMapKeyRef *ConfigMapKeyRef `json:"configMapKeyRef,omitempty" yaml:"configMapKeyRef,omitempty"`
+}
+
+// SecretKeyRef references a specific key in a Kubernetes Secret
+type SecretKeyRef struct {
+	// Name is the name of the Secret
+	Name string `json:"name" yaml:"name"`
+
+	// Key is the key within the Secret to read
+	Key string `json:"key" yaml:"key"`
+
+	// Namespace is the namespace of the Secret
+	// If not specified, defaults to the namespace where the SupportBundle is running
+	// +optional
+	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+
+	// Optional specifies whether the Secret must exist
+	// If true and the Secret or key doesn't exist, resolves to empty string
+	// If false (default) and the Secret or key doesn't exist, resolution fails
+	// +optional
+	Optional *bool `json:"optional,omitempty" yaml:"optional,omitempty"`
+}
+
+// ConfigMapKeyRef references a specific key in a Kubernetes ConfigMap
+type ConfigMapKeyRef struct {
+	// Name is the name of the ConfigMap
+	Name string `json:"name" yaml:"name"`
+
+	// Key is the key within the ConfigMap to read
+	Key string `json:"key" yaml:"key"`
+
+	// Namespace is the namespace of the ConfigMap
+	// If not specified, defaults to the namespace where the SupportBundle is running
+	// +optional
+	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+
+	// Optional specifies whether the ConfigMap must exist
+	// If true and the ConfigMap or key doesn't exist, resolves to empty string
+	// If false (default) and the ConfigMap or key doesn't exist, resolution fails
+	// +optional
+	Optional *bool `json:"optional,omitempty" yaml:"optional,omitempty"`
+}

pkg/apis/troubleshoot/v1beta3/supportbundle_types.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2019 Replicated, Inc..
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// SupportBundleSpec defines the desired state of SupportBundle
+type SupportBundleSpec struct {
+	AfterCollection []*AfterCollection `json:"afterCollection,omitempty" yaml:"afterCollection,omitempty"`
+	Collectors      []*Collect         `json:"collectors,omitempty" yaml:"collectors,omitempty"`
+	HostCollectors  []*HostCollect     `json:"hostCollectors,omitempty" yaml:"hostCollectors,omitempty"`
+	Analyzers       []*Analyze         `json:"analyzers,omitempty" yaml:"analyzers,omitempty"`
+	HostAnalyzers   []*HostAnalyze     `json:"hostAnalyzers,omitempty" yaml:"hostAnalyzers,omitempty"`
+	// URI optionally defines a location which is the source of this spec to allow updating of the spec at runtime
+	Uri                    string `json:"uri,omitempty" yaml:"uri,omitempty"`
+	RunHostCollectorsInPod bool   `json:"runHostCollectorsInPod,omitempty" yaml:"runHostCollectorsInPod,omitempty"`
+}
+
+// SupportBundleStatus defines the observed state of SupportBundle
+type SupportBundleStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+}
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// SupportBundle is the Schema for the SupportBundles API
+// +k8s:openapi-gen=true
+type SupportBundle struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+
+	Spec   SupportBundleSpec   `json:"spec,omitempty" yaml:"spec,omitempty"`
+	Status SupportBundleStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// SupportBundleList contains a list of SupportBundle
+type SupportBundleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []SupportBundle `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&SupportBundle{}, &SupportBundleList{})
+}

pkg/apis/troubleshoot/v1beta3/zz_generated.deepcopy.go

@@ -0,0 +1,441 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2019 Replicated, Inc..
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1beta3
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/multitype"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AfterCollection) DeepCopyInto(out *AfterCollection) {
+	*out = *in
+	in.CollectorMeta.DeepCopyInto(&out.CollectorMeta)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AfterCollection.
+func (in *AfterCollection) DeepCopy() *AfterCollection {
+	if in == nil {
+		return nil
+	}
+	out := new(AfterCollection)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Analyze) DeepCopyInto(out *Analyze) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Analyze.
+func (in *Analyze) DeepCopy() *Analyze {
+	if in == nil {
+		return nil
+	}
+	out := new(Analyze)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Collect) DeepCopyInto(out *Collect) {
+	*out = *in
+	if in.Postgres != nil {
+		in, out := &in.Postgres, &out.Postgres
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Mssql != nil {
+		in, out := &in.Mssql, &out.Mssql
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Mysql != nil {
+		in, out := &in.Mysql, &out.Mysql
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Redis != nil {
+		in, out := &in.Redis, &out.Redis
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Collect.
+func (in *Collect) DeepCopy() *Collect {
+	if in == nil {
+		return nil
+	}
+	out := new(Collect)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CollectorMeta) DeepCopyInto(out *CollectorMeta) {
+	*out = *in
+	if in.Exclude != nil {
+		in, out := &in.Exclude, &out.Exclude
+		*out = new(multitype.BoolOrString)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CollectorMeta.
+func (in *CollectorMeta) DeepCopy() *CollectorMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(CollectorMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigMapKeyRef) DeepCopyInto(out *ConfigMapKeyRef) {
+	*out = *in
+	if in.Optional != nil {
+		in, out := &in.Optional, &out.Optional
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigMapKeyRef.
+func (in *ConfigMapKeyRef) DeepCopy() *ConfigMapKeyRef {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigMapKeyRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Database) DeepCopyInto(out *Database) {
+	*out = *in
+	in.CollectorMeta.DeepCopyInto(&out.CollectorMeta)
+	in.URI.DeepCopyInto(&out.URI)
+	if in.Parameters != nil {
+		in, out := &in.Parameters, &out.Parameters
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSParams)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
+func (in *Database) DeepCopy() *Database {
+	if in == nil {
+		return nil
+	}
+	out := new(Database)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HostAnalyze) DeepCopyInto(out *HostAnalyze) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostAnalyze.
+func (in *HostAnalyze) DeepCopy() *HostAnalyze {
+	if in == nil {
+		return nil
+	}
+	out := new(HostAnalyze)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HostCollect) DeepCopyInto(out *HostCollect) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostCollect.
+func (in *HostCollect) DeepCopy() *HostCollect {
+	if in == nil {
+		return nil
+	}
+	out := new(HostCollect)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SecretKeyRef) DeepCopyInto(out *SecretKeyRef) {
+	*out = *in
+	if in.Optional != nil {
+		in, out := &in.Optional, &out.Optional
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretKeyRef.
+func (in *SecretKeyRef) DeepCopy() *SecretKeyRef {
+	if in == nil {
+		return nil
+	}
+	out := new(SecretKeyRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StringOrValueFrom) DeepCopyInto(out *StringOrValueFrom) {
+	*out = *in
+	if in.Value != nil {
+		in, out := &in.Value, &out.Value
+		*out = new(string)
+		**out = **in
+	}
+	if in.ValueFrom != nil {
+		in, out := &in.ValueFrom, &out.ValueFrom
+		*out = new(ValueFromSource)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StringOrValueFrom.
+func (in *StringOrValueFrom) DeepCopy() *StringOrValueFrom {
+	if in == nil {
+		return nil
+	}
+	out := new(StringOrValueFrom)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundle) DeepCopyInto(out *SupportBundle) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	out.Status = in.Status
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundle.
+func (in *SupportBundle) DeepCopy() *SupportBundle {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundle)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *SupportBundle) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundleList) DeepCopyInto(out *SupportBundleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]SupportBundle, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundleList.
+func (in *SupportBundleList) DeepCopy() *SupportBundleList {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *SupportBundleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundleSpec) DeepCopyInto(out *SupportBundleSpec) {
+	*out = *in
+	if in.AfterCollection != nil {
+		in, out := &in.AfterCollection, &out.AfterCollection
+		*out = make([]*AfterCollection, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(AfterCollection)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Collectors != nil {
+		in, out := &in.Collectors, &out.Collectors
+		*out = make([]*Collect, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Collect)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.HostCollectors != nil {
+		in, out := &in.HostCollectors, &out.HostCollectors
+		*out = make([]*HostCollect, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HostCollect)
+				**out = **in
+			}
+		}
+	}
+	if in.Analyzers != nil {
+		in, out := &in.Analyzers, &out.Analyzers
+		*out = make([]*Analyze, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Analyze)
+				**out = **in
+			}
+		}
+	}
+	if in.HostAnalyzers != nil {
+		in, out := &in.HostAnalyzers, &out.HostAnalyzers
+		*out = make([]*HostAnalyze, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HostAnalyze)
+				**out = **in
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundleSpec.
+func (in *SupportBundleSpec) DeepCopy() *SupportBundleSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundleSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundleStatus) DeepCopyInto(out *SupportBundleStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundleStatus.
+func (in *SupportBundleStatus) DeepCopy() *SupportBundleStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundleStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSParams) DeepCopyInto(out *TLSParams) {
+	*out = *in
+	if in.Secret != nil {
+		in, out := &in.Secret, &out.Secret
+		*out = new(TLSSecret)
+		**out = **in
+	}
+	in.CACert.DeepCopyInto(&out.CACert)
+	in.ClientCert.DeepCopyInto(&out.ClientCert)
+	in.ClientKey.DeepCopyInto(&out.ClientKey)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSParams.
+func (in *TLSParams) DeepCopy() *TLSParams {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSParams)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSSecret) DeepCopyInto(out *TLSSecret) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSSecret.
+func (in *TLSSecret) DeepCopy() *TLSSecret {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSSecret)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ValueFromSource) DeepCopyInto(out *ValueFromSource) {
+	*out = *in
+	if in.SecretKeyRef != nil {
+		in, out := &in.SecretKeyRef, &out.SecretKeyRef
+		*out = new(SecretKeyRef)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ConfigMapKeyRef != nil {
+		in, out := &in.ConfigMapKeyRef, &out.ConfigMapKeyRef
+		*out = new(ConfigMapKeyRef)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValueFromSource.
+func (in *ValueFromSource) DeepCopy() *ValueFromSource {
+	if in == nil {
+		return nil
+	}
+	out := new(ValueFromSource)
+	in.DeepCopyInto(out)
+	return out
+}

pkg/collect/cluster_resources.go

@@ -400,6 +400,13 @@ func (c *CollectClusterResources) Collect(progressChan chan<- interface{}) (Coll
 	}
 
 	output.SaveResult(c.BundlePath, path.Join(constants.CLUSTER_RESOURCES_DIR, fmt.Sprintf("%s-errors.json", constants.CLUSTER_RESOURCES_CONFIGMAPS)), marshalErrors(configMapsErrors))
+
+	// Replicated License
+	licenseData, licenseErr := replicatedLicense(ctx, client, namespaceNames)
+	if licenseErr == nil {
+		output.SaveResult(c.BundlePath, path.Join(constants.CLUSTER_RESOURCES_DIR, constants.CLUSTER_RESOURCES_REPLICATED_LICENSE), bytes.NewBuffer(licenseData))
+	}
+
 	return output, nil
 }
 
@@ -2176,3 +2183,68 @@ func storeCustomResource(name string, objects any, m map[string][]byte) error {
 	m[fmt.Sprintf("%s.yaml", name)] = y
 	return nil
 }
+
+// replicatedLicense searches for the replicated secret across namespaces,
+// extracts the config.yaml field, and extracts the licenseID and appSlug.
+// Note: secret.Data already contains decoded bytes; no base64 decoding is required.
+func replicatedLicense(ctx context.Context, client *kubernetes.Clientset, namespaces []string) ([]byte, error) {
+	// Structure to parse the config.yaml content
+	type ConfigYAML struct {
+		License string `yaml:"license"` // This is a YAML string containing the License object
+	}
+
+	type LicenseSpec struct {
+		LicenseID string `yaml:"licenseID"`
+		AppSlug   string `yaml:"appSlug"`
+	}
+
+	type License struct {
+		Spec LicenseSpec `yaml:"spec"`
+	}
+
+	// Search through all namespaces for the replicated secret
+	for _, namespace := range namespaces {
+		secret, err := client.CoreV1().Secrets(namespace).Get(ctx, "replicated", metav1.GetOptions{})
+		if err != nil {
+			// Secret not found in this namespace, continue to next
+			continue
+		}
+
+		// Extract the config.yaml field from the secret data
+		configYAMLBase64, exists := secret.Data["config.yaml"]
+		if !exists {
+			continue
+		}
+
+		configYAMLBytes := configYAMLBase64
+
+		// Parse the YAML to extract the license field
+		var config ConfigYAML
+		if err := yaml.Unmarshal(configYAMLBytes, &config); err != nil {
+			// Malformed config in this namespace; try the next namespace
+			continue
+		}
+
+		// Parse the license field (which is a YAML string) to extract licenseID and appSlug
+		var license License
+		if err := yaml.Unmarshal([]byte(config.License), &license); err != nil {
+			// Malformed license in this namespace; try the next namespace
+			continue
+		}
+
+		// Return both licenseID and appSlug as JSON
+		licenseData := map[string]string{
+			"licenseID": license.Spec.LicenseID,
+			"appSlug":   license.Spec.AppSlug,
+		}
+		licenseJSON, err := json.Marshal(licenseData)
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal license data: %w", err)
+		}
+
+		return licenseJSON, nil
+	}
+
+	// No replicated secret with a parsable license found in any namespace
+	return nil, fmt.Errorf("replicated secret with parsable license not found in any namespace")
+}

pkg/collect/registry.go

@@ -9,15 +9,15 @@ import (
 	"strings"
 	"time"
 
-	imagedocker "github.com/containers/image/v5/docker"
-	dockerref "github.com/containers/image/v5/docker/reference"
-	"github.com/containers/image/v5/transports/alltransports"
-	"github.com/containers/image/v5/types"
 	"github.com/distribution/distribution/v3/registry/api/errcode"
 	registryv2 "github.com/distribution/distribution/v3/registry/api/v2"
 	"github.com/pkg/errors"
 	"github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
 	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	imagedocker "go.podman.io/image/v5/docker"
+	dockerref "go.podman.io/image/v5/docker/reference"
+	"go.podman.io/image/v5/transports/alltransports"
+	"go.podman.io/image/v5/types"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"

pkg/collect/registry_test.go

@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
 	"github.com/stretchr/testify/assert"
+	"go.podman.io/image/v5/transports/alltransports"
 	"k8s.io/client-go/rest"
 )
 

pkg/collect/util.go

@@ -80,7 +80,19 @@ func DeterministicIDForCollector(collector *troubleshootv1beta2.Collect) string
 }
 
 func selectorToString(selector []string) string {
-	return strings.Replace(strings.Join(selector, "-"), "=", "-", -1)
+	result := strings.Replace(strings.Join(selector, "-"), "=", "-", -1)
+	// Sanitize characters that are invalid in Windows filenames: < > : " / \ | ? *
+	// Replace them with underscores to ensure cross-platform compatibility
+	result = strings.ReplaceAll(result, "*", "all")
+	result = strings.ReplaceAll(result, "?", "_")
+	result = strings.ReplaceAll(result, ":", "_")
+	result = strings.ReplaceAll(result, "<", "_")
+	result = strings.ReplaceAll(result, ">", "_")
+	result = strings.ReplaceAll(result, "|", "_")
+	result = strings.ReplaceAll(result, "\"", "_")
+	result = strings.ReplaceAll(result, "/", "_")
+	result = strings.ReplaceAll(result, "\\", "_")
+	return result
 }
 
 func pathToString(path string) string {

pkg/constants/constants.go

@@ -61,6 +61,7 @@ const (
 	CLUSTER_RESOURCES_LEASES                      = "leases"
 	CLUSTER_RESOURCES_VOLUME_ATTACHMENTS          = "volumeattachments"
 	CLUSTER_RESOURCES_CONFIGMAPS                  = "configmaps"
+	CLUSTER_RESOURCES_REPLICATED_LICENSE          = "license.json"
 
 	// SelfSubjectRulesReview evaluation responses
 	SELFSUBJECTRULESREVIEW_ERROR_AUTHORIZATION_WEBHOOK_UNSUPPORTED = "webhook authorizer does not support user rule resolution"

pkg/k8sutil/pod.go

@@ -25,6 +25,26 @@ const (
 	PodStatusReasonInitCrashLoopBackOff PodStatusReason = "Init:CrashLoopBackOff"
 )
 
+// isNativeSidecar checks if an init container is a native sidecar.
+// Native sidecars are init containers with restartPolicy: Always (Kubernetes 1.28+).
+// They run continuously alongside main containers, unlike traditional init containers
+// which must complete before main containers start.
+func isNativeSidecar(pod *corev1.Pod, initContainerIndex int) bool {
+	// Bounds check - ensure the index is valid
+	if initContainerIndex >= len(pod.Spec.InitContainers) {
+		return false
+	}
+
+	initContainer := pod.Spec.InitContainers[initContainerIndex]
+
+	// Check if RestartPolicy is set to Always
+	if initContainer.RestartPolicy != nil && *initContainer.RestartPolicy == corev1.ContainerRestartPolicyAlways {
+		return true
+	}
+
+	return false
+}
+
 // reference: https://github.com/kubernetes/kubernetes/blob/e8fcd0de98d50f4019561a6b7a0287f5c059267a/pkg/printers/internalversion/printers.go#L741
 func GetPodStatusReason(pod *corev1.Pod) (string, string) {
 	reason := string(pod.Status.Phase)
@@ -55,6 +75,11 @@ func GetPodStatusReason(pod *corev1.Pod) (string, string) {
 		case container.State.Waiting != nil && len(container.State.Waiting.Reason) > 0 && container.State.Waiting.Reason != "PodInitializing":
 			reason = "Init:" + container.State.Waiting.Reason
 			initializing = true
+		case isNativeSidecar(pod, i) && container.State.Running != nil:
+			// Native sidecar running - this is expected, not stuck initializing.
+			// Native sidecars (init containers with restartPolicy: Always) are designed
+			// to run continuously, so a Running state means successful initialization.
+			continue
 		default:
 			reason = fmt.Sprintf("Init:%d/%d", i, len(pod.Spec.InitContainers))
 			initializing = true

pkg/k8sutil/pod_test.go

@@ -1,9 +1,11 @@
 package k8sutil
 
 import (
+	"testing"
+
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
-	"testing"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 func TestIsPodUnhealthy(t *testing.T) {
@@ -99,3 +101,284 @@ func TestIsPodUnhealthy(t *testing.T) {
 		})
 	}
 }
+
+// TestGetPodStatusReason_HealthyNativeSidecar tests that a pod with a running native sidecar
+// is correctly reported as "Running" and not stuck initializing.
+func TestGetPodStatusReason_HealthyNativeSidecar(t *testing.T) {
+	startedTrue := true
+	restartPolicyAlways := corev1.ContainerRestartPolicyAlways
+
+	pod := &corev1.Pod{
+		Spec: corev1.PodSpec{
+			InitContainers: []corev1.Container{
+				{
+					Name:          "istio-proxy",
+					Image:         "istio/proxyv2:1.20",
+					RestartPolicy: &restartPolicyAlways, // Native sidecar!
+				},
+			},
+			Containers: []corev1.Container{
+				{
+					Name:  "app",
+					Image: "myapp:latest",
+				},
+			},
+		},
+		Status: corev1.PodStatus{
+			Phase: corev1.PodRunning,
+			Conditions: []corev1.PodCondition{
+				{
+					Type:   corev1.PodReady,
+					Status: corev1.ConditionTrue,
+				},
+			},
+			InitContainerStatuses: []corev1.ContainerStatus{
+				{
+					Name:    "istio-proxy",
+					Ready:   true,
+					Started: &startedTrue,
+					State: corev1.ContainerState{
+						Running: &corev1.ContainerStateRunning{
+							StartedAt: metav1.Now(),
+						},
+					},
+				},
+			},
+			ContainerStatuses: []corev1.ContainerStatus{
+				{
+					Name:    "app",
+					Ready:   true,
+					Started: &startedTrue,
+					State: corev1.ContainerState{
+						Running: &corev1.ContainerStateRunning{
+							StartedAt: metav1.Now(),
+						},
+					},
+				},
+			},
+		},
+	}
+
+	reason, message := GetPodStatusReason(pod)
+
+	// Should report as Running, not Init:0/1
+	if reason != "Running" {
+		t.Errorf("Expected reason 'Running', got '%s'", reason)
+	}
+
+	if message != "" {
+		t.Errorf("Expected empty message, got '%s'", message)
+	}
+}
+
+// TestIsPodUnhealthy_HealthyNativeSidecar tests that a pod with a healthy running native sidecar
+// is not marked as unhealthy.
+func TestIsPodUnhealthy_HealthyNativeSidecar(t *testing.T) {
+	startedTrue := true
+	restartPolicyAlways := corev1.ContainerRestartPolicyAlways
+
+	pod := &corev1.Pod{
+		Spec: corev1.PodSpec{
+			InitContainers: []corev1.Container{
+				{
+					Name:          "istio-proxy",
+					RestartPolicy: &restartPolicyAlways,
+				},
+			},
+			Containers: []corev1.Container{
+				{
+					Name: "app",
+				},
+			},
+		},
+		Status: corev1.PodStatus{
+			Phase: corev1.PodRunning,
+			Conditions: []corev1.PodCondition{
+				{
+					Type:   corev1.PodReady,
+					Status: corev1.ConditionTrue,
+				},
+			},
+			InitContainerStatuses: []corev1.ContainerStatus{
+				{
+					Name:    "istio-proxy",
+					Ready:   true,
+					Started: &startedTrue,
+					State: corev1.ContainerState{
+						Running: &corev1.ContainerStateRunning{},
+					},
+				},
+			},
+			ContainerStatuses: []corev1.ContainerStatus{
+				{
+					Name:    "app",
+					Ready:   true,
+					Started: &startedTrue,
+					State: corev1.ContainerState{
+						Running: &corev1.ContainerStateRunning{},
+					},
+				},
+			},
+		},
+	}
+
+	unhealthy := IsPodUnhealthy(pod)
+
+	if unhealthy {
+		t.Error("Pod with healthy native sidecar should not be marked as unhealthy")
+	}
+}
+
+// TestGetPodStatusReason_TraditionalInitAndNativeSidecar tests that a pod with both
+// a completed traditional init container and a running native sidecar is reported as "Running".
+func TestGetPodStatusReason_TraditionalInitAndNativeSidecar(t *testing.T) {
+	startedTrue := true
+	restartPolicyAlways := corev1.ContainerRestartPolicyAlways
+
+	pod := &corev1.Pod{
+		Spec: corev1.PodSpec{
+			InitContainers: []corev1.Container{
+				{
+					Name: "init-setup",
+					// No RestartPolicy = traditional init container
+				},
+				{
+					Name:          "istio-proxy",
+					RestartPolicy: &restartPolicyAlways, // Native sidecar
+				},
+			},
+			Containers: []corev1.Container{
+				{
+					Name: "app",
+				},
+			},
+		},
+		Status: corev1.PodStatus{
+			Phase: corev1.PodRunning,
+			Conditions: []corev1.PodCondition{
+				{
+					Type:   corev1.PodReady,
+					Status: corev1.ConditionTrue,
+				},
+			},
+			InitContainerStatuses: []corev1.ContainerStatus{
+				{
+					Name: "init-setup",
+					State: corev1.ContainerState{
+						Terminated: &corev1.ContainerStateTerminated{
+							ExitCode: 0,
+							Reason:   "Completed",
+						},
+					},
+				},
+				{
+					Name:    "istio-proxy",
+					Ready:   true,
+					Started: &startedTrue,
+					State: corev1.ContainerState{
+						Running: &corev1.ContainerStateRunning{},
+					},
+				},
+			},
+			ContainerStatuses: []corev1.ContainerStatus{
+				{
+					Name:    "app",
+					Ready:   true,
+					Started: &startedTrue,
+					State: corev1.ContainerState{
+						Running: &corev1.ContainerStateRunning{},
+					},
+				},
+			},
+		},
+	}
+
+	reason, _ := GetPodStatusReason(pod)
+
+	if reason != "Running" {
+		t.Errorf("Expected reason 'Running', got '%s'", reason)
+	}
+}
+
+// TestGetPodStatusReason_NativeSidecarCrashLoopBackOff tests that a native sidecar
+// in CrashLoopBackOff is still correctly detected as an error.
+func TestGetPodStatusReason_NativeSidecarCrashLoopBackOff(t *testing.T) {
+	restartPolicyAlways := corev1.ContainerRestartPolicyAlways
+
+	pod := &corev1.Pod{
+		Spec: corev1.PodSpec{
+			InitContainers: []corev1.Container{
+				{
+					Name:          "istio-proxy",
+					RestartPolicy: &restartPolicyAlways,
+				},
+			},
+			Containers: []corev1.Container{
+				{
+					Name: "app",
+				},
+			},
+		},
+		Status: corev1.PodStatus{
+			Phase: corev1.PodPending,
+			InitContainerStatuses: []corev1.ContainerStatus{
+				{
+					Name:  "istio-proxy",
+					Ready: false,
+					State: corev1.ContainerState{
+						Waiting: &corev1.ContainerStateWaiting{
+							Reason:  "CrashLoopBackOff",
+							Message: "Back-off 5m0s restarting failed container",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	reason, _ := GetPodStatusReason(pod)
+
+	// Should still catch the error
+	if reason != "Init:CrashLoopBackOff" {
+		t.Errorf("Expected reason 'Init:CrashLoopBackOff', got '%s'", reason)
+	}
+}
+
+// TestGetPodStatusReason_TraditionalInitStuck tests that a traditional init container
+// that is stuck running is still correctly detected as stuck initializing.
+func TestGetPodStatusReason_TraditionalInitStuck(t *testing.T) {
+	pod := &corev1.Pod{
+		Spec: corev1.PodSpec{
+			InitContainers: []corev1.Container{
+				{
+					Name: "init-setup",
+					// No RestartPolicy = traditional init
+				},
+			},
+			Containers: []corev1.Container{
+				{
+					Name: "app",
+				},
+			},
+		},
+		Status: corev1.PodStatus{
+			Phase: corev1.PodPending,
+			InitContainerStatuses: []corev1.ContainerStatus{
+				{
+					Name:  "init-setup",
+					Ready: false,
+					State: corev1.ContainerState{
+						Running: &corev1.ContainerStateRunning{},
+					},
+				},
+			},
+		},
+	}
+
+	reason, _ := GetPodStatusReason(pod)
+
+	// Traditional init running = stuck
+	if reason != "Init:0/1" {
+		t.Errorf("Expected reason 'Init:0/1', got '%s'", reason)
+	}
+}

pkg/lint/fixes.go

@@ -0,0 +1,345 @@
+package lint
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+)
+
+func applyFixesInMemory(content string, result LintResult) (string, bool, error) {
+	fixed := false
+	newContent := content
+	lines := strings.Split(newContent, "\n")
+
+	// Fix A: If templating errors exist in a v1beta2 file, upgrade apiVersion to v1beta3 (minimal, deterministic)
+	hasTemplateInV1beta2 := false
+	for _, e := range result.Errors {
+		if e.Field == "template" && strings.Contains(e.Message, "not supported in v1beta2") {
+			hasTemplateInV1beta2 = true
+			break
+		}
+	}
+	if hasTemplateInV1beta2 {
+		for i, line := range lines {
+			if strings.HasPrefix(strings.TrimSpace(line), "apiVersion:") && strings.Contains(line, constants.Troubleshootv1beta2Kind) {
+				indent := line[:len(line)-len(strings.TrimLeft(line, " \t"))]
+				lines[i] = indent + "apiVersion: " + constants.Troubleshootv1beta3Kind
+				fixed = true
+				break
+			}
+		}
+	}
+
+	// Sort errors by line number (descending) to avoid line number shifts when editing
+	errorsByLine := make(map[int][]LintError)
+	for _, err := range result.Errors {
+		if err.Line > 0 {
+			errorsByLine[err.Line] = append(errorsByLine[err.Line], err)
+		}
+	}
+
+	// Process errors line by line
+	for lineNum, errs := range errorsByLine {
+		if lineNum > len(lines) {
+			continue
+		}
+
+		line := lines[lineNum-1]
+		originalLine := line
+
+		for _, err := range errs {
+			// Fix 1: Add missing colon
+			if strings.Contains(err.Message, "could not find expected ':'") {
+				if !strings.Contains(line, ":") {
+					trimmed := strings.TrimSpace(line)
+					indent := line[:len(line)-len(strings.TrimLeft(line, " \t"))]
+					line = indent + trimmed + ":"
+					fixed = true
+				}
+			}
+
+			// Fix 2: Add missing leading dot in template expressions
+			if strings.Contains(err.Message, "Template expression may be missing leading dot:") {
+				// Extract the expression from the error message
+				re := regexp.MustCompile(`Template expression may be missing leading dot: \{\{ (.+?) \}\}`)
+				matches := re.FindStringSubmatch(err.Message)
+				if len(matches) > 1 {
+					badExpr := matches[1]
+					// Add the leading dot
+					fixedExpr := "." + badExpr
+					// Replace in the line
+					line = strings.Replace(line, "{{ "+badExpr+" }}", "{{ "+fixedExpr+" }}", 1)
+					line = strings.Replace(line, "{{"+badExpr+"}}", "{{"+fixedExpr+"}}", 1)
+					line = strings.Replace(line, "{{- "+badExpr+" }}", "{{- "+fixedExpr+" }}", 1)
+					line = strings.Replace(line, "{{- "+badExpr+" -}}", "{{- "+fixedExpr+" -}}", 1)
+					fixed = true
+				}
+			}
+
+			// Fix 3: Fix wrong apiVersion
+			if strings.Contains(err.Message, "File must contain apiVersion:") && err.Field == "apiVersion" {
+				if strings.Contains(line, "apiVersion:") && !strings.Contains(line, constants.Troubleshootv1beta3Kind) {
+					// Replace existing apiVersion with correct one
+					indent := line[:len(line)-len(strings.TrimLeft(line, " \t"))]
+					line = indent + "apiVersion: " + constants.Troubleshootv1beta3Kind
+					fixed = true
+				}
+			}
+		}
+
+		// Update the line if it changed
+		if line != originalLine {
+			lines[lineNum-1] = line
+		}
+	}
+
+	// Fix B: Wrap mapping under required list fields (collectors, hostCollectors, analyzers)
+	for _, err := range result.Errors {
+		if strings.HasPrefix(err.Message, "Expected 'collectors' to be a list") {
+			if wrapFirstChildAsList(&lines, "collectors:") {
+				fixed = true
+			}
+		}
+		if strings.HasPrefix(err.Message, "Expected 'hostCollectors' to be a list") {
+			if wrapFirstChildAsList(&lines, "hostCollectors:") || convertScalarToEmptyList(&lines, "hostCollectors:") {
+				fixed = true
+			}
+		}
+		if strings.HasPrefix(err.Message, "Expected 'analyzers' to be a list") {
+			if wrapFirstChildAsList(&lines, "analyzers:") {
+				fixed = true
+			}
+		}
+	}
+
+	// Fix C: Add missing required fields with empty placeholders (non-assumptive)
+	// Collectors
+	for _, err := range result.Errors {
+		if strings.HasPrefix(err.Message, "Missing required field '") && strings.Contains(err.Message, " for collector '") {
+			// Parse field and collector type
+			// e.g., Missing required field 'namespace' for collector 'ceph'
+			fieldName := between(err.Message, "Missing required field '", "'")
+			collectorType := betweenAfter(err.Message, "collector '", "'")
+			if fieldName == "" || collectorType == "" {
+				continue
+			}
+			// Only handle simple case where the list item is in {} form: "- type: {}"
+			// Find the list item line from current content
+			cur := strings.Join(lines, "\n")
+			lineNum := findCollectorLine(cur, "collectors", indexFromField(err.Field))
+			if lineNum > 0 {
+				li := lineNum - 1
+				if strings.Contains(lines[li], "- "+collectorType+": {}") {
+					indent := lines[li][:len(lines[li])-len(strings.TrimLeft(lines[li], " \t"))]
+					childIndent := indent + "    "
+					// choose placeholder: outcomes -> [] ; others -> ""
+					placeholder := "\"\""
+					if fieldName == "outcomes" {
+						placeholder = "[]"
+					}
+					lines[li] = strings.Replace(lines[li], ": {}", ":\n"+childIndent+fieldName+": "+placeholder, 1)
+					fixed = true
+				} else if strings.Contains(lines[li], "- "+collectorType+":") {
+					// Multi-line mapping; insert missing field under this item
+					if insertMissingFieldUnderListItem(&lines, li, fieldName) {
+						fixed = true
+					}
+				}
+			}
+		}
+	}
+	// Analyzers
+	for _, err := range result.Errors {
+		if strings.HasPrefix(err.Message, "Missing required field '") && strings.Contains(err.Message, " for analyzer '") {
+			fieldName := between(err.Message, "Missing required field '", "'")
+			analyzerType := betweenAfter(err.Message, "analyzer '", "'")
+			if fieldName == "" || analyzerType == "" {
+				continue
+			}
+			cur := strings.Join(lines, "\n")
+			lineNum := findAnalyzerLine(cur, indexFromField(err.Field))
+			if lineNum > 0 {
+				li := lineNum - 1
+				if strings.Contains(lines[li], "- "+analyzerType+": {}") {
+					indent := lines[li][:len(lines[li])-len(strings.TrimLeft(lines[li], " \t"))]
+					childIndent := indent + "    "
+					placeholder := "\"\""
+					if fieldName == "outcomes" {
+						placeholder = "[]"
+					}
+					lines[li] = strings.Replace(lines[li], ": {}", ":\n"+childIndent+fieldName+": "+placeholder, 1)
+					fixed = true
+				} else if strings.Contains(lines[li], "- "+analyzerType+":") {
+					if insertMissingFieldUnderListItem(&lines, li, fieldName) {
+						fixed = true
+					}
+				}
+			}
+		}
+	}
+
+	// Return fixed content if changes were made
+	if fixed {
+		newContent = strings.Join(lines, "\n")
+		return newContent, true, nil
+	}
+
+	return content, false, nil
+}
+
+// wrapFirstChildAsList prefixes the first child mapping line under the given key with '- '
+func wrapFirstChildAsList(lines *[]string, key string) bool {
+	arr := *lines
+	// find key line index
+	baseIdx := -1
+	for i, l := range arr {
+		if strings.Contains(l, key) {
+			baseIdx = i
+			break
+		}
+	}
+	if baseIdx == -1 {
+		return false
+	}
+	baseIndent := arr[baseIdx][:len(arr[baseIdx])-len(strings.TrimLeft(arr[baseIdx], " \t"))]
+	// find first child line with greater indent
+	for j := baseIdx + 1; j < len(arr); j++ {
+		line := arr[j]
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		// stop when indentation goes back to or less than base
+		if !strings.HasPrefix(line, baseIndent+" ") && !strings.HasPrefix(line, baseIndent+"\t") {
+			break
+		}
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "- ") {
+			// already a list
+			return false
+		}
+		// prefix '- '
+		childIndent := line[:len(line)-len(strings.TrimLeft(line, " \t"))]
+		arr[j] = childIndent + "- " + strings.TrimSpace(line)
+		*lines = arr
+		return true
+	}
+	return false
+}
+
+// convertScalarToEmptyList changes `key: <scalar>` to `key: []` on the same line
+func convertScalarToEmptyList(lines *[]string, key string) bool {
+	arr := *lines
+	for i, l := range arr {
+		trimmed := strings.TrimSpace(l)
+		if strings.HasPrefix(trimmed, key) {
+			// If already ends with ':' leave for wrapper; else replace value with []
+			if strings.HasSuffix(trimmed, ":") {
+				return false
+			}
+			// Replace everything after the first ':' with [] preserving indentation/key
+			parts := strings.SplitN(l, ":", 2)
+			if len(parts) == 2 {
+				arr[i] = parts[0] + ": []"
+				*lines = arr
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// indexFromField extracts the numeric index from a path like spec.collectors[1] or spec.analyzers[0]
+func indexFromField(field string) int {
+	// find [number]
+	start := strings.Index(field, "[")
+	end := strings.Index(field, "]")
+	if start == -1 || end == -1 || end <= start+1 {
+		return 0
+	}
+	numStr := field[start+1 : end]
+	// naive parse
+	n := 0
+	for _, ch := range numStr {
+		if ch < '0' || ch > '9' {
+			return 0
+		}
+		n = n*10 + int(ch-'0')
+	}
+	return n
+}
+
+// insertMissingFieldUnderListItem inserts "fieldName: <placeholder>" under list item at startIdx
+// Placeholder is [] for outcomes, "" otherwise. Preserves indentation by using the next child indentation if available
+func insertMissingFieldUnderListItem(lines *[]string, startIdx int, fieldName string) bool {
+	arr := *lines
+	baseLine := arr[startIdx]
+	baseIndent := baseLine[:len(baseLine)-len(strings.TrimLeft(baseLine, " \t"))]
+	// Determine child indentation: prefer next non-empty line's indent if deeper than base
+	childIndent := baseIndent + "  "
+	insertPos := startIdx + 1
+	for j := startIdx + 1; j < len(arr); j++ {
+		if strings.TrimSpace(arr[j]) == "" {
+			insertPos = j + 1
+			continue
+		}
+		lineIndent := arr[j][:len(arr[j])-len(strings.TrimLeft(arr[j], " \t"))]
+		if len(lineIndent) > len(baseIndent) {
+			childIndent = lineIndent
+			insertPos = j
+		}
+		break
+	}
+	// Choose placeholder
+	placeholder := "\"\""
+	if fieldName == "outcomes" {
+		placeholder = "[]"
+	}
+	// Insert new line
+	newLine := childIndent + fieldName + ": " + placeholder
+	// Avoid duplicate insert if the field already exists within this block
+	for k := startIdx + 1; k < len(arr); k++ {
+		if strings.TrimSpace(arr[k]) == "" {
+			continue
+		}
+		// Stop when block ends (indentation returns to base or less)
+		kIndent := arr[k][:len(arr[k])-len(strings.TrimLeft(arr[k], " \t"))]
+		if len(kIndent) <= len(baseIndent) {
+			break
+		}
+		if strings.HasPrefix(strings.TrimSpace(arr[k]), fieldName+":") {
+			return false
+		}
+	}
+	arr = append(arr[:insertPos], append([]string{newLine}, arr[insertPos:]...)...)
+	*lines = arr
+	return true
+}
+
+// between extracts substring between prefix and suffix (first occurrences)
+func between(s, prefix, suffix string) string {
+	i := strings.Index(s, prefix)
+	if i == -1 {
+		return ""
+	}
+	s2 := s[i+len(prefix):]
+	j := strings.Index(s2, suffix)
+	if j == -1 {
+		return ""
+	}
+	return s2[:j]
+}
+
+// betweenAfter extracts substring between prefix and suffix starting search after prefix
+func betweenAfter(s, prefix, suffix string) string {
+	i := strings.Index(s, prefix)
+	if i == -1 {
+		return ""
+	}
+	s2 := s[i+len(prefix):]
+	j := strings.Index(s2, suffix)
+	if j == -1 {
+		return ""
+	}
+	return s2[:j]
+}

pkg/lint/format.go

@@ -0,0 +1,103 @@
+package lint
+
+import (
+	"fmt"
+	"strings"
+)
+
+// FormatResults formats lint results for output
+func FormatResults(results []LintResult, format string) string {
+	if format == "json" {
+		return formatJSON(results)
+	}
+	return formatText(results)
+}
+
+func formatText(results []LintResult) string {
+	var output strings.Builder
+	totalErrors := 0
+	totalWarnings := 0
+
+	for _, result := range results {
+		if len(result.Errors) == 0 && len(result.Warnings) == 0 {
+			output.WriteString(fmt.Sprintf("✓ %s: No issues found\n", result.FilePath))
+			continue
+		}
+
+		output.WriteString(fmt.Sprintf("\n%s:\n", result.FilePath))
+
+		for _, err := range result.Errors {
+			output.WriteString(fmt.Sprintf("  ✗ Error (line %d): %s\n", err.Line, err.Message))
+			if err.Field != "" {
+				output.WriteString(fmt.Sprintf("    Field: %s\n", err.Field))
+			}
+			totalErrors++
+		}
+
+		for _, warn := range result.Warnings {
+			output.WriteString(fmt.Sprintf("  ⚠ Warning (line %d): %s\n", warn.Line, warn.Message))
+			if warn.Field != "" {
+				output.WriteString(fmt.Sprintf("    Field: %s\n", warn.Field))
+			}
+			totalWarnings++
+		}
+	}
+
+	output.WriteString(fmt.Sprintf("\nSummary: %d error(s), %d warning(s) across %d file(s)\n", totalErrors, totalWarnings, len(results)))
+
+	return output.String()
+}
+
+func formatJSON(results []LintResult) string {
+	// Simple JSON formatting without importing encoding/json
+	var output strings.Builder
+	output.WriteString("{\n")
+	output.WriteString("  \"results\": [\n")
+
+	for i, result := range results {
+		output.WriteString("    {\n")
+		output.WriteString(fmt.Sprintf("      \"filePath\": %q,\n", result.FilePath))
+		output.WriteString("      \"errors\": [\n")
+
+		for j, err := range result.Errors {
+			output.WriteString("        {\n")
+			output.WriteString(fmt.Sprintf("          \"line\": %d,\n", err.Line))
+			output.WriteString(fmt.Sprintf("          \"column\": %d,\n", err.Column))
+			output.WriteString(fmt.Sprintf("          \"message\": %q,\n", err.Message))
+			output.WriteString(fmt.Sprintf("          \"field\": %q\n", err.Field))
+			output.WriteString("        }")
+			if j < len(result.Errors)-1 {
+				output.WriteString(",")
+			}
+			output.WriteString("\n")
+		}
+
+		output.WriteString("      ],\n")
+		output.WriteString("      \"warnings\": [\n")
+
+		for j, warn := range result.Warnings {
+			output.WriteString("        {\n")
+			output.WriteString(fmt.Sprintf("          \"line\": %d,\n", warn.Line))
+			output.WriteString(fmt.Sprintf("          \"column\": %d,\n", warn.Column))
+			output.WriteString(fmt.Sprintf("          \"message\": %q,\n", warn.Message))
+			output.WriteString(fmt.Sprintf("          \"field\": %q\n", warn.Field))
+			output.WriteString("        }")
+			if j < len(result.Warnings)-1 {
+				output.WriteString(",")
+			}
+			output.WriteString("\n")
+		}
+
+		output.WriteString("      ]\n")
+		output.WriteString("    }")
+		if i < len(results)-1 {
+			output.WriteString(",")
+		}
+		output.WriteString("\n")
+	}
+
+	output.WriteString("  ]\n")
+	output.WriteString("}\n")
+
+	return output.String()
+}

pkg/lint/helpers.go

@@ -0,0 +1,63 @@
+package lint
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// findLineNumber returns the first 1-based line number containing the search string
+func findLineNumber(content, search string) int {
+	lines := strings.Split(content, "\n")
+	for i, line := range lines {
+		if strings.Contains(line, search) {
+			return i + 1
+		}
+	}
+	return 0
+}
+
+func findAnalyzerLine(content string, index int) int {
+	return findListItemLine(content, "analyzers", index)
+}
+
+// findCollectorLine locates the starting line of the Nth entry in a collectors list
+func findCollectorLine(content string, field string, index int) int {
+	return findListItemLine(content, field, index)
+}
+
+// findListItemLine locates the starting line of the Nth entry in a list under listKey
+func findListItemLine(content, listKey string, index int) int {
+	lines := strings.Split(content, "\n")
+	count := 0
+	inList := false
+	for i, line := range lines {
+		if strings.Contains(line, listKey+":") {
+			inList = true
+			continue
+		}
+		if inList && strings.HasPrefix(strings.TrimSpace(line), "- ") {
+			if count == index {
+				return i + 1
+			}
+			count++
+		}
+		if inList && !strings.HasPrefix(line, " ") && !strings.HasPrefix(line, "\t") && strings.TrimSpace(line) != "" {
+			break
+		}
+	}
+	return 0
+}
+
+// extractLineFromError tries to parse a YAML error message for a line number
+func extractLineFromError(err error) int {
+	// Try to extract line number from YAML error message
+	re := regexp.MustCompile(`line (\d+)`)
+	matches := re.FindStringSubmatch(err.Error())
+	if len(matches) > 1 {
+		var line int
+		fmt.Sscanf(matches[1], "%d", &line)
+		return line
+	}
+	return 0
+}

pkg/lint/lint.go

@@ -0,0 +1,325 @@
+package lint
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/internal/util"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"helm.sh/helm/v3/pkg/strvals"
+	"sigs.k8s.io/yaml"
+)
+
+// LintFiles validates troubleshoot specs for syntax and structural errors
+func LintFiles(opts LintOptions) ([]LintResult, error) {
+	results := []LintResult{}
+
+	// Load known analyzer/collector types from schemas (best effort)
+	ensureKnownTypesLoaded()
+
+	for _, filePath := range opts.FilePaths {
+		// Read entire file once
+		fileBytes, readErr := os.ReadFile(filePath)
+		if readErr != nil {
+			return nil, errors.Wrapf(readErr, "failed to read file %s", filePath)
+		}
+		fileContent := string(fileBytes)
+
+		// Check if this is a v1beta3 spec
+		isV1Beta3 := detectAPIVersionFromContent(fileContent) == constants.Troubleshootv1beta3Kind
+		isV1Beta2 := detectAPIVersionFromContent(fileContent) == constants.Troubleshootv1beta2Kind
+
+		// Check if the content has Helm templates (for preflight v1beta3)
+		hasTemplates := strings.Contains(fileContent, "{{") && strings.Contains(fileContent, "}}")
+
+		// Track if we should add a warning about unused values for v1beta2
+		hasUnusedValuesWarning := isV1Beta2 && (len(opts.ValuesFiles) > 0 || len(opts.SetValues) > 0)
+
+		// If v1beta3 with templates, require values and render the template
+		if isV1Beta3 && hasTemplates {
+			if len(opts.ValuesFiles) == 0 && len(opts.SetValues) == 0 {
+				return nil, errors.New("v1beta3 specs with Helm templates require a values file. Please provide values using --values or --set flags")
+			}
+
+			// Load values from files and --set flags
+			values := make(map[string]interface{})
+			for _, valuesFile := range opts.ValuesFiles {
+				if valuesFile == "" {
+					continue
+				}
+				data, err := os.ReadFile(valuesFile)
+				if err != nil {
+					return nil, errors.Wrapf(err, "failed to read values file %s", valuesFile)
+				}
+
+				var fileValues map[string]interface{}
+				if err := yaml.Unmarshal(data, &fileValues); err != nil {
+					return nil, errors.Wrapf(err, "failed to parse values file %s", valuesFile)
+				}
+
+				values = preflight.MergeMaps(values, fileValues)
+			}
+
+			// Apply --set values
+			for _, setValue := range opts.SetValues {
+				if err := strvals.ParseInto(setValue, values); err != nil {
+					return nil, errors.Wrapf(err, "failed to parse --set value: %s", setValue)
+				}
+			}
+
+			// Render the template
+			preflight.SeedDefaultBooleans(fileContent, values)
+			preflight.SeedParentMapsForValueRefs(fileContent, values)
+			rendered, err := preflight.RenderWithHelmTemplate(fileContent, values)
+			if err != nil {
+				// If rendering fails, create a result with the render error
+				// This allows us to report template syntax errors
+				results = append(results, LintResult{
+					FilePath: filePath,
+					Errors: []LintError{
+						{
+							Line:    1,
+							Message: fmt.Sprintf("Failed to render v1beta3 template: %v", err),
+							Field:   "template",
+						},
+					},
+				})
+				continue
+			}
+
+			// Use the rendered content for linting
+			fileContent = rendered
+		}
+
+		// Split into YAML documents
+		docs := util.SplitYAML(fileContent)
+
+		// Pre-compute starting line number for each doc within the file (1-based)
+		docStarts := make([]int, len(docs))
+		runningStart := 1
+		for i, d := range docs {
+			docStarts[i] = runningStart
+			// Count lines in this doc
+			runningStart += util.EstimateNumberOfLines(d)
+			// Account for the '---' separator line between documents
+			if i < len(docs)-1 {
+				runningStart += 1
+			}
+		}
+
+		// Lint each document, in parallel
+		type docOutcome struct {
+			errs    []LintError
+			warns   []LintWarning
+			newDoc  string
+			changed bool
+		}
+		outcomes := make([]docOutcome, len(docs))
+		var wg sync.WaitGroup
+		wg.Add(len(docs))
+		for i := range docs {
+			i := i
+			go func() {
+				defer wg.Done()
+				// Compute lint result for this doc, optionally applying fixes in-memory
+				res, finalDoc, _ /*changed*/, _ := lintContentInMemory(docs[i], opts.Fix)
+
+				// Adjust line numbers to file coordinates
+				lineOffset := docStarts[i] - 1
+				for idx := range res.Errors {
+					if res.Errors[idx].Line > 0 {
+						res.Errors[idx].Line += lineOffset
+					}
+				}
+				for idx := range res.Warnings {
+					if res.Warnings[idx].Line > 0 {
+						res.Warnings[idx].Line += lineOffset
+					}
+				}
+
+				changed := finalDoc != docs[i]
+				outcomes[i] = docOutcome{
+					errs:    res.Errors,
+					warns:   res.Warnings,
+					newDoc:  finalDoc,
+					changed: changed,
+				}
+			}()
+		}
+		wg.Wait()
+
+		// Assemble per-file result
+		fileResult := LintResult{FilePath: filePath}
+		writeNeeded := false
+		newDocs := make([]string, len(docs))
+		for i, oc := range outcomes {
+			fileResult.Errors = append(fileResult.Errors, oc.errs...)
+			fileResult.Warnings = append(fileResult.Warnings, oc.warns...)
+			if oc.changed {
+				writeNeeded = true
+			}
+			if oc.newDoc == "" {
+				newDocs[i] = docs[i]
+			} else {
+				newDocs[i] = oc.newDoc
+			}
+		}
+
+		// Add warning if values were provided for a v1beta2 spec
+		if hasUnusedValuesWarning {
+			fileResult.Warnings = append([]LintWarning{
+				{
+					Line:    1,
+					Message: "Values files provided but this is a v1beta2 spec. Values are only used with v1beta3 specs. Did you mean to use apiVersion: troubleshoot.sh/v1beta3?",
+					Field:   "apiVersion",
+				},
+			}, fileResult.Warnings...)
+		}
+
+		if writeNeeded {
+			// Reassemble with the same delimiter used by util.SplitYAML
+			updated := strings.Join(newDocs, "\n---\n")
+			if writeErr := os.WriteFile(filePath, []byte(updated), 0644); writeErr != nil {
+				return nil, errors.Wrapf(writeErr, "failed to write fixed content to %s", filePath)
+			}
+		}
+
+		results = append(results, fileResult)
+	}
+
+	return results, nil
+}
+
+func lintContentInMemory(content string, fix bool) (LintResult, string, bool, error) {
+	// Compute result for the provided content
+	compute := func(body string) LintResult {
+		res := LintResult{Errors: []LintError{}, Warnings: []LintWarning{}}
+
+		// Check if content contains template expressions
+		hasTemplates := strings.Contains(body, "{{") && strings.Contains(body, "}}")
+
+		// Validate YAML syntax (but be lenient with templated files)
+		var parsed map[string]interface{}
+		if err := yaml.Unmarshal([]byte(body), &parsed); err != nil {
+			// If the content has templates, YAML parsing may fail - that's expected for v1beta3 only
+			if !hasTemplates {
+				res.Errors = append(res.Errors, LintError{
+					Line:    extractLineFromError(err),
+					Message: fmt.Sprintf("YAML syntax error: %s", err.Error()),
+				})
+				return res
+			}
+
+			// Attempt to detect apiVersion from raw content
+			detectedAPIVersion := detectAPIVersionFromContent(body)
+			if detectedAPIVersion == "" {
+				res.Errors = append(res.Errors, LintError{
+					Line:    findLineNumber(body, "apiVersion"),
+					Field:   "apiVersion",
+					Message: "Missing or unreadable 'apiVersion' field",
+				})
+				return res
+			}
+
+			if detectedAPIVersion == constants.Troubleshootv1beta2Kind {
+				// v1beta2 does not support templating
+				addTemplatingErrorsForAllLines(&res, body)
+				return res
+			}
+
+			// For v1beta3 with templates, we can't parse YAML strictly, so just check template syntax
+			templateErrors, templateValueRefs := checkTemplateSyntax(body)
+			res.Errors = append(res.Errors, templateErrors...)
+
+			// Add warning about template values for v1beta3
+			if detectedAPIVersion == constants.Troubleshootv1beta3Kind && len(templateValueRefs) > 0 {
+				res.Warnings = append(res.Warnings, LintWarning{
+					Line:    1,
+					Field:   "template-values",
+					Message: fmt.Sprintf("Template values that must be provided at runtime: %s", strings.Join(templateValueRefs, ", ")),
+				})
+			}
+
+			return res
+		}
+
+		// Determine apiVersion from parsed YAML
+		apiVersion := ""
+		if v, ok := parsed["apiVersion"].(string); ok {
+			apiVersion = v
+		}
+		if apiVersion == "" {
+			res.Errors = append(res.Errors, LintError{
+				Line:    findLineNumber(body, "apiVersion"),
+				Field:   "apiVersion",
+				Message: "Missing or empty 'apiVersion' field",
+			})
+			return res
+		}
+
+		// Templating policy: only v1beta3 supports templating
+		if apiVersion == constants.Troubleshootv1beta2Kind && hasTemplates {
+			addTemplatingErrorsForAllLines(&res, body)
+		}
+
+		// Check required fields
+		res.Errors = append(res.Errors, checkRequiredFields(parsed, body)...)
+
+		// Check template syntax and collect template value references
+		templateErrors, templateValueRefs := checkTemplateSyntax(body)
+		res.Errors = append(res.Errors, templateErrors...)
+
+		// Check for kind-specific requirements
+		if kind, ok := parsed["kind"].(string); ok {
+			switch kind {
+			case "Preflight":
+				res.Errors = append(res.Errors, checkPreflightSpec(parsed, body)...)
+				// Validate analyzer entries
+				res.Errors = append(res.Errors, validateAnalyzers(parsed, body)...)
+			case "SupportBundle":
+				res.Errors = append(res.Errors, checkSupportBundleSpec(parsed, body)...)
+				// Validate analyzers if present in SupportBundle specs as well
+				res.Errors = append(res.Errors, validateAnalyzers(parsed, body)...)
+				// Validate collector entries (collectors and hostCollectors)
+				res.Errors = append(res.Errors, validateCollectors(parsed, body, "collectors")...)
+				res.Errors = append(res.Errors, validateCollectors(parsed, body, "hostCollectors")...)
+			}
+		}
+
+		// Check for common issues
+		res.Warnings = append(res.Warnings, checkCommonIssues(parsed, body, apiVersion, templateValueRefs)...)
+
+		return res
+	}
+
+	// Initial lint
+	result := compute(content)
+
+	// Apply fixes if requested (multi-pass within a single invocation), in-memory
+	changed := false
+	if fix && (len(result.Errors) > 0 || len(result.Warnings) > 0) {
+		const maxFixPasses = 3
+		for pass := 0; pass < maxFixPasses; pass++ {
+			updatedContent, fixed, err := applyFixesInMemory(content, result)
+			if err != nil {
+				return result, content, changed, err
+			}
+			if !fixed {
+				break
+			}
+			changed = true
+			content = updatedContent
+			// Recompute without applying fixes in this cycle
+			result = compute(content)
+			if len(result.Errors) == 0 && len(result.Warnings) == 0 {
+				break
+			}
+		}
+	}
+
+	return result, content, changed, nil
+}

pkg/lint/lint_test.go

@@ -0,0 +1,466 @@
+package lint
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLintMultipleFiles(t *testing.T) {
+	// Get the project root by going up from pkg/lint
+	projectRoot := filepath.Join("..", "..")
+	testDir := filepath.Join(projectRoot, "examples", "test-error-messages")
+
+	tests := []struct {
+		name           string
+		files          []string
+		valuesFiles    []string            // values files for v1beta3 specs
+		expectErrors   map[string][]string // filename -> expected error substrings
+		expectWarnings map[string][]string // filename -> expected warning substrings
+		expectPass     map[string]bool     // filename -> should pass without errors
+	}{
+		{
+			name: "valid v1beta3 with templates",
+			files: []string{
+				"helm-builtins-v1beta3.yaml",
+			},
+			valuesFiles: []string{
+				"values-helm-builtins.yaml",
+			},
+			expectErrors:   map[string][]string{},
+			expectWarnings: map[string][]string{},
+			expectPass: map[string]bool{
+				"helm-builtins-v1beta3.yaml": true,
+			},
+		},
+		{
+			name: "invalid collectors and analyzers",
+			files: []string{
+				"invalid-collectors-analyzers.yaml",
+			},
+			valuesFiles: []string{
+				"values-empty.yaml",
+			},
+			expectErrors: map[string][]string{
+				"invalid-collectors-analyzers.yaml": {
+					// The linter may stop early due to structural issues
+					// At minimum, it should catch the hostCollectors type error
+					"Expected 'hostCollectors' to be a list",
+				},
+			},
+			expectPass: map[string]bool{
+				"invalid-collectors-analyzers.yaml": false,
+			},
+		},
+		{
+			name: "missing required fields",
+			files: []string{
+				"missing-apiversion-v1beta3.yaml",
+				"missing-metadata-v1beta3.yaml",
+				"no-analyzers-v1beta3.yaml",
+			},
+			valuesFiles: []string{
+				"values-empty.yaml",
+			},
+			expectErrors: map[string][]string{
+				"missing-apiversion-v1beta3.yaml": {
+					"Missing or empty 'apiVersion' field",
+				},
+				"missing-metadata-v1beta3.yaml": {
+					"Missing 'metadata' section",
+				},
+				"no-analyzers-v1beta3.yaml": {
+					"Preflight spec must contain 'analyzers'",
+				},
+			},
+			expectPass: map[string]bool{
+				"missing-apiversion-v1beta3.yaml": false,
+				"missing-metadata-v1beta3.yaml":   false,
+				"no-analyzers-v1beta3.yaml":       false,
+			},
+		},
+		{
+			name: "v1beta2 file (valid but with docString warning)",
+			files: []string{
+				"wrong-apiversion-v1beta3.yaml", // Actually has v1beta2 which is valid
+			},
+			expectErrors: map[string][]string{},
+			expectWarnings: map[string][]string{
+				"wrong-apiversion-v1beta3.yaml": {
+					"Some analyzers are missing docString",
+				},
+			},
+			expectPass: map[string]bool{
+				"wrong-apiversion-v1beta3.yaml": true, // No errors, just warnings
+			},
+		},
+		{
+			name: "support bundle specs",
+			files: []string{
+				"support-bundle-no-collectors-v1beta3.yaml",
+				"support-bundle-valid-v1beta3.yaml",
+			},
+			valuesFiles: []string{
+				"values-empty.yaml",
+			},
+			expectErrors: map[string][]string{
+				"support-bundle-no-collectors-v1beta3.yaml": {
+					"SupportBundle spec must contain 'collectors' or 'hostCollectors'",
+				},
+			},
+			expectPass: map[string]bool{
+				"support-bundle-no-collectors-v1beta3.yaml": false,
+				"support-bundle-valid-v1beta3.yaml":         true,
+			},
+		},
+		{
+			name: "multiple files with mixed validity",
+			files: []string{
+				"support-bundle-valid-v1beta3.yaml",
+				"missing-metadata-v1beta3.yaml",
+				"wrong-apiversion-v1beta3.yaml",
+			},
+			valuesFiles: []string{
+				"values-empty.yaml",
+			},
+			expectErrors: map[string][]string{
+				"missing-metadata-v1beta3.yaml": {
+					"Missing 'metadata' section",
+				},
+			},
+			expectWarnings: map[string][]string{
+				"wrong-apiversion-v1beta3.yaml": {
+					"Some analyzers are missing docString",
+				},
+			},
+			expectPass: map[string]bool{
+				"support-bundle-valid-v1beta3.yaml": true,
+				"missing-metadata-v1beta3.yaml":     false,
+				"wrong-apiversion-v1beta3.yaml":     true, // No errors, just warnings
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Build full file paths
+			filePaths := make([]string, len(tt.files))
+			for i, f := range tt.files {
+				filePaths[i] = filepath.Join(testDir, f)
+				// Check file exists
+				if _, err := os.Stat(filePaths[i]); os.IsNotExist(err) {
+					t.Skipf("Test file %s does not exist, skipping", filePaths[i])
+				}
+			}
+
+			// Build values file paths
+			var valuesFilePaths []string
+			for _, vf := range tt.valuesFiles {
+				valuesFilePaths = append(valuesFilePaths, filepath.Join(testDir, vf))
+			}
+
+			// Run linter
+			opts := LintOptions{
+				FilePaths:   filePaths,
+				Fix:         false,
+				Format:      "text",
+				ValuesFiles: valuesFilePaths,
+			}
+
+			results, err := LintFiles(opts)
+			if err != nil {
+				t.Fatalf("LintFiles failed: %v", err)
+			}
+
+			// Verify we got results for all files
+			if len(results) != len(filePaths) {
+				t.Errorf("Expected %d results, got %d", len(filePaths), len(results))
+			}
+
+			// Check each result
+			for _, result := range results {
+				filename := filepath.Base(result.FilePath)
+
+				// Check expected errors
+				if expectedErrors, ok := tt.expectErrors[filename]; ok {
+					if len(expectedErrors) > 0 && len(result.Errors) == 0 {
+						t.Errorf("File %s: expected errors but got none", filename)
+					}
+					for _, expectedErr := range expectedErrors {
+						found := false
+						for _, err := range result.Errors {
+							if strings.Contains(err.Message, expectedErr) {
+								found = true
+								break
+							}
+						}
+						if !found {
+							t.Errorf("File %s: expected error containing '%s' but not found in errors: %v",
+								filename, expectedErr, getErrorMessages(result.Errors))
+						}
+					}
+				}
+
+				// Check expected warnings
+				if expectedWarnings, ok := tt.expectWarnings[filename]; ok {
+					for _, expectedWarn := range expectedWarnings {
+						found := false
+						for _, warn := range result.Warnings {
+							if strings.Contains(warn.Message, expectedWarn) {
+								found = true
+								break
+							}
+						}
+						if !found {
+							t.Errorf("File %s: expected warning containing '%s' but not found in warnings: %v",
+								filename, expectedWarn, getWarningMessages(result.Warnings))
+						}
+					}
+				}
+
+				// Check if should pass
+				if shouldPass, ok := tt.expectPass[filename]; ok {
+					hasNoErrors := len(result.Errors) == 0
+					if shouldPass && !hasNoErrors {
+						t.Errorf("File %s: expected to pass but has errors: %v",
+							filename, getErrorMessages(result.Errors))
+					} else if !shouldPass && hasNoErrors && len(tt.expectErrors[filename]) > 0 {
+						t.Errorf("File %s: expected to fail but passed", filename)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestLintWithFix(t *testing.T) {
+	// Create a temporary directory for test files
+	tmpDir, err := os.MkdirTemp("", "lint-test-*")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	tests := []struct {
+		name         string
+		content      string
+		expectFix    bool
+		fixedContent string // substring that should appear after fix
+	}{
+		{
+			name: "fix v1beta2 with templates to v1beta3",
+			content: `apiVersion: troubleshoot.sh/v1beta2
+kind: Preflight
+metadata:
+  name: test-{{ .Values.name }}
+spec:
+  analyzers:
+    - clusterVersion:
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: OK`,
+			expectFix:    true,
+			fixedContent: "apiVersion: troubleshoot.sh/v1beta3",
+		},
+		{
+			name: "v1beta3 template syntax error is reported",
+			content: `apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: test-{{ Values.name }}
+spec:
+  analyzers:
+    - clusterVersion:
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: OK`,
+			expectFix:    false,                               // Template errors in v1beta3 are not auto-fixable, rendering will fail
+			fixedContent: "Failed to render v1beta3 template", // Expect an error message
+		},
+	}
+
+	// Create empty values file for v1beta3 tests
+	emptyValuesFile := filepath.Join(tmpDir, "values-empty.yaml")
+	if err := os.WriteFile(emptyValuesFile, []byte("{}"), 0644); err != nil {
+		t.Fatalf("Failed to write empty values file: %v", err)
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Write test content to temp file
+			testFile := filepath.Join(tmpDir, tt.name+".yaml")
+			if err := os.WriteFile(testFile, []byte(tt.content), 0644); err != nil {
+				t.Fatalf("Failed to write test file: %v", err)
+			}
+
+			// Run linter with fix enabled
+			opts := LintOptions{
+				FilePaths:   []string{testFile},
+				Fix:         true,
+				Format:      "text",
+				ValuesFiles: []string{emptyValuesFile},
+			}
+
+			results, err := LintFiles(opts)
+			if err != nil {
+				t.Fatalf("LintFiles failed: %v", err)
+			}
+
+			if len(results) != 1 {
+				t.Fatalf("Expected 1 result, got %d", len(results))
+			}
+
+			// Read the potentially fixed content
+			fixedBytes, err := os.ReadFile(testFile)
+			if err != nil {
+				t.Fatalf("Failed to read fixed file: %v", err)
+			}
+			fixedContent := string(fixedBytes)
+
+			// Check if fix was applied or error was reported
+			if tt.expectFix {
+				if !strings.Contains(fixedContent, tt.fixedContent) {
+					t.Errorf("Expected fixed content to contain '%s', but got:\n%s",
+						tt.fixedContent, fixedContent)
+				}
+			} else {
+				// For tests that don't expect fix, check for errors
+				if len(results[0].Errors) > 0 {
+					errorFound := false
+					for _, err := range results[0].Errors {
+						if strings.Contains(err.Message, tt.fixedContent) {
+							errorFound = true
+							break
+						}
+					}
+					if !errorFound {
+						t.Errorf("Expected error containing '%s', but got errors: %v",
+							tt.fixedContent, results[0].Errors)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestHasErrors(t *testing.T) {
+	tests := []struct {
+		name     string
+		results  []LintResult
+		expected bool
+	}{
+		{
+			name: "no errors",
+			results: []LintResult{
+				{
+					FilePath: "test1.yaml",
+					Errors:   []LintError{},
+					Warnings: []LintWarning{{Message: "warning"}},
+				},
+				{
+					FilePath: "test2.yaml",
+					Errors:   []LintError{},
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "has errors",
+			results: []LintResult{
+				{
+					FilePath: "test1.yaml",
+					Errors:   []LintError{{Message: "error"}},
+				},
+				{
+					FilePath: "test2.yaml",
+					Errors:   []LintError{},
+				},
+			},
+			expected: true,
+		},
+		{
+			name:     "empty results",
+			results:  []LintResult{},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := HasErrors(tt.results)
+			if result != tt.expected {
+				t.Errorf("HasErrors() = %v, want %v", result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestFormatResults(t *testing.T) {
+	results := []LintResult{
+		{
+			FilePath: "test.yaml",
+			Errors: []LintError{
+				{Line: 5, Message: "Missing field", Field: "spec.analyzers"},
+			},
+			Warnings: []LintWarning{
+				{Line: 10, Message: "Consider adding docString", Field: "spec.analyzers[0]"},
+			},
+		},
+	}
+
+	t.Run("text format", func(t *testing.T) {
+		output := FormatResults(results, "text")
+
+		// Check for key components in text output
+		if !strings.Contains(output, "test.yaml") {
+			t.Error("Text output missing file path")
+		}
+		if !strings.Contains(output, "Error (line 5)") {
+			t.Error("Text output missing error with line number")
+		}
+		if !strings.Contains(output, "Warning (line 10)") {
+			t.Error("Text output missing warning with line number")
+		}
+		if !strings.Contains(output, "Summary:") {
+			t.Error("Text output missing summary")
+		}
+	})
+
+	t.Run("json format", func(t *testing.T) {
+		output := FormatResults(results, "json")
+
+		// Check for key JSON components
+		if !strings.Contains(output, `"filePath"`) {
+			t.Error("JSON output missing filePath field")
+		}
+		if !strings.Contains(output, `"errors"`) {
+			t.Error("JSON output missing errors field")
+		}
+		if !strings.Contains(output, `"warnings"`) {
+			t.Error("JSON output missing warnings field")
+		}
+		if !strings.Contains(output, `"line": 5`) {
+			t.Error("JSON output missing line number")
+		}
+	})
+}
+
+// Helper functions
+func getErrorMessages(errors []LintError) []string {
+	messages := make([]string, len(errors))
+	for i, err := range errors {
+		messages[i] = err.Message
+	}
+	return messages
+}
+
+func getWarningMessages(warnings []LintWarning) []string {
+	messages := make([]string, len(warnings))
+	for i, warn := range warnings {
+		messages[i] = warn.Message
+	}
+	return messages
+}

pkg/lint/templating.go

@@ -0,0 +1,181 @@
+package lint
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+)
+
+// detectAPIVersionFromContent tries to extract apiVersion from raw YAML text
+func detectAPIVersionFromContent(content string) string {
+	lines := strings.Split(content, "\n")
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "apiVersion:") {
+			parts := strings.SplitN(trimmed, ":", 2)
+			if len(parts) == 2 {
+				val := strings.TrimSpace(parts[1])
+				// strip quotes if present
+				val = strings.Trim(val, "'\"")
+				return val
+			}
+		}
+	}
+	return ""
+}
+
+// addTemplatingErrorsForAllLines records an error for each line containing template braces in versions that do not support templating
+func addTemplatingErrorsForAllLines(result *LintResult, content string) {
+	lines := strings.Split(content, "\n")
+	for i, line := range lines {
+		if strings.Contains(line, "{{") && strings.Contains(line, "}}") {
+			result.Errors = append(result.Errors, LintError{
+				Line:    i + 1,
+				Message: "Templating is not supported in v1beta2 specs",
+				Field:   "template",
+			})
+		}
+	}
+}
+
+func checkTemplateSyntax(content string) ([]LintError, []string) {
+	errors := []LintError{}
+	lines := strings.Split(content, "\n")
+	templateValueRefs := map[string]bool{}
+
+	// Check for unmatched braces
+	for i, line := range lines {
+		// Count opening and closing braces
+		opening := strings.Count(line, "{{")
+		closing := strings.Count(line, "}}")
+
+		if opening != closing {
+			errors = append(errors, LintError{
+				Line:    i + 1,
+				Message: fmt.Sprintf("Unmatched template braces: %d opening, %d closing", opening, closing),
+			})
+		}
+
+		// Check for common template syntax issues
+		// Look for templates that might be missing the leading dot
+		if strings.Contains(line, "{{") && strings.Contains(line, "}}") {
+			// Extract template expressions
+			templateExpr := extractTemplateBetweenBraces(line)
+			for _, expr := range templateExpr {
+				trimmed := strings.TrimSpace(expr)
+
+				// Skip empty expressions
+				if trimmed == "" {
+					continue
+				}
+
+				// Skip comments: {{/* ... */}}
+				if strings.HasPrefix(trimmed, "/*") || strings.HasPrefix(trimmed, "*/") {
+					continue
+				}
+
+				// Track template value references for warning (check this before skipping control structures)
+				if strings.Contains(trimmed, ".Values.") {
+					// Extract the value path
+					valuePattern := regexp.MustCompile(`\.Values\.(\w+(?:\.\w+)*)`)
+					matches := valuePattern.FindAllStringSubmatch(trimmed, -1)
+					for _, match := range matches {
+						if len(match) > 1 {
+							templateValueRefs[match[1]] = true
+						}
+					}
+				}
+
+				// Skip control structures (if, else, end, range, with, etc.)
+				if isControlStructure(trimmed) {
+					continue
+				}
+
+				// Skip template variables (start with $)
+				if strings.HasPrefix(trimmed, "$") {
+					continue
+				}
+
+				// Skip expressions that start with a dot (valid references)
+				if strings.HasPrefix(trimmed, ".") {
+					continue
+				}
+
+				// Skip string literals
+				if strings.HasPrefix(trimmed, "\"") || strings.HasPrefix(trimmed, "'") {
+					continue
+				}
+
+				// Skip numeric literals
+				if regexp.MustCompile(`^[0-9]+$`).MatchString(trimmed) {
+					continue
+				}
+
+				// Skip function calls (contain parentheses or pipes)
+				if strings.Contains(trimmed, "(") || strings.Contains(trimmed, "|") {
+					continue
+				}
+
+				// Skip known Helm functions/keywords
+				helmFunctions := []string{"toYaml", "toJson", "include", "required", "default", "quote", "nindent", "indent", "upper", "lower", "trim"}
+				isFunction := false
+				for _, fn := range helmFunctions {
+					if strings.HasPrefix(trimmed, fn+" ") || trimmed == fn {
+						isFunction = true
+						break
+					}
+				}
+				if isFunction {
+					continue
+				}
+
+				// If we got here, it might be missing a leading dot
+				errors = append(errors, LintError{
+					Line:    i + 1,
+					Message: fmt.Sprintf("Template expression may be missing leading dot: {{ %s }}", expr),
+				})
+			}
+		}
+	}
+
+	// Collect template values that need to be provided at runtime
+	var valueList []string
+	for val := range templateValueRefs {
+		valueList = append(valueList, val)
+	}
+	// Sort for consistent output
+	sort.Strings(valueList)
+
+	return errors, valueList
+}
+
+// extractTemplateBetweenBraces extracts template expressions from a line
+func extractTemplateBetweenBraces(line string) []string {
+	var expressions []string
+	// Match {{ ... }} with optional whitespace trimming (-), including comments {{/* */}}
+	re := regexp.MustCompile(`\{\{-?\s*(.+?)\s*-?\}\}`)
+	matches := re.FindAllStringSubmatch(line, -1)
+	for _, match := range matches {
+		if len(match) > 1 {
+			// Clean up the expression
+			expr := match[1]
+			// Remove */ at the end if it's part of a comment
+			expr = strings.TrimSuffix(strings.TrimSpace(expr), "*/")
+			expressions = append(expressions, expr)
+		}
+	}
+	return expressions
+}
+
+// isControlStructure checks if a template expression is a control structure
+func isControlStructure(expr string) bool {
+	trimmed := strings.TrimSpace(expr)
+	controlKeywords := []string{"if", "else", "end", "range", "with", "define", "template", "block", "include"}
+	for _, keyword := range controlKeywords {
+		if strings.HasPrefix(trimmed, keyword+" ") || trimmed == keyword {
+			return true
+		}
+	}
+	return false
+}

pkg/lint/types.go

@@ -0,0 +1,41 @@
+package lint
+
+// Core types used by the lint package
+
+type LintResult struct {
+	FilePath string
+	Errors   []LintError
+	Warnings []LintWarning
+}
+
+type LintError struct {
+	Line    int
+	Column  int
+	Message string
+	Field   string
+}
+
+type LintWarning struct {
+	Line    int
+	Column  int
+	Message string
+	Field   string
+}
+
+type LintOptions struct {
+	FilePaths   []string
+	Fix         bool
+	Format      string   // "text" or "json"
+	ValuesFiles []string // Path to YAML files with template values (for v1beta3)
+	SetValues   []string // Template values from command line (for v1beta3)
+}
+
+// HasErrors returns true if any of the results contain errors
+func HasErrors(results []LintResult) bool {
+	for _, result := range results {
+		if len(result.Errors) > 0 {
+			return true
+		}
+	}
+	return false
+}

pkg/lint/validators.go

@@ -0,0 +1,452 @@
+package lint
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"encoding/json"
+)
+
+func checkRequiredFields(parsed map[string]interface{}, content string) []LintError {
+	errors := []LintError{}
+
+	// Check apiVersion
+	if apiVersion, ok := parsed["apiVersion"].(string); !ok || apiVersion == "" {
+		errors = append(errors, LintError{
+			Line:    findLineNumber(content, "apiVersion"),
+			Field:   "apiVersion",
+			Message: "Missing 'apiVersion'",
+		})
+	}
+
+	// Check kind
+	if kind, ok := parsed["kind"].(string); !ok || kind == "" {
+		errors = append(errors, LintError{
+			Line:    findLineNumber(content, "kind"),
+			Field:   "kind",
+			Message: "Missing or empty 'kind' field",
+		})
+	} else if kind != "Preflight" && kind != "SupportBundle" {
+		errors = append(errors, LintError{
+			Line:    findLineNumber(content, "kind"),
+			Field:   "kind",
+			Message: fmt.Sprintf("Expected kind 'Preflight' or 'SupportBundle' (found '%s')", kind),
+		})
+	}
+
+	// Check metadata
+	if _, ok := parsed["metadata"]; !ok {
+		errors = append(errors, LintError{
+			Line:    findLineNumber(content, "metadata"),
+			Field:   "metadata",
+			Message: "Missing 'metadata' section",
+		})
+	} else if metadata, ok := parsed["metadata"].(map[string]interface{}); ok {
+		if name, ok := metadata["name"].(string); !ok || name == "" {
+			errors = append(errors, LintError{
+				Line:    findLineNumber(content, "name"),
+				Field:   "metadata.name",
+				Message: "Missing 'metadata.name'",
+			})
+		}
+	}
+
+	// Check spec
+	if _, ok := parsed["spec"]; !ok {
+		errors = append(errors, LintError{
+			Line:    findLineNumber(content, "spec"),
+			Field:   "spec",
+			Message: "Missing 'spec' section",
+		})
+	}
+
+	return errors
+}
+
+func checkPreflightSpec(parsed map[string]interface{}, content string) []LintError {
+	errors := []LintError{}
+
+	spec, ok := parsed["spec"].(map[string]interface{})
+	if !ok {
+		return errors
+	}
+
+	// Check for analyzers
+	analyzers, hasAnalyzers := spec["analyzers"]
+	if !hasAnalyzers {
+		errors = append(errors, LintError{
+			Line:    findLineNumber(content, "spec:"),
+			Field:   "spec.analyzers",
+			Message: "Preflight spec must contain 'analyzers'",
+		})
+	} else if analyzersList, ok := analyzers.([]interface{}); ok {
+		if len(analyzersList) == 0 {
+			errors = append(errors, LintError{
+				Line:    findLineNumber(content, "analyzers"),
+				Field:   "spec.analyzers",
+				Message: "Preflight spec must have at least one analyzer",
+			})
+		}
+	}
+
+	return errors
+}
+
+func checkSupportBundleSpec(parsed map[string]interface{}, content string) []LintError {
+	errors := []LintError{}
+
+	spec, ok := parsed["spec"].(map[string]interface{})
+	if !ok {
+		return errors
+	}
+
+	// Check for collectors
+	collectors, hasCollectors := spec["collectors"]
+	_, hasHostCollectors := spec["hostCollectors"]
+
+	if !hasCollectors && !hasHostCollectors {
+		errors = append(errors, LintError{
+			Line:    findLineNumber(content, "spec:"),
+			Field:   "spec.collectors",
+			Message: "SupportBundle spec must contain 'collectors' or 'hostCollectors'",
+		})
+	} else {
+		// Check if collectors list is empty
+		if hasCollectors {
+			if collectorsList, ok := collectors.([]interface{}); ok && len(collectorsList) == 0 {
+				errors = append(errors, LintError{
+					Line:    findLineNumber(content, "collectors"),
+					Field:   "spec.collectors",
+					Message: "Collectors list is empty",
+				})
+			}
+		}
+	}
+
+	return errors
+}
+
+// checkCommonIssues aggregates advisory warnings based on best practices
+func checkCommonIssues(parsed map[string]interface{}, content string, apiVersion string, templateValueRefs []string) []LintWarning {
+	warnings := []LintWarning{}
+
+	// Check for missing docStrings in analyzers and collectors
+	spec, ok := parsed["spec"].(map[string]interface{})
+	if !ok {
+		return warnings
+	}
+
+	// Check if any analyzers are missing docString
+	analyzersMissingDocString := false
+	if analyzers, ok := spec["analyzers"].([]interface{}); ok {
+		for _, analyzer := range analyzers {
+			if analyzerMap, ok := analyzer.(map[string]interface{}); ok {
+				// Check if docString exists at the analyzer level (v1beta3)
+				if _, hasDocString := analyzerMap["docString"]; !hasDocString {
+					analyzersMissingDocString = true
+					break
+				}
+			}
+		}
+	}
+
+	// Check if any collectors are missing docString
+	collectorsMissingDocString := false
+	if collectors, ok := spec["collectors"].([]interface{}); ok {
+		for _, collector := range collectors {
+			if collectorMap, ok := collector.(map[string]interface{}); ok {
+				// Get the actual collector type (first key-value pair)
+				for _, collectorSpec := range collectorMap {
+					if specMap, ok := collectorSpec.(map[string]interface{}); ok {
+						if _, hasDocString := specMap["docString"]; !hasDocString {
+							collectorsMissingDocString = true
+							break
+						}
+					}
+					// Only check the first key since collectors have single type
+					break
+				}
+			}
+			if collectorsMissingDocString {
+				break
+			}
+		}
+	}
+
+	// Add consolidated warnings if any items are missing docString
+	if analyzersMissingDocString && collectorsMissingDocString {
+		warnings = append(warnings, LintWarning{
+			Line:    findLineNumber(content, "spec:"),
+			Field:   "spec",
+			Message: "Some analyzers and collectors are missing docString (recommended for v1beta3)",
+		})
+	} else if analyzersMissingDocString {
+		warnings = append(warnings, LintWarning{
+			Line:    findLineNumber(content, "analyzers:"),
+			Field:   "spec.analyzers",
+			Message: "Some analyzers are missing docString (recommended for v1beta3)",
+		})
+	} else if collectorsMissingDocString {
+		warnings = append(warnings, LintWarning{
+			Line:    findLineNumber(content, "collectors:"),
+			Field:   "spec.collectors",
+			Message: "Some collectors are missing docString (recommended for v1beta3)",
+		})
+	}
+
+	// Add warning about template values that need to be provided at runtime (v1beta3 only)
+	if apiVersion == "troubleshoot.sh/v1beta3" && len(templateValueRefs) > 0 {
+		warnings = append(warnings, LintWarning{
+			Line:    1,
+			Field:   "template-values",
+			Message: fmt.Sprintf("Template values that must be provided at runtime: %s", strings.Join(templateValueRefs, ", ")),
+		})
+	}
+
+	return warnings
+}
+
+// --- Schema-backed quick validation (best-effort) ---
+
+type schemaTypeInfo struct {
+	required   map[string]struct{}
+	properties map[string]struct{}
+}
+
+var (
+	knownAnalyzerTypes  map[string]struct{}
+	knownCollectorTypes map[string]struct{}
+	analyzerTypeInfo    map[string]schemaTypeInfo
+	collectorTypeInfo   map[string]schemaTypeInfo
+	knownTypesLoaded    bool
+)
+
+func ensureKnownTypesLoaded() {
+	if knownTypesLoaded {
+		return
+	}
+	knownAnalyzerTypes = map[string]struct{}{}
+	knownCollectorTypes = map[string]struct{}{}
+	analyzerTypeInfo = map[string]schemaTypeInfo{}
+	collectorTypeInfo = map[string]schemaTypeInfo{}
+
+	// Analyzer schema (v1beta2)
+	loadKeysFromSchema(
+		filepath.Join("schemas", "analyzer-troubleshoot-v1beta2.json"),
+		[]string{"properties", "spec", "properties", "analyzers", "items", "properties"},
+		knownAnalyzerTypes,
+	)
+	loadTypeInfoFromSchema(
+		filepath.Join("schemas", "analyzer-troubleshoot-v1beta2.json"),
+		[]string{"properties", "spec", "properties", "analyzers", "items", "properties"},
+		analyzerTypeInfo,
+	)
+	// Collector schema (v1beta2)
+	loadKeysFromSchema(
+		filepath.Join("schemas", "collector-troubleshoot-v1beta2.json"),
+		[]string{"properties", "spec", "properties", "collectors", "items", "properties"},
+		knownCollectorTypes,
+	)
+	loadTypeInfoFromSchema(
+		filepath.Join("schemas", "collector-troubleshoot-v1beta2.json"),
+		[]string{"properties", "spec", "properties", "collectors", "items", "properties"},
+		collectorTypeInfo,
+	)
+
+	knownTypesLoaded = true
+}
+
+// loadKeysFromSchema walks a JSON object by keysPath and adds map keys at that node into dest
+func loadKeysFromSchema(schemaPath string, keysPath []string, dest map[string]struct{}) {
+	data, err := os.ReadFile(schemaPath)
+	if err != nil {
+		return
+	}
+	var obj map[string]interface{}
+	if err := json.Unmarshal(data, &obj); err != nil {
+		return
+	}
+	node := interface{}(obj)
+	for _, key := range keysPath {
+		m, ok := node.(map[string]interface{})
+		if !ok {
+			return
+		}
+		node, ok = m[key]
+		if !ok {
+			return
+		}
+	}
+	props, ok := node.(map[string]interface{})
+	if !ok {
+		return
+	}
+	for k := range props {
+		dest[k] = struct{}{}
+	}
+}
+
+// loadTypeInfoFromSchema records required/properties for each type under the node
+func loadTypeInfoFromSchema(schemaPath string, keysPath []string, dest map[string]schemaTypeInfo) {
+	data, err := os.ReadFile(schemaPath)
+	if err != nil {
+		return
+	}
+	var obj map[string]interface{}
+	if err := json.Unmarshal(data, &obj); err != nil {
+		return
+	}
+	node := interface{}(obj)
+	for _, key := range keysPath {
+		m, ok := node.(map[string]interface{})
+		if !ok {
+			return
+		}
+		node, ok = m[key]
+		if !ok {
+			return
+		}
+	}
+	typesNode, ok := node.(map[string]interface{})
+	if !ok {
+		return
+	}
+	for typeName, raw := range typesNode {
+		m, ok := raw.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		info := schemaTypeInfo{required: map[string]struct{}{}, properties: map[string]struct{}{}}
+		if req, ok := m["required"].([]interface{}); ok {
+			for _, r := range req {
+				if s, ok := r.(string); ok {
+					info.required[s] = struct{}{}
+				}
+			}
+		}
+		if props, ok := m["properties"].(map[string]interface{}); ok {
+			for prop := range props {
+				info.properties[prop] = struct{}{}
+			}
+		}
+		dest[typeName] = info
+	}
+}
+
+// validateAnalyzers delegates to the generic typed-list validator
+func validateAnalyzers(parsed map[string]interface{}, content string) []LintError {
+	return validateTypedList(parsed, content, "analyzers", "analyzer", knownAnalyzerTypes, analyzerTypeInfo)
+}
+
+func validateCollectors(parsed map[string]interface{}, content string, field string) []LintError {
+	return validateTypedList(parsed, content, field, "collector", knownCollectorTypes, collectorTypeInfo)
+}
+
+// validateTypedList provides generic validation for lists of typed single-key objects
+func validateTypedList(
+	parsed map[string]interface{},
+	content string,
+	listKey string,
+	subject string,
+	knownTypes map[string]struct{},
+	typeInfo map[string]schemaTypeInfo,
+) []LintError {
+	var errs []LintError
+	spec, ok := parsed["spec"].(map[string]interface{})
+	if !ok {
+		return errs
+	}
+	raw, exists := spec[listKey]
+	if !exists {
+		return errs
+	}
+	list, ok := raw.([]interface{})
+	if !ok {
+		errs = append(errs, LintError{
+			Line:    findLineNumber(content, listKey+":"),
+			Field:   "spec." + listKey,
+			Message: fmt.Sprintf("Expected '%s' to be a list", listKey),
+		})
+		return errs
+	}
+	for i, item := range list {
+		m, ok := item.(map[string]interface{})
+		if !ok {
+			errs = append(errs, LintError{
+				Line:    findListItemLine(content, listKey, i),
+				Field:   fmt.Sprintf("spec.%s[%d]", listKey, i),
+				Message: fmt.Sprintf("Expected %s entry to be a mapping", subject),
+			})
+			continue
+		}
+		// Count non-docString keys (docString is metadata in v1beta3, not a type)
+		typeCount := 0
+		var typ string
+		var body interface{}
+		for k, v := range m {
+			if k == "docString" {
+				// docString is metadata, not a type - skip it
+				continue
+			} else {
+				typeCount++
+				typ, body = k, v
+			}
+		}
+
+		// Check that we have exactly one type (excluding docString)
+		if typeCount != 1 {
+			errs = append(errs, LintError{
+				Line:    findListItemLine(content, listKey, i),
+				Field:   fmt.Sprintf("spec.%s[%d]", listKey, i),
+				Message: fmt.Sprintf("%s entry must specify exactly one %s type", strings.Title(subject), subject),
+			})
+			continue
+		}
+
+		// If no actual type was found (only docString), skip further validation
+		if typ == "" {
+			continue
+		}
+		if len(knownTypes) > 0 {
+			if _, ok := knownTypes[typ]; !ok {
+				errs = append(errs, LintError{
+					Line:    findListItemLine(content, listKey, i),
+					Field:   fmt.Sprintf("spec.%s[%d]", listKey, i),
+					Message: fmt.Sprintf("Unknown %s type '%s'", subject, typ),
+				})
+			}
+		}
+		bodyMap, ok := body.(map[string]interface{})
+		if !ok {
+			errs = append(errs, LintError{
+				Line:    findListItemLine(content, listKey, i),
+				Field:   fmt.Sprintf("spec.%s[%d].%s", listKey, i, typ),
+				Message: fmt.Sprintf("Expected %s definition to be a mapping", subject),
+			})
+			continue
+		}
+		if ti, ok := typeInfo[typ]; ok {
+			for req := range ti.required {
+				if _, ok := bodyMap[req]; !ok {
+					errs = append(errs, LintError{
+						Line:    findListItemLine(content, listKey, i),
+						Field:   fmt.Sprintf("spec.%s[%d].%s.%s", listKey, i, typ, req),
+						Message: fmt.Sprintf("Missing required field '%s' for %s '%s'", req, subject, typ),
+					})
+				}
+			}
+			for k := range bodyMap {
+				if _, ok := ti.properties[k]; !ok {
+					errs = append(errs, LintError{
+						Line:    findListItemLine(content, listKey, i),
+						Field:   fmt.Sprintf("spec.%s[%d].%s.%s", listKey, i, typ, k),
+						Message: fmt.Sprintf("Unknown field '%s' for %s '%s'", k, subject, typ),
+					})
+				}
+			}
+		}
+	}
+	return errs
+}

pkg/loader/loader.go

@@ -8,12 +8,14 @@ import (
 	"github.com/pkg/errors"
 	"github.com/replicatedhq/troubleshoot/internal/util"
 	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	troubleshootv1beta3 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta3"
 	"github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
 	"github.com/replicatedhq/troubleshoot/pkg/constants"
 	"github.com/replicatedhq/troubleshoot/pkg/docrewrite"
 	"github.com/replicatedhq/troubleshoot/pkg/types"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes"
 	"k8s.io/klog/v2"
 	"sigs.k8s.io/yaml"
 )
@@ -23,6 +25,8 @@ var decoder runtime.Decoder
 func init() {
 	// Allow serializing Secrets and ConfigMaps
 	_ = v1.AddToScheme(scheme.Scheme)
+	// Ensure v1beta3 Troubleshoot types are registered for decoding
+	_ = troubleshootv1beta3.AddToScheme(scheme.Scheme)
 	decoder = scheme.Codecs.UniversalDeserializer()
 }
 
@@ -40,6 +44,14 @@ type LoadOptions struct {
 	// If true, the loader will return an error if any of the specs are not valid
 	// else the invalid specs will be ignored
 	Strict bool
+
+	// Client is the kubernetes client used for resolving v1beta3 StringOrValueFrom fields
+	// If not provided, v1beta3 specs with secretKeyRef will fail to load
+	Client kubernetes.Interface
+
+	// Namespace is the default namespace for resolving v1beta3 secret references
+	// Defaults to "default" if not provided
+	Namespace string
 }
 
 // TODO: Additional requirements needed in this package
@@ -64,8 +76,18 @@ type LoadOptions struct {
 // the documents are not valid, else the invalid documents will be ignored.
 func LoadSpecs(ctx context.Context, opt LoadOptions) (*TroubleshootKinds, error) {
 	opt.RawSpecs = append(opt.RawSpecs, opt.RawSpec)
+
+	// Default namespace to "default" if not provided
+	namespace := opt.Namespace
+	if namespace == "" {
+		namespace = "default"
+	}
+
 	l := specLoader{
-		strict: opt.Strict,
+		strict:    opt.Strict,
+		client:    opt.Client,
+		namespace: namespace,
+		ctx:       ctx,
 	}
 
 	return l.loadFromStrings(opt.RawSpecs...)
@@ -140,7 +162,10 @@ func NewTroubleshootKinds() *TroubleshootKinds {
 }
 
 type specLoader struct {
-	strict bool
+	strict    bool
+	client    kubernetes.Interface
+	namespace string
+	ctx       context.Context
 }
 
 // loadFromStrings accepts a list of strings (exploded) which should be yaml documents
@@ -216,6 +241,23 @@ func (l *specLoader) loadFromSplitDocs(splitdocs []string) (*TroubleshootKinds,
 	kinds := NewTroubleshootKinds()
 
 	for _, doc := range splitdocs {
+		// Check if this is a v1beta3 spec
+		var parsed parsedDoc
+		if err := yaml.Unmarshal([]byte(doc), &parsed); err == nil && parsed.APIVersion == constants.Troubleshootv1beta3Kind {
+			// Only handle v1beta3 SupportBundle specially (to resolve valueFrom and convert)
+			if parsed.Kind == "SupportBundle" {
+				if err := l.loadV1Beta3Spec(doc, kinds); err != nil {
+					// Always surface v1beta3 SupportBundle errors so users get actionable guidance
+					return nil, err
+				}
+				// handled as support bundle; move to next doc
+				continue
+			}
+			// For other v1beta3 kinds (e.g., Preflight), fall through to the generic
+			// v1beta3->v1beta2 conversion path below to preserve prior behavior.
+		}
+
+		// Handle v1beta2 and v1beta1 specs
 		converted, err := docrewrite.ConvertToV1Beta2([]byte(doc))
 		if err != nil {
 			if !l.strict {
@@ -263,6 +305,119 @@ func (l *specLoader) loadFromSplitDocs(splitdocs []string) (*TroubleshootKinds,
 	return kinds, nil
 }
 
+// loadV1Beta3Spec handles loading and resolving v1beta3 specs
+func (l *specLoader) loadV1Beta3Spec(doc string, kinds *TroubleshootKinds) error {
+	// Unmarshal to v1beta3 types
+	obj, _, err := decoder.Decode([]byte(doc), nil, nil)
+	if err != nil {
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES,
+			errors.Wrapf(err, "failed to decode v1beta3 spec: '%s'", doc),
+		)
+	}
+
+	switch v3spec := obj.(type) {
+	case *troubleshootv1beta3.SupportBundle:
+		// Resolve secrets and convert to v1beta2
+		requiresClient := v1beta3SpecRequiresClient(&v3spec.Spec)
+		if requiresClient && l.client == nil {
+			return types.NewExitCodeError(
+				constants.EXIT_CODE_SPEC_ISSUES,
+				errors.New("kubernetes client required"),
+			)
+		}
+
+		v2spec, err := troubleshootv1beta3.ConvertToV1Beta2WithResolution(l.ctx, &v3spec.Spec, l.client, l.namespace)
+		if err != nil {
+			// When secret/configmap references are present, show a clear guidance message
+			// instead of leaking underlying RBAC or lookup errors.
+			if requiresClient {
+				return types.NewExitCodeError(
+					constants.EXIT_CODE_SPEC_ISSUES,
+					errors.New("this v1beta3 SupportBundle uses secret/configmap references and must be run in a cluster"),
+				)
+			}
+			return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES,
+				errors.Wrap(err, "failed to resolve and convert v1beta3 support bundle spec"),
+			)
+		}
+
+		// Create v1beta2 support bundle
+		v2bundle := troubleshootv1beta2.SupportBundle{
+			TypeMeta:   v3spec.TypeMeta,
+			ObjectMeta: v3spec.ObjectMeta,
+			Spec:       *v2spec,
+		}
+		// Update apiVersion to v1beta2
+		v2bundle.APIVersion = constants.Troubleshootv1beta2Kind
+		kinds.SupportBundlesV1Beta2 = append(kinds.SupportBundlesV1Beta2, v2bundle)
+
+	// TODO: Add other v1beta3 types as they are implemented
+	default:
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES,
+			errors.Errorf("unsupported v1beta3 kind: %T", v3spec),
+		)
+	}
+
+	return nil
+}
+
+// v1beta3SpecRequiresClient returns true if the v1beta3 spec contains any
+// StringOrValueFrom references that require fetching from the cluster.
+func v1beta3SpecRequiresClient(spec *troubleshootv1beta3.SupportBundleSpec) bool {
+	if spec == nil || spec.Collectors == nil {
+		return false
+	}
+
+	for _, c := range spec.Collectors {
+		if c == nil {
+			continue
+		}
+
+		// Database collectors
+		if c.Postgres != nil && databaseRequiresClient(c.Postgres) {
+			return true
+		}
+		if c.Mysql != nil && databaseRequiresClient(c.Mysql) {
+			return true
+		}
+		if c.Mssql != nil && databaseRequiresClient(c.Mssql) {
+			return true
+		}
+		if c.Redis != nil && databaseRequiresClient(c.Redis) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func databaseRequiresClient(db *troubleshootv1beta3.Database) bool {
+	if db == nil {
+		return false
+	}
+
+	if stringOrValueFromHasRef(db.URI) {
+		return true
+	}
+
+	if db.TLS != nil {
+		if stringOrValueFromHasRef(db.TLS.CACert) ||
+			stringOrValueFromHasRef(db.TLS.ClientCert) ||
+			stringOrValueFromHasRef(db.TLS.ClientKey) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func stringOrValueFromHasRef(s troubleshootv1beta3.StringOrValueFrom) bool {
+	if s.ValueFrom == nil {
+		return false
+	}
+	return s.ValueFrom.SecretKeyRef != nil || s.ValueFrom.ConfigMapKeyRef != nil
+}
+
 func isSecret(parsedDocHead parsedDoc) bool {
 	if parsedDocHead.Kind == "Secret" && parsedDocHead.APIVersion == "v1" {
 		return true

pkg/loader/loader_v1beta3_test.go

@@ -0,0 +1,289 @@
+package loader
+
+import (
+	"context"
+	"testing"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+func TestLoadSpecs_V1Beta3WithSecretRef(t *testing.T) {
+	// Create test secret
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "postgres-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("postgresql://user:password@localhost:5432/mydb"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	spec := `
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: test-bundle
+spec:
+  collectors:
+    - postgres:
+        collectorName: main-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-secret
+              key: uri
+`
+
+	kinds, err := LoadSpecs(context.Background(), LoadOptions{
+		RawSpec:   spec,
+		Client:    client,
+		Namespace: "default",
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, kinds)
+	require.Len(t, kinds.SupportBundlesV1Beta2, 1)
+
+	bundle := kinds.SupportBundlesV1Beta2[0]
+	assert.Equal(t, "test-bundle", bundle.Name)
+	assert.Equal(t, "troubleshoot.sh/v1beta2", bundle.APIVersion)
+
+	require.Len(t, bundle.Spec.Collectors, 1)
+	require.NotNil(t, bundle.Spec.Collectors[0].Postgres)
+	assert.Equal(t, "main-db", bundle.Spec.Collectors[0].Postgres.CollectorName)
+	assert.Equal(t, "postgresql://user:password@localhost:5432/mydb", bundle.Spec.Collectors[0].Postgres.URI)
+}
+
+func TestLoadSpecs_V1Beta3WithTLSSecrets(t *testing.T) {
+	// Create test secret with TLS certs
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "tls-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"ca.crt":     []byte("CA_CERT_DATA"),
+			"client.crt": []byte("CLIENT_CERT_DATA"),
+			"client.key": []byte("CLIENT_KEY_DATA"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	spec := `
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: test-bundle
+spec:
+  collectors:
+    - postgres:
+        uri:
+          value: "postgresql://localhost:5432/db"
+        tls:
+          cacert:
+            valueFrom:
+              secretKeyRef:
+                name: tls-secret
+                key: ca.crt
+          clientCert:
+            valueFrom:
+              secretKeyRef:
+                name: tls-secret
+                key: client.crt
+          clientKey:
+            valueFrom:
+              secretKeyRef:
+                name: tls-secret
+                key: client.key
+`
+
+	kinds, err := LoadSpecs(context.Background(), LoadOptions{
+		RawSpec:   spec,
+		Client:    client,
+		Namespace: "default",
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, kinds)
+	require.Len(t, kinds.SupportBundlesV1Beta2, 1)
+
+	bundle := kinds.SupportBundlesV1Beta2[0]
+	require.Len(t, bundle.Spec.Collectors, 1)
+	require.NotNil(t, bundle.Spec.Collectors[0].Postgres)
+	require.NotNil(t, bundle.Spec.Collectors[0].Postgres.TLS)
+
+	assert.Equal(t, "CA_CERT_DATA", bundle.Spec.Collectors[0].Postgres.TLS.CACert)
+	assert.Equal(t, "CLIENT_CERT_DATA", bundle.Spec.Collectors[0].Postgres.TLS.ClientCert)
+	assert.Equal(t, "CLIENT_KEY_DATA", bundle.Spec.Collectors[0].Postgres.TLS.ClientKey)
+}
+
+func TestLoadSpecs_V1Beta3MultipleCollectors(t *testing.T) {
+	pgSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "postgres-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("postgresql://localhost:5432/db"),
+		},
+	}
+
+	mysqlSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mysql-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("mysql://localhost:3306/db"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(pgSecret, mysqlSecret)
+
+	spec := `
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: test-bundle
+spec:
+  collectors:
+    - postgres:
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-secret
+              key: uri
+    - mysql:
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: mysql-secret
+              key: uri
+`
+
+	kinds, err := LoadSpecs(context.Background(), LoadOptions{
+		RawSpec:   spec,
+		Client:    client,
+		Namespace: "default",
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, kinds)
+	require.Len(t, kinds.SupportBundlesV1Beta2, 1)
+
+	bundle := kinds.SupportBundlesV1Beta2[0]
+	require.Len(t, bundle.Spec.Collectors, 2)
+
+	require.NotNil(t, bundle.Spec.Collectors[0].Postgres)
+	assert.Equal(t, "postgresql://localhost:5432/db", bundle.Spec.Collectors[0].Postgres.URI)
+
+	require.NotNil(t, bundle.Spec.Collectors[1].Mysql)
+	assert.Equal(t, "mysql://localhost:3306/db", bundle.Spec.Collectors[1].Mysql.URI)
+}
+
+func TestLoadSpecs_V1Beta3WithoutClient(t *testing.T) {
+	spec := `
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: test-bundle
+spec:
+  collectors:
+    - postgres:
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-secret
+              key: uri
+`
+
+	_, err := LoadSpecs(context.Background(), LoadOptions{
+		RawSpec: spec,
+		Strict:  true, // Enable strict mode to get error instead of warning
+		// No client provided
+	})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "kubernetes client required")
+}
+
+func TestLoadSpecs_V1Beta3MixedWithV1Beta2(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "postgres-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("postgresql://localhost:5432/db"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	specs := `
+---
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: v1beta3-bundle
+spec:
+  collectors:
+    - postgres:
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-secret
+              key: uri
+---
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: v1beta2-bundle
+spec:
+  collectors:
+    - clusterInfo: {}
+`
+
+	kinds, err := LoadSpecs(context.Background(), LoadOptions{
+		RawSpec:   specs,
+		Client:    client,
+		Namespace: "default",
+	})
+
+	require.NoError(t, err)
+	require.NotNil(t, kinds)
+	require.Len(t, kinds.SupportBundlesV1Beta2, 2)
+
+	// Find the v1beta3-converted bundle
+	var v3Bundle *troubleshootv1beta2.SupportBundle
+	var v2Bundle *troubleshootv1beta2.SupportBundle
+	for i := range kinds.SupportBundlesV1Beta2 {
+		if kinds.SupportBundlesV1Beta2[i].Name == "v1beta3-bundle" {
+			v3Bundle = &kinds.SupportBundlesV1Beta2[i]
+		}
+		if kinds.SupportBundlesV1Beta2[i].Name == "v1beta2-bundle" {
+			v2Bundle = &kinds.SupportBundlesV1Beta2[i]
+		}
+	}
+
+	require.NotNil(t, v3Bundle, "v1beta3 bundle should be converted and loaded")
+	require.NotNil(t, v2Bundle, "v1beta2 bundle should be loaded")
+
+	// Verify v1beta3 bundle was resolved correctly
+	require.Len(t, v3Bundle.Spec.Collectors, 1)
+	require.NotNil(t, v3Bundle.Spec.Collectors[0].Postgres)
+	assert.Equal(t, "postgresql://localhost:5432/db", v3Bundle.Spec.Collectors[0].Postgres.URI)
+
+	// Verify v1beta2 bundle was loaded correctly
+	require.Len(t, v2Bundle.Spec.Collectors, 1)
+	require.NotNil(t, v2Bundle.Spec.Collectors[0].ClusterInfo)
+}

pkg/namespaces/namespace-pinger.go

@@ -5,6 +5,7 @@ package namespaces
 import (
 	"fmt"
 	"net"
+	"strconv"
 	"time"
 )
 
@@ -51,7 +52,7 @@ func (n *NamespacePinger) PingUDP(dst net.IP) error {
 func (n *NamespacePinger) PingTCP(dst net.IP) error {
 	n.cfg.Logf("reaching to %q from %q with tcp", dst, n.InternalIP)
 	pinger := func() error {
-		addr := fmt.Sprintf("%s:%d", dst, n.cfg.Port)
+		addr := net.JoinHostPort(dst.String(), strconv.Itoa(n.cfg.Port))
 		conn, err := net.DialTimeout("tcp", addr, n.cfg.Timeout)
 		if err != nil {
 			return fmt.Errorf("error dialing tcp: %w", err)
@@ -90,7 +91,7 @@ func (n *NamespacePinger) StartTCPEchoServer(errors chan error) {
 // received, the server ends. Callers must wait until the ready channel is
 // closed before they can start sending packets.
 func (n *NamespacePinger) startTCPEchoServer(ready chan struct{}) (err error) {
-	addr := fmt.Sprintf("%s:%d", n.InternalIP, n.cfg.Port)
+	addr := net.JoinHostPort(n.InternalIP.String(), strconv.Itoa(n.cfg.Port))
 	n.cfg.Logf("starting tcp echo server on namespace %q(%q)", n.name, addr)
 
 	if err = n.Join(); err != nil {

pkg/preflight/read_specs.go

@@ -88,6 +88,52 @@ func preprocessV1Beta3Specs(args []string) ([]string, []string, error) {
 	valuesFiles := viper.GetStringSlice("values")
 	setValues := viper.GetStringSlice("set")
 
+	// Check if any args contain v1beta3 specs
+	hasV1Beta3 := false
+	for _, arg := range args {
+		// Skip non-file arguments
+		if arg == "-" || strings.HasPrefix(arg, "http://") || strings.HasPrefix(arg, "https://") ||
+			strings.HasPrefix(arg, "secret/") || strings.HasPrefix(arg, "configmap/") {
+			continue
+		}
+
+		// Check if file exists
+		if _, err := os.Stat(arg); err != nil {
+			continue
+		}
+
+		// Read the file
+		content, err := os.ReadFile(arg)
+		if err != nil {
+			continue
+		}
+
+		// Check if it's a v1beta3 spec with templates
+		contentStr := string(content)
+		var parsed map[string]interface{}
+		if err := yaml.Unmarshal(content, &parsed); err == nil {
+			if apiVersion, ok := parsed["apiVersion"]; ok && apiVersion == constants.Troubleshootv1beta3Kind {
+				// Only require values if the spec has Helm templates
+				if strings.Contains(contentStr, "{{") && strings.Contains(contentStr, "}}") {
+					hasV1Beta3 = true
+					break
+				}
+			}
+		} else {
+			// If YAML parsing fails, check raw content for v1beta3 with templates
+			if strings.Contains(contentStr, "apiVersion: troubleshoot.sh/v1beta3") &&
+				strings.Contains(contentStr, "{{") && strings.Contains(contentStr, "}}") {
+				hasV1Beta3 = true
+				break
+			}
+		}
+	}
+
+	// If v1beta3 spec with templates found but no values provided, return error
+	if hasV1Beta3 && len(valuesFiles) == 0 && len(setValues) == 0 {
+		return nil, nil, errors.New("v1beta3 specs with Helm templates require a values file. Please provide values using --values or --set flags")
+	}
+
 	// If no values provided, return args unchanged
 	if len(valuesFiles) == 0 && len(setValues) == 0 {
 		return args, nil, nil
@@ -109,7 +155,7 @@ func preprocessV1Beta3Specs(args []string) ([]string, []string, error) {
 			return nil, nil, errors.Wrapf(err, "failed to parse values file %s", valuesFile)
 		}
 
-		values = mergeMaps(values, fileValues)
+		values = MergeMaps(values, fileValues)
 	}
 
 	// Apply --set values

pkg/preflight/read_specs_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/replicatedhq/troubleshoot/internal/testutils"
 	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
 	"github.com/replicatedhq/troubleshoot/pkg/loader"
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -410,3 +411,75 @@ func singleTestPreflightSpecsRead(t *testing.T, tt *PreflightSpecsReadTest) (*lo
 
 	return kinds, err
 }
+
+func TestPreprocessV1Beta3Specs_RequiresValues(t *testing.T) {
+	// Save and restore viper state
+	oldValues := viper.Get("values")
+	oldSet := viper.Get("set")
+	defer func() {
+		viper.Set("values", oldValues)
+		viper.Set("set", oldSet)
+	}()
+
+	t.Run("v1beta3 without values should error", func(t *testing.T) {
+		// Clear viper values
+		viper.Set("values", []string{})
+		viper.Set("set", []string{})
+
+		v1beta3File := filepath.Join(testutils.FileDir(), "../../examples/preflight/simple-v1beta3.yaml")
+		_, _, err := preprocessV1Beta3Specs([]string{v1beta3File})
+
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "v1beta3 specs with Helm templates require a values file")
+	})
+
+	t.Run("v1beta3 with values file should succeed", func(t *testing.T) {
+		valuesFile := filepath.Join(testutils.FileDir(), "../../examples/preflight/values-v1beta3-1.yaml")
+		viper.Set("values", []string{valuesFile})
+		viper.Set("set", []string{})
+
+		v1beta3File := filepath.Join(testutils.FileDir(), "../../examples/preflight/simple-v1beta3.yaml")
+		processedArgs, tempFiles, err := preprocessV1Beta3Specs([]string{v1beta3File})
+
+		// Clean up temp files
+		defer func() {
+			for _, f := range tempFiles {
+				_ = os.Remove(f)
+			}
+		}()
+
+		require.NoError(t, err)
+		assert.NotNil(t, processedArgs)
+	})
+
+	t.Run("v1beta3 with --set values should succeed", func(t *testing.T) {
+		viper.Set("values", []string{})
+		viper.Set("set", []string{"kubernetes.enabled=true"})
+
+		v1beta3File := filepath.Join(testutils.FileDir(), "../../examples/preflight/simple-v1beta3.yaml")
+		processedArgs, tempFiles, err := preprocessV1Beta3Specs([]string{v1beta3File})
+
+		// Clean up temp files
+		defer func() {
+			for _, f := range tempFiles {
+				_ = os.Remove(f)
+			}
+		}()
+
+		require.NoError(t, err)
+		assert.NotNil(t, processedArgs)
+	})
+
+	t.Run("v1beta2 without values should succeed", func(t *testing.T) {
+		viper.Set("values", []string{})
+		viper.Set("set", []string{})
+
+		v1beta2File := filepath.Join(testutils.FileDir(), "../../testdata/preflightspec/troubleshoot_v1beta2_preflight_gotest.yaml")
+		processedArgs, tempFiles, err := preprocessV1Beta3Specs([]string{v1beta2File})
+
+		require.NoError(t, err)
+		assert.NotNil(t, processedArgs)
+		assert.Empty(t, tempFiles)
+		assert.Equal(t, []string{v1beta2File}, processedArgs)
+	})
+}

pkg/preflight/template.go

@@ -33,7 +33,7 @@ func RunTemplate(templateFile string, valuesFiles []string, setValues []string,
 		if err != nil {
 			return errors.Wrapf(err, "failed to load values file %s", valuesFile)
 		}
-		values = mergeMaps(values, fileValues)
+		values = MergeMaps(values, fileValues)
 	}
 
 	// Apply --set values (Helm semantics)
@@ -165,8 +165,8 @@ func cleanRenderedYAML(content string) string {
 	return strings.Join(cleaned, "\n") + "\n"
 }
 
-// mergeMaps recursively merges two maps
-func mergeMaps(base, overlay map[string]interface{}) map[string]interface{} {
+// MergeMaps recursively merges two maps, with overlay taking precedence
+func MergeMaps(base, overlay map[string]interface{}) map[string]interface{} {
 	result := make(map[string]interface{})
 
 	// Copy base map
@@ -180,7 +180,7 @@ func mergeMaps(base, overlay map[string]interface{}) map[string]interface{} {
 			// If both are maps, merge recursively
 			if baseMap, ok := baseVal.(map[string]interface{}); ok {
 				if overlayMap, ok := v.(map[string]interface{}); ok {
-					result[k] = mergeMaps(baseMap, overlayMap)
+					result[k] = MergeMaps(baseMap, overlayMap)
 					continue
 				}
 			}

pkg/preflight/template_test.go

@@ -430,7 +430,7 @@ func TestRender_V1Beta3_MergeMultipleValuesFiles_And_SetPrecedence(t *testing.T)
 	for _, f := range []string{minimalFile, file1, file3} {
 		m, err := loadValuesFile(f)
 		require.NoError(t, err)
-		vals = mergeMaps(vals, m)
+		vals = MergeMaps(vals, m)
 	}
 
 	// First render without --set; expect NO kubernetes analyzer

pkg/supportbundle/extract_license.go

@@ -16,8 +16,9 @@ import (
 )
 
 // ExtractLicenseFromBundle extracts the license ID from a support bundle
-// It looks in cluster-resources/configmaps/* for a license field
-// Returns both the license ID and the app slug (from the filename where license was found)
+// It first looks for cluster-resources/license.json, then falls back to searching
+// cluster-resources/configmaps/* for a license field
+// Returns both the license ID and the app slug
 func ExtractLicenseFromBundle(bundlePath string) (string, string, error) {
 	file, err := os.Open(bundlePath)
 	if err != nil {
@@ -42,7 +43,27 @@ func ExtractLicenseFromBundle(bundlePath string) (string, string, error) {
 			return "", "", errors.Wrap(err, "failed to read tar header")
 		}
 
-		// Only process files in cluster-resources/configmaps/ (may be nested under bundle directory)
+		// First priority: check for the new license.json file
+		if strings.Contains(header.Name, "cluster-resources/license.json") && header.Typeflag == tar.TypeReg {
+			content := make([]byte, header.Size)
+			if _, err := io.ReadFull(tarReader, content); err != nil {
+				continue
+			}
+
+			// Parse the license.json file
+			var licenseData struct {
+				LicenseID string `json:"licenseID"`
+				AppSlug   string `json:"appSlug"`
+			}
+			if err := json.Unmarshal(content, &licenseData); err == nil {
+				if licenseData.LicenseID != "" && licenseData.AppSlug != "" {
+					return licenseData.LicenseID, licenseData.AppSlug, nil
+				}
+			}
+			continue
+		}
+
+		// Fallback: process files in cluster-resources/configmaps/
 		if !strings.Contains(header.Name, "cluster-resources/configmaps/") {
 			continue
 		}

pkg/supportbundle/upload.go

@@ -10,7 +10,7 @@ import (
 
 // UploadToReplicatedApp uploads a support bundle directly to replicated.app
 // using the app slug as the upload path
-func UploadToReplicatedApp(bundlePath, licenseID, appSlug string) error {
+func UploadToReplicatedApp(bundlePath, licenseID, appSlug, uploadDomain string) error {
 	// Open the bundle file
 	file, err := os.Open(bundlePath)
 	if err != nil {
@@ -23,8 +23,14 @@ func UploadToReplicatedApp(bundlePath, licenseID, appSlug string) error {
 		return errors.Wrap(err, "failed to stat file")
 	}
 
+	// Use custom domain if provided, otherwise default to replicated.app
+	domain := uploadDomain
+	if domain == "" {
+		domain = "replicated.app"
+	}
+
 	// Build the upload URL using the app slug
-	uploadURL := fmt.Sprintf("https://replicated.app/supportbundle/upload/%s", appSlug)
+	uploadURL := fmt.Sprintf("https://%s/supportbundle/upload/%s", domain, appSlug)
 
 	// Create the request
 	req, err := http.NewRequest("POST", uploadURL, file)
@@ -53,7 +59,7 @@ func UploadToReplicatedApp(bundlePath, licenseID, appSlug string) error {
 }
 
 // UploadBundleAutoDetect uploads a support bundle with automatic license and app slug detection
-func UploadBundleAutoDetect(bundlePath string, providedLicenseID, providedAppSlug string) error {
+func UploadBundleAutoDetect(bundlePath string, providedLicenseID, providedAppSlug, uploadDomain string) error {
 	licenseID := providedLicenseID
 
 	// Always extract from bundle to get app slug (and license if not provided)
@@ -79,9 +85,15 @@ func UploadBundleAutoDetect(bundlePath string, providedLicenseID, providedAppSlu
 		appSlug = extractedAppSlug
 	}
 
+	// Determine target domain for upload message
+	targetDomain := uploadDomain
+	if targetDomain == "" {
+		targetDomain = "replicated.app"
+	}
+
 	// Upload the bundle
-	fmt.Printf("Uploading support bundle to replicated.app...\n")
-	if err := UploadToReplicatedApp(bundlePath, licenseID, appSlug); err != nil {
+	fmt.Printf("Uploading support bundle to %s...\n", targetDomain)
+	if err := UploadToReplicatedApp(bundlePath, licenseID, appSlug, uploadDomain); err != nil {
 		return errors.Wrap(err, "failed to upload bundle")
 	}