Bump Go from 1.26.3 to 1.26.4 (#2055 )

Bump Go to version from 1.26.3 to 1.26.4 Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
chore(deps): bump the security group with 7 updates (#2052 )
2026-08-27 00:37:20 +00:00 · 2026-06-08 16:38:50 +01:00 · 2026-06-04 17:46:47 +12:00 · 2026-05-29 14:25:15 -04:00 · 2026-05-29 13:39:20 -04:00 · 2026-05-29 12:33:42 -04:00
193 changed files with 15966 additions and 1655 deletions
@@ -0,0 +1,22 @@
+# Code Review Guidelines
+
+## Basic Review
+
+- **Breaking API changes** — Check for removed/renamed fields in `pkg/apis/`, changed function signatures in public packages, or modified CLI flags and output formats.
+- **Pattern violations** — New code should follow existing patterns in the codebase (e.g., collector/analyzer structure, error handling conventions, interface usage).
+- **Security** — Watch for command injection in exec-based collectors, path traversal in file operations, unsanitized user input in specs, and leaked credentials in collected data.
+- **Go standards** — Issues that linters like `go vet`, `staticcheck`, and `modernize` would catch: deprecated API usage, unnecessary allocations, error shadowing, unchecked errors.
+- **Test coverage** — New functionality should have tests. Changes to existing code should not reduce coverage compared to the last test run on `main`.
+- **Error handling** — Errors should wrap context (`fmt.Errorf("... : %w", err)`), not be silently swallowed, and provide actionable messages for operator-facing output.
+- **Concurrency safety** — Collectors run concurrently. Shared state must be protected. `CollectorResult` map writes from goroutines need synchronization.
+- **Bundle storage** — Collectors must save data using `CollectorResult.SaveResult` and related methods (`SaveResults`, `SymLinkResult`). Never write files directly — `CollectorResult` handles dual-mode storage (in-memory for preflights, on-disk for support bundles). See `pkg/collect/result.go`.
+
+## Advanced Review
+
+- **Cross-feature impact** — Consider whether a change to one collector/analyzer could affect the broader collection pipeline, redaction, or output archive structure.
+- **CLI vs SDK consumers** — This project is consumed both as CLI tools and as Go packages (SDK). Changes targeting a CLI use case must not break SDK consumers who import `pkg/collect`, `pkg/analyze`, or API types directly.
+- **Documentation** — Does the change add, modify, or remove user-facing behavior? Check whether https://troubleshoot.sh needs updates. Use https://troubleshoot.sh/llms.txt or https://troubleshoot.sh/llms-full.txt to review current docs.
+- **Dedicated documentation needs** — For large or complex changes, consider whether CLI users or SDK consumers need standalone documentation (migration guides, new feature walkthroughs, updated examples).
+- **Backwards compatibility** — Spec changes must consider existing specs in the wild. New fields should have sensible zero-value defaults. Removed fields should not cause parse failures.
+- **Downstream impact on sbctl** — Changes to public Go packages (`pkg/collect`, `pkg/analyze`, API types, etc.) may require follow-up changes in [replicatedhq/sbctl](https://github.com/replicatedhq/sbctl), which imports this project as a dependency. Flag any breaking or behavioral changes that could affect sbctl.
+- **Repository docs** — If your changes affect build commands, architecture, project conventions, or review guidelines, update `CLAUDE.md`, `README.md`, and this file accordingly.
@@ -1,39 +0,0 @@
-name: 'Setup Go Environment'
-description: 'Setup Go with caching and common environment variables'
-inputs:
-  go-version-file:
-    description: 'Path to go.mod file'
-    required: false
-    default: 'go.mod'
-outputs:
-  go-version:
-    description: 'The Go version that was installed'
-    value: ${{ steps.setup-go.outputs.go-version }}
-  cache-hit:
-    description: 'Whether the Go cache was hit'
-    value: ${{ steps.setup-go.outputs.cache-hit }}
-runs:
-  using: 'composite'
-  steps:
-    - name: Setup Go
-      id: setup-go
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: ${{ inputs.go-version-file }}
-        cache: true
-
-    - name: Set Go environment variables
-      shell: bash
-      run: |
-        echo "GOMAXPROCS=2" >> $GITHUB_ENV
-        echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-        echo "GOMODCACHE=$(go env GOMODCACHE)" >> $GITHUB_ENV
-
-    - name: Print Go environment
-      shell: bash
-      run: |
-        echo "Go version: $(go version)"
-        echo "GOOS: $(go env GOOS)"
-        echo "GOARCH: $(go env GOARCH)"
-        echo "Cache directory: $(go env GOCACHE)"
-        echo "Module cache: $(go env GOMODCACHE)"
@@ -30,7 +30,7 @@ jobs:
  tidy-check:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'
@@ -39,7 +39,7 @@ jobs:
  test-integration:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'
@@ -54,12 +54,12 @@ jobs:
  compile-preflight:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'
      - run: make generate preflight
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: preflight
          path: bin/preflight
@@ -68,13 +68,13 @@ jobs:
    runs-on: ubuntu-latest
    needs: compile-preflight
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - uses: replicatedhq/action-k3s@main
        id: k3s
        with:
          version: v1.31.2-k3s1
      - name: Download preflight binary
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
        with:
          name: preflight
          path: bin/
@@ -84,27 +84,40 @@ jobs:
  compile-supportbundle:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'
      - run: make generate support-bundle
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: support-bundle
          path: bin/support-bundle

+  compile-collect:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+      - run: make generate collect
+      - uses: actions/upload-artifact@v7
+        with:
+          name: collect
+          path: bin/collect
+
  validate-supportbundle-e2e:
    runs-on: ubuntu-latest
    needs: compile-supportbundle
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - uses: replicatedhq/action-k3s@main
        id: k3s
        with:
          version: v1.31.2-k3s1
      - name: Download support bundle binary
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
        with:
          name: support-bundle
          path: bin/
@@ -114,17 +127,17 @@ jobs:
  # Additional e2e tests for support bundle that run in Go, these create a Kind cluster
  validate-supportbundle-e2e-go:
     runs-on: ubuntu-latest
-     needs: compile-supportbundle
+     needs: [compile-supportbundle, compile-collect]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - name: Download support bundle binary
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
        with:
          name: support-bundle
          path: bin/
      - run: chmod +x bin/support-bundle
      - name: Download preflight binary
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
        with:
          name: preflight
          path: bin/
@@ -21,8 +21,8 @@ jobs:
      support-bundle: ${{ steps.filter.outputs.support-bundle }}
      examples: ${{ steps.filter.outputs.examples }}
    steps:
-      - uses: actions/checkout@v5
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
@@ -44,8 +44,10 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v5
-      - uses: ./.github/actions/setup-go
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'

      - name: Check go mod tidy
        run: |
@@ -71,8 +73,10 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
-      - uses: actions/checkout@v5
-      - uses: ./.github/actions/setup-go
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'

      - name: Setup K3s
        uses: replicatedhq/action-k3s@main
@@ -89,15 +93,145 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v5
-      - uses: ./.github/actions/setup-go
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
      - run: make build
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: binaries
          path: bin/
          retention-days: 1

+  # Minimal linux architecture smoke tests
+  linux-arch-smoke:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goarch: amd64
+            docker_platform: linux/amd64
+            expected_machine: x86_64
+          - goarch: arm64
+            docker_platform: linux/arm64
+            expected_machine: aarch64
+          - goarch: arm
+            goarm: "7"
+            docker_platform: linux/arm/v7
+            expected_machine: armv7l
+          - goarch: riscv64
+            docker_platform: linux/riscv64
+            expected_machine: riscv64
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+      - name: Setup K3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+      - uses: docker/setup-qemu-action@v4
+        with:
+          platforms: arm64,arm,riscv64
+
+      - name: Build linux/${{ matrix.goarch }} binaries
+        env:
+          CGO_ENABLED: "0"
+          GOOS: linux
+          GOARCH: ${{ matrix.goarch }}
+          GOARM: ${{ matrix.goarm }}
+        run: |
+          if [ -n "${GOARM}" ]; then
+            echo "Building for GOARCH=${GOARCH} GOARM=${GOARM}"
+          else
+            echo "Building for GOARCH=${GOARCH}"
+          fi
+          make build
+
+      - name: Collect a minimal support bundle on ${{ matrix.docker_platform }}
+        env:
+          PREFLIGHT_AUTO_UPDATE: "false"
+          TROUBLESHOOT_AUTO_UPDATE: "false"
+        run: |
+          set -euo pipefail
+          tmpdir="$(mktemp -d)"
+          trap 'rm -rf "$tmpdir"' EXIT
+          kubeconfig_path="${KUBECONFIG:-$HOME/.kube/config}"
+
+          assert_tar_member() {
+            local pattern="$1"
+            local label="$2"
+            local member
+            member="$(grep -m1 "$pattern" "$tmpdir/archive-members.txt" || true)"
+            if [ -z "$member" ]; then
+              echo "Expected ${label} was not found in ${archive}"
+              exit 1
+            fi
+            echo "Found ${label}: ${member}"
+          }
+
+          echo "Using kubeconfig at ${kubeconfig_path}"
+          test -f "${kubeconfig_path}"
+          cp "${kubeconfig_path}" "$tmpdir/kubeconfig"
+
+          echo "Verifying K3s cluster is reachable on the host"
+          kubectl --kubeconfig "$tmpdir/kubeconfig" get nodes -o wide
+
+          docker run --rm \
+            --platform ${{ matrix.docker_platform }} \
+            --network host \
+            -v "$PWD:/src" \
+            -v "$tmpdir:/tmp/linux-arch-smoke" \
+            -w /src \
+            alpine:3.23 \
+            sh -ec '
+              export PREFLIGHT_AUTO_UPDATE=false
+              export TROUBLESHOOT_AUTO_UPDATE=false
+              /src/bin/support-bundle \
+                --kubeconfig /tmp/linux-arch-smoke/kubeconfig \
+                --interactive=false \
+                /src/test/e2e/support-bundle/spec/linuxArchSmokeLocalHostCollectors.yaml \
+                --output /tmp/linux-arch-smoke/linux-arch-support-bundle.tar.gz
+            '
+
+          archive="$tmpdir/linux-arch-support-bundle.tar.gz"
+          test -f "$archive"
+          echo "Generated support bundle archive: $archive"
+          tar -tf "$archive" > "$tmpdir/archive-members.txt"
+
+          assert_tar_member '/host-collectors/system/cpu.json$' 'cpu.json'
+          assert_tar_member '/host-collectors/system/memory.json$' 'memory.json'
+          assert_tar_member '/host-collectors/run-host/uname.txt$' 'uname.txt'
+          assert_tar_member '/cluster-resources/nodes.json$' 'cluster-resources nodes.json'
+          assert_tar_member '/cluster-resources/resources.json$' 'cluster-resources resources.json'
+          assert_tar_member '/analysis.json$' 'analysis.json'
+
+          echo "Checking uname -m output"
+          uname_path="$(grep -m1 '/host-collectors/run-host/uname.txt$' "$tmpdir/archive-members.txt")"
+          uname_machine="$(tar -xOf "$archive" "$uname_path" | tr -d '\r\n')"
+          if [ "$uname_machine" != '${{ matrix.expected_machine }}' ]; then
+            echo "Unexpected uname -m output: ${uname_machine}"
+            exit 1
+          fi
+          echo "Analyzer input check passed: uname -m reported ${uname_machine}"
+
+          echo "Checking analysis.json"
+          analysis_path="$(grep -m1 '/analysis.json$' "$tmpdir/archive-members.txt")"
+          tar -xOf "$archive" "$analysis_path" > "$tmpdir/analysis.json"
+          jq -e '
+            .[]
+            | select(.insight.primary == "Linux arch smoke node count")
+            | select(.insight.detail == "This cluster has exactly 1 node")
+            | select(.severity == "debug")
+          ' "$tmpdir/analysis.json" >/dev/null
+          echo "Found expected analyzer result: Linux arch smoke node count -> This cluster has exactly 1 node"
+
  # E2E tests
  e2e:
    if: needs.changes.outputs.go-files == 'true' || github.event_name == 'push'
@@ -118,7 +252,7 @@ jobs:
            target: support-bundle-e2e-go-test
            needs-k3s: false
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6

      - name: Setup K3s
        if: matrix.needs-k3s
@@ -126,7 +260,7 @@ jobs:
        with:
          version: v1.31.2-k3s1

-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
        with:
          name: binaries
          path: bin/
@@ -137,7 +271,7 @@ jobs:
  # Success summary
  success:
    if: always()
-    needs: [lint, test, build, e2e]
+    needs: [lint, test, build, linux-arch-smoke, e2e]
    runs-on: ubuntu-latest
    steps:
      - name: Check results
@@ -146,6 +280,7 @@ jobs:
          if [[ "${{ needs.lint.result }}" == "failure" ]] || \
             [[ "${{ needs.test.result }}" == "failure" ]] || \
             [[ "${{ needs.build.result }}" == "failure" ]] || \
+             [[ "${{ needs.linux-arch-smoke.result }}" == "failure" ]] || \
             [[ "${{ needs.e2e.result }}" == "failure" ]]; then
            echo "::error::Some jobs failed or were cancelled"
            exit 1
@@ -155,6 +290,7 @@ jobs:
          if [[ "${{ needs.lint.result }}" == "cancelled" ]] || \
             [[ "${{ needs.test.result }}" == "cancelled" ]] || \
             [[ "${{ needs.build.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.linux-arch-smoke.result }}" == "cancelled" ]] || \
             [[ "${{ needs.e2e.result }}" == "cancelled" ]]; then
            echo "::error::Some jobs failed or were cancelled"
            exit 1
@@ -13,44 +13,22 @@ on:
        default: false

 jobs:
-  regression-test:
+  # Build binaries once (shared by all test jobs)
+  build-binaries:
+    if: github.actor != 'dependabot[bot]'
    runs-on: ubuntu-22.04
-    timeout-minutes: 25
+    timeout-minutes: 5

    steps:
-      # 1. SETUP
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
-          fetch-depth: 0  # Fetch all history for git describe to work
-
-      - name: Create output directory
-        run: mkdir -p test/output
-
-      - name: Create k3s cluster
-        id: create-cluster
-        uses: replicatedhq/compatibility-actions/create-cluster@v1
-        with:
-          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
-          kubernetes-distribution: k3s
-          cluster-name: regression-${{ github.run_id }}-${{ github.run_attempt }}
-          ttl: 25m
-          timeout-minutes: 5
-
-      - name: Configure kubeconfig
-        run: |
-          echo "${{ steps.create-cluster.outputs.cluster-kubeconfig }}" > $GITHUB_WORKSPACE/kubeconfig.yaml
-          echo "KUBECONFIG=$GITHUB_WORKSPACE/kubeconfig.yaml" >> $GITHUB_ENV
-
-      - name: Verify cluster access
-        run: kubectl get nodes -o wide
+          fetch-depth: 0

      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
-          go-version-file: go.mod
-          cache: true
-          cache-dependency-path: go.sum
+          go-version-file: 'go.mod'

      - name: Build binaries
        run: |
@@ -59,84 +37,83 @@ jobs:
          ./bin/preflight version
          ./bin/support-bundle version

+      - name: Upload binaries
+        uses: actions/upload-artifact@v7
+        with:
+          name: binaries-${{ github.run_id }}
+          path: |
+            bin/preflight
+            bin/support-bundle
+          retention-days: 1
+
+  # Preflight v1beta3 test (parallel job 1)
+  test-preflight-v1beta3:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/preflight version
+
      - name: Setup Python for comparison
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: '3.11'

      - name: Install Python dependencies
-        run: |
-          pip install pyyaml deepdiff
+        run: pip install pyyaml deepdiff

-      # 2. EXECUTE SPECS (in parallel)
-      - name: Run all specs in parallel
+      - name: Run preflight v1beta3
        continue-on-error: true
        run: |
-          echo "Running all 3 specs in parallel..."
+          echo "Running preflight v1beta3..."
+          ./bin/preflight \
+            examples/preflight/complex-v1beta3.yaml \
+            --values examples/preflight/values-complex-full.yaml \
+            --interactive=false \
+            --format=json \
+            --auto-update=false \
+            --output=test/output/preflight-results-v1beta3.json 2>&1 | tee test/output/v1beta3.log || true

-          # Run v1beta3 in background
-          (
-            echo "Starting preflight v1beta3..."
-            ./bin/preflight \
-              examples/preflight/complex-v1beta3.yaml \
-              --values examples/preflight/values-complex-full.yaml \
-              --interactive=false \
-              --format=json \
-              --output=test/output/preflight-results-v1beta3.json 2>&1 | tee test/output/v1beta3.log || true
+          BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
+          if [ -n "$BUNDLE" ]; then
+            mv "$BUNDLE" test/output/preflight-v1beta3-bundle.tar.gz
+            echo "✓ v1beta3 bundle saved"
+          fi

-            BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
-            if [ -n "$BUNDLE" ]; then
-              mv "$BUNDLE" test/output/preflight-v1beta3-bundle.tar.gz
-              echo "✓ v1beta3 bundle saved"
-            fi
-          ) &
-          PID_V1BETA3=$!
-
-          # Run v1beta2 in background
-          (
-            echo "Starting preflight v1beta2..."
-            ./bin/preflight \
-              examples/preflight/all-analyzers-v1beta2.yaml \
-              --interactive=false \
-              --format=json \
-              --output=test/output/preflight-results-v1beta2.json 2>&1 | tee test/output/v1beta2.log || true
-
-            BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
-            if [ -n "$BUNDLE" ]; then
-              mv "$BUNDLE" test/output/preflight-v1beta2-bundle.tar.gz
-              echo "✓ v1beta2 bundle saved"
-            fi
-          ) &
-          PID_V1BETA2=$!
-
-          # Run support bundle in background
-          (
-            echo "Starting support bundle..."
-            ./bin/support-bundle \
-              examples/collect/host/all-kubernetes-collectors.yaml \
-              --interactive=false \
-              --output=test/output/supportbundle.tar.gz 2>&1 | tee test/output/supportbundle.log || true
-
-            if [ -f test/output/supportbundle.tar.gz ]; then
-              echo "✓ Support bundle saved"
-            fi
-          ) &
-          PID_SUPPORTBUNDLE=$!
-
-          # Wait for all to complete
-          echo "Waiting for all specs to complete..."
-          wait $PID_V1BETA3
-          wait $PID_V1BETA2
-          wait $PID_SUPPORTBUNDLE
-
-          echo "All specs completed!"
-
-          # Verify bundles exist
-          ls -lh test/output/*.tar.gz || echo "Warning: Some bundles may be missing"
-
-      # 3. COMPARE BUNDLES
      - name: Compare preflight v1beta3 bundle
-        id: compare-v1beta3
+        id: compare
        continue-on-error: true
        run: |
          echo "Comparing v1beta3 preflight bundle against baseline..."
@@ -153,8 +130,93 @@ jobs:
            --report test/output/diff-report-v1beta3.json \
            --spec-type preflight

+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-v1beta3-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/preflight-v1beta3-bundle.tar.gz
+            test/output/preflight-results-v1beta3.json
+            test/output/diff-report-v1beta3.json
+            test/output/v1beta3.log
+          retention-days: 30
+
+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Preflight v1beta2 test (parallel job 2)
+  test-preflight-v1beta2:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/preflight version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Run preflight v1beta2
+        continue-on-error: true
+        run: |
+          echo "Running preflight v1beta2..."
+          ./bin/preflight \
+            examples/preflight/all-analyzers-v1beta2.yaml \
+            --interactive=false \
+            --format=json \
+            --auto-update=false \
+            --output=test/output/preflight-results-v1beta2.json 2>&1 | tee test/output/v1beta2.log || true
+
+          BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
+          if [ -n "$BUNDLE" ]; then
+            mv "$BUNDLE" test/output/preflight-v1beta2-bundle.tar.gz
+            echo "✓ v1beta2 bundle saved"
+          fi
+
      - name: Compare preflight v1beta2 bundle
-        id: compare-v1beta2
+        id: compare
        continue-on-error: true
        run: |
          echo "Comparing v1beta2 preflight bundle against baseline..."
@@ -171,8 +233,90 @@ jobs:
            --report test/output/diff-report-v1beta2.json \
            --spec-type preflight

+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-v1beta2-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/preflight-v1beta2-bundle.tar.gz
+            test/output/preflight-results-v1beta2.json
+            test/output/diff-report-v1beta2.json
+            test/output/v1beta2.log
+          retention-days: 30
+
+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Support bundle test (parallel job 3)
+  test-supportbundle:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/support-bundle version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Run support bundle
+        continue-on-error: true
+        run: |
+          echo "Running support bundle..."
+          ./bin/support-bundle \
+            examples/collect/host/all-kubernetes-collectors.yaml \
+            --interactive=false \
+            --auto-update=false \
+            --output=test/output/supportbundle.tar.gz 2>&1 | tee test/output/supportbundle.log || true
+
+          if [ -f test/output/supportbundle.tar.gz ]; then
+            echo "✓ Support bundle saved"
+          fi
+
      - name: Compare support bundle
-        id: compare-supportbundle
+        id: compare
        continue-on-error: true
        run: |
          echo "Comparing support bundle against baseline..."
@@ -189,45 +333,116 @@ jobs:
            --report test/output/diff-report-supportbundle.json \
            --spec-type supportbundle

-      # 4. REPORT RESULTS
-      - name: Generate summary report
-        if: always()
-        run: |
-          python3 scripts/generate_summary.py \
-            --reports test/output/diff-report-*.json \
-            --output-file $GITHUB_STEP_SUMMARY \
-            --output-console
-
      - name: Upload test artifacts
-        if: always()
-        uses: actions/upload-artifact@v4
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
        with:
-          name: regression-test-results-${{ github.run_id }}-${{ github.run_attempt }}
+          name: test-results-supportbundle-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
-            test/output/*.tar.gz
-            test/output/*.json
+            test/output/supportbundle.tar.gz
+            test/output/diff-report-supportbundle.json
+            test/output/supportbundle.log
          retention-days: 30

+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Report results (runs after all tests complete)
+  report-results:
+    needs: [test-preflight-v1beta3, test-preflight-v1beta2, test-supportbundle]
+    if: ${{ !cancelled() && github.actor != 'dependabot[bot]' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Download all test artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: test/output
+          pattern: test-results-*
+
+      - name: Reorganize artifacts
+        run: |
+          # Move artifacts from nested directories to test/output
+          # Use shopt to handle glob patterns that don't match
+          shopt -s nullglob
+          for dir in test/output/test-results-*; do
+            if [ -d "$dir" ]; then
+              find "$dir" -type f -exec mv {} test/output/ \;
+            fi
+          done
+          # Clean up empty directories
+          for dir in test/output/test-results-*; do
+            if [ -d "$dir" ]; then
+              find "$dir" -type d -empty -delete || true
+            fi
+          done
+          shopt -u nullglob
+
+      - name: Generate summary report
+        run: |
+          # Handle case where no reports exist
+          shopt -s nullglob
+          REPORTS=(test/output/diff-report-*.json)
+          shopt -u nullglob
+          
+          if [ ${#REPORTS[@]} -eq 0 ]; then
+            echo "⚠ No comparison reports found - test jobs may have failed before generating reports"
+            echo "## Summary Report" >> $GITHUB_STEP_SUMMARY
+            echo "No comparison reports available. Check individual test job results." >> $GITHUB_STEP_SUMMARY
+          else
+            python3 scripts/generate_summary.py \
+              --reports test/output/diff-report-*.json \
+              --output-file $GITHUB_STEP_SUMMARY \
+              --output-console
+          fi
+
      - name: Check for regressions
-        if: always()
        run: |
          echo "Checking comparison results..."

-          # Check if any comparisons failed
          FAILURES=0

-          if [ "${{ steps.compare-v1beta3.outcome }}" == "failure" ] && [ "${{ steps.compare-v1beta3.outputs.baseline_missing }}" != "true" ]; then
-            echo "❌ v1beta3 comparison failed"
+          if [ "${{ needs.test-preflight-v1beta3.result }}" == "failure" ] || [ "${{ needs.test-preflight-v1beta3.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-preflight-v1beta3.result }}" == "skipped" ]; then
+              echo "❌ v1beta3 test was skipped (likely due to build failure)"
+            else
+              echo "❌ v1beta3 comparison failed"
+            fi
            FAILURES=$((FAILURES + 1))
          fi

-          if [ "${{ steps.compare-v1beta2.outcome }}" == "failure" ] && [ "${{ steps.compare-v1beta2.outputs.baseline_missing }}" != "true" ]; then
-            echo "❌ v1beta2 comparison failed"
+          if [ "${{ needs.test-preflight-v1beta2.result }}" == "failure" ] || [ "${{ needs.test-preflight-v1beta2.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-preflight-v1beta2.result }}" == "skipped" ]; then
+              echo "❌ v1beta2 test was skipped (likely due to build failure)"
+            else
+              echo "❌ v1beta2 comparison failed"
+            fi
            FAILURES=$((FAILURES + 1))
          fi

-          if [ "${{ steps.compare-supportbundle.outcome }}" == "failure" ] && [ "${{ steps.compare-supportbundle.outputs.baseline_missing }}" != "true" ]; then
-            echo "❌ Support bundle comparison failed"
+          if [ "${{ needs.test-supportbundle.result }}" == "failure" ] || [ "${{ needs.test-supportbundle.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-supportbundle.result }}" == "skipped" ]; then
+              echo "❌ Support bundle test was skipped (likely due to build failure)"
+            else
+              echo "❌ Support bundle comparison failed"
+            fi
            FAILURES=$((FAILURES + 1))
          fi

@@ -240,9 +455,8 @@ jobs:
            echo "✅ All comparisons passed or skipped (no baseline)"
          fi

-      # 5. UPDATE BASELINES (optional, manual trigger only)
      - name: Update baselines
-        if: github.event.inputs.update_baselines == 'true' && github.event_name == 'workflow_dispatch'
+        if: ${{ !cancelled() && github.event.inputs.update_baselines == 'true' && github.event_name == 'workflow_dispatch' }}
        run: |
          echo "Updating baselines with current bundles..."

@@ -270,7 +484,7 @@ jobs:
          {
            "updated_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
            "git_sha": "${{ github.sha }}",
-            "k8s_version": "v1.28.3",
+            "k8s_version": "v1.31.2-k3s1",
            "workflow_run": "${{ github.run_id }}"
          }
          EOF
@@ -281,12 +495,3 @@ jobs:
          git add test/baselines/
          git commit -m "chore: update regression test baselines from run ${{ github.run_id }}"
          git push
-
-      # 6. CLEANUP
-      - name: Remove cluster
-        if: always()
-        uses: replicatedhq/compatibility-actions/remove-cluster@v1
-        continue-on-error: true
-        with:
-          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
-          cluster-id: ${{ steps.create-cluster.outputs.cluster-id }}
@@ -14,7 +14,7 @@ jobs:
    runs-on: troubleshoot_release
    steps:
      - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -28,7 +28,7 @@ jobs:
          go-version-file: 'go.mod'

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
        with:
          version: "v2.12.3"
          args: release --clean --config deploy/.goreleaser.yaml
@@ -37,12 +37,20 @@ jobs:

      - name: Update new preflight version in krew-index
        if: ${{ !contains(github.ref_name, '-') }}
-        uses: rajatjindal/krew-release-bot@v0.0.47
+        uses: rajatjindal/krew-release-bot@v0.0.51
        with:
          krew_template_file: deploy/krew/preflight.yaml

      - name: Update new support-bundle version in krew-index
        if: ${{ !contains(github.ref_name, '-') }}
-        uses: rajatjindal/krew-release-bot@v0.0.47
+        uses: rajatjindal/krew-release-bot@v0.0.51
        with:
          krew_template_file: deploy/krew/support-bundle.yaml
+
+  notify:
+    if: ${{ !contains(github.ref_name, '-') }}
+    uses: replicatedhq/reusable-workflows/.github/workflows/notify-release.yml@0432fb838fc83852b78be97a150b35991a85d56f
+    with:
+      tag: ${{ github.ref_name }}
+    secrets:
+      slack_webhook: ${{ secrets.RELEASE_SLACK_WEBHOOK }}
@@ -0,0 +1,24 @@
+name: Upgrade Go Version
+
+on:
+  # Run manually when needed
+  workflow_dispatch:
+  # Run weekly on Mondays at 8am UTC
+  schedule:
+    - cron: "0 8 * * MON"
+
+jobs:
+  upgrade-go:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Check for Go updates
+        uses: StefMa/Upgrade-Go-Action@v1
+        with:
+          base-branch: 'main'
+          gh-token: ${{ secrets.TROUBLESHOOT_GH_PAT }}
@@ -50,9 +50,14 @@ sbom/
 !testdata/supportbundle/*.tar.gz
 !test/baselines/**/baseline.tar.gz

-# Ignore built binaries
-troubleshoot
-troubleshoot-test
+# Ignore built binaries (use / prefix to avoid catching source files)
+/troubleshoot
+/troubleshoot-test
 cmd/troubleshoot/troubleshoot
 cmd/*/troubleshoot
-support-bundle
+/support-bundle
+/.worktrees/
+
+# IDEs
+## IntelliJ / GoLand
+/troubleshoot.iml
@@ -0,0 +1,4 @@
+NAME	INSTALLED	FIXED-IN	TYPE	VULNERABILITY	SEVERITY	EPSS	RISK	PATH
+{{- range .Matches}}
+{{.Artifact.Name}}	{{.Artifact.Version}}	{{join .Vulnerability.Fix.Versions ","}}	{{.Artifact.Type}}	{{.Vulnerability.ID}}	{{.Vulnerability.Severity}}	{{.Vulnerability.EPSS}}	{{.Vulnerability.Risk}}	{{range .Artifact.Locations}}{{.AccessPath}}{{end}}
+{{- end}}
@@ -0,0 +1,3 @@
+exclude:
+  - ./examples/**
+  - ./bin/**
@@ -0,0 +1,3 @@
+# AGENTS.md
+
+ALWAYS read and follow the instructions in CLAUDE.md before starting any work in this repository.
@@ -0,0 +1,30 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Replicated Troubleshoot is a Kubernetes diagnostic framework providing two kubectl plugins: `preflight` (pre-installation cluster validation) and `support-bundle` (post-installation diagnostics with log collection, redaction, and analysis). Specs use the Kubernetes custom resource format (as a serialization convention, not installed in-cluster) and are defined by application vendors and executed by cluster operators.
+
+## Build & Test Commands
+
+```bash
+make build                        # Build bin/support-bundle and bin/preflight
+make test                         # Unit tests (includes generate, fmt, vet)
+make test RUN=TestMyFunction      # Run a single test
+make test-integration             # Integration tests (requires k8s cluster)
+make e2e                          # All e2e tests
+make generate                     # Regenerate types/clients after modifying pkg/apis/
+```
+
+## Architecture
+
+The core data flow is: **Spec loading → Collection → Redaction → Analysis → Results**. The two main workflows are orchestrated by `pkg/supportbundle/` and `pkg/preflight/`.
+
+Three API versions coexist in `pkg/apis/troubleshoot/`: v1beta1, v1beta2 (primary, all types defined here), and v1beta3 (in-progress, adds `StringOrValueFrom` for Secret/ConfigMap references, converts to v1beta2 at runtime).
+
+Collectors live in `pkg/collect/`, analyzers in `pkg/analyze/`. When adding either, follow the pattern of existing implementations and run `make generate` after modifying API types.
+
+## Code Review
+
+See [.cursor/BUGBOT.md](.cursor/BUGBOT.md) for the full review checklist covering basic checks (API breaks, pattern violations, security, test coverage) and advanced checks (cross-feature impact, CLI vs SDK consumers, documentation needs).
@@ -61,6 +61,9 @@ test: generate fmt vet
 test-integration: generate fmt vet
 	go test -v --tags="integration exclude_graphdriver_devicemapper exclude_graphdriver_btrfs" ${BUILDPATHS}

+.PHONY: e2e
+e2e: preflight-e2e-test support-bundle-e2e-test support-bundle-e2e-go-test
+
 .PHONY: preflight-e2e-test
 preflight-e2e-test:
 	./test/validate-preflight-e2e.sh
@@ -158,6 +161,7 @@ generate: controller-gen client-gen
 		--input-base github.com/replicatedhq/troubleshoot/pkg/apis \
 		--input troubleshoot/v1beta1 \
 		--input troubleshoot/v1beta2 \
+		--input troubleshoot/v1beta3 \
 		--go-header-file ./hack/boilerplate.go.txt
 	cp -r troubleshootclientset pkg/client
 	rm -rf troubleshootclientset
@@ -254,14 +258,19 @@ sbom: sbom/assets/troubleshoot-sbom.tgz
 		sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig
 	cosign public-key --key cosign.key --outfile sbom/assets/key.pub

+.PHONY: get-govulncheck
+get-govulncheck:
+	@command -v govulncheck >/dev/null 2>&1 || go install golang.org/x/vuln/cmd/govulncheck@latest
+
+.PHONY: get-grype
+get-grype:
+	@command -v grype >/dev/null 2>&1 || curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b $(GOPATH)/bin
+
 .PHONY: scan
-scan:
-	trivy fs \
-		--scanners vuln \
-		--exit-code=1 \
-		--severity="HIGH,CRITICAL" \
-		--ignore-unfixed \
-		./
+scan: get-govulncheck get-grype
+	govulncheck ./...
+	grype db update
+	grype dir:. --only-fixed --fail-on high -o template -t .grype.tmpl

 .PHONY: watch
 watch: npm-install
@@ -295,4 +304,4 @@ longhorn:
 	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/k8s\/pkg/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn/g"
 	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/types/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn\/types/g"
 	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/util/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn\/util/g"
-	rm -rf longhorn-manager
+	rm -rf longhorn-manager
@@ -0,0 +1,21 @@
+package cli
+
+import (
+	"errors"
+	"syscall"
+
+	"github.com/replicatedhq/troubleshoot/internal/util"
+)
+
+func checkAndSetChroot(newroot string) error {
+	if newroot == "" {
+		return nil
+	}
+	if !util.IsRunningAsRoot() {
+		return errors.New("Can only chroot when run as root")
+	}
+	if err := syscall.Chroot(newroot); err != nil {
+		return err
+	}
+	return nil
+}
@@ -0,0 +1,21 @@
+package cli
+
+import (
+	"errors"
+	"syscall"
+
+	"github.com/replicatedhq/troubleshoot/internal/util"
+)
+
+func checkAndSetChroot(newroot string) error {
+	if newroot == "" {
+		return nil
+	}
+	if !util.IsRunningAsRoot() {
+		return errors.New("Can only chroot when run as root")
+	}
+	if err := syscall.Chroot(newroot); err != nil {
+		return err
+	}
+	return nil
+}
@@ -0,0 +1,9 @@
+package cli
+
+import (
+	"errors"
+)
+
+func checkAndSetChroot(newroot string) error {
+	return errors.New("chroot is only implimented in linux/darwin")
+}
@@ -0,0 +1,90 @@
+package cli
+
+import (
+	"os"
+	"strings"
+
+	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+)
+
+func RootCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:          "collect [url]",
+		Args:         cobra.MinimumNArgs(1),
+		Short:        "Run a collector",
+		Long:         `Run a collector and output the results.`,
+		SilenceUsage: true,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			v := viper.GetViper()
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+
+			if err := util.StartProfiling(); err != nil {
+				klog.Errorf("Failed to start profiling: %v", err)
+			}
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			if err := checkAndSetChroot(v.GetString("chroot")); err != nil {
+				return err
+			}
+
+			return runCollect(v, args[0])
+		},
+		PostRun: func(cmd *cobra.Command, args []string) {
+			if err := util.StopProfiling(); err != nil {
+				klog.Errorf("Failed to stop profiling: %v", err)
+			}
+		},
+	}
+
+	cobra.OnInitialize(initConfig)
+
+	cmd.AddCommand(util.VersionCmd())
+
+	cmd.Flags().StringSlice("redactors", []string{}, "names of the additional redactors to use")
+	cmd.Flags().Bool("redact", true, "enable/disable default redactions")
+	cmd.Flags().String("format", "json", "output format, one of json or raw.")
+	cmd.Flags().String("collector-image", "", "the full name of the collector image to use")
+	cmd.Flags().String("collector-pull-policy", "", "the pull policy of the collector image")
+	cmd.Flags().String("selector", "", "selector (label query) to filter remote collection nodes on.")
+	cmd.Flags().Bool("collect-without-permissions", false, "always generate a support bundle, even if it some require additional permissions")
+	cmd.Flags().Bool("debug", false, "enable debug logging")
+	cmd.Flags().String("chroot", "", "Chroot to path")
+
+	// hidden in favor of the `insecure-skip-tls-verify` flag
+	cmd.Flags().Bool("allow-insecure-connections", false, "when set, do not verify TLS certs when retrieving spec and reporting results")
+	cmd.Flags().MarkHidden("allow-insecure-connections")
+
+	viper.BindPFlags(cmd.Flags())
+
+	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+
+	k8sutil.AddFlags(cmd.Flags())
+
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
+	// CPU and memory profiling flags
+	util.AddProfilingFlags(cmd)
+
+	return cmd
+}
+
+func InitAndExecute() {
+	if err := RootCmd().Execute(); err != nil {
+		os.Exit(1)
+	}
+}
+
+func initConfig() {
+	viper.SetEnvPrefix("TROUBLESHOOT")
+	viper.AutomaticEnv()
+}
@@ -0,0 +1,189 @@
+package cli
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/internal/util"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/replicatedhq/troubleshoot/pkg/docrewrite"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/specs"
+	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
+	"github.com/spf13/viper"
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+const (
+	defaultTimeout = 30 * time.Second
+)
+
+func runCollect(v *viper.Viper, arg string) error {
+	go func() {
+		signalChan := make(chan os.Signal, 1)
+		signal.Notify(signalChan, os.Interrupt)
+		<-signalChan
+		os.Exit(0)
+	}()
+
+	var collectorContent []byte
+	var err error
+	if strings.HasPrefix(arg, "secret/") {
+		// format secret/namespace-name/secret-name
+		pathParts := strings.Split(arg, "/")
+		if len(pathParts) != 3 {
+			return errors.Errorf("path %s must have 3 components", arg)
+		}
+
+		spec, err := specs.LoadFromSecret(pathParts[1], pathParts[2], "collect-spec")
+		if err != nil {
+			return errors.Wrap(err, "failed to get spec from secret")
+		}
+
+		collectorContent = spec
+	} else if arg == "-" {
+		b, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = b
+	} else if _, err = os.Stat(arg); err == nil {
+		b, err := os.ReadFile(arg)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = b
+	} else {
+		if !util.IsURL(arg) {
+			return fmt.Errorf("%s is not a URL and was not found", arg)
+		}
+
+		req, err := http.NewRequest("GET", arg, nil)
+		if err != nil {
+			return err
+		}
+		req.Header.Set("User-Agent", "Replicated_Collect/v1beta2")
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = body
+	}
+
+	collectorContent, err = docrewrite.ConvertToV1Beta2(collectorContent)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert to v1beta2")
+	}
+
+	multidocs := strings.Split(string(collectorContent), "\n---\n")
+
+	decode := scheme.Codecs.UniversalDeserializer().Decode
+
+	redactors, err := supportbundle.GetRedactorsFromURIs(v.GetStringSlice("redactors"))
+	if err != nil {
+		return errors.Wrap(err, "failed to get redactors")
+	}
+
+	additionalRedactors := &troubleshootv1beta2.Redactor{
+		Spec: troubleshootv1beta2.RedactorSpec{
+			Redactors: redactors,
+		},
+	}
+
+	for i, additionalDoc := range multidocs {
+		if i == 0 {
+			continue
+		}
+		additionalDoc, err := docrewrite.ConvertToV1Beta2([]byte(additionalDoc))
+		if err != nil {
+			return errors.Wrap(err, "failed to convert to v1beta2")
+		}
+		obj, _, err := decode(additionalDoc, nil, nil)
+		if err != nil {
+			return errors.Wrapf(err, "failed to parse additional doc %d", i)
+		}
+		multidocRedactors, ok := obj.(*troubleshootv1beta2.Redactor)
+		if !ok {
+			continue
+		}
+		additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, multidocRedactors.Spec.Redactors...)
+	}
+
+	// make sure we don't block any senders
+	progressCh := make(chan interface{})
+	defer close(progressCh)
+	go func() {
+		for range progressCh {
+		}
+	}()
+
+	restConfig, err := k8sutil.GetRESTConfig()
+	if err != nil {
+		return errors.Wrap(err, "failed to convert kube flags to rest config")
+	}
+
+	labelSelector, err := labels.Parse(v.GetString("selector"))
+	if err != nil {
+		return errors.Wrap(err, "unable to parse selector")
+	}
+
+	namespace := v.GetString("namespace")
+	if namespace == "" {
+		namespace = "default"
+	}
+
+	timeout := v.GetDuration("request-timeout")
+	if timeout == 0 {
+		timeout = defaultTimeout
+	}
+
+	createOpts := collect.CollectorRunOpts{
+		CollectWithoutPermissions: v.GetBool("collect-without-permissions"),
+		KubernetesRestConfig:      restConfig,
+		Image:                     v.GetString("collector-image"),
+		PullPolicy:                v.GetString("collector-pullpolicy"),
+		LabelSelector:             labelSelector.String(),
+		Namespace:                 namespace,
+		Timeout:                   timeout,
+		ProgressChan:              progressCh,
+	}
+
+	// we only support HostCollector or RemoteCollector kinds.
+	hostCollector, err := collect.ParseHostCollectorFromDoc([]byte(multidocs[0]))
+	if err == nil {
+		results, err := collect.CollectHost(hostCollector, additionalRedactors, createOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to collect from host")
+		}
+		return showHostStdoutResults(v.GetString("format"), hostCollector.Name, results)
+	}
+
+	remoteCollector, err := collect.ParseRemoteCollectorFromDoc([]byte(multidocs[0]))
+	if err == nil {
+		results, err := collect.CollectRemote(remoteCollector, additionalRedactors, createOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to collect from remote host(s)")
+		}
+		return showRemoteStdoutResults(v.GetString("format"), remoteCollector.Name, results)
+	}
+
+	return errors.New("failed to parse hostCollector or remoteCollector")
+}
@@ -0,0 +1,103 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+)
+
+const (
+	// FormatJSON is intended for CLI output.
+	FormatJSON = "json"
+
+	// FormatRaw is intended for consumption by a remote collector.  Output is a
+	// string of quoted JSON.
+	FormatRaw = "raw"
+)
+
+func showHostStdoutResults(format string, collectName string, results *collect.HostCollectResult) error {
+	switch format {
+	case FormatJSON:
+		return showHostStdoutResultsJSON(collectName, results.AllCollectedData)
+	case FormatRaw:
+		return showHostStdoutResultsRaw(collectName, results.AllCollectedData)
+	default:
+		return errors.Errorf("unknown output format: %q", format)
+	}
+}
+
+func showRemoteStdoutResults(format string, collectName string, results *collect.RemoteCollectResult) error {
+	switch format {
+	case FormatJSON:
+		return showRemoteStdoutResultsJSON(collectName, results.AllCollectedData)
+	case FormatRaw:
+		return errors.Errorf("raw format not supported for remote collectors")
+	default:
+		return errors.Errorf("unknown output format: %q", format)
+	}
+}
+
+func showHostStdoutResultsJSON(collectName string, results map[string][]byte) error {
+	output := make(map[string]interface{})
+	for file, collectorResult := range results {
+		var collectedItems map[string]interface{}
+		if err := json.Unmarshal([]byte(collectorResult), &collectedItems); err != nil {
+			return errors.Wrap(err, "failed to marshal collector results")
+		}
+		output[file] = collectedItems
+	}
+
+	formatted, err := json.MarshalIndent(output, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+
+	fmt.Print(string(formatted))
+	return nil
+}
+
+// showHostStdoutResultsRaw outputs the collector output as a string of quoted json.
+func showHostStdoutResultsRaw(collectName string, results map[string][]byte) error {
+	strData := map[string]string{}
+	for k, v := range results {
+		strData[k] = string(v)
+	}
+	formatted, err := json.MarshalIndent(strData, "", "    ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+	fmt.Print(string(formatted))
+	return nil
+}
+
+func showRemoteStdoutResultsJSON(collectName string, results map[string][]byte) error {
+	type CollectorResult map[string]interface{}
+	type NodeResult map[string]CollectorResult
+
+	var output = make(map[string]NodeResult)
+
+	for node, result := range results {
+		var nodeResult map[string]string
+		if err := json.Unmarshal(result, &nodeResult); err != nil {
+			return errors.Wrap(err, "failed to marshal node results")
+		}
+		nr := make(NodeResult)
+		for file, collectorResult := range nodeResult {
+			var collectedItems map[string]interface{}
+			if err := json.Unmarshal([]byte(collectorResult), &collectedItems); err != nil {
+				return errors.Wrap(err, "failed to marshal collector results")
+			}
+			nr[file] = collectedItems
+		}
+		output[node] = nr
+	}
+
+	formatted, err := json.MarshalIndent(output, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+	fmt.Print(string(formatted))
+	return nil
+}
@@ -0,0 +1,10 @@
+package main
+
+import (
+	"github.com/replicatedhq/troubleshoot/cmd/collect/cli"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+)
+
+func main() {
+	cli.InitAndExecute()
+}
@@ -88,7 +88,7 @@ func extractDocs(templateFiles []string, valuesFiles []string, setValues []strin
 		if err != nil {
 			return errors.Wrapf(err, "failed to load values file %s", valuesFile)
 		}
-		values = mergeMaps(values, fileValues)
+		values = preflight.MergeMaps(values, fileValues)
 	}

 	// Normalize maps for Helm set merging
@@ -331,25 +331,6 @@ func setNestedValue(m map[string]interface{}, keys []string, value interface{})
 	}
 }

-func mergeMaps(base, overlay map[string]interface{}) map[string]interface{} {
-	result := make(map[string]interface{})
-	for k, v := range base {
-		result[k] = v
-	}
-	for k, v := range overlay {
-		if baseVal, exists := result[k]; exists {
-			if baseMap, ok := baseVal.(map[string]interface{}); ok {
-				if overlayMap, ok := v.(map[string]interface{}); ok {
-					result[k] = mergeMaps(baseMap, overlayMap)
-					continue
-				}
-			}
-		}
-		result[k] = v
-	}
-	return result
-}
-
 func renderTemplate(templateContent string, values map[string]interface{}) (string, error) {
 	tmpl := template.New("preflight").Funcs(sprig.FuncMap())
 	tmpl, err := tmpl.Parse(templateContent)
@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/lint"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func LintCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lint [spec-files...]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Lint v1beta2/v1beta3 preflight specs for syntax and structural errors",
+		Long: `Lint v1beta2/v1beta3 preflight specs for syntax and structural errors.
+
+This command validates v1beta2/v1beta3 preflight specs and checks for:
+- YAML syntax errors
+- Missing required fields (apiVersion, kind, metadata, spec)
+- Invalid template syntax ({{ .Values.* }})
+- Missing analyzers or collectors
+- Common structural issues
+- Missing docStrings (warning)
+
+Examples:
+  # Lint a single spec file
+  preflight lint my-preflight.yaml
+
+  # Lint multiple spec files
+  preflight lint spec1.yaml spec2.yaml spec3.yaml
+
+  # Lint with automatic fixes
+  preflight lint --fix my-preflight.yaml
+
+  # Lint and output as JSON for CI/CD integration
+  preflight lint --format json my-preflight.yaml
+
+Notes:
+- v1beta2 does not support templating; template syntax in v1beta2 files will be flagged as errors.
+- v1beta3 supports templating and is linted with template-awareness.
+
+Exit codes:
+  0 - No errors found
+  2 - Validation errors found`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			opts := lint.LintOptions{
+				FilePaths:   args,
+				Fix:         v.GetBool("fix"),
+				Format:      v.GetString("format"),
+				ValuesFiles: v.GetStringSlice("values"),
+				SetValues:   v.GetStringSlice("set"),
+			}
+
+			return runLint(opts)
+		},
+	}
+
+	cmd.Flags().Bool("fix", false, "Automatically fix issues where possible")
+	cmd.Flags().String("format", "text", "Output format: text or json")
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files with template values (required for v1beta3 specs)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values via command line (e.g., --set key=value)")
+
+	return cmd
+}
+
+func runLint(opts lint.LintOptions) error {
+	// Validate file paths exist
+	for _, filePath := range opts.FilePaths {
+		if _, err := os.Stat(filePath); err != nil {
+			return errors.Wrapf(err, "file not found: %s", filePath)
+		}
+	}
+
+	// Run linting
+	results, err := lint.LintFiles(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to lint files")
+	}
+
+	// Format and print results
+	output := lint.FormatResults(results, opts.Format)
+	fmt.Print(output)
+
+	// Return appropriate exit code
+	if lint.HasErrors(results) {
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES, nil)
+	}
+
+	return nil
+}
@@ -25,7 +25,13 @@ func RootCmd() *cobra.Command {
 		Args:  cobra.MinimumNArgs(1),
 		Short: "Run and retrieve preflight checks in a cluster",
 		Long: `A preflight check is a set of validations that can and should be run to ensure
-that a cluster meets the requirements to run an application.`,
+that a cluster meets the requirements to run an application.
+
+Unlike support-bundle, preflight does not support --load-cluster-specs because
+preflight checks are designed to run before an application is installed or
+upgraded. Since no deployment has occurred yet, there are no in-cluster specs
+to discover. Preflight specs must be provided via a URL, local file path, or
+stdin (e.g. "helm template ... | kubectl preflight -").`,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
@@ -89,6 +95,7 @@ that a cluster meets the requirements to run an application.`,
 	cmd.AddCommand(TemplateCmd())
 	cmd.AddCommand(DocsCmd())
 	cmd.AddCommand(ConvertCmd())
+	cmd.AddCommand(LintCmd())

 	preflight.AddFlags(cmd.PersistentFlags())

@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/lint"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func LintCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lint [spec-files...]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Lint v1beta2/v1beta3 troubleshoot specs for syntax and structural errors",
+		Long: `Lint v1beta2/v1beta3 troubleshoot specs (both preflight and support-bundle) for syntax and structural errors.
+
+This command validates v1beta2/v1beta3 troubleshoot specs and checks for:
+- YAML syntax errors
+- Missing required fields (apiVersion, kind, metadata, spec)
+- Invalid template syntax ({{ .Values.* }})
+- Missing collectors or hostCollectors
+- Common structural issues
+- Missing docStrings (warning)
+
+Examples:
+  # Lint a single spec file
+  support-bundle lint my-spec.yaml
+
+  # Lint multiple spec files
+  support-bundle lint spec1.yaml spec2.yaml spec3.yaml
+
+  # Lint with automatic fixes
+  support-bundle lint --fix my-spec.yaml
+
+  # Lint and output as JSON for CI/CD integration
+  support-bundle lint --format json my-spec.yaml
+
+Notes:
+- v1beta2 does not support templating; template syntax in v1beta2 files will be flagged as errors.
+- v1beta3 supports templating and is linted with template-awareness.
+
+Exit codes:
+  0 - No errors found
+  2 - Validation errors found`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			opts := lint.LintOptions{
+				FilePaths:   args,
+				Fix:         v.GetBool("fix"),
+				Format:      v.GetString("format"),
+				ValuesFiles: v.GetStringSlice("values"),
+				SetValues:   v.GetStringSlice("set"),
+			}
+
+			return runLint(opts)
+		},
+	}
+
+	cmd.Flags().Bool("fix", false, "Automatically fix issues where possible")
+	cmd.Flags().String("format", "text", "Output format: text or json")
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files with template values (required for v1beta3 specs)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values via command line (e.g., --set key=value)")
+
+	return cmd
+}
+
+func runLint(opts lint.LintOptions) error {
+	// Validate file paths exist
+	for _, filePath := range opts.FilePaths {
+		if _, err := os.Stat(filePath); err != nil {
+			return errors.Wrapf(err, "file not found: %s", filePath)
+		}
+	}
+
+	// Run linting
+	results, err := lint.LintFiles(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to lint files")
+	}
+
+	// Format and print results
+	output := lint.FormatResults(results, opts.Format)
+	fmt.Print(output)
+
+	// Return appropriate exit code
+	if lint.HasErrors(results) {
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES, nil)
+	}
+
+	return nil
+}
@@ -5,10 +5,14 @@ import (
 	"os"
 	"strings"

+	"errors"
+
 	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
 	"github.com/replicatedhq/troubleshoot/internal/traces"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
 	"github.com/replicatedhq/troubleshoot/pkg/updater"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -108,6 +112,7 @@ If no arguments are provided, specs are automatically loaded from the cluster by
 	cmd.AddCommand(Diff())
 	cmd.AddCommand(Schedule())
 	cmd.AddCommand(UploadCmd())
+	cmd.AddCommand(LintCmd())
 	cmd.AddCommand(util.VersionCmd())

 	cmd.Flags().StringSlice("redactors", []string{}, "names of the additional redactors to use")
@@ -127,10 +132,18 @@ If no arguments are provided, specs are automatically loaded from the cluster by
 	cmd.Flags().Bool("load-cluster-specs", false, "enable/disable loading additional troubleshoot specs found within the cluster. Do not load by default unless no specs are provided in the cli args")
 	cmd.Flags().String("since-time", "", "force pod logs collectors to return logs after a specific date (RFC3339)")
 	cmd.Flags().String("since", "", "force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.")
-	cmd.Flags().StringP("output", "o", "", "specify the output file path for the support bundle")
+	cmd.Flags().Int("remote-host-collect-timeout", 30, "timeout in seconds for remote host collect operations (e.g. waiting for pods/daemonsets)")
+	cmd.Flags().StringP("output", "o", "", "specify the output file path for the support bundle (.tar.gz extension is added automatically)")
 	cmd.Flags().Bool("debug", false, "enable debug logging. This is equivalent to --v=0")
 	cmd.Flags().Bool("dry-run", false, "print support bundle spec without collecting anything")
 	cmd.Flags().Bool("auto-update", true, "enable automatic binary self-update check and install")
+	cmd.Flags().StringSlice("metadata", []string{}, "user-provided metadata key=value pairs to include in the bundle (can be specified multiple times)")
+
+	// Upload flags
+	cmd.Flags().Bool("auto-upload", false, "automatically upload resulting bundle to replicated.app")
+	cmd.Flags().String("license-id", "", "license ID for authentication when uploading (auto-detected from bundle if not provided)")
+	cmd.Flags().String("app-slug", "", "application slug when uploading (auto-detected from bundle if not provided)")
+	cmd.Flags().String("upload-domain", "", "custom domain for upload (default: replicated.app)")

 	// Auto-discovery flags
 	cmd.Flags().Bool("auto", false, "enable auto-discovery of foundational collectors. When used with YAML specs, adds foundational collectors to YAML collectors. When used alone, collects only foundational data")
@@ -161,7 +174,16 @@ If no arguments are provided, specs are automatically loaded from the cluster by
 }

 func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
+	cmd := RootCmd()
+	if err := cmd.Execute(); err != nil {
+		var exitErr types.ExitError
+		if errors.As(err, &exitErr) {
+			if exitErr.ExitStatus() != constants.EXIT_CODE_FAIL && exitErr.ExitStatus() != constants.EXIT_CODE_WARN {
+				cmd.PrintErrln("Error:", err.Error())
+			}
+			os.Exit(exitErr.ExitStatus())
+		}
+		cmd.PrintErrln("Error:", err.Error())
 		os.Exit(1)
 	}
 }
@@ -166,7 +166,18 @@ func runTroubleshoot(v *viper.Viper, args []string) error {
 		go func() {
 			defer wg.Done()
 			for msg := range progressChan {
-				klog.Infof("Collecting support bundle: %v", msg)
+				switch msg := msg.(type) {
+				case error:
+					klog.Warningf("Collecting support bundle: %v", msg)
+				case string:
+					if strings.Contains(msg, "skipping collector") {
+						klog.Warningf("Collecting support bundle: %s", msg)
+					} else {
+						klog.Infof("Collecting support bundle: %s", msg)
+					}
+				default:
+					klog.Infof("Collecting support bundle: %v", msg)
+				}
 			}
 		}()
 	} else {
@@ -200,17 +211,23 @@ func runTroubleshoot(v *viper.Viper, args []string) error {
 		}()
 	}

+	userMetadata, err := parseMetadataFlag(v.GetStringSlice("metadata"))
+	if err != nil {
+		return errors.Wrap(err, "invalid metadata flag")
+	}
+
 	createOpts := supportbundle.SupportBundleCreateOpts{
-		CollectorProgressCallback: collectorCB,
-		CollectWithoutPermissions: v.GetBool("collect-without-permissions"),
-		KubernetesRestConfig:      restConfig,
-		Namespace:                 v.GetString("namespace"),
-		ProgressChan:              progressChan,
-		SinceTime:                 sinceTime,
-		OutputPath:                v.GetString("output"),
-		Redact:                    v.GetBool("redact"),
-		FromCLI:                   true,
-		RunHostCollectorsInPod:    mainBundle.Spec.RunHostCollectorsInPod,
+		CollectorProgressCallback:       collectorCB,
+		CollectWithoutPermissions:       v.GetBool("collect-without-permissions"),
+		RemoteHostCollectTimeoutSeconds: v.GetInt("remote-host-collect-timeout"),
+		KubernetesRestConfig:            restConfig,
+		Namespace:                       v.GetString("namespace"),
+		ProgressChan:                    progressChan,
+		SinceTime:                       sinceTime,
+		OutputPath:                      v.GetString("output"),
+		Redact:                          v.GetBool("redact"),
+		FromCLI:                         true,
+		RunHostCollectorsInPod:          mainBundle.Spec.RunHostCollectorsInPod,

 		// Phase 4: Tokenization options
 		Tokenize:            v.GetBool("tokenize"),
@@ -220,6 +237,7 @@ func runTroubleshoot(v *viper.Viper, args []string) error {
 		VerifyTokenization:  v.GetBool("verify-tokenization"),
 		BundleID:            v.GetString("bundle-id"),
 		TokenizationStats:   v.GetBool("tokenization-stats"),
+		UserMetadata:        userMetadata,
 	}

 	nonInteractiveOutput := analysisOutput{}
@@ -242,6 +260,26 @@ func runTroubleshoot(v *viper.Viper, args []string) error {
 		}
 	}

+	// Attempt auto-upload before any early returns
+	if v.GetBool("auto-upload") && !response.FileUploaded {
+		licenseID := v.GetString("license-id")
+		appSlug := v.GetString("app-slug")
+		uploadDomain := v.GetString("upload-domain")
+
+		targetDomain := uploadDomain
+		if targetDomain == "" {
+			targetDomain = "replicated.app"
+		}
+
+		fmt.Fprintf(os.Stderr, "Auto-uploading bundle to %s...\n", targetDomain)
+		if err := supportbundle.UploadBundleAutoDetect(response.ArchivePath, licenseID, appSlug, uploadDomain); err != nil {
+			fmt.Fprintf(os.Stderr, "Auto-upload failed: %v\n", err)
+			fmt.Fprintf(os.Stderr, "You can manually upload the bundle using: support-bundle upload %s\n", response.ArchivePath)
+		} else {
+			response.FileUploaded = true
+		}
+	}
+
 	if !response.FileUploaded {
 		if appName := mainBundle.Labels["applicationName"]; appName != "" {
 			f := `A support bundle for %s has been created in this directory
@@ -269,11 +307,12 @@ the %s Admin Console to begin analysis.`
 		fmt.Printf("\r%s\r", cursor.ClearEntireLine())
 	}
 	if response.FileUploaded {
-		fmt.Printf("A support bundle has been created and uploaded to your cluster for analysis. Please visit the Troubleshoot page to continue.\n")
+		fmt.Printf("A support bundle has been created and uploaded to replicated.app for analysis.\n")
 		fmt.Printf("A copy of this support bundle was written to the current directory, named %q\n", response.ArchivePath)
 	} else {
 		fmt.Printf("A support bundle has been created in the current directory named %q\n", response.ArchivePath)
 	}
+
 	return nil
 }

@@ -497,7 +536,7 @@ func (a *analysisOutput) FormattedAnalysisOutput() (outputJson string, err error

 	formatted, err := json.MarshalIndent(o, "", "    ")
 	if err != nil {
-		return "", fmt.Errorf("\r * Failed to format analysis: %v\n", err)
+		return "", fmt.Errorf("\r * Failed to format analysis: %v", err)
 	}
 	return string(formatted), nil
 }
@@ -604,3 +643,18 @@ func VerifyTokenizationSetup(v *viper.Viper) error {

 	return nil
 }
+
+func parseMetadataFlag(values []string) (map[string]string, error) {
+	if len(values) == 0 {
+		return nil, nil
+	}
+	metadata := make(map[string]string, len(values))
+	for _, v := range values {
+		k, val, ok := strings.Cut(v, "=")
+		if !ok {
+			return nil, fmt.Errorf("invalid metadata format %q, expected key=value", v)
+		}
+		metadata[k] = val
+	}
+	return metadata, nil
+}
@@ -13,6 +13,7 @@ import (
 	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
 	"github.com/replicatedhq/troubleshoot/pkg/httputil"
 	"github.com/replicatedhq/troubleshoot/pkg/loader"
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	testclient "k8s.io/client-go/kubernetes/fake"
@@ -436,3 +437,81 @@ func Test_loadInvalidURISpec(t *testing.T) {
 	assert.Len(t, sb.Spec.Collectors, 3)              // default + clusterInfo + clusterResources
 	assert.NotNil(t, sb.Spec.Collectors[0].ConfigMap) // come from the original spec
 }
+
+func TestCollectTimeoutFlag(t *testing.T) {
+	const defaultCollectTimeout = 30
+
+	// Parse flags and bind to viper without running the full command (avoids k8s connection).
+	// This verifies the flag is defined and viper receives the correct value.
+	bindFlagsFromArgs := func(t *testing.T, args []string) {
+		t.Helper()
+		cmd := RootCmd()
+		require.NoError(t, cmd.Flags().Parse(args))
+		if cmd.PersistentPreRun != nil {
+			cmd.PersistentPreRun(cmd, nil)
+		}
+	}
+
+	t.Run("default value when flag not set", func(t *testing.T) {
+		bindFlagsFromArgs(t, []string{})
+		actualTimeout := viper.GetInt("remote-host-collect-timeout")
+		assert.Equal(t, defaultCollectTimeout, actualTimeout, "remote-host-collect-timeout should default to 30 seconds")
+	})
+
+	t.Run("custom value when flag set", func(t *testing.T) {
+		bindFlagsFromArgs(t, []string{"--remote-host-collect-timeout=90"})
+		actualTimeout := viper.GetInt("remote-host-collect-timeout")
+		assert.Equal(t, 90, actualTimeout, "remote-host-collect-timeout should be 90 when --remote-host-collect-timeout=90 is passed")
+	})
+}
+
+func TestParseMetadataFlag(t *testing.T) {
+	tests := []struct {
+		name    string
+		values  []string
+		want    map[string]string
+		wantErr bool
+	}{
+		{
+			name:   "nil input",
+			values: nil,
+			want:   nil,
+		},
+		{
+			name:   "empty input",
+			values: []string{},
+			want:   nil,
+		},
+		{
+			name:   "single pair",
+			values: []string{"env=staging"},
+			want:   map[string]string{"env": "staging"},
+		},
+		{
+			name:   "multiple pairs",
+			values: []string{"env=staging", "version=1.2.3"},
+			want:   map[string]string{"env": "staging", "version": "1.2.3"},
+		},
+		{
+			name:   "value contains equals",
+			values: []string{"config=key=value"},
+			want:   map[string]string{"config": "key=value"},
+		},
+		{
+			name:    "missing equals",
+			values:  []string{"noequals"},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parseMetadataFlag(tt.values)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tt.want, got)
+			}
+		})
+	}
+}
@@ -26,7 +26,10 @@ Examples:
  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID

  # Specify both license and app
-  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID --app-slug my-app`,
+  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID --app-slug my-app
+
+  # Upload to a custom domain (e.g., development environment)
+  support-bundle upload bundle.tar.gz --upload-domain replicated-app-dev.example.com`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 			bundlePath := args[0]
@@ -39,9 +42,10 @@ Examples:
 			// Get upload parameters
 			licenseID := v.GetString("license-id")
 			appSlug := v.GetString("app-slug")
+			uploadDomain := v.GetString("upload-domain")

 			// Use auto-detection for uploads
-			if err := supportbundle.UploadBundleAutoDetect(bundlePath, licenseID, appSlug); err != nil {
+			if err := supportbundle.UploadBundleAutoDetect(bundlePath, licenseID, appSlug, uploadDomain); err != nil {
 				return errors.Wrap(err, "upload failed")
 			}

@@ -51,6 +55,7 @@ Examples:

 	cmd.Flags().String("license-id", "", "license ID for authentication (auto-detected from bundle if not provided)")
 	cmd.Flags().String("app-slug", "", "application slug (auto-detected from bundle if not provided)")
+	cmd.Flags().String("upload-domain", "", "custom domain for upload (default: replicated.app)")

 	return cmd
 }
@@ -880,6 +880,55 @@ spec:
                      - namespace
                      - outcomes
                      type: object
+                    ingressClass:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        ingressClassName:
+                          type: string
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
                    jobStatus:
                      properties:
                        annotations:
@@ -1311,6 +1360,8 @@ spec:
                              - key
                              type: object
                          type: object
+                        ignoreIfNoFiles:
+                          type: boolean
                        outcomes:
                          items:
                            properties:
@@ -1563,6 +1614,58 @@ spec:
                      - outcomes
                      - selector
                      type: object
+                    s3Status:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        fileName:
+                          type: string
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - collectorName
+                      - outcomes
+                      type: object
                    secret:
                      properties:
                        annotations:
@@ -1922,7 +2025,16 @@ spec:
                items:
                  properties:
                    blockDevices:
+                      description: BlockDevicesAnalyze evaluates host-collected block
+                        device listings (lsblk-based).
                      properties:
+                        additionalDeviceTypes:
+                          description: |-
+                            AdditionalDeviceTypes are extra lsblk TYPE values (e.g. loop, lvm) that may count toward outcomes,
+                            in addition to whole disks and (when IncludeUnmountedPartitions is set) partitions.
+                          items:
+                            type: string
+                          type: array
                        annotations:
                          additionalProperties:
                            type: string
@@ -2725,6 +2837,55 @@ spec:
                      required:
                      - outcomes
                      type: object
+                    registryImages:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
                    subnetAvailable:
                      properties:
                        annotations:
@@ -2674,7 +2674,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -5933,7 +5935,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -6723,8 +6727,8 @@ spec:
                                will be made available to those containers which consume them
                                by name.

-                                This is an alpha field and requires enabling the
-                                DynamicResourceAllocation feature gate.
+                                This is a stable field but requires that the
+                                DynamicResourceAllocation feature gate is enabled.

                                This field is immutable.
                              items:
@@ -7184,9 +7188,10 @@ spec:
                                  operator:
                                    description: |-
                                      Operator represents a key's relationship to the value.
-                                      Valid operators are Exists and Equal. Defaults to Equal.
+                                      Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                      Exists is equivalent to wildcard for value, so that a pod can
                                      tolerate all taints of a particular category.
+                                      Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                    type: string
                                  tolerationSeconds:
                                    description: |-
@@ -7987,7 +7992,7 @@ spec:
                                              resources:
                                                description: |-
                                                  resources represents the minimum resources the volume should have.
-                                                  If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                                  Users are allowed to specify resource requirements
                                                  that are lower than previous value but must still be higher than capacity recorded in the
                                                  status field of the claim.
                                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -8888,6 +8893,24 @@ spec:
                                                    CSRs will be addressed to this
                                                    signer.
                                                  type: string
+                                                userAnnotations:
+                                                  additionalProperties:
+                                                    type: string
+                                                  description: |-
+                                                    userAnnotations allow pod authors to pass additional information to
+                                                    the signer implementation.  Kubernetes does not restrict or validate this
+                                                    metadata in any way.
+
+                                                    These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                                    the PodCertificateRequest objects that Kubelet creates.
+
+                                                    Entries are subject to the same validation as object metadata annotations,
+                                                    with the addition that all keys must be domain-prefixed. No restrictions
+                                                    are placed on values, except an overall size limitation on the entire field.
+
+                                                    Signers should document the keys and values they support. Signers should
+                                                    deny requests that contain keys they do not recognize.
+                                                  type: object
                                              required:
                                              - keyType
                                              - signerName
@@ -9318,6 +9341,42 @@ spec:
                              x-kubernetes-list-map-keys:
                              - name
                              x-kubernetes-list-type: map
+                            workloadRef:
+                              description: |-
+                                WorkloadRef provides a reference to the Workload object that this Pod belongs to.
+                                This field is used by the scheduler to identify the PodGroup and apply the
+                                correct group scheduling policies. The Workload object referenced
+                                by this field may not exist at the time the Pod is created.
+                                This field is immutable, but a Workload object with the same name
+                                may be recreated with different policies. Doing this during pod scheduling
+                                may result in the placement not conforming to the expected policies.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name defines the name of the Workload object this Pod belongs to.
+                                    Workload must be in the same namespace as the Pod.
+                                    If it doesn't match any existing Workload, the Pod will remain unschedulable
+                                    until a Workload object is created and observed by the kube-scheduler.
+                                    It must be a DNS subdomain.
+                                  type: string
+                                podGroup:
+                                  description: |-
+                                    PodGroup is the name of the PodGroup within the Workload that this Pod
+                                    belongs to. If it doesn't match any existing PodGroup within the Workload,
+                                    the Pod will remain unschedulable until the Workload object is recreated
+                                    and observed by the kube-scheduler. It must be a DNS label.
+                                  type: string
+                                podGroupReplicaKey:
+                                  description: |-
+                                    PodGroupReplicaKey specifies the replica key of the PodGroup to which this
+                                    Pod belongs. It is used to distinguish pods belonging to different replicas
+                                    of the same pod group. The pod group policy is applied separately to each replica.
+                                    When set, it must be a DNS label.
+                                  type: string
+                              required:
+                              - name
+                              - podGroup
+                              type: object
                          required:
                          - containers
                          type: object
@@ -11199,7 +11258,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -14458,7 +14519,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -15248,8 +15311,8 @@ spec:
                                will be made available to those containers which consume them
                                by name.

-                                This is an alpha field and requires enabling the
-                                DynamicResourceAllocation feature gate.
+                                This is a stable field but requires that the
+                                DynamicResourceAllocation feature gate is enabled.

                                This field is immutable.
                              items:
@@ -15709,9 +15772,10 @@ spec:
                                  operator:
                                    description: |-
                                      Operator represents a key's relationship to the value.
-                                      Valid operators are Exists and Equal. Defaults to Equal.
+                                      Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                      Exists is equivalent to wildcard for value, so that a pod can
                                      tolerate all taints of a particular category.
+                                      Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                    type: string
                                  tolerationSeconds:
                                    description: |-
@@ -16512,7 +16576,7 @@ spec:
                                              resources:
                                                description: |-
                                                  resources represents the minimum resources the volume should have.
-                                                  If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                                  Users are allowed to specify resource requirements
                                                  that are lower than previous value but must still be higher than capacity recorded in the
                                                  status field of the claim.
                                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -17413,6 +17477,24 @@ spec:
                                                    CSRs will be addressed to this
                                                    signer.
                                                  type: string
+                                                userAnnotations:
+                                                  additionalProperties:
+                                                    type: string
+                                                  description: |-
+                                                    userAnnotations allow pod authors to pass additional information to
+                                                    the signer implementation.  Kubernetes does not restrict or validate this
+                                                    metadata in any way.
+
+                                                    These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                                    the PodCertificateRequest objects that Kubelet creates.
+
+                                                    Entries are subject to the same validation as object metadata annotations,
+                                                    with the addition that all keys must be domain-prefixed. No restrictions
+                                                    are placed on values, except an overall size limitation on the entire field.
+
+                                                    Signers should document the keys and values they support. Signers should
+                                                    deny requests that contain keys they do not recognize.
+                                                  type: object
                                              required:
                                              - keyType
                                              - signerName
@@ -17843,6 +17925,42 @@ spec:
                              x-kubernetes-list-map-keys:
                              - name
                              x-kubernetes-list-type: map
+                            workloadRef:
+                              description: |-
+                                WorkloadRef provides a reference to the Workload object that this Pod belongs to.
+                                This field is used by the scheduler to identify the PodGroup and apply the
+                                correct group scheduling policies. The Workload object referenced
+                                by this field may not exist at the time the Pod is created.
+                                This field is immutable, but a Workload object with the same name
+                                may be recreated with different policies. Doing this during pod scheduling
+                                may result in the placement not conforming to the expected policies.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name defines the name of the Workload object this Pod belongs to.
+                                    Workload must be in the same namespace as the Pod.
+                                    If it doesn't match any existing Workload, the Pod will remain unschedulable
+                                    until a Workload object is created and observed by the kube-scheduler.
+                                    It must be a DNS subdomain.
+                                  type: string
+                                podGroup:
+                                  description: |-
+                                    PodGroup is the name of the PodGroup within the Workload that this Pod
+                                    belongs to. If it doesn't match any existing PodGroup within the Workload,
+                                    the Pod will remain unschedulable until the Workload object is recreated
+                                    and observed by the kube-scheduler. It must be a DNS label.
+                                  type: string
+                                podGroupReplicaKey:
+                                  description: |-
+                                    PodGroupReplicaKey specifies the replica key of the PodGroup to which this
+                                    Pod belongs. It is used to distinguish pods belonging to different replicas
+                                    of the same pod group. The pod group policy is applied separately to each replica.
+                                    When set, it must be a DNS label.
+                                  type: string
+                              required:
+                              - name
+                              - podGroup
+                              type: object
                          required:
                          - containers
                          type: object
@@ -17851,6 +17969,29 @@ spec:
                      required:
                      - namespace
                      type: object
+                    s3Status:
+                      properties:
+                        accessKeyID:
+                          type: string
+                        bucketName:
+                          type: string
+                        collectorName:
+                          type: string
+                        endpoint:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        insecure:
+                          type: boolean
+                        region:
+                          type: string
+                        secretAccessKey:
+                          type: string
+                        usePathStyle:
+                          type: boolean
+                      required:
+                      - bucketName
+                      type: object
                    secret:
                      properties:
                        collectorName:
@@ -17881,6 +18022,17 @@ spec:
                        namespace:
                          type: string
                      type: object
+                    supportBundleMetadata:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        namespace:
+                          type: string
+                      required:
+                      - namespace
+                      type: object
                    sysctl:
                      properties:
                        collectorName:
@@ -18333,6 +18485,27 @@ spec:
                      - port
                      - toCIDR
                      type: object
+                    registryImages:
+                      description: |-
+                        HostRegistryImages checks whether images are accessible from the host,
+                        without requiring a Kubernetes cluster. Auth can be supplied inline via
+                        Username/Password or omitted to rely on ambient credentials (e.g. ~/.docker/config.json).
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        images:
+                          items:
+                            type: string
+                          type: array
+                        password:
+                          type: string
+                        username:
+                          type: string
+                      required:
+                      - images
+                      type: object
                    run:
                      properties:
                        args:
@@ -43,7 +43,16 @@ spec:
                items:
                  properties:
                    blockDevices:
+                      description: BlockDevicesAnalyze evaluates host-collected block
+                        device listings (lsblk-based).
                      properties:
+                        additionalDeviceTypes:
+                          description: |-
+                            AdditionalDeviceTypes are extra lsblk TYPE values (e.g. loop, lvm) that may count toward outcomes,
+                            in addition to whole disks and (when IncludeUnmountedPartitions is set) partitions.
+                          items:
+                            type: string
+                          type: array
                        annotations:
                          additionalProperties:
                            type: string
@@ -846,6 +855,55 @@ spec:
                      required:
                      - outcomes
                      type: object
+                    registryImages:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
                    subnetAvailable:
                      properties:
                        annotations:
@@ -1775,6 +1833,27 @@ spec:
                      - port
                      - toCIDR
                      type: object
+                    registryImages:
+                      description: |-
+                        HostRegistryImages checks whether images are accessible from the host,
+                        without requiring a Kubernetes cluster. Auth can be supplied inline via
+                        Username/Password or omitted to rely on ambient credentials (e.g. ~/.docker/config.json).
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        images:
+                          items:
+                            type: string
+                          type: array
+                        password:
+                          type: string
+                        username:
+                          type: string
+                      required:
+                      - images
+                      type: object
                    run:
                      properties:
                        args:
@@ -43,7 +43,16 @@ spec:
                items:
                  properties:
                    blockDevices:
+                      description: BlockDevicesAnalyze evaluates host-collected block
+                        device listings (lsblk-based).
                      properties:
+                        additionalDeviceTypes:
+                          description: |-
+                            AdditionalDeviceTypes are extra lsblk TYPE values (e.g. loop, lvm) that may count toward outcomes,
+                            in addition to whole disks and (when IncludeUnmountedPartitions is set) partitions.
+                          items:
+                            type: string
+                          type: array
                        annotations:
                          additionalProperties:
                            type: string
@@ -846,6 +855,55 @@ spec:
                      required:
                      - outcomes
                      type: object
+                    registryImages:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
                    subnetAvailable:
                      properties:
                        annotations:
@@ -1775,6 +1833,27 @@ spec:
                      - port
                      - toCIDR
                      type: object
+                    registryImages:
+                      description: |-
+                        HostRegistryImages checks whether images are accessible from the host,
+                        without requiring a Kubernetes cluster. Auth can be supplied inline via
+                        Username/Password or omitted to rely on ambient credentials (e.g. ~/.docker/config.json).
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        images:
+                          items:
+                            type: string
+                          type: array
+                        password:
+                          type: string
+                        username:
+                          type: string
+                      required:
+                      - images
+                      type: object
                    run:
                      properties:
                        args:
@@ -880,6 +880,55 @@ spec:
                      - namespace
                      - outcomes
                      type: object
+                    ingressClass:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        ingressClassName:
+                          type: string
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
                    jobStatus:
                      properties:
                        annotations:
@@ -1311,6 +1360,8 @@ spec:
                              - key
                              type: object
                          type: object
+                        ignoreIfNoFiles:
+                          type: boolean
                        outcomes:
                          items:
                            properties:
@@ -1563,6 +1614,58 @@ spec:
                      - outcomes
                      - selector
                      type: object
+                    s3Status:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        fileName:
+                          type: string
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - collectorName
+                      - outcomes
+                      type: object
                    secret:
                      properties:
                        annotations:
@@ -4522,7 +4625,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -7781,7 +7886,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -8571,8 +8678,8 @@ spec:
                                will be made available to those containers which consume them
                                by name.

-                                This is an alpha field and requires enabling the
-                                DynamicResourceAllocation feature gate.
+                                This is a stable field but requires that the
+                                DynamicResourceAllocation feature gate is enabled.

                                This field is immutable.
                              items:
@@ -9032,9 +9139,10 @@ spec:
                                  operator:
                                    description: |-
                                      Operator represents a key's relationship to the value.
-                                      Valid operators are Exists and Equal. Defaults to Equal.
+                                      Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                      Exists is equivalent to wildcard for value, so that a pod can
                                      tolerate all taints of a particular category.
+                                      Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                    type: string
                                  tolerationSeconds:
                                    description: |-
@@ -9835,7 +9943,7 @@ spec:
                                              resources:
                                                description: |-
                                                  resources represents the minimum resources the volume should have.
-                                                  If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                                  Users are allowed to specify resource requirements
                                                  that are lower than previous value but must still be higher than capacity recorded in the
                                                  status field of the claim.
                                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -10736,6 +10844,24 @@ spec:
                                                    CSRs will be addressed to this
                                                    signer.
                                                  type: string
+                                                userAnnotations:
+                                                  additionalProperties:
+                                                    type: string
+                                                  description: |-
+                                                    userAnnotations allow pod authors to pass additional information to
+                                                    the signer implementation.  Kubernetes does not restrict or validate this
+                                                    metadata in any way.
+
+                                                    These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                                    the PodCertificateRequest objects that Kubelet creates.
+
+                                                    Entries are subject to the same validation as object metadata annotations,
+                                                    with the addition that all keys must be domain-prefixed. No restrictions
+                                                    are placed on values, except an overall size limitation on the entire field.
+
+                                                    Signers should document the keys and values they support. Signers should
+                                                    deny requests that contain keys they do not recognize.
+                                                  type: object
                                              required:
                                              - keyType
                                              - signerName
@@ -11166,6 +11292,42 @@ spec:
                              x-kubernetes-list-map-keys:
                              - name
                              x-kubernetes-list-type: map
+                            workloadRef:
+                              description: |-
+                                WorkloadRef provides a reference to the Workload object that this Pod belongs to.
+                                This field is used by the scheduler to identify the PodGroup and apply the
+                                correct group scheduling policies. The Workload object referenced
+                                by this field may not exist at the time the Pod is created.
+                                This field is immutable, but a Workload object with the same name
+                                may be recreated with different policies. Doing this during pod scheduling
+                                may result in the placement not conforming to the expected policies.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name defines the name of the Workload object this Pod belongs to.
+                                    Workload must be in the same namespace as the Pod.
+                                    If it doesn't match any existing Workload, the Pod will remain unschedulable
+                                    until a Workload object is created and observed by the kube-scheduler.
+                                    It must be a DNS subdomain.
+                                  type: string
+                                podGroup:
+                                  description: |-
+                                    PodGroup is the name of the PodGroup within the Workload that this Pod
+                                    belongs to. If it doesn't match any existing PodGroup within the Workload,
+                                    the Pod will remain unschedulable until the Workload object is recreated
+                                    and observed by the kube-scheduler. It must be a DNS label.
+                                  type: string
+                                podGroupReplicaKey:
+                                  description: |-
+                                    PodGroupReplicaKey specifies the replica key of the PodGroup to which this
+                                    Pod belongs. It is used to distinguish pods belonging to different replicas
+                                    of the same pod group. The pod group policy is applied separately to each replica.
+                                    When set, it must be a DNS label.
+                                  type: string
+                              required:
+                              - name
+                              - podGroup
+                              type: object
                          required:
                          - containers
                          type: object
@@ -13047,7 +13209,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -16306,7 +16470,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -17096,8 +17262,8 @@ spec:
                                will be made available to those containers which consume them
                                by name.

-                                This is an alpha field and requires enabling the
-                                DynamicResourceAllocation feature gate.
+                                This is a stable field but requires that the
+                                DynamicResourceAllocation feature gate is enabled.

                                This field is immutable.
                              items:
@@ -17557,9 +17723,10 @@ spec:
                                  operator:
                                    description: |-
                                      Operator represents a key's relationship to the value.
-                                      Valid operators are Exists and Equal. Defaults to Equal.
+                                      Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                      Exists is equivalent to wildcard for value, so that a pod can
                                      tolerate all taints of a particular category.
+                                      Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                    type: string
                                  tolerationSeconds:
                                    description: |-
@@ -18360,7 +18527,7 @@ spec:
                                              resources:
                                                description: |-
                                                  resources represents the minimum resources the volume should have.
-                                                  If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                                  Users are allowed to specify resource requirements
                                                  that are lower than previous value but must still be higher than capacity recorded in the
                                                  status field of the claim.
                                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -19261,6 +19428,24 @@ spec:
                                                    CSRs will be addressed to this
                                                    signer.
                                                  type: string
+                                                userAnnotations:
+                                                  additionalProperties:
+                                                    type: string
+                                                  description: |-
+                                                    userAnnotations allow pod authors to pass additional information to
+                                                    the signer implementation.  Kubernetes does not restrict or validate this
+                                                    metadata in any way.
+
+                                                    These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                                    the PodCertificateRequest objects that Kubelet creates.
+
+                                                    Entries are subject to the same validation as object metadata annotations,
+                                                    with the addition that all keys must be domain-prefixed. No restrictions
+                                                    are placed on values, except an overall size limitation on the entire field.
+
+                                                    Signers should document the keys and values they support. Signers should
+                                                    deny requests that contain keys they do not recognize.
+                                                  type: object
                                              required:
                                              - keyType
                                              - signerName
@@ -19691,6 +19876,42 @@ spec:
                              x-kubernetes-list-map-keys:
                              - name
                              x-kubernetes-list-type: map
+                            workloadRef:
+                              description: |-
+                                WorkloadRef provides a reference to the Workload object that this Pod belongs to.
+                                This field is used by the scheduler to identify the PodGroup and apply the
+                                correct group scheduling policies. The Workload object referenced
+                                by this field may not exist at the time the Pod is created.
+                                This field is immutable, but a Workload object with the same name
+                                may be recreated with different policies. Doing this during pod scheduling
+                                may result in the placement not conforming to the expected policies.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name defines the name of the Workload object this Pod belongs to.
+                                    Workload must be in the same namespace as the Pod.
+                                    If it doesn't match any existing Workload, the Pod will remain unschedulable
+                                    until a Workload object is created and observed by the kube-scheduler.
+                                    It must be a DNS subdomain.
+                                  type: string
+                                podGroup:
+                                  description: |-
+                                    PodGroup is the name of the PodGroup within the Workload that this Pod
+                                    belongs to. If it doesn't match any existing PodGroup within the Workload,
+                                    the Pod will remain unschedulable until the Workload object is recreated
+                                    and observed by the kube-scheduler. It must be a DNS label.
+                                  type: string
+                                podGroupReplicaKey:
+                                  description: |-
+                                    PodGroupReplicaKey specifies the replica key of the PodGroup to which this
+                                    Pod belongs. It is used to distinguish pods belonging to different replicas
+                                    of the same pod group. The pod group policy is applied separately to each replica.
+                                    When set, it must be a DNS label.
+                                  type: string
+                              required:
+                              - name
+                              - podGroup
+                              type: object
                          required:
                          - containers
                          type: object
@@ -19699,6 +19920,29 @@ spec:
                      required:
                      - namespace
                      type: object
+                    s3Status:
+                      properties:
+                        accessKeyID:
+                          type: string
+                        bucketName:
+                          type: string
+                        collectorName:
+                          type: string
+                        endpoint:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        insecure:
+                          type: boolean
+                        region:
+                          type: string
+                        secretAccessKey:
+                          type: string
+                        usePathStyle:
+                          type: boolean
+                      required:
+                      - bucketName
+                      type: object
                    secret:
                      properties:
                        collectorName:
@@ -19729,6 +19973,17 @@ spec:
                        namespace:
                          type: string
                      type: object
+                    supportBundleMetadata:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        namespace:
+                          type: string
+                      required:
+                      - namespace
+                      type: object
                    sysctl:
                      properties:
                        collectorName:
@@ -911,6 +911,55 @@ spec:
                      - namespace
                      - outcomes
                      type: object
+                    ingressClass:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        ingressClassName:
+                          type: string
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
                    jobStatus:
                      properties:
                        annotations:
@@ -1342,6 +1391,8 @@ spec:
                              - key
                              type: object
                          type: object
+                        ignoreIfNoFiles:
+                          type: boolean
                        outcomes:
                          items:
                            properties:
@@ -1594,6 +1645,58 @@ spec:
                      - outcomes
                      - selector
                      type: object
+                    s3Status:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        fileName:
+                          type: string
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - collectorName
+                      - outcomes
+                      type: object
                    secret:
                      properties:
                        annotations:
@@ -4553,7 +4656,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -7812,7 +7917,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -8602,8 +8709,8 @@ spec:
                                will be made available to those containers which consume them
                                by name.

-                                This is an alpha field and requires enabling the
-                                DynamicResourceAllocation feature gate.
+                                This is a stable field but requires that the
+                                DynamicResourceAllocation feature gate is enabled.

                                This field is immutable.
                              items:
@@ -9063,9 +9170,10 @@ spec:
                                  operator:
                                    description: |-
                                      Operator represents a key's relationship to the value.
-                                      Valid operators are Exists and Equal. Defaults to Equal.
+                                      Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                      Exists is equivalent to wildcard for value, so that a pod can
                                      tolerate all taints of a particular category.
+                                      Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                    type: string
                                  tolerationSeconds:
                                    description: |-
@@ -9866,7 +9974,7 @@ spec:
                                              resources:
                                                description: |-
                                                  resources represents the minimum resources the volume should have.
-                                                  If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                                  Users are allowed to specify resource requirements
                                                  that are lower than previous value but must still be higher than capacity recorded in the
                                                  status field of the claim.
                                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -10767,6 +10875,24 @@ spec:
                                                    CSRs will be addressed to this
                                                    signer.
                                                  type: string
+                                                userAnnotations:
+                                                  additionalProperties:
+                                                    type: string
+                                                  description: |-
+                                                    userAnnotations allow pod authors to pass additional information to
+                                                    the signer implementation.  Kubernetes does not restrict or validate this
+                                                    metadata in any way.
+
+                                                    These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                                    the PodCertificateRequest objects that Kubelet creates.
+
+                                                    Entries are subject to the same validation as object metadata annotations,
+                                                    with the addition that all keys must be domain-prefixed. No restrictions
+                                                    are placed on values, except an overall size limitation on the entire field.
+
+                                                    Signers should document the keys and values they support. Signers should
+                                                    deny requests that contain keys they do not recognize.
+                                                  type: object
                                              required:
                                              - keyType
                                              - signerName
@@ -11197,6 +11323,42 @@ spec:
                              x-kubernetes-list-map-keys:
                              - name
                              x-kubernetes-list-type: map
+                            workloadRef:
+                              description: |-
+                                WorkloadRef provides a reference to the Workload object that this Pod belongs to.
+                                This field is used by the scheduler to identify the PodGroup and apply the
+                                correct group scheduling policies. The Workload object referenced
+                                by this field may not exist at the time the Pod is created.
+                                This field is immutable, but a Workload object with the same name
+                                may be recreated with different policies. Doing this during pod scheduling
+                                may result in the placement not conforming to the expected policies.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name defines the name of the Workload object this Pod belongs to.
+                                    Workload must be in the same namespace as the Pod.
+                                    If it doesn't match any existing Workload, the Pod will remain unschedulable
+                                    until a Workload object is created and observed by the kube-scheduler.
+                                    It must be a DNS subdomain.
+                                  type: string
+                                podGroup:
+                                  description: |-
+                                    PodGroup is the name of the PodGroup within the Workload that this Pod
+                                    belongs to. If it doesn't match any existing PodGroup within the Workload,
+                                    the Pod will remain unschedulable until the Workload object is recreated
+                                    and observed by the kube-scheduler. It must be a DNS label.
+                                  type: string
+                                podGroupReplicaKey:
+                                  description: |-
+                                    PodGroupReplicaKey specifies the replica key of the PodGroup to which this
+                                    Pod belongs. It is used to distinguish pods belonging to different replicas
+                                    of the same pod group. The pod group policy is applied separately to each replica.
+                                    When set, it must be a DNS label.
+                                  type: string
+                              required:
+                              - name
+                              - podGroup
+                              type: object
                          required:
                          - containers
                          type: object
@@ -13078,7 +13240,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -16337,7 +16501,9 @@ spec:
                                        type: integer
                                    type: object
                                  resizePolicy:
-                                    description: Resources resize policy for the container.
+                                    description: |-
+                                      Resources resize policy for the container.
+                                      This field cannot be set on ephemeral containers.
                                    items:
                                      description: ContainerResizePolicy represents
                                        resource resize policy for the container.
@@ -17127,8 +17293,8 @@ spec:
                                will be made available to those containers which consume them
                                by name.

-                                This is an alpha field and requires enabling the
-                                DynamicResourceAllocation feature gate.
+                                This is a stable field but requires that the
+                                DynamicResourceAllocation feature gate is enabled.

                                This field is immutable.
                              items:
@@ -17588,9 +17754,10 @@ spec:
                                  operator:
                                    description: |-
                                      Operator represents a key's relationship to the value.
-                                      Valid operators are Exists and Equal. Defaults to Equal.
+                                      Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                                      Exists is equivalent to wildcard for value, so that a pod can
                                      tolerate all taints of a particular category.
+                                      Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                                    type: string
                                  tolerationSeconds:
                                    description: |-
@@ -18391,7 +18558,7 @@ spec:
                                              resources:
                                                description: |-
                                                  resources represents the minimum resources the volume should have.
-                                                  If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                                  Users are allowed to specify resource requirements
                                                  that are lower than previous value but must still be higher than capacity recorded in the
                                                  status field of the claim.
                                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
@@ -19292,6 +19459,24 @@ spec:
                                                    CSRs will be addressed to this
                                                    signer.
                                                  type: string
+                                                userAnnotations:
+                                                  additionalProperties:
+                                                    type: string
+                                                  description: |-
+                                                    userAnnotations allow pod authors to pass additional information to
+                                                    the signer implementation.  Kubernetes does not restrict or validate this
+                                                    metadata in any way.
+
+                                                    These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
+                                                    the PodCertificateRequest objects that Kubelet creates.
+
+                                                    Entries are subject to the same validation as object metadata annotations,
+                                                    with the addition that all keys must be domain-prefixed. No restrictions
+                                                    are placed on values, except an overall size limitation on the entire field.
+
+                                                    Signers should document the keys and values they support. Signers should
+                                                    deny requests that contain keys they do not recognize.
+                                                  type: object
                                              required:
                                              - keyType
                                              - signerName
@@ -19722,6 +19907,42 @@ spec:
                              x-kubernetes-list-map-keys:
                              - name
                              x-kubernetes-list-type: map
+                            workloadRef:
+                              description: |-
+                                WorkloadRef provides a reference to the Workload object that this Pod belongs to.
+                                This field is used by the scheduler to identify the PodGroup and apply the
+                                correct group scheduling policies. The Workload object referenced
+                                by this field may not exist at the time the Pod is created.
+                                This field is immutable, but a Workload object with the same name
+                                may be recreated with different policies. Doing this during pod scheduling
+                                may result in the placement not conforming to the expected policies.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name defines the name of the Workload object this Pod belongs to.
+                                    Workload must be in the same namespace as the Pod.
+                                    If it doesn't match any existing Workload, the Pod will remain unschedulable
+                                    until a Workload object is created and observed by the kube-scheduler.
+                                    It must be a DNS subdomain.
+                                  type: string
+                                podGroup:
+                                  description: |-
+                                    PodGroup is the name of the PodGroup within the Workload that this Pod
+                                    belongs to. If it doesn't match any existing PodGroup within the Workload,
+                                    the Pod will remain unschedulable until the Workload object is recreated
+                                    and observed by the kube-scheduler. It must be a DNS label.
+                                  type: string
+                                podGroupReplicaKey:
+                                  description: |-
+                                    PodGroupReplicaKey specifies the replica key of the PodGroup to which this
+                                    Pod belongs. It is used to distinguish pods belonging to different replicas
+                                    of the same pod group. The pod group policy is applied separately to each replica.
+                                    When set, it must be a DNS label.
+                                  type: string
+                              required:
+                              - name
+                              - podGroup
+                              type: object
                          required:
                          - containers
                          type: object
@@ -19730,6 +19951,29 @@ spec:
                      required:
                      - namespace
                      type: object
+                    s3Status:
+                      properties:
+                        accessKeyID:
+                          type: string
+                        bucketName:
+                          type: string
+                        collectorName:
+                          type: string
+                        endpoint:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        insecure:
+                          type: boolean
+                        region:
+                          type: string
+                        secretAccessKey:
+                          type: string
+                        usePathStyle:
+                          type: boolean
+                      required:
+                      - bucketName
+                      type: object
                    secret:
                      properties:
                        collectorName:
@@ -19760,6 +20004,17 @@ spec:
                        namespace:
                          type: string
                      type: object
+                    supportBundleMetadata:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        namespace:
+                          type: string
+                      required:
+                      - namespace
+                      type: object
                    sysctl:
                      properties:
                        collectorName:
@@ -19797,7 +20052,16 @@ spec:
                items:
                  properties:
                    blockDevices:
+                      description: BlockDevicesAnalyze evaluates host-collected block
+                        device listings (lsblk-based).
                      properties:
+                        additionalDeviceTypes:
+                          description: |-
+                            AdditionalDeviceTypes are extra lsblk TYPE values (e.g. loop, lvm) that may count toward outcomes,
+                            in addition to whole disks and (when IncludeUnmountedPartitions is set) partitions.
+                          items:
+                            type: string
+                          type: array
                        annotations:
                          additionalProperties:
                            type: string
@@ -20600,6 +20864,55 @@ spec:
                      required:
                      - outcomes
                      type: object
+                    registryImages:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
                    subnetAvailable:
                      properties:
                        annotations:
@@ -21529,6 +21842,27 @@ spec:
                      - port
                      - toCIDR
                      type: object
+                    registryImages:
+                      description: |-
+                        HostRegistryImages checks whether images are accessible from the host,
+                        without requiring a Kubernetes cluster. Auth can be supplied inline via
+                        Username/Password or omitted to rely on ambient credentials (e.g. ~/.docker/config.json).
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        images:
+                          items:
+                            type: string
+                          type: array
+                        password:
+                          type: string
+                        username:
+                          type: string
+                      required:
+                      - images
+                      type: object
                    run:
                      properties:
                        args:
@@ -8,11 +8,15 @@ builds:
  - id: preflight
    main: ./cmd/preflight/main.go
    env: [CGO_ENABLED=0]
-    goos: [linux, darwin]
-    goarch: [amd64, arm, arm64]
+    goos: [linux, darwin, windows]
+    goarch: [amd64, arm, arm64, riscv64]
    ignore:
      - goos: windows
        goarch: arm
+      - goos: windows
+        goarch: riscv64
+      - goos: darwin
+        goarch: riscv64
    ldflags:
      - -s -w
      - -X github.com/replicatedhq/troubleshoot/pkg/version.version={{ .Version }}
@@ -31,11 +35,15 @@ builds:
  - id: support-bundle
    main: ./cmd/troubleshoot/main.go
    env: [CGO_ENABLED=0]
-    goos: [linux, darwin]
-    goarch: [amd64, arm, arm64]
+    goos: [linux, darwin, windows]
+    goarch: [amd64, arm, arm64, riscv64]
    ignore:
      - goos: windows
        goarch: arm
+      - goos: windows
+        goarch: riscv64
+      - goos: darwin
+        goarch: riscv64
    ldflags:
      - -s -w
      - -X github.com/replicatedhq/troubleshoot/pkg/version.version={{ .Version }}
@@ -51,6 +59,33 @@ builds:
      - -installsuffix=netgo
    binary: support-bundle

+  - id: collect
+    main: ./cmd/collect/main.go
+    env: [CGO_ENABLED=0]
+    goos: [linux, darwin, windows]
+    goarch: [amd64, arm, arm64, riscv64]
+    ignore:
+      - goos: windows
+        goarch: arm
+      - goos: windows
+        goarch: riscv64
+      - goos: darwin
+        goarch: riscv64
+    ldflags:
+      - -s -w
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.version={{ .Version }}
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.gitSHA={{ .Commit }}
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.buildTime={{ .Date }}
+      - -extldflags "-static"
+    flags:
+      - -tags=netgo
+      - -tags=containers_image_ostree_stub
+      - -tags=exclude_graphdriver_devicemapper
+      - -tags=exclude_graphdriver_btrfs
+      - -tags=containers_image_openpgp
+      - -installsuffix=netgo
+    binary: collect
+
 archives:
  - id: preflight
    ids: [preflight]
@@ -135,7 +170,7 @@ dockers:
    ids:
      - support-bundle
      - preflight
-    skip_push: true
+      - collect
  - dockerfile: ./deploy/Dockerfile.troubleshoot
    image_templates:
      - "replicated/preflight:latest"
@@ -145,7 +180,7 @@ dockers:
    ids:
      - support-bundle
      - preflight
-    skip_push: true
+      - collect

 universal_binaries:
  - id: preflight-universal
@@ -7,6 +7,7 @@ RUN apt-get -qq update \

 COPY support-bundle /troubleshoot/support-bundle
 COPY preflight /troubleshoot/preflight
+COPY collect /troubleshoot/collect

 ENV PATH="/troubleshoot:${PATH}"

@@ -0,0 +1,59 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: test-v1beta3-secretref
+spec:
+  collectors:
+    # Test 1: PostgreSQL with URI from secret
+    - postgres:
+        collectorName: postgres-with-secret
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: test-database-credentials
+              key: postgres-uri
+        # This will fail to connect (fake server) but that's OK -
+        # we're testing secret resolution, not actual DB connectivity
+
+    # Test 2: PostgreSQL with TLS certs from secret
+    - postgres:
+        collectorName: postgres-with-tls
+        uri:
+          value: "postgresql://testuser:testpass@localhost:5432/testdb"
+        tls:
+          cacert:
+            valueFrom:
+              secretKeyRef:
+                name: test-database-credentials
+                key: ca.crt
+          clientCert:
+            valueFrom:
+              secretKeyRef:
+                name: test-database-credentials
+                key: client.crt
+          clientKey:
+            valueFrom:
+              secretKeyRef:
+                name: test-database-credentials
+                key: client.key
+
+    # Test 3: MySQL with URI from secret
+    - mysql:
+        collectorName: mysql-with-secret
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: test-database-credentials
+              key: mysql-uri
+
+    # Test 4: Redis with URI from secret
+    - redis:
+        collectorName: redis-with-secret
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: test-database-credentials
+              key: redis-uri
+
+    # Test 5: Literal value (no secret) for comparison
+    - clusterInfo: {}
@@ -0,0 +1,39 @@
+---
+# Secret containing database credentials
+apiVersion: v1
+kind: Secret
+metadata:
+  name: test-database-credentials
+  namespace: default
+type: Opaque
+stringData:
+  # PostgreSQL connection URI
+  postgres-uri: "postgresql://testuser:supersecret@postgres.example.com:5432/testdb?sslmode=require"
+
+  # MySQL connection URI
+  mysql-uri: "mysql://testuser:supersecret@mysql.example.com:3306/testdb"
+
+  # Redis connection URI
+  redis-uri: "redis://:supersecret@redis.example.com:6379"
+
+  # TLS certificates (example data)
+  ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIICpDCCAYwCCQDU+pQ3ZUD30jANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
+    b2NhbGhvc3QwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjAUMRIwEAYD
+    VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+    VJTUt9Us8cKjMzEfYyjiWA4R4/M2bS1+fWIcPm15A8IgC0qC1J3xGhE=
+    -----END CERTIFICATE-----
+
+  client.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIICpDCCAYwCCQDU+pQ3ZUD30jANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
+    b2NhbGhvc3QwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjAUMRIwEAYD
+    VQQDDA5jbGllbnQtY2VydA==
+    -----END CERTIFICATE-----
+
+  client.key: |
+    -----BEGIN PRIVATE KEY-----
+    MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKj
+    MzEfYyjiWA4R4/M2bS1+fWIcPm15A8IgC0qC1J3xGhE=
+    -----END PRIVATE KEY-----
@@ -92,7 +92,7 @@ spec:
    - nodeResources:
        checkName: Must have 1 node with 2Gi (available) memory and at least 2 cores (on a single node)
        filters:
-          allocatableMemory: 2Gi
+          memoryAllocatable: 2Gi
          cpuCapacity: "2"
        outcomes:
          - pass:
@@ -28,7 +28,7 @@ spec:
    - nodeResources:
        checkName: Must have 1 node with 16 GB (available) memory and 10 cores (on a single node)
        filters:
-          allocatableMemory: 16Gi
+          memoryAllocatable: 16Gi
          cpuCapacity: "10"
        outcomes:
          - fail:
@@ -39,7 +39,7 @@ spec:
    - nodeResources:
        checkName: Must have 1 node with 16 GB (available) memory and 4 cores of amd64 arch (on a single node)
        filters:
-          allocatableMemory: 16Gi
+          memoryAllocatable: 16Gi
          cpuArchitecture: amd64
          cpuCapacity: "4"
        outcomes:
@@ -54,7 +54,7 @@ spec:
          selector:
            matchLabel:
              node-role.kubernetes.io/master: ""
-          allocatableMemory: 16Gi
+          memoryAllocatable: 16Gi
          cpuArchitecture: amd64
          cpuCapacity: "6"
        outcomes:
@@ -1,6 +1,6 @@
 module helm-template

-go 1.24.6
+go 1.26.3

 // Always use the local version of troubleshoot so as to build using
 // the latest version of the library. This will ensure the example
@@ -9,26 +9,25 @@ replace github.com/replicatedhq/troubleshoot v0.0.0 => ../../../

 require (
 	github.com/replicatedhq/troubleshoot v0.0.0
-	helm.sh/helm/v3 v3.19.0
+	helm.sh/helm/v3 v3.21.0
 	sigs.k8s.io/yaml v1.6.0
 )

 require (
 	dario.cat/mergo v1.0.2 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
-	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -46,28 +45,29 @@ require (
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.42.0 // indirect
-	golang.org/x/net v0.44.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sys v0.36.0 // indirect
-	golang.org/x/term v0.35.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/term v0.43.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.34.1 // indirect
-	k8s.io/apiextensions-apiserver v0.34.1 // indirect
-	k8s.io/apimachinery v0.34.1 // indirect
-	k8s.io/client-go v0.34.1 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
-	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
-	sigs.k8s.io/controller-runtime v0.22.1 // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	k8s.io/api v0.36.1 // indirect
+	k8s.io/apiextensions-apiserver v0.36.1 // indirect
+	k8s.io/apimachinery v0.36.1 // indirect
+	k8s.io/client-go v0.36.1 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
+	sigs.k8s.io/controller-runtime v0.24.1 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
 )
@@ -2,24 +2,24 @@ dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
-github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
-github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
-github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
@@ -36,8 +36,6 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
 github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -45,8 +43,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
@@ -55,8 +53,6 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -75,17 +71,17 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
-github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
-github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/onsi/ginkgo/v2 v2.27.4 h1:fcEcQW/A++6aZAZQNUmNjvA9PSOzefMJBerHJ4t8v8Y=
+github.com/onsi/ginkgo/v2 v2.27.4/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/gomega v1.39.0 h1:y2ROC3hKFmQZJNFeGAMeHZKkjBL65mIZcvrLQBF9k6Q=
+github.com/onsi/gomega v1.39.0/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
@@ -102,89 +98,66 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
-golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
-golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
-golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
+golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.19.0 h1:krVyCGa8fa/wzTZgqw0DUiXuRT5BPdeqE/sQXujQ22k=
-helm.sh/helm/v3 v3.19.0/go.mod h1:Lk/SfzN0w3a3C3o+TdAKrLwJ0wcZ//t1/SDXAvfgDdc=
-k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
-k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
-k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
-k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
-k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
-k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
-k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
-k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
-k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
-k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
-k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/controller-runtime v0.22.1 h1:Ah1T7I+0A7ize291nJZdS1CabF/lB4E++WizgV24Eqg=
-sigs.k8s.io/controller-runtime v0.22.1/go.mod h1:FwiwRjkRPbiN+zp2QRp7wlTCzbUXxZ/D4OzuQUDwBHY=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+helm.sh/helm/v3 v3.21.0 h1:9TRbaXQH+BIKLLDYlu++JsyWodS5kBBOLF7C7HY5+cs=
+helm.sh/helm/v3 v3.21.0/go.mod h1:5IvU6Ae6ruB/vasVHhnC1IU5RvqFM349vLYS1BiHqeY=
+k8s.io/api v0.36.1 h1:XbL/EMj8K2aJpJtePmqUyQMsM0D4QI2pvl7YKJ20FTY=
+k8s.io/api v0.36.1/go.mod h1:KOWo4ey3TINlXjeHVuwB3i+tXXnu+UcwFBHlI/9dvEo=
+k8s.io/apiextensions-apiserver v0.36.1 h1:6JfYmPUsuUIHuN+3QxutXYWj492RqF5fBSx67GYK5Ks=
+k8s.io/apiextensions-apiserver v0.36.1/go.mod h1:pLzZin90riwisdzKwv/GoTwENooytoIx5zWJb4Hkby8=
+k8s.io/apimachinery v0.36.1 h1:G63Gjx2W+q0YD+72Vo8oY0nDnePVwnuzTmmy5ENrVSA=
+k8s.io/apimachinery v0.36.1/go.mod h1:ibYOR00vW/I1kzvi5SF0dRuJ52BvKtfvRdOn35GPQ+8=
+k8s.io/client-go v0.36.1 h1:FN/K8QIT2CEDt+2WB2HnWrUANZ50AP5GII43/SP2JR0=
+k8s.io/client-go v0.36.1/go.mod h1:s6rAnCtTGYDQnpNjEhSaISV+2O8jwruZ6m3QOYBFbtU=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=
+sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
@@ -77,7 +77,7 @@ spec:
    - nodeResources:
        checkName: Must have 1 node with 2Gi (available) memory and at least 2 cores (on a single node)
        filters:
-          allocatableMemory: 2Gi
+          memoryAllocatable: 2Gi
          cpuCapacity: "2"
        outcomes:
          - pass:
@@ -0,0 +1,236 @@
+# v1beta3 Support Bundle Examples
+
+This directory contains example Support Bundle specs using the v1beta3 API, which introduces `StringOrValueFrom` support for securely referencing Kubernetes Secrets and ConfigMaps in collector fields.
+
+## Features
+
+### StringOrValueFrom Pattern
+
+The v1beta3 API introduces a Kubernetes-native pattern for referencing sensitive values:
+
+```yaml
+uri:
+  valueFrom:
+    secretKeyRef:
+      name: my-secret
+      key: connection-uri
+```
+
+or
+
+```yaml
+uri: "postgresql://localhost:5432/db"  # Literal value
+```
+
+### Supported Collectors
+
+Currently, v1beta3 supports `StringOrValueFrom` for:
+
+- **Database collectors**: `postgres`, `mysql`, `redis`, `mssql`
+  - `uri` field - Connection strings from secrets
+  - `tls` fields - CA cert, client cert, and client key from secrets
+
+## Examples
+
+### 1. postgres-with-secret.yaml
+Basic PostgreSQL collector with connection URI from a secret.
+
+**Use case**: Securely store database credentials without hardcoding them in the spec.
+
+```bash
+kubectl apply -f postgres-with-secret.yaml
+```
+
+### 2. postgres-with-tls.yaml
+PostgreSQL with TLS configuration from secrets.
+
+**Use case**: Secure database connections with mutual TLS, storing certificates in secrets.
+
+```bash
+kubectl apply -f postgres-with-tls.yaml
+```
+
+### 3. multiple-databases.yaml
+Multiple database collectors (PostgreSQL, MySQL, Redis, MSSQL) with various configurations.
+
+**Use case**: Collect diagnostics from multiple databases in your application stack.
+
+```bash
+kubectl apply -f multiple-databases.yaml
+```
+
+### 4. cross-namespace-secrets.yaml
+Accessing secrets from different namespaces.
+
+**Use case**: Centralized credential management in a shared namespace.
+
+```bash
+kubectl apply -f cross-namespace-secrets.yaml
+```
+
+**RBAC Requirements**: The support bundle service account needs `get` permission on secrets in the referenced namespaces.
+
+### 5. optional-secrets.yaml
+Using the `optional` field for graceful degradation.
+
+**Use case**: Collect diagnostics even when some credentials are unavailable (e.g., optional secondary databases).
+
+```bash
+kubectl apply -f optional-secrets.yaml
+```
+
+### 6. configmap-example.yaml
+Using ConfigMaps for non-sensitive configuration.
+
+**Use case**: Store non-sensitive connection strings (e.g., development databases) in ConfigMaps.
+
+```bash
+kubectl apply -f configmap-example.yaml
+```
+
+## Key Concepts
+
+### Secret vs ConfigMap
+
+- **Secrets**: Use for sensitive data (passwords, tokens, certificates)
+- **ConfigMaps**: Use for non-sensitive configuration (development endpoints, feature flags)
+
+### Optional Field
+
+```yaml
+uri:
+  valueFrom:
+    secretKeyRef:
+      name: my-secret
+      key: uri
+      optional: true  # Returns empty string if secret/key doesn't exist
+```
+
+- `optional: false` (default): Collection fails if secret is missing
+- `optional: true`: Returns empty string if secret/key is missing
+
+### Cross-Namespace Access
+
+```yaml
+uri:
+  valueFrom:
+    secretKeyRef:
+      name: shared-secret
+      key: uri
+      namespace: other-namespace  # Access secrets in different namespaces
+```
+
+If `namespace` is not specified, uses the support bundle's namespace.
+
+### Backward Compatibility
+
+v1beta3 maintains backward compatibility with v1beta2 TLS configuration:
+
+```yaml
+tls:
+  secret:  # v1beta2 style
+    name: tls-secret
+    namespace: default
+```
+
+## RBAC Configuration
+
+Support bundles need appropriate RBAC permissions to read secrets:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: troubleshoot-secret-reader
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["postgres-connection", "redis-creds"]  # Restrict to specific secrets
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: troubleshoot-secret-reader-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: troubleshoot-secret-reader
+subjects:
+- kind: ServiceAccount
+  name: troubleshoot
+  namespace: default
+```
+
+## Migration from v1beta2
+
+### Before (v1beta2):
+```yaml
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  collectors:
+    - postgres:
+        uri: "postgresql://user:password@host:5432/db"  # Hardcoded
+```
+
+### After (v1beta3):
+```yaml
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+spec:
+  collectors:
+    - postgres:
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-connection
+              key: connection-uri
+```
+
+## Limitations
+
+1. **No value composition**: Cannot combine multiple secrets into a single value
+   ```yaml
+   # NOT SUPPORTED
+   uri: "postgresql://$(USERNAME):$(PASSWORD)@host:5432/db"
+   ```
+   Store the complete connection string in a single secret key.
+
+2. **Collector scope**: Only database collectors support `StringOrValueFrom` initially
+   - Future versions will extend to HTTP, Data, and other collectors
+
+3. **No templating**: The entire field value comes from one source
+
+## Security Best Practices
+
+1. **Use resourceNames in RBAC**: Restrict access to specific secrets
+2. **Separate secrets**: Don't reuse secrets across applications
+3. **Rotate credentials**: Update secrets regularly
+4. **Audit access**: Monitor secret access logs
+5. **Redact output**: Ensure connection strings are redacted in bundle output
+
+## Troubleshooting
+
+### Error: "failed to get secret default/my-secret"
+
+- **Cause**: Secret doesn't exist or RBAC denied access
+- **Solution**: Verify secret exists: `kubectl get secret my-secret`
+- **Solution**: Check RBAC: `kubectl auth can-i get secret/my-secret`
+
+### Error: "key 'uri' not found in secret"
+
+- **Cause**: Secret exists but doesn't contain the specified key
+- **Solution**: Check secret keys: `kubectl get secret my-secret -o jsonpath='{.data}'`
+
+### Error: "cannot specify both 'value' and 'valueFrom'"
+
+- **Cause**: Both literal value and secret reference provided
+- **Solution**: Use only one: either `value: "string"` or `valueFrom: {...}`
+
+## Additional Resources
+
+- [Troubleshoot Documentation](https://troubleshoot.sh)
+- [v1beta3 API Reference](https://troubleshoot.sh/docs/v1beta3/)
+- [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/)
+- [RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
@@ -0,0 +1,57 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: configmap-example
+spec:
+  collectors:
+    # Database URI from ConfigMap (non-sensitive connection string)
+    - postgres:
+        collectorName: dev-database
+        uri:
+          valueFrom:
+            configMapKeyRef:
+              name: database-config
+              key: dev-connection-uri
+
+    # Redis URI from ConfigMap
+    - redis:
+        collectorName: dev-redis
+        uri:
+          valueFrom:
+            configMapKeyRef:
+              name: cache-config
+              key: redis-uri
+
+    # Mixed: URI from ConfigMap, password from Secret
+    # Note: This shows the limitation - you can't compose values from multiple sources
+    # The full connection string must be in one place
+    - mysql:
+        collectorName: staging-mysql
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: mysql-secret
+              key: complete-connection-string
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: database-config
+data:
+  dev-connection-uri: "postgresql://devuser@dev-postgres.default.svc:5432/devdb"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cache-config
+data:
+  redis-uri: "redis://dev-redis.default.svc:6379/0"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mysql-secret
+type: Opaque
+stringData:
+  # Complete connection string with password included
+  complete-connection-string: "mysql://staging:stagingpass@staging-mysql:3306/stagingdb"
@@ -0,0 +1,45 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: cross-namespace-example
+spec:
+  collectors:
+    # Database in one namespace, secret in another
+    - postgres:
+        collectorName: shared-database
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: shared-postgres-connection
+              key: uri
+              namespace: shared-services  # Secret is in a different namespace
+
+    # Redis accessing centralized credentials
+    - redis:
+        collectorName: shared-cache
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: shared-redis-creds
+              key: uri
+              namespace: platform-credentials
+---
+# This secret would be in the 'shared-services' namespace
+apiVersion: v1
+kind: Secret
+metadata:
+  name: shared-postgres-connection
+  namespace: shared-services
+type: Opaque
+stringData:
+  uri: "postgresql://shared:password@shared-postgres.shared-services.svc:5432/shared_db"
+---
+# This secret would be in the 'platform-credentials' namespace
+apiVersion: v1
+kind: Secret
+metadata:
+  name: shared-redis-creds
+  namespace: platform-credentials
+type: Opaque
+stringData:
+  uri: "redis://shared-redis.shared-services.svc:6379/0"
@@ -0,0 +1,78 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: multi-database-support-bundle
+spec:
+  collectors:
+    # PostgreSQL with secret reference
+    - postgres:
+        collectorName: primary-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-primary
+              key: connection-uri
+
+    # PostgreSQL replica with secret reference
+    - postgres:
+        collectorName: replica-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-replica
+              key: connection-uri
+
+    # Redis cache with secret reference
+    - redis:
+        collectorName: cache
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: redis-creds
+              key: uri
+
+    # MySQL with literal value (for development/testing)
+    - mysql:
+        collectorName: local-mysql
+        uri: "mysql://root:password@localhost:3306/testdb"
+
+    # MSSQL with secret reference
+    - mssql:
+        collectorName: legacy-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: mssql-connection
+              key: dsn
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-primary
+type: Opaque
+stringData:
+  connection-uri: "postgresql://app:secret123@postgres-primary.default.svc:5432/appdb"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-replica
+type: Opaque
+stringData:
+  connection-uri: "postgresql://app:secret123@postgres-replica.default.svc:5432/appdb"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: redis-creds
+type: Opaque
+stringData:
+  uri: "redis://:cachesecret@redis.default.svc:6379/0"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mssql-connection
+type: Opaque
+stringData:
+  dsn: "sqlserver://sa:Str0ngP@ssw0rd@mssql.default.svc:1433?database=legacy"
@@ -0,0 +1,58 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: optional-secrets-example
+spec:
+  collectors:
+    # Required database - collection will fail if secret doesn't exist
+    - postgres:
+        collectorName: required-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: required-postgres
+              key: uri
+              optional: false  # Default behavior - secret must exist
+
+    # Optional database - collection continues if secret doesn't exist
+    - postgres:
+        collectorName: optional-db
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: optional-postgres
+              key: uri
+              optional: true  # Gracefully degrades if secret is missing
+
+    # Mixed required and optional TLS
+    - postgres:
+        collectorName: partially-optional
+        uri: "postgresql://localhost:5432/db"
+        tls:
+          cacert:
+            valueFrom:
+              secretKeyRef:
+                name: tls-certs
+                key: ca.crt
+                optional: false  # CA cert is required
+          clientCert:
+            valueFrom:
+              secretKeyRef:
+                name: tls-certs
+                key: client.crt
+                optional: true  # Client cert is optional (cert-only TLS)
+          clientKey:
+            valueFrom:
+              secretKeyRef:
+                name: tls-certs
+                key: client.key
+                optional: true  # Client key is optional
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: required-postgres
+type: Opaque
+stringData:
+  uri: "postgresql://user:pass@required-postgres:5432/db"
+# Note: optional-postgres secret intentionally not created
@@ -0,0 +1,21 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: postgres-support-bundle
+spec:
+  collectors:
+    - postgres:
+        collectorName: main-database
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-connection
+              key: connection-uri
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-connection
+type: Opaque
+stringData:
+  connection-uri: "postgresql://myuser:mypassword@postgres.default.svc:5432/mydb?sslmode=require"
@@ -0,0 +1,47 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: postgres-tls-support-bundle
+spec:
+  collectors:
+    - postgres:
+        collectorName: secure-database
+        uri:
+          valueFrom:
+            secretKeyRef:
+              name: postgres-connection
+              key: connection-uri
+        tls:
+          cacert:
+            valueFrom:
+              secretKeyRef:
+                name: postgres-tls
+                key: ca.crt
+          clientCert:
+            valueFrom:
+              secretKeyRef:
+                name: postgres-tls
+                key: tls.crt
+          clientKey:
+            valueFrom:
+              secretKeyRef:
+                name: postgres-tls
+                key: tls.key
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-connection
+type: Opaque
+stringData:
+  connection-uri: "postgresql://myuser:mypassword@postgres.default.svc:5432/mydb?sslmode=verify-full"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-tls
+type: kubernetes.io/tls
+data:
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi4uLgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi4uLgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi4uLgotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
@@ -0,0 +1,33 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: helm-builtins-example
+  labels:
+    release: {{ .Release.Name }}
+spec:
+  analyzers:
+    - docString: |
+        Title: Example using Helm builtin objects
+        Requirement: Demonstrates .Values, .Release, .Chart, etc.
+
+        Supported Helm builtin objects:
+        - .Values.* - User-provided values
+        - .Release.Name - Release name (default: "preflight")
+        - .Release.Namespace - Release namespace (default: "default")
+        - .Release.IsInstall - Whether this is an install (true)
+        - .Release.IsUpgrade - Whether this is an upgrade (false)
+        - .Release.Revision - Release revision (1)
+        - .Chart.Name - Chart name
+        - .Chart.Version - Chart version
+        - .Capabilities.KubeVersion - Kubernetes version capabilities
+      clusterVersion:
+        checkName: Kubernetes version check in {{ .Release.Namespace }}
+        outcomes:
+          - fail:
+              when: '< {{ .Values.minVersion | default "1.19.0" }}'
+              message: |
+                Release {{ .Release.Name }} requires Kubernetes {{ .Values.minVersion | default "1.19.0" }} or later.
+                Chart: {{ .Chart.Name }}
+          - pass:
+              when: '>= {{ .Values.minVersion | default "1.19.0" }}'
+              message: Kubernetes version is supported for release {{ .Release.Name }}
@@ -0,0 +1,19 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: invalid-collectors
+spec:
+  collectors:
+    # Unknown collector type
+    - notACollector: {}
+    # Known collector but missing required fields (e.g., ceph requires namespace)
+    - ceph: {}
+  # Field exists but wrong type (should be a list)
+  hostCollectors: "not-a-list"
+  analyzers:
+    # Unknown analyzer type
+    - notAnAnalyzer: {}
+    # Known analyzer missing required 'outcomes'
+    - cephStatus:
+        namespace: default
+
@@ -0,0 +1,8 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata
+  name: invalid-yaml
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
@@ -0,0 +1,11 @@
+kind: Preflight
+metadata:
+  name: missing-apiversion
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported
@@ -0,0 +1,10 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported
@@ -0,0 +1,7 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: no-analyzers
+spec:
+  collectors:
+    - clusterInfo: {}
@@ -0,0 +1,18 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: simple-no-template
+spec:
+  analyzers:
+    - docString: |
+        Title: Kubernetes Version Check
+        Requirement: Kubernetes 1.19.0 or later
+      clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - fail:
+              when: '< 1.19.0'
+              message: Kubernetes version must be at least 1.19.0
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported
@@ -0,0 +1,12 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: no-collectors
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported
@@ -0,0 +1,15 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: SupportBundle
+metadata:
+  name: valid-support-bundle
+spec:
+  collectors:
+    - clusterInfo: {}
+    - clusterResources: {}
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported
@@ -0,0 +1,15 @@
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: valid-preflight
+spec:
+  analyzers:
+    - docString: |
+        Title: Test Analyzer
+        Requirement: Test requirement
+      clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported
@@ -0,0 +1,2 @@
+# Empty values file for v1beta3 specs without templates
+{}
@@ -0,0 +1 @@
+minVersion: "1.19.0"
@@ -0,0 +1,12 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: Preflight
+metadata:
+  name: wrong-version
+spec:
+  analyzers:
+    - clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - pass:
+              when: '>= 1.19.0'
+              message: Kubernetes version is supported
@@ -1,209 +1,195 @@
 module github.com/replicatedhq/troubleshoot

-go 1.24.6
+go 1.26.4

 require (
+	github.com/ClickHouse/clickhouse-go/v2 v2.46.0
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/ahmetalpbalkan/go-cursor v0.0.0-20131010032410-8136607ea412
-	github.com/apparentlymart/go-cidr v1.1.0
+	github.com/apparentlymart/go-cidr v1.1.1
+	github.com/aws/aws-sdk-go-v2 v1.41.11
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.21
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.103.1
 	github.com/blang/semver/v4 v4.0.0
 	github.com/casbin/govaluate v1.10.0
-	github.com/cilium/ebpf v0.19.0
-	github.com/containerd/cgroups/v3 v3.0.5
-	github.com/containers/image/v5 v5.36.2
-	github.com/distribution/distribution/v3 v3.0.0
-	github.com/fatih/color v1.18.0
+	github.com/cilium/ebpf v0.21.0
+	github.com/containerd/cgroups/v3 v3.1.3
+	github.com/fatih/color v1.19.0
 	github.com/go-logr/logr v1.4.3
 	github.com/go-redis/redis/v7 v7.4.1
-	github.com/go-sql-driver/mysql v1.9.3
+	github.com/go-sql-driver/mysql v1.10.0
 	github.com/gobwas/glob v0.2.3
-	github.com/godbus/dbus/v5 v5.1.0
+	github.com/godbus/dbus/v5 v5.2.2
+	github.com/google/go-containerregistry v0.21.6
 	github.com/google/gofuzz v1.2.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/handlers v1.5.2
-	github.com/hashicorp/go-getter v1.8.2
+	github.com/hashicorp/go-getter v1.8.6
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/jackc/pgx/v5 v5.7.6
+	github.com/jackc/pgx/v5 v5.10.0
 	github.com/longhorn/go-iscsi-helper v0.0.0-20210330030558-49a327fb024e
 	github.com/manifoldco/promptui v0.9.0
-	github.com/mattn/go-isatty v0.0.20
-	github.com/microsoft/go-mssqldb v1.9.3
-	github.com/miekg/dns v1.1.68
+	github.com/mattn/go-isatty v0.0.22
+	github.com/microsoft/go-mssqldb v1.10.0
+	github.com/miekg/dns v1.1.72
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/pkg/errors v0.9.1
 	github.com/replicatedhq/termui/v3 v3.1.1-0.20200811145416-f40076d26851
 	github.com/segmentio/ksuid v1.0.4
-	github.com/shirou/gopsutil/v4 v4.25.9
-	github.com/spf13/cobra v1.10.1
+	github.com/shirou/gopsutil/v4 v4.26.5
+	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
 	github.com/tj/go-spin v1.1.0
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
-	github.com/vmware-tanzu/velero v1.17.0
-	go.opentelemetry.io/otel v1.38.0
-	go.opentelemetry.io/otel/sdk v1.38.0
-	golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67
-	golang.org/x/mod v0.28.0
-	golang.org/x/sync v0.17.0
+	github.com/vmware-tanzu/velero v1.18.1
+	go.opentelemetry.io/otel v1.44.0
+	go.opentelemetry.io/otel/sdk v1.44.0
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
+	golang.org/x/mod v0.36.0
+	golang.org/x/sync v0.20.0
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.34.1
-	k8s.io/apiextensions-apiserver v0.34.1
-	k8s.io/apimachinery v0.34.1
-	k8s.io/apiserver v0.34.1
-	k8s.io/cli-runtime v0.34.1
-	k8s.io/client-go v0.34.1
-	k8s.io/klog/v2 v2.130.1
-	k8s.io/kubernetes v1.34.1
-	oras.land/oras-go v1.2.6
-	sigs.k8s.io/controller-runtime v0.22.2
-	sigs.k8s.io/e2e-framework v0.6.0
+	k8s.io/api v0.36.1
+	k8s.io/apiextensions-apiserver v0.36.1
+	k8s.io/apimachinery v0.36.1
+	k8s.io/apiserver v0.36.1
+	k8s.io/cli-runtime v0.36.1
+	k8s.io/client-go v0.36.1
+	k8s.io/klog/v2 v2.140.0
+	k8s.io/streaming v0.36.1
+	oras.land/oras-go/v2 v2.6.0
+	sigs.k8s.io/controller-runtime v0.24.1
+	sigs.k8s.io/e2e-framework v0.7.0
 )

 require (
-	cel.dev/expr v0.24.0 // indirect
-	cloud.google.com/go/auth v0.16.2 // indirect
+	cel.dev/expr v0.25.1 // indirect
+	cloud.google.com/go/auth v0.20.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.7.0 // indirect
-	cloud.google.com/go/monitoring v1.24.2 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	cloud.google.com/go/monitoring v1.24.3 // indirect
 	dario.cat/mergo v1.0.2 // indirect
-	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
+	filippo.io/edwards25519 v1.2.0 // indirect
+	github.com/ClickHouse/ch-go v0.71.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
+	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.29.15 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.68 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.80.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.20 // indirect
-	github.com/aws/smithy-go v1.22.3 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.12 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.27 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.27 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.27 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.28 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.20 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.27 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.27 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.1.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.31.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.43.1 // indirect
+	github.com/aws/smithy-go v1.27.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
-	github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f // indirect
+	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/containerd/typeurl/v2 v2.2.3 // indirect
-	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/ebitengine/purego v0.9.0 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/distribution/distribution/v3 v3.1.1 // indirect
+	github.com/docker/cli v29.4.3+incompatible // indirect
+	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-faster/city v1.0.1 // indirect
+	github.com/go-faster/errors v0.7.1 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/go-containerregistry v0.20.3 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.15 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.65 // indirect
+	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
-	github.com/lib/pq v1.10.9 // indirect
+	github.com/lib/pq v1.11.2 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
-	github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
+	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/sys/capability v0.4.0 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
-	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/paulmach/orb v0.12.0 // indirect
+	github.com/pierrec/lz4/v4 v4.1.25 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/rubenv/sql-migrate v1.8.0 // indirect
+	github.com/rubenv/sql-migrate v1.8.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/segmentio/asm v1.2.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/sylabs/sif/v2 v2.21.1 // indirect
-	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
-	github.com/vladimirvivien/gexe v0.4.1 // indirect
+	github.com/vladimirvivien/gexe v0.5.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/zeebo/errs v1.4.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/tools v0.36.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
-	k8s.io/component-base v0.34.1 // indirect
-	k8s.io/kubectl v0.34.0 // indirect
-	oras.land/oras-go/v2 v2.6.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gotest.tools/v3 v3.5.2 // indirect
+	k8s.io/component-base v0.36.1 // indirect
+	k8s.io/kubectl v0.36.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
 )

 require (
-	cloud.google.com/go v0.121.1 // indirect
-	cloud.google.com/go/iam v1.5.2 // indirect
-	cloud.google.com/go/storage v1.55.0 // indirect
+	cloud.google.com/go v0.123.0 // indirect
+	cloud.google.com/go/iam v1.5.3 // indirect
+	cloud.google.com/go/storage v1.61.3 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/Microsoft/hcsshim v0.13.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/c9s/goprocinfo v0.0.0-20170724085704-0010a05ce49f // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/containerd/containerd v1.7.28 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
-	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
-	github.com/containers/ocicrypt v1.2.1 // indirect
-	github.com/containers/storage v1.59.1 // indirect
-	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/containerd/containerd v1.7.32 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v28.3.2+incompatible // indirect
-	github.com/docker/docker v28.3.3+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
-	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
+	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
@@ -212,31 +198,22 @@ require (
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/go-intervals v0.0.2 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.2 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
+	github.com/googleapis/gax-go/v2 v2.22.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-version v1.7.0
+	github.com/hashicorp/go-version v1.9.0
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/pgzip v1.2.6 // indirect
+	github.com/klauspost/compress v1.18.6 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1
-	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/spdystream v0.5.0 // indirect
-	github.com/moby/sys/mountinfo v0.7.2 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
@@ -244,47 +221,44 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nsf/termbox-go v0.0.0-20190121233118-02980233997d // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/runtime-spec v1.2.1
-	github.com/opencontainers/selinux v1.12.0 // indirect
+	github.com/opencontainers/runtime-spec v1.3.0
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
-	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.65.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tklauser/go-sysconf v0.3.15 // indirect
-	github.com/tklauser/numcpus v0.10.0 // indirect
-	github.com/vbatts/tar-split v0.12.1 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/crypto v0.42.0 // indirect
-	golang.org/x/net v0.44.0
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sys v0.36.0
-	golang.org/x/term v0.35.0 // indirect
-	golang.org/x/text v0.29.0
-	golang.org/x/time v0.12.0 // indirect
-	google.golang.org/api v0.241.0 // indirect
-	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
-	google.golang.org/grpc v1.73.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.55.0
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sys v0.45.0
+	golang.org/x/term v0.43.0 // indirect
+	golang.org/x/text v0.37.0
+	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/api v0.277.0 // indirect
+	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
+	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	helm.sh/helm/v3 v3.19.0
-	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
-	k8s.io/kubelet v0.34.1
-	k8s.io/metrics v0.34.1
-	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
+	helm.sh/helm/v3 v3.21.0
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
+	k8s.io/kubelet v0.36.1
+	k8s.io/metrics v0.36.1
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
 	periph.io/x/host/v3 v3.8.5
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
-	sigs.k8s.io/kustomize/api v0.20.1 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/kustomize/api v0.21.1 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
 	sigs.k8s.io/yaml v1.6.0
 )

@@ -191,7 +191,9 @@ func LoadFromCLIArgs(ctx context.Context, client kubernetes.Interface, args []st

 				// load URL spec first to remove URI key from the spec
 				urlSpec, err := loader.LoadSpecs(ctx, loader.LoadOptions{
-					RawSpec: rawURLSpec,
+					RawSpec:   rawURLSpec,
+					Client:    client,
+					Namespace: vp.GetString("namespace"),
 				})
 				if err != nil {
 					fmt.Println(color.YellowString("failed to load spec from URI %q: %v\n", v, err))
@@ -209,7 +211,9 @@ func LoadFromCLIArgs(ctx context.Context, client kubernetes.Interface, args []st
 	}

 	kinds, err := loader.LoadSpecs(ctx, loader.LoadOptions{
-		RawSpecs: rawSpecs,
+		RawSpecs:  rawSpecs,
+		Client:    client,
+		Namespace: vp.GetString("namespace"),
 	})
 	if err != nil {
 		return nil, err
@@ -363,7 +367,9 @@ func LoadFromCluster(ctx context.Context, client kubernetes.Interface, selectors

 	// Load troubleshoot specs from the raw specs
 	return loader.LoadSpecs(ctx, loader.LoadOptions{
-		RawSpecs: rawSpecs,
+		RawSpecs:  rawSpecs,
+		Client:    client,
+		Namespace: ns,
 	})
 }

@@ -194,6 +194,8 @@ func GetAnalyzer(analyzer *troubleshootv1beta2.Analyze) Analyzer {
 		return &AnalyzeClusterVersion{analyzer: analyzer.ClusterVersion}
 	case analyzer.StorageClass != nil:
 		return &AnalyzeStorageClass{analyzer: analyzer.StorageClass}
+	case analyzer.IngressClass != nil:
+		return &AnalyzeIngressClass{analyzer: analyzer.IngressClass}
 	case analyzer.CustomResourceDefinition != nil:
 		return &AnalyzeCustomResourceDefinition{analyzer: analyzer.CustomResourceDefinition}
 	case analyzer.Ingress != nil:
@@ -236,6 +238,8 @@ func GetAnalyzer(analyzer *troubleshootv1beta2.Analyze) Analyzer {
 		return &AnalyzeMssql{analyzer: analyzer.Mssql}
 	case analyzer.Redis != nil:
 		return &AnalyzeRedis{analyzer: analyzer.Redis}
+	case analyzer.ClickHouse != nil:
+		return &AnalyzeClickhouse{analyzer: analyzer.ClickHouse}
 	case analyzer.CephStatus != nil:
 		return &AnalyzeCephStatus{analyzer: analyzer.CephStatus}
 	case analyzer.Velero != nil:
@@ -260,6 +264,8 @@ func GetAnalyzer(analyzer *troubleshootv1beta2.Analyze) Analyzer {
 		return &AnalyzeNodeMetrics{analyzer: analyzer.NodeMetrics}
 	case analyzer.HTTP != nil:
 		return &AnalyzeHTTPAnalyze{analyzer: analyzer.HTTP}
+	case analyzer.S3Status != nil:
+		return &AnalyzeS3Status{analyzer: analyzer.S3Status}
 	default:
 		return nil
 	}
@@ -0,0 +1,193 @@
+package analyzer
+
+import (
+	"encoding/json"
+	"fmt"
+	"path"
+	"strconv"
+	"strings"
+
+	"github.com/hashicorp/go-version"
+	"github.com/pkg/errors"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+)
+
+type AnalyzeClickhouse struct {
+	analyzer *troubleshootv1beta2.DatabaseAnalyze
+}
+
+func (a *AnalyzeClickhouse) Title() string {
+	title := a.analyzer.CheckName
+	if title == "" {
+		title = a.collectorName()
+	}
+
+	return title
+}
+
+func (a *AnalyzeClickhouse) IsExcluded() (bool, error) {
+	return isExcluded(a.analyzer.Exclude)
+}
+
+func (a *AnalyzeClickhouse) Analyze(getFile getCollectedFileContents, findFiles getChildCollectedFileContents) ([]*AnalyzeResult, error) {
+	result, err := a.analyze(a.analyzer, getFile)
+	if err != nil {
+		return nil, err
+	}
+	result.Strict = a.analyzer.Strict.BoolOrDefaultFalse()
+	return []*AnalyzeResult{result}, nil
+}
+
+func (a *AnalyzeClickhouse) collectorName() string {
+	if a.analyzer.CollectorName != "" {
+		return a.analyzer.CollectorName
+	}
+	return "clickhouse"
+}
+
+func compareClickhouseConditionalToActual(conditional string, result *collect.DatabaseConnection) (bool, error) {
+	parts := strings.Split(strings.TrimSpace(conditional), " ")
+
+	if len(parts) != 3 {
+		return false, errors.New("unable to parse conditional")
+	}
+
+	switch parts[0] {
+	case "connected":
+		expected, err := strconv.ParseBool(parts[2])
+		if err != nil {
+			return false, errors.Wrap(err, "failed to parse bool")
+		}
+
+		switch parts[1] {
+		case "=", "==", "===":
+			return expected == result.IsConnected, nil
+		case "!=", "!==":
+			return expected != result.IsConnected, nil
+		}
+
+		return false, errors.New("unable to parse ClickHouse connected analyzer")
+
+	case "version":
+		expected, err := version.NewVersion(strings.ReplaceAll(parts[2], "x", "0"))
+		if err != nil {
+			return false, errors.Wrap(err, "failed to parse expected version")
+		}
+
+		operation := parts[1]
+		switch operation {
+		case "=", "==", "===":
+			operation = "="
+		case "!=", "!==":
+			operation = "!="
+		}
+
+		actual, err := version.NewVersion(strings.ReplaceAll(result.Version, "x", "0"))
+		if err != nil {
+			return false, errors.Wrap(err, "failed to parse ClickHouse db actual version")
+		}
+
+		constraints, err := version.NewConstraint(fmt.Sprintf("%s %s", operation, expected))
+		if err != nil {
+			return false, errors.Wrap(err, "failed to create constraint")
+		}
+		return constraints.Check(actual), nil
+	}
+
+	return false, nil
+}
+
+func (a *AnalyzeClickhouse) analyze(analyzer *troubleshootv1beta2.DatabaseAnalyze, getCollectedFileContents func(string) ([]byte, error)) (*AnalyzeResult, error) {
+	fullPath := path.Join("", fmt.Sprintf("clickhouse/%s.json", a.collectorName()))
+
+	collected, err := getCollectedFileContents(fullPath)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to read collected file name: %s", fullPath)
+	}
+
+	databaseConnection := collect.DatabaseConnection{}
+	if err := json.Unmarshal(collected, &databaseConnection); err != nil {
+		return nil, errors.Wrap(err, "failed to unmarshal database connection result")
+	}
+
+	result := &AnalyzeResult{
+		Title:   a.Title(),
+		IconKey: "kubernetes_clickhouse_analyze",
+		IconURI: "https://troubleshoot.sh/images/analyzer-icons/clickhouse-analyze.svg",
+	}
+
+	for _, outcome := range analyzer.Outcomes {
+		if outcome.Fail != nil {
+			if outcome.Fail.When == "" {
+				result.IsFail = true
+				result.Message = outcome.Fail.Message
+				result.URI = outcome.Fail.URI
+
+				return result, nil
+			}
+
+			isMatch, err := compareClickhouseConditionalToActual(outcome.Fail.When, &databaseConnection)
+			if err != nil {
+				return result, errors.Wrap(err, "failed to compare ClickHouse database conditional")
+			}
+
+			if isMatch {
+				if databaseConnection.Error != "" {
+					result.Message = outcome.Fail.Message + " " + databaseConnection.Error
+				} else {
+					result.Message = outcome.Fail.Message
+				}
+
+				result.IsFail = true
+				result.URI = outcome.Fail.URI
+
+				return result, nil
+			}
+		} else if outcome.Warn != nil {
+			if outcome.Warn.When == "" {
+				result.IsWarn = true
+				result.Message = outcome.Warn.Message
+				result.URI = outcome.Warn.URI
+
+				return result, nil
+			}
+
+			isMatch, err := compareClickhouseConditionalToActual(outcome.Warn.When, &databaseConnection)
+			if err != nil {
+				return result, errors.Wrap(err, "failed to compare ClickHouse database conditional")
+			}
+
+			if isMatch {
+				result.IsWarn = true
+				result.Message = outcome.Warn.Message
+				result.URI = outcome.Warn.URI
+
+				return result, nil
+			}
+		} else if outcome.Pass != nil {
+			if outcome.Pass.When == "" {
+				result.IsPass = true
+				result.Message = outcome.Pass.Message
+				result.URI = outcome.Pass.URI
+
+				return result, nil
+			}
+
+			isMatch, err := compareClickhouseConditionalToActual(outcome.Pass.When, &databaseConnection)
+			if err != nil {
+				return result, errors.Wrap(err, "failed to compare ClickHouse database conditional")
+			}
+
+			if isMatch {
+				result.IsPass = true
+				result.Message = outcome.Pass.Message
+				result.URI = outcome.Pass.URI
+
+				return result, nil
+			}
+		}
+	}
+
+	return result, nil
+}
@@ -699,6 +699,10 @@ func (e *DefaultAnalysisEngine) convertAnalyzerToSpec(analyzer *troubleshootv1be
 		spec.Name = "redis"
 		spec.Type = "database"
 		spec.Config["analyzer"] = analyzer.Redis
+	case analyzer.ClickHouse != nil:
+		spec.Name = "clickhouse"
+		spec.Type = "database"
+		spec.Config["analyzer"] = analyzer.ClickHouse

 	// ✅ Storage analyzers
 	case analyzer.CephStatus != nil:
@@ -67,6 +67,8 @@ func GetHostAnalyzer(analyzer *troubleshootv1beta2.HostAnalyze) (HostAnalyzer, b
 		return &AnalyzeHostNetworkNamespaceConnectivity{analyzer.NetworkNamespaceConnectivity}, true
 	case analyzer.Sysctl != nil:
 		return &AnalyzeHostSysctl{analyzer.Sysctl}, true
+	case analyzer.RegistryImages != nil:
+		return &AnalyzeHostRegistryImages{analyzer.RegistryImages}, true
 	default:
 		return nil, false
 	}
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"

@@ -16,6 +17,25 @@ type AnalyzeHostBlockDevices struct {
 	hostAnalyzer *troubleshootv1beta2.BlockDevicesAnalyze
 }

+// blockDevicesMatchConfig carries analyzer settings for counting devices toward a blockDevices when-clause
+// ("<name-regex> <op> <count>" against host block_devices.json). A device is eligible when its name matches
+// the regex; its type is "disk", or "part" if includeUnmountedPartitions, or listed in additionalDeviceTypes;
+// size >= minimumAcceptableSize when that is non-zero; it has no mountpoint or filesystem; it is not
+// read-only or removable; and no other row has ParentKernelName equal to its KernelName.
+type blockDevicesMatchConfig struct {
+	minimumAcceptableSize      uint64
+	includeUnmountedPartitions bool
+	additionalDeviceTypes      []string
+}
+
+func matchConfigFromAnalyzer(a *troubleshootv1beta2.BlockDevicesAnalyze) blockDevicesMatchConfig {
+	return blockDevicesMatchConfig{
+		minimumAcceptableSize:      a.MinimumAcceptableSize,
+		includeUnmountedPartitions: a.IncludeUnmountedPartitions,
+		additionalDeviceTypes:      a.AdditionalDeviceTypes,
+	}
+}
+
 func (a *AnalyzeHostBlockDevices) Title() string {
 	return hostAnalyzerTitleOrDefault(a.hostAnalyzer.AnalyzeMeta, "Block Devices")
 }
@@ -49,7 +69,7 @@ func (a *AnalyzeHostBlockDevices) Analyze(

 // <regexp> <op> <count>
 // example: sdb > 0
-func compareHostBlockDevicesConditionalToActual(conditional string, minimumAcceptableSize uint64, includeUnmountedPartitions bool, devices []collect.BlockDeviceInfo) (res bool, err error) {
+func compareHostBlockDevicesConditionalToActual(conditional string, cfg blockDevicesMatchConfig, devices []collect.BlockDeviceInfo) (res bool, err error) {
 	parts := strings.Split(conditional, " ")
 	if len(parts) != 3 {
 		return false, fmt.Errorf("Expected exactly 3 parts, got %d", len(parts))
@@ -59,7 +79,7 @@ func compareHostBlockDevicesConditionalToActual(conditional string, minimumAccep
 	if err != nil {
 		return false, errors.Wrapf(err, "failed to compile regex %q", parts[0])
 	}
-	count := countEligibleBlockDevices(rx, minimumAcceptableSize, includeUnmountedPartitions, devices)
+	count := countEligibleBlockDevices(rx, cfg, devices)

 	desiredInt, err := strconv.Atoi(parts[2])
 	if err != nil {
@@ -82,11 +102,11 @@ func compareHostBlockDevicesConditionalToActual(conditional string, minimumAccep
 	return false, fmt.Errorf("Unexpected operator %q", parts[1])
 }

-func countEligibleBlockDevices(rx *regexp.Regexp, minimumAcceptableSize uint64, includeUnmountedPartitions bool, devices []collect.BlockDeviceInfo) int {
+func countEligibleBlockDevices(rx *regexp.Regexp, cfg blockDevicesMatchConfig, devices []collect.BlockDeviceInfo) int {
 	count := 0

 	for _, device := range devices {
-		if isEligibleBlockDevice(rx, minimumAcceptableSize, includeUnmountedPartitions, device, devices) {
+		if isEligibleBlockDevice(rx, cfg, device, devices) {
 			count++
 		}
 	}
@@ -94,23 +114,27 @@ func countEligibleBlockDevices(rx *regexp.Regexp, minimumAcceptableSize uint64,
 	return count
 }

-func isEligibleBlockDevice(rx *regexp.Regexp, minimumAcceptableSize uint64, includeUnmountedPartitions bool, device collect.BlockDeviceInfo, devices []collect.BlockDeviceInfo) bool {
+func isEligibleDeviceType(deviceType string, cfg blockDevicesMatchConfig) bool {
+	if deviceType == "disk" {
+		return true
+	}
+	if cfg.includeUnmountedPartitions && deviceType == "part" {
+		return true
+	}
+	return slices.Contains(cfg.additionalDeviceTypes, deviceType)
+}
+
+func isEligibleBlockDevice(rx *regexp.Regexp, cfg blockDevicesMatchConfig, device collect.BlockDeviceInfo, devices []collect.BlockDeviceInfo) bool {
 	if !rx.MatchString(device.Name) {
 		return false
 	}

-	if includeUnmountedPartitions {
-		if device.Type != "disk" && device.Type != "part" {
-			return false
-		}
-	} else {
-		if device.Type != "disk" {
-			return false
-		}
+	if !isEligibleDeviceType(device.Type, cfg) {
+		return false
 	}

-	if minimumAcceptableSize != 0 {
-		if device.Size < minimumAcceptableSize {
+	if cfg.minimumAcceptableSize != 0 {
+		if device.Size < cfg.minimumAcceptableSize {
 			return false
 		}
 	}
@@ -141,12 +165,10 @@ func isEligibleBlockDevice(rx *regexp.Regexp, minimumAcceptableSize uint64, incl
 }

 func (a *AnalyzeHostBlockDevices) CheckCondition(when string, data []byte) (bool, error) {
-
 	var devices []collect.BlockDeviceInfo
 	if err := json.Unmarshal(data, &devices); err != nil {
 		return false, errors.Wrap(err, "failed to unmarshal block devices info")
 	}

-	return compareHostBlockDevicesConditionalToActual(when, a.hostAnalyzer.MinimumAcceptableSize, a.hostAnalyzer.IncludeUnmountedPartitions, devices)
-
+	return compareHostBlockDevicesConditionalToActual(when, matchConfigFromAnalyzer(a.hostAnalyzer), devices)
 }
@@ -0,0 +1,102 @@
+package analyzer
+
+import (
+	"testing"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestHostBlockDevices_deviceTypeEligibility documents type rules in isolation (see blockDevicesMatchConfig in host_block_devices.go).
+func TestHostBlockDevices_deviceTypeEligibility(t *testing.T) {
+	tests := []struct {
+		name    string
+		cfg     blockDevicesMatchConfig
+		devType string
+		want    bool
+	}{
+		{name: "disk always", cfg: blockDevicesMatchConfig{}, devType: "disk", want: true},
+		{name: "part without flag", cfg: blockDevicesMatchConfig{}, devType: "part", want: false},
+		{name: "part with flag", cfg: blockDevicesMatchConfig{includeUnmountedPartitions: true}, devType: "part", want: true},
+		{name: "loop without additional", cfg: blockDevicesMatchConfig{}, devType: "loop", want: false},
+		{name: "loop with additional", cfg: blockDevicesMatchConfig{additionalDeviceTypes: []string{"loop"}}, devType: "loop", want: true},
+		{name: "lvm with additional", cfg: blockDevicesMatchConfig{additionalDeviceTypes: []string{"lvm"}}, devType: "lvm", want: true},
+		{name: "crypt with additional", cfg: blockDevicesMatchConfig{additionalDeviceTypes: []string{"crypt"}}, devType: "crypt", want: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := isEligibleDeviceType(tt.devType, tt.cfg)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+// TestHostBlockDevices_additionalDeviceTypes covers end-to-end analyze behavior for AdditionalDeviceTypes and representative preflights.
+func TestHostBlockDevices_additionalDeviceTypes(t *testing.T) {
+	const rawStoragePass = "At least one raw block device is available for storage."
+	const rawStorageFail = "No raw block devices found. At least one unformatted, unmounted disk is required for storage. Attach a raw disk and ensure it has no filesystem or mount point."
+
+	rawStorageOutcomes := []*troubleshootv1beta2.Outcome{
+		{Fail: &troubleshootv1beta2.SingleOutcome{When: ".* == 0", Message: rawStorageFail}},
+		{Pass: &troubleshootv1beta2.SingleOutcome{When: ".* >= 1", Message: rawStoragePass}},
+	}
+
+	tests := []struct {
+		name         string
+		devices      []collect.BlockDeviceInfo
+		hostAnalyzer *troubleshootv1beta2.BlockDevicesAnalyze
+		want         []*AnalyzeResult
+	}{
+		{
+			name: "preflight-style 10GiB loop0 with includeUnmountedPartitions + additionalDeviceTypes loop",
+			devices: []collect.BlockDeviceInfo{{
+				Name: "loop0", KernelName: "loop0", Type: "loop", Major: 7, Minor: 0,
+				Size: 10737418240, ReadOnly: false, Removable: false,
+			}},
+			hostAnalyzer: &troubleshootv1beta2.BlockDevicesAnalyze{
+				IncludeUnmountedPartitions: true,
+				MinimumAcceptableSize:      10737418240,
+				AdditionalDeviceTypes:      []string{"loop"},
+				Outcomes:                   rawStorageOutcomes,
+			},
+			want: []*AnalyzeResult{{Title: "Block Devices", IsPass: true, Message: rawStoragePass}},
+		},
+		{
+			name: "preflight-style 10GiB LVM with includeUnmountedPartitions + additionalDeviceTypes lvm",
+			devices: []collect.BlockDeviceInfo{{
+				Name: "ceph--vg-lv--osd0", KernelName: "dm-0", Type: "lvm", Major: 252, Minor: 0,
+				Size: 10737418240, ReadOnly: false, Removable: false,
+			}},
+			hostAnalyzer: &troubleshootv1beta2.BlockDevicesAnalyze{
+				IncludeUnmountedPartitions: true,
+				MinimumAcceptableSize:      10737418240,
+				AdditionalDeviceTypes:      []string{"lvm"},
+				Outcomes:                   rawStorageOutcomes,
+			},
+			want: []*AnalyzeResult{{Title: "Block Devices", IsPass: true, Message: rawStoragePass}},
+		},
+		{
+			name: "loop counts with only additionalDeviceTypes (includeUnmountedPartitions false)",
+			devices: []collect.BlockDeviceInfo{{
+				Name: "loop0", KernelName: "loop0", Type: "loop", Major: 7,
+			}},
+			hostAnalyzer: &troubleshootv1beta2.BlockDevicesAnalyze{
+				AdditionalDeviceTypes: []string{"loop"},
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{Pass: &troubleshootv1beta2.SingleOutcome{When: ".* > 0", Message: "Block device available"}},
+					{Fail: &troubleshootv1beta2.SingleOutcome{Message: "No block device available"}},
+				},
+			},
+			want: []*AnalyzeResult{{Title: "Block Devices", IsPass: true, Message: "Block device available"}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := analyzeHostBlockDevicesOutput(t, tt.devices, tt.hostAnalyzer)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
@@ -256,23 +256,22 @@ func TestAnalyzeBlockDevices(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			req := require.New(t)
-			b, err := json.Marshal(test.devices)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			getCollectedFileContents := func(filename string) ([]byte, error) {
-				return b, nil
-			}
-
-			result, err := (&AnalyzeHostBlockDevices{test.hostAnalyzer}).Analyze(getCollectedFileContents, nil)
+			result, err := analyzeHostBlockDevicesOutput(t, test.devices, test.hostAnalyzer)
 			if test.expectErr {
 				req.Error(err)
 			} else {
 				req.NoError(err)
 			}
-
 			assert.Equal(t, test.result, result)
 		})
 	}
 }
+
+// analyzeHostBlockDevicesOutput runs the host block device analyzer on marshaled fixture data (shared by match tests).
+func analyzeHostBlockDevicesOutput(t *testing.T, devices []collect.BlockDeviceInfo, hostAnalyzer *troubleshootv1beta2.BlockDevicesAnalyze) ([]*AnalyzeResult, error) {
+	t.Helper()
+	b, err := json.Marshal(devices)
+	require.NoError(t, err)
+	getCollectedFileContents := func(string) ([]byte, error) { return b, nil }
+	return (&AnalyzeHostBlockDevices{hostAnalyzer}).Analyze(getCollectedFileContents, nil)
+}
@@ -0,0 +1,199 @@
+package analyzer
+
+import (
+	"encoding/json"
+	"fmt"
+	"slices"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/internal/util"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"k8s.io/klog/v2"
+)
+
+// RegistryImagesSummary is passed as template data when rendering outcome messages.
+// Fields are exported so Go templates can reference them.
+//
+//   - Verified: images confirmed to exist in the registry.
+//   - Missing: images confirmed not to exist in the registry.
+//   - Errors: images that could not be checked (parse failures, timeouts, auth errors, etc).
+//   - UnverifiedReasons: map of image name to reason string for every unverified image
+//     (union of Missing and Errors).
+//
+// The `when` conditions follow the existing registry images analyzer nomenclature:
+// "verified", "missing", and "errors" (see https://troubleshoot.sh/docs/analyze/registry-images).
+type RegistryImagesSummary struct {
+	Verified          []string
+	Missing           []string
+	Errors            []string
+	UnverifiedReasons map[string]string
+}
+
+type AnalyzeHostRegistryImages struct {
+	hostAnalyzer *troubleshootv1beta2.HostRegistryImagesAnalyze
+}
+
+func (a *AnalyzeHostRegistryImages) Title() string {
+	return hostAnalyzerTitleOrDefault(a.hostAnalyzer.AnalyzeMeta, "Registry Images")
+}
+
+func (a *AnalyzeHostRegistryImages) IsExcluded() (bool, error) {
+	return isExcluded(a.hostAnalyzer.Exclude)
+}
+
+func (a *AnalyzeHostRegistryImages) Analyze(
+	getCollectedFileContents func(string) ([]byte, error), findFiles getChildCollectedFileContents,
+) ([]*AnalyzeResult, error) {
+	collectorName := a.hostAnalyzer.CollectorName
+	if collectorName == "" {
+		collectorName = "images"
+	}
+
+	const nodeBaseDir = "host-collectors/registry-images"
+	localPath := fmt.Sprintf("%s/%s.json", nodeBaseDir, collectorName)
+	fileName := fmt.Sprintf("%s.json", collectorName)
+
+	collectedContents, err := retrieveCollectedContents(
+		getCollectedFileContents,
+		localPath,
+		nodeBaseDir,
+		fileName,
+	)
+	if err != nil {
+		return []*AnalyzeResult{{Title: a.Title()}}, err
+	}
+
+	var results []*AnalyzeResult
+	for _, content := range collectedContents {
+		currentTitle := a.Title()
+		if content.NodeName != "" {
+			currentTitle = fmt.Sprintf("%s - Node %s", a.Title(), content.NodeName)
+		}
+
+		result, err := a.evaluateOutcomesWithTemplate(content.Data, currentTitle)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to analyze host registry images")
+		}
+		if result != nil {
+			klog.V(2).Infof("registry images analysis result: title=%q pass=%t warn=%t fail=%t message=%q",
+				result.Title, result.IsPass, result.IsWarn, result.IsFail, result.Message)
+			results = append(results, result)
+		}
+	}
+
+	return results, nil
+}
+
+func (a *AnalyzeHostRegistryImages) evaluateOutcomesWithTemplate(data []byte, title string) (*AnalyzeResult, error) {
+	summary, err := buildRegistryImagesSummary(data)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, outcome := range a.hostAnalyzer.Outcomes {
+		result := &AnalyzeResult{Title: title}
+
+		switch {
+		case outcome.Fail != nil:
+			if outcome.Fail.When == "" {
+				result.IsFail = true
+				result.Message = renderRegistryMessage(outcome.Fail.Message, summary)
+				result.URI = outcome.Fail.URI
+				return result, nil
+			}
+			isMatch, err := compareRegistryConditionalToActual(outcome.Fail.When, len(summary.Verified), len(summary.Missing), len(summary.Errors))
+			if err != nil {
+				return result, errors.Wrapf(err, "failed to compare %s", outcome.Fail.When)
+			}
+			if isMatch {
+				result.IsFail = true
+				result.Message = renderRegistryMessage(outcome.Fail.Message, summary)
+				result.URI = outcome.Fail.URI
+				return result, nil
+			}
+
+		case outcome.Warn != nil:
+			if outcome.Warn.When == "" {
+				result.IsWarn = true
+				result.Message = renderRegistryMessage(outcome.Warn.Message, summary)
+				result.URI = outcome.Warn.URI
+				return result, nil
+			}
+			isMatch, err := compareRegistryConditionalToActual(outcome.Warn.When, len(summary.Verified), len(summary.Missing), len(summary.Errors))
+			if err != nil {
+				return result, errors.Wrapf(err, "failed to compare %s", outcome.Warn.When)
+			}
+			if isMatch {
+				result.IsWarn = true
+				result.Message = renderRegistryMessage(outcome.Warn.Message, summary)
+				result.URI = outcome.Warn.URI
+				return result, nil
+			}
+
+		case outcome.Pass != nil:
+			if outcome.Pass.When == "" {
+				result.IsPass = true
+				result.Message = renderRegistryMessage(outcome.Pass.Message, summary)
+				result.URI = outcome.Pass.URI
+				return result, nil
+			}
+			isMatch, err := compareRegistryConditionalToActual(outcome.Pass.When, len(summary.Verified), len(summary.Missing), len(summary.Errors))
+			if err != nil {
+				return result, errors.Wrapf(err, "failed to compare %s", outcome.Pass.When)
+			}
+			if isMatch {
+				result.IsPass = true
+				result.Message = renderRegistryMessage(outcome.Pass.Message, summary)
+				result.URI = outcome.Pass.URI
+				return result, nil
+			}
+		}
+	}
+
+	return nil, nil
+}
+
+func buildRegistryImagesSummary(data []byte) (*RegistryImagesSummary, error) {
+	var registryInfo collect.RegistryInfo
+	if err := json.Unmarshal(data, &registryInfo); err != nil {
+		return nil, errors.Wrap(err, "failed to unmarshal registry info")
+	}
+
+	summary := &RegistryImagesSummary{
+		UnverifiedReasons: map[string]string{},
+	}
+	for image, info := range registryInfo.Images {
+		if info.Error != "" {
+			summary.Errors = append(summary.Errors, image)
+			summary.UnverifiedReasons[image] = info.Error
+		} else if !info.Exists {
+			summary.Missing = append(summary.Missing, image)
+			summary.UnverifiedReasons[image] = "image not found in registry"
+		} else {
+			summary.Verified = append(summary.Verified, image)
+		}
+	}
+	slices.Sort(summary.Verified)
+	slices.Sort(summary.Missing)
+	slices.Sort(summary.Errors)
+	return summary, nil
+}
+
+func renderRegistryMessage(message string, summary *RegistryImagesSummary) string {
+	rendered, err := util.RenderTemplate(message, summary)
+	if err != nil {
+		klog.V(2).Infof("Failed to render registry message template: %v", err)
+		return message
+	}
+	return rendered
+}
+
+func (a *AnalyzeHostRegistryImages) CheckCondition(when string, data []byte) (bool, error) {
+	summary, err := buildRegistryImagesSummary(data)
+	if err != nil {
+		return false, err
+	}
+
+	return compareRegistryConditionalToActual(when, len(summary.Verified), len(summary.Missing), len(summary.Errors))
+}
@@ -0,0 +1,412 @@
+package analyzer
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/pkg/errors"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAnalyzeHostRegistryImagesCheckCondition(t *testing.T) {
+	tests := []struct {
+		name        string
+		conditional string
+		data        collect.RegistryInfo
+		expected    bool
+		expectErr   string
+	}{
+		{
+			name:        "all images found",
+			conditional: "missing == 0",
+			data: collect.RegistryInfo{
+				Images: map[string]collect.RegistryImage{
+					"registry.example.com/app:v1": {Exists: true},
+					"registry.example.com/app:v2": {Exists: true},
+				},
+			},
+			expected: true,
+		},
+		{
+			name:        "some images not found",
+			conditional: "missing > 0",
+			data: collect.RegistryInfo{
+				Images: map[string]collect.RegistryImage{
+					"registry.example.com/app:v1": {Exists: true},
+					"registry.example.com/app:v2": {Exists: false},
+				},
+			},
+			expected: true,
+		},
+		{
+			name:        "verified count matches found",
+			conditional: "verified == 2",
+			data: collect.RegistryInfo{
+				Images: map[string]collect.RegistryImage{
+					"registry.example.com/app:v1": {Exists: true},
+					"registry.example.com/app:v2": {Exists: true},
+				},
+			},
+			expected: true,
+		},
+		{
+			name:        "errored images counted under errors",
+			conditional: "errors > 0",
+			data: collect.RegistryInfo{
+				Images: map[string]collect.RegistryImage{
+					"registry.example.com/app:v1": {Error: "connection refused"},
+				},
+			},
+			expected: true,
+		},
+		{
+			name:        "no errors when all found",
+			conditional: "missing == 0",
+			data: collect.RegistryInfo{
+				Images: map[string]collect.RegistryImage{
+					"registry.example.com/app:v1": {Exists: true},
+				},
+			},
+			expected: true,
+		},
+		{
+			name:        "mixed results - missing and errors counted separately",
+			conditional: "missing == 1",
+			data: collect.RegistryInfo{
+				Images: map[string]collect.RegistryImage{
+					"registry.example.com/app:v1": {Exists: true},
+					"registry.example.com/app:v2": {Exists: false},
+					"registry.example.com/app:v3": {Error: "timeout"},
+				},
+			},
+			expected: true,
+		},
+		{
+			name:        "invalid conditional format",
+			conditional: "missing",
+			data: collect.RegistryInfo{
+				Images: map[string]collect.RegistryImage{},
+			},
+			expected:  false,
+			expectErr: "unable to parse conditional",
+		},
+		{
+			name:        "unmarshal error",
+			conditional: "missing == 0",
+			expected:    false,
+			expectErr:   "failed to unmarshal registry info",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := require.New(t)
+			a := &AnalyzeHostRegistryImages{}
+
+			var data []byte
+			if test.expectErr == "failed to unmarshal registry info" {
+				data = []byte(`{not valid json}`)
+			} else {
+				var err error
+				data, err = json.Marshal(test.data)
+				req.NoError(err)
+			}
+
+			result, err := a.CheckCondition(test.conditional, data)
+			if test.expectErr != "" {
+				req.ErrorContains(err, test.expectErr)
+			} else {
+				req.NoError(err)
+			}
+			assert.Equal(t, test.expected, result)
+		})
+	}
+}
+
+func TestAnalyzeHostRegistryImages(t *testing.T) {
+	tests := []struct {
+		name                     string
+		hostAnalyzer             *troubleshootv1beta2.HostRegistryImagesAnalyze
+		getCollectedFileContents func(string) ([]byte, error)
+		expectedResults          []*AnalyzeResult
+		expectedError            string
+	}{
+		{
+			name: "pass when all images found",
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							When:    "missing == 0",
+							Message: "All images are available",
+						},
+					},
+				},
+			},
+			getCollectedFileContents: func(path string) ([]byte, error) {
+				if path == "host-collectors/registry-images/images.json" {
+					return json.Marshal(collect.RegistryInfo{
+						Images: map[string]collect.RegistryImage{
+							"registry.example.com/app:v1": {Exists: true},
+						},
+					})
+				}
+				return nil, errors.New("file not found")
+			},
+			expectedResults: []*AnalyzeResult{
+				{
+					Title:   "Registry Images",
+					IsPass:  true,
+					Message: "All images are available",
+				},
+			},
+		},
+		{
+			name: "fail when images not found",
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							When:    "missing > 0",
+							Message: "Some images are not available",
+						},
+					},
+				},
+			},
+			getCollectedFileContents: func(path string) ([]byte, error) {
+				if path == "host-collectors/registry-images/images.json" {
+					return json.Marshal(collect.RegistryInfo{
+						Images: map[string]collect.RegistryImage{
+							"registry.example.com/app:v1": {Exists: false},
+						},
+					})
+				}
+				return nil, errors.New("file not found")
+			},
+			expectedResults: []*AnalyzeResult{
+				{
+					Title:   "Registry Images",
+					IsFail:  true,
+					Message: "Some images are not available",
+				},
+			},
+		},
+		{
+			name: "errored images matched by errors condition",
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							When:    "errors > 0",
+							Message: "Some images are not available",
+						},
+					},
+				},
+			},
+			getCollectedFileContents: func(path string) ([]byte, error) {
+				if path == "host-collectors/registry-images/images.json" {
+					return json.Marshal(collect.RegistryInfo{
+						Images: map[string]collect.RegistryImage{
+							"registry.example.com/app:v1": {Error: "connection refused"},
+						},
+					})
+				}
+				return nil, errors.New("file not found")
+			},
+			expectedResults: []*AnalyzeResult{
+				{
+					Title:   "Registry Images",
+					IsFail:  true,
+					Message: "Some images are not available",
+				},
+			},
+		},
+		{
+			name: "custom collector name used in path",
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				CollectorName: "my-registry",
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							When:    "missing == 0",
+							Message: "All images are available",
+						},
+					},
+				},
+			},
+			getCollectedFileContents: func(path string) ([]byte, error) {
+				if path == "host-collectors/registry-images/my-registry.json" {
+					return json.Marshal(collect.RegistryInfo{
+						Images: map[string]collect.RegistryImage{
+							"registry.example.com/app:v1": {Exists: true},
+						},
+					})
+				}
+				return nil, errors.New("file not found")
+			},
+			expectedResults: []*AnalyzeResult{
+				{
+					Title:   "Registry Images",
+					IsPass:  true,
+					Message: "All images are available",
+				},
+			},
+		},
+		{
+			name: "return error when collection data missing",
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							When:    "missing == 0",
+							Message: "All images are available",
+						},
+					},
+				},
+			},
+			getCollectedFileContents: func(path string) ([]byte, error) {
+				return nil, errors.New("file not found")
+			},
+			expectedResults: []*AnalyzeResult{
+				{
+					Title: "Registry Images",
+				},
+			},
+			expectedError: "file not found",
+		},
+		{
+			name: "template rendering with NotFound list",
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							When:    "missing > 0",
+							Message: "Missing: {{ .Missing | join \", \" }}",
+						},
+					},
+				},
+			},
+			getCollectedFileContents: func(path string) ([]byte, error) {
+				if path == "host-collectors/registry-images/images.json" {
+					return json.Marshal(collect.RegistryInfo{
+						Images: map[string]collect.RegistryImage{
+							"registry.example.com/app:v1": {Exists: false},
+							"registry.example.com/app:v2": {Exists: true},
+						},
+					})
+				}
+				return nil, errors.New("file not found")
+			},
+			expectedResults: []*AnalyzeResult{
+				{
+					Title:   "Registry Images",
+					IsFail:  true,
+					Message: "Missing: registry.example.com/app:v1",
+				},
+			},
+		},
+		{
+			name: "template rendering with NotFoundReasons map",
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							When:    "errors > 0",
+							Message: `{{ range $image, $reason := .UnverifiedReasons }}{{ $image }}: {{ $reason }}; {{ end }}`,
+						},
+					},
+				},
+			},
+			getCollectedFileContents: func(path string) ([]byte, error) {
+				if path == "host-collectors/registry-images/images.json" {
+					return json.Marshal(collect.RegistryInfo{
+						Images: map[string]collect.RegistryImage{
+							"registry.example.com/app:v1": {Error: "connection refused"},
+						},
+					})
+				}
+				return nil, errors.New("file not found")
+			},
+			expectedResults: []*AnalyzeResult{
+				{
+					Title:   "Registry Images",
+					IsFail:  true,
+					Message: "registry.example.com/app:v1: connection refused; ",
+				},
+			},
+		},
+		{
+			name: "template rendering with Found count",
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							When:    "missing == 0",
+							Message: "All {{ len .Verified }} images are available",
+						},
+					},
+				},
+			},
+			getCollectedFileContents: func(path string) ([]byte, error) {
+				if path == "host-collectors/registry-images/images.json" {
+					return json.Marshal(collect.RegistryInfo{
+						Images: map[string]collect.RegistryImage{
+							"registry.example.com/app:v1": {Exists: true},
+							"registry.example.com/app:v2": {Exists: true},
+						},
+					})
+				}
+				return nil, errors.New("file not found")
+			},
+			expectedResults: []*AnalyzeResult{
+				{
+					Title:   "Registry Images",
+					IsPass:  true,
+					Message: "All 2 images are available",
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := require.New(t)
+
+			a := &AnalyzeHostRegistryImages{
+				hostAnalyzer: test.hostAnalyzer,
+			}
+
+			results, err := a.Analyze(test.getCollectedFileContents, nil)
+
+			if test.expectedError != "" {
+				req.ErrorContains(err, test.expectedError)
+			} else {
+				req.NoError(err)
+			}
+			req.Equal(test.expectedResults, results)
+		})
+	}
+}
+
+func TestAnalyzeHostRegistryImagesTitle(t *testing.T) {
+	t.Run("default title", func(t *testing.T) {
+		a := &AnalyzeHostRegistryImages{
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{},
+		}
+		assert.Equal(t, "Registry Images", a.Title())
+	})
+
+	t.Run("custom title", func(t *testing.T) {
+		a := &AnalyzeHostRegistryImages{
+			hostAnalyzer: &troubleshootv1beta2.HostRegistryImagesAnalyze{
+				AnalyzeMeta: troubleshootv1beta2.AnalyzeMeta{
+					CheckName: "My Registry Check",
+				},
+			},
+		}
+		assert.Equal(t, "My Registry Check", a.Title())
+	})
+}
@@ -0,0 +1,87 @@
+package analyzer
+
+import (
+	"encoding/json"
+	"fmt"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	networkingv1 "k8s.io/api/networking/v1"
+)
+
+type AnalyzeIngressClass struct {
+	analyzer *troubleshootv1beta2.IngressClass
+}
+
+func (a *AnalyzeIngressClass) Title() string {
+	title := a.analyzer.CheckName
+	if title == "" {
+		if a.analyzer.IngressClassName != "" {
+			title = fmt.Sprintf("Ingress class %s", a.analyzer.IngressClassName)
+		} else {
+			title = "Default Ingress Class"
+		}
+	}
+	return title
+}
+
+func (a *AnalyzeIngressClass) IsExcluded() (bool, error) {
+	return isExcluded(a.analyzer.Exclude)
+}
+
+func (a *AnalyzeIngressClass) Analyze(getFile getCollectedFileContents, findFiles getChildCollectedFileContents) ([]*AnalyzeResult, error) {
+	result, err := a.analyzeIngressClass(a.analyzer, getFile)
+	if err != nil {
+		return nil, err
+	}
+	result.Strict = a.analyzer.Strict.BoolOrDefaultFalse()
+	return []*AnalyzeResult{result}, nil
+}
+
+func (a *AnalyzeIngressClass) analyzeIngressClass(analyzer *troubleshootv1beta2.IngressClass, getCollectedFileContents func(string) ([]byte, error)) (*AnalyzeResult, error) {
+	ingressClassesData, err := getCollectedFileContents(fmt.Sprintf("%s/%s.json", constants.CLUSTER_RESOURCES_DIR, constants.CLUSTER_RESOURCES_INGRESS_CLASS))
+	if err != nil {
+		return nil, err
+	}
+
+	var ingressClasses networkingv1.IngressClassList
+	if err := json.Unmarshal(ingressClassesData, &ingressClasses); err != nil {
+		return nil, err
+	}
+
+	result := AnalyzeResult{
+		Title:   a.Title(),
+		IconKey: "kubernetes_ingress_class",
+		IconURI: "https://troubleshoot.sh/images/analyzer-icons/ingress-class.svg?w=12&h=12",
+	}
+
+	for _, ingressClass := range ingressClasses.Items {
+		val := ingressClass.Annotations["ingressclass.kubernetes.io/is-default-class"]
+		if (ingressClass.Name == analyzer.IngressClassName) || (analyzer.IngressClassName == "" && val == "true") {
+			result.IsPass = true
+			for _, outcome := range analyzer.Outcomes {
+				if outcome.Pass != nil {
+					result.Message = outcome.Pass.Message
+					result.URI = outcome.Pass.URI
+				}
+			}
+			if analyzer.IngressClassName == "" && result.Message == "" {
+				result.Message = "Default Ingress Class found"
+			}
+			return &result, nil
+		}
+	}
+
+	result.IsFail = true
+	for _, outcome := range analyzer.Outcomes {
+		if outcome.Fail != nil {
+			result.Message = outcome.Fail.Message
+			result.URI = outcome.Fail.URI
+		}
+	}
+	if analyzer.IngressClassName == "" && result.Message == "" {
+		result.Message = "No Default Ingress Class found"
+	}
+
+	return &result, nil
+}
@@ -0,0 +1,202 @@
+package analyzer
+
+import (
+	"encoding/json"
+	"testing"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	networkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestAnalyzeIngressClass(t *testing.T) {
+	tests := []struct {
+		name         string
+		analyzer     *troubleshootv1beta2.IngressClass
+		ingressList  *networkingv1.IngressClassList
+		expectResult AnalyzeResult
+	}{
+		{
+			name: "named ingress class found",
+			analyzer: &troubleshootv1beta2.IngressClass{
+				IngressClassName: "nginx",
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							Message: "nginx ingress class found",
+						},
+					},
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							Message: "nginx ingress class not found",
+						},
+					},
+				},
+			},
+			ingressList: &networkingv1.IngressClassList{
+				Items: []networkingv1.IngressClass{
+					{ObjectMeta: metav1.ObjectMeta{Name: "nginx"}},
+				},
+			},
+			expectResult: AnalyzeResult{
+				IsPass:  true,
+				Title:   "Ingress class nginx",
+				Message: "nginx ingress class found",
+				IconKey: "kubernetes_ingress_class",
+				IconURI: "https://troubleshoot.sh/images/analyzer-icons/ingress-class.svg?w=12&h=12",
+			},
+		},
+		{
+			name: "named ingress class not found",
+			analyzer: &troubleshootv1beta2.IngressClass{
+				IngressClassName: "nginx",
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							Message: "nginx ingress class found",
+						},
+					},
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							Message: "nginx ingress class not found",
+						},
+					},
+				},
+			},
+			ingressList: &networkingv1.IngressClassList{
+				Items: []networkingv1.IngressClass{
+					{ObjectMeta: metav1.ObjectMeta{Name: "traefik"}},
+				},
+			},
+			expectResult: AnalyzeResult{
+				IsFail:  true,
+				Title:   "Ingress class nginx",
+				Message: "nginx ingress class not found",
+				IconKey: "kubernetes_ingress_class",
+				IconURI: "https://troubleshoot.sh/images/analyzer-icons/ingress-class.svg?w=12&h=12",
+			},
+		},
+		{
+			name: "default ingress class found",
+			analyzer: &troubleshootv1beta2.IngressClass{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							Message: "default ingress class exists",
+						},
+					},
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							Message: "no default ingress class",
+						},
+					},
+				},
+			},
+			ingressList: &networkingv1.IngressClassList{
+				Items: []networkingv1.IngressClass{
+					{
+						ObjectMeta: metav1.ObjectMeta{
+							Name: "nginx",
+							Annotations: map[string]string{
+								"ingressclass.kubernetes.io/is-default-class": "true",
+							},
+						},
+					},
+				},
+			},
+			expectResult: AnalyzeResult{
+				IsPass:  true,
+				Title:   "Default Ingress Class",
+				Message: "default ingress class exists",
+				IconKey: "kubernetes_ingress_class",
+				IconURI: "https://troubleshoot.sh/images/analyzer-icons/ingress-class.svg?w=12&h=12",
+			},
+		},
+		{
+			name: "default ingress class not found",
+			analyzer: &troubleshootv1beta2.IngressClass{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							Message: "default ingress class exists",
+						},
+					},
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							Message: "no default ingress class",
+						},
+					},
+				},
+			},
+			ingressList: &networkingv1.IngressClassList{
+				Items: []networkingv1.IngressClass{
+					{ObjectMeta: metav1.ObjectMeta{Name: "nginx"}},
+				},
+			},
+			expectResult: AnalyzeResult{
+				IsFail:  true,
+				Title:   "Default Ingress Class",
+				Message: "no default ingress class",
+				IconKey: "kubernetes_ingress_class",
+				IconURI: "https://troubleshoot.sh/images/analyzer-icons/ingress-class.svg?w=12&h=12",
+			},
+		},
+		{
+			name: "default ingress class not found with default message",
+			analyzer: &troubleshootv1beta2.IngressClass{
+				Outcomes: []*troubleshootv1beta2.Outcome{},
+			},
+			ingressList: &networkingv1.IngressClassList{},
+			expectResult: AnalyzeResult{
+				IsFail:  true,
+				Title:   "Default Ingress Class",
+				Message: "No Default Ingress Class found",
+				IconKey: "kubernetes_ingress_class",
+				IconURI: "https://troubleshoot.sh/images/analyzer-icons/ingress-class.svg?w=12&h=12",
+			},
+		},
+		{
+			name: "default ingress class found with default message",
+			analyzer: &troubleshootv1beta2.IngressClass{
+				Outcomes: []*troubleshootv1beta2.Outcome{},
+			},
+			ingressList: &networkingv1.IngressClassList{
+				Items: []networkingv1.IngressClass{
+					{
+						ObjectMeta: metav1.ObjectMeta{
+							Name: "nginx",
+							Annotations: map[string]string{
+								"ingressclass.kubernetes.io/is-default-class": "true",
+							},
+						},
+					},
+				},
+			},
+			expectResult: AnalyzeResult{
+				IsPass:  true,
+				Title:   "Default Ingress Class",
+				Message: "Default Ingress Class found",
+				IconKey: "kubernetes_ingress_class",
+				IconURI: "https://troubleshoot.sh/images/analyzer-icons/ingress-class.svg?w=12&h=12",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b, err := json.Marshal(tt.ingressList)
+			require.NoError(t, err)
+
+			getFile := func(_ string) ([]byte, error) {
+				return b, nil
+			}
+
+			a := AnalyzeIngressClass{analyzer: tt.analyzer}
+			result, err := a.analyzeIngressClass(tt.analyzer, getFile)
+			require.NoError(t, err)
+			assert.Equal(t, tt.expectResult, *result)
+		})
+	}
+}
@@ -17,24 +17,26 @@ import (
 )

 var Filemap = map[string]string{
-	"deployment":            constants.CLUSTER_RESOURCES_DEPLOYMENTS,
-	"daemonset":             constants.CLUSTER_RESOURCES_DAEMONSETS,
-	"statefulset":           constants.CLUSTER_RESOURCES_STATEFULSETS,
-	"networkpolicy":         constants.CLUSTER_RESOURCES_NETWORK_POLICY,
-	"pod":                   constants.CLUSTER_RESOURCES_PODS,
-	"ingress":               constants.CLUSTER_RESOURCES_INGRESS,
-	"service":               constants.CLUSTER_RESOURCES_SERVICES,
-	"resourcequota":         constants.CLUSTER_RESOURCES_RESOURCE_QUOTA,
-	"job":                   constants.CLUSTER_RESOURCES_JOBS,
-	"persistentvolumeclaim": constants.CLUSTER_RESOURCES_PVCS,
-	"pvc":                   constants.CLUSTER_RESOURCES_PVCS,
-	"replicaset":            constants.CLUSTER_RESOURCES_REPLICASETS,
-	"configmap":             constants.CLUSTER_RESOURCES_CONFIGMAPS,
-	"namespace":             fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_NAMESPACES),
-	"persistentvolume":      fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_PVS),
-	"pv":                    fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_PVS),
-	"node":                  fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_NODES),
-	"storageclass":          fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_STORAGE_CLASS),
+	"deployment":                     constants.CLUSTER_RESOURCES_DEPLOYMENTS,
+	"daemonset":                      constants.CLUSTER_RESOURCES_DAEMONSETS,
+	"statefulset":                    constants.CLUSTER_RESOURCES_STATEFULSETS,
+	"networkpolicy":                  constants.CLUSTER_RESOURCES_NETWORK_POLICY,
+	"pod":                            constants.CLUSTER_RESOURCES_PODS,
+	"ingress":                        constants.CLUSTER_RESOURCES_INGRESS,
+	"service":                        constants.CLUSTER_RESOURCES_SERVICES,
+	"resourcequota":                  constants.CLUSTER_RESOURCES_RESOURCE_QUOTA,
+	"job":                            constants.CLUSTER_RESOURCES_JOBS,
+	"persistentvolumeclaim":          constants.CLUSTER_RESOURCES_PVCS,
+	"pvc":                            constants.CLUSTER_RESOURCES_PVCS,
+	"replicaset":                     constants.CLUSTER_RESOURCES_REPLICASETS,
+	"configmap":                      constants.CLUSTER_RESOURCES_CONFIGMAPS,
+	"validatingwebhookconfiguration": fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_VALIDATING_WEBHOOK_CONFIGURATIONS),
+	"mutatingwebhookconfiguration":   fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_MUTATING_WEBHOOK_CONFIGURATIONS),
+	"namespace":                      fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_NAMESPACES),
+	"persistentvolume":               fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_PVS),
+	"pv":                             fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_PVS),
+	"node":                           fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_NODES),
+	"storageclass":                   fmt.Sprintf("%s.json", constants.CLUSTER_RESOURCES_STORAGE_CLASS),
 }

 type AnalyzeClusterResource struct {
@@ -12,11 +12,12 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/kubernetes/pkg/util/taints"

 	"github.com/replicatedhq/troubleshoot/internal/util"
 	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
 	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
 )

 type AnalyzeNodeResources struct {
@@ -45,6 +46,9 @@ func (a *AnalyzeNodeResources) Analyze(getFile getCollectedFileContents, findFil
 	if err != nil {
 		return nil, err
 	}
+	if result == nil {
+		return nil, nil
+	}
 	result.Strict = a.analyzer.Strict.BoolOrDefaultFalse()
 	return []*AnalyzeResult{result}, nil
 }
@@ -53,7 +57,19 @@ func (a *AnalyzeNodeResources) analyzeNodeResources(analyzer *troubleshootv1beta

 	collected, err := getCollectedFileContents(fmt.Sprintf("%s/%s.json", constants.CLUSTER_RESOURCES_DIR, constants.CLUSTER_RESOURCES_NODES))
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to get contents of nodes.json")
+		if _, ok := err.(*types.NotFoundError); !ok {
+			return nil, errors.Wrap(err, "failed to get contents of nodes.json")
+		}
+		if analyzer.IgnoreIfNoFiles {
+			return nil, nil
+		}
+		return &AnalyzeResult{
+			Title:   a.Title(),
+			IconKey: "kubernetes_node_resources",
+			IconURI: "https://troubleshoot.sh/images/analyzer-icons/node-resources.svg?w=16&h=18",
+			IsWarn:  true,
+			Message: "No node resources were collected, unable to analyze node resources",
+		}, nil
 	}

 	var nodes corev1.NodeList
@@ -453,7 +469,7 @@ func nodeMatchesFilters(node corev1.Node, filters *troubleshootv1beta2.NodeResou
 	}

 	if filters.Taint != nil {
-		return taints.TaintExists(node.Spec.Taints, filters.Taint), nil
+		return k8sutil.TaintExists(node.Spec.Taints, filters.Taint), nil
 	}

 	if filters.CPUArchitecture != "" {
@@ -1,6 +1,7 @@
 package analyzer

 import (
+	"fmt"
 	"testing"

 	"github.com/stretchr/testify/assert"
@@ -10,6 +11,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
 )

 func Test_compareNodeResourceConditionalToActual(t *testing.T) {
@@ -1684,3 +1686,56 @@ func Test_analyzeNodeResources(t *testing.T) {
 		})
 	}
 }
+
+func Test_analyzeNodeResources_NoFiles(t *testing.T) {
+	missingFile := func(name string) ([]byte, error) {
+		return nil, &types.NotFoundError{Name: name}
+	}
+
+	t.Run("emits warning when nodes.json is not collected", func(t *testing.T) {
+		req := require.New(t)
+		analyzer := &troubleshootv1beta2.NodeResources{
+			Outcomes: []*troubleshootv1beta2.Outcome{
+				{Pass: &troubleshootv1beta2.SingleOutcome{Message: "ok"}},
+			},
+		}
+		a := AnalyzeNodeResources{analyzer: analyzer}
+		got, err := a.Analyze(missingFile, nil)
+		req.NoError(err)
+		req.Len(got, 1)
+		req.True(got[0].IsWarn)
+		req.Equal("Node Resources", got[0].Title)
+	})
+
+	t.Run("ignoreIfNoFiles suppresses the warning", func(t *testing.T) {
+		req := require.New(t)
+		analyzer := &troubleshootv1beta2.NodeResources{
+			IgnoreIfNoFiles: true,
+			Outcomes: []*troubleshootv1beta2.Outcome{
+				{Pass: &troubleshootv1beta2.SingleOutcome{Message: "ok"}},
+			},
+		}
+		a := AnalyzeNodeResources{analyzer: analyzer}
+		got, err := a.Analyze(missingFile, nil)
+		req.NoError(err)
+		req.Empty(got)
+	})
+
+	t.Run("non-NotFound errors are propagated", func(t *testing.T) {
+		req := require.New(t)
+		analyzer := &troubleshootv1beta2.NodeResources{
+			IgnoreIfNoFiles: true,
+			Outcomes: []*troubleshootv1beta2.Outcome{
+				{Pass: &troubleshootv1beta2.SingleOutcome{Message: "ok"}},
+			},
+		}
+		ioErr := func(string) ([]byte, error) {
+			return nil, fmt.Errorf("permission denied")
+		}
+		a := AnalyzeNodeResources{analyzer: analyzer}
+		got, err := a.Analyze(ioErr, nil)
+		req.Error(err)
+		req.Nil(got)
+		req.Contains(err.Error(), "permission denied")
+	})
+}
@@ -146,7 +146,7 @@ func (h *OllamaHelper) downloadAndInstallWindows() error {
 		return errors.Wrap(err, "failed to create temporary file")
 	}
 	defer os.Remove(tmpFile.Name())
-	defer tmpFile.Close()
+	defer tmpFile.Close() // Ensures file is closed in error paths

 	// Download installer
 	resp, err := http.Get(h.downloadURL)
@@ -165,6 +165,13 @@ func (h *OllamaHelper) downloadAndInstallWindows() error {
 		return errors.Wrap(err, "failed to write installer")
 	}

+	// Close the file before executing it (required on Windows)
+	// Note: This will be called twice (here and via defer), but that's safe
+	// The defer ensures cleanup on error paths, this ensures closure before execution
+	if err := tmpFile.Close(); err != nil {
+		return errors.Wrap(err, "failed to close installer file")
+	}
+
 	// Run installer
 	klog.Info("Running Ollama installer...")
 	cmd := exec.Command(tmpFile.Name())
@@ -0,0 +1,139 @@
+package analyzer
+
+import (
+	"encoding/json"
+	"fmt"
+	"path"
+
+	"github.com/pkg/errors"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+)
+
+type AnalyzeS3Status struct {
+	analyzer *troubleshootv1beta2.DatabaseAnalyze
+}
+
+func (a *AnalyzeS3Status) Title() string {
+	title := a.analyzer.CheckName
+	if title == "" {
+		title = a.collectorName()
+	}
+
+	return title
+}
+
+func (a *AnalyzeS3Status) IsExcluded() (bool, error) {
+	return isExcluded(a.analyzer.Exclude)
+}
+
+func (a *AnalyzeS3Status) Analyze(getFile getCollectedFileContents, findFiles getChildCollectedFileContents) ([]*AnalyzeResult, error) {
+	result, err := a.analyzeS3Status(a.analyzer, getFile)
+	if err != nil {
+		return nil, err
+	}
+	result.Strict = a.analyzer.Strict.BoolOrDefaultFalse()
+	return []*AnalyzeResult{result}, nil
+}
+
+func (a *AnalyzeS3Status) collectorName() string {
+	collectorName := a.analyzer.CollectorName
+	if collectorName == "" {
+		collectorName = "s3Status"
+	}
+
+	return collectorName
+}
+
+func (a *AnalyzeS3Status) analyzeS3Status(analyzer *troubleshootv1beta2.DatabaseAnalyze, getCollectedFileContents func(string) ([]byte, error)) (*AnalyzeResult, error) {
+	fullPath := path.Join("s3Status", fmt.Sprintf("%s.json", a.collectorName()))
+
+	collected, err := getCollectedFileContents(fullPath)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to read collected file name: %s", fullPath)
+	}
+
+	databaseConnection := collect.DatabaseConnection{}
+	if err := json.Unmarshal(collected, &databaseConnection); err != nil {
+		return nil, errors.Wrap(err, "failed to unmarshal s3 status result")
+	}
+
+	result := &AnalyzeResult{
+		Title:   a.Title(),
+		IconKey: "kubernetes_s3_analyze",
+		IconURI: "https://troubleshoot.sh/images/analyzer-icons/s3-analyze.svg",
+	}
+
+	for _, outcome := range analyzer.Outcomes {
+		if outcome.Fail != nil {
+			if outcome.Fail.When == "" {
+				result.IsFail = true
+				result.Message = outcome.Fail.Message
+				result.URI = outcome.Fail.URI
+
+				return result, nil
+			}
+
+			isMatch, err := compareDatabaseConditionalToActual(outcome.Fail.When, &databaseConnection)
+			if err != nil {
+				return result, errors.Wrap(err, "failed to compare s3 status conditional")
+			}
+
+			if isMatch {
+				result.IsFail = true
+				if databaseConnection.Error != "" {
+					result.Message = outcome.Fail.Message + " " + databaseConnection.Error
+				} else {
+					result.Message = outcome.Fail.Message
+				}
+				result.URI = outcome.Fail.URI
+
+				return result, nil
+			}
+		} else if outcome.Warn != nil {
+			if outcome.Warn.When == "" {
+				result.IsWarn = true
+				result.Message = outcome.Warn.Message
+				result.URI = outcome.Warn.URI
+
+				return result, nil
+			}
+
+			isMatch, err := compareDatabaseConditionalToActual(outcome.Warn.When, &databaseConnection)
+			if err != nil {
+				return result, errors.Wrap(err, "failed to compare s3 status conditional")
+			}
+
+			if isMatch {
+				result.IsWarn = true
+				result.Message = outcome.Warn.Message
+				result.URI = outcome.Warn.URI
+
+				return result, nil
+			}
+		} else if outcome.Pass != nil {
+			if outcome.Pass.When == "" {
+				result.IsPass = true
+				result.Message = outcome.Pass.Message
+				result.URI = outcome.Pass.URI
+
+				return result, nil
+			}
+
+			isMatch, err := compareDatabaseConditionalToActual(outcome.Pass.When, &databaseConnection)
+			if err != nil {
+				return result, errors.Wrap(err, "failed to compare s3 status conditional")
+			}
+
+			if isMatch {
+				result.IsPass = true
+				result.Message = outcome.Pass.Message
+				result.URI = outcome.Pass.URI
+
+				return result, nil
+			}
+		}
+	}
+
+	return result, nil
+}
@@ -0,0 +1,175 @@
+package analyzer
+
+import (
+	"encoding/json"
+	"testing"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAnalyzeS3Status(t *testing.T) {
+	tests := []struct {
+		name        string
+		analyzer    *troubleshootv1beta2.DatabaseAnalyze
+		collected   *collect.DatabaseConnection
+		wantPass    bool
+		wantFail    bool
+		wantWarn    bool
+		wantMessage string
+	}{
+		{
+			name: "connected, pass",
+			analyzer: &troubleshootv1beta2.DatabaseAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							When:    "connected == false",
+							Message: "Cannot access the S3 bucket.",
+						},
+					},
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							When:    "connected == true",
+							Message: "S3 bucket is accessible.",
+						},
+					},
+				},
+			},
+			collected: &collect.DatabaseConnection{
+				IsConnected: true,
+			},
+			wantPass:    true,
+			wantMessage: "S3 bucket is accessible.",
+		},
+		{
+			name: "not connected, fail with error appended",
+			analyzer: &troubleshootv1beta2.DatabaseAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							When:    "connected == false",
+							Message: "Cannot access the S3 bucket.",
+						},
+					},
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							When:    "connected == true",
+							Message: "S3 bucket is accessible.",
+						},
+					},
+				},
+			},
+			collected: &collect.DatabaseConnection{
+				IsConnected: false,
+				Error:       "operation error S3: HeadBucket, StatusCode: 403",
+			},
+			wantFail:    true,
+			wantMessage: "Cannot access the S3 bucket. operation error S3: HeadBucket, StatusCode: 403",
+		},
+		{
+			name: "not connected, fail without error",
+			analyzer: &troubleshootv1beta2.DatabaseAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							When:    "connected == false",
+							Message: "Cannot access the S3 bucket.",
+						},
+					},
+				},
+			},
+			collected: &collect.DatabaseConnection{
+				IsConnected: false,
+			},
+			wantFail:    true,
+			wantMessage: "Cannot access the S3 bucket.",
+		},
+		{
+			name: "warn outcome",
+			analyzer: &troubleshootv1beta2.DatabaseAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Warn: &troubleshootv1beta2.SingleOutcome{
+							When:    "connected == false",
+							Message: "S3 bucket may be inaccessible.",
+						},
+					},
+				},
+			},
+			collected: &collect.DatabaseConnection{
+				IsConnected: false,
+			},
+			wantWarn:    true,
+			wantMessage: "S3 bucket may be inaccessible.",
+		},
+		{
+			name: "unconditional fail",
+			analyzer: &troubleshootv1beta2.DatabaseAnalyze{
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Fail: &troubleshootv1beta2.SingleOutcome{
+							Message: "Always fails.",
+						},
+					},
+				},
+			},
+			collected: &collect.DatabaseConnection{
+				IsConnected: true,
+			},
+			wantFail:    true,
+			wantMessage: "Always fails.",
+		},
+		{
+			name: "custom collector name",
+			analyzer: &troubleshootv1beta2.DatabaseAnalyze{
+				AnalyzeMeta: troubleshootv1beta2.AnalyzeMeta{
+					CheckName: "My S3 Check",
+				},
+				CollectorName: "my-bucket",
+				Outcomes: []*troubleshootv1beta2.Outcome{
+					{
+						Pass: &troubleshootv1beta2.SingleOutcome{
+							When:    "connected == true",
+							Message: "Bucket OK.",
+						},
+					},
+				},
+			},
+			collected: &collect.DatabaseConnection{
+				IsConnected: true,
+			},
+			wantPass:    true,
+			wantMessage: "Bucket OK.",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			collectedData, err := json.Marshal(tt.collected)
+			require.NoError(t, err)
+
+			a := &AnalyzeS3Status{analyzer: tt.analyzer}
+
+			getFile := func(path string) ([]byte, error) {
+				return collectedData, nil
+			}
+
+			results, err := a.Analyze(getFile, nil)
+			require.NoError(t, err)
+			require.Len(t, results, 1)
+
+			result := results[0]
+			assert.Equal(t, tt.wantPass, result.IsPass)
+			assert.Equal(t, tt.wantFail, result.IsFail)
+			assert.Equal(t, tt.wantWarn, result.IsWarn)
+			assert.Equal(t, tt.wantMessage, result.Message)
+
+			if tt.analyzer.CheckName != "" {
+				assert.Equal(t, tt.analyzer.CheckName, result.Title)
+			}
+		})
+	}
+}
@@ -261,7 +261,7 @@ func (c *Collect) AccessReviewSpecs(overrideNS string) []authorizationv1.SelfSub
 		result = append(result, authorizationv1.SelfSubjectAccessReviewSpec{
 			ResourceAttributes: &authorizationv1.ResourceAttributes{
 				Namespace:   pickNamespaceOrDefault(c.Exec.Namespace, overrideNS),
-				Verb:        "get",
+				Verb:        "create",
 				Group:       "",
 				Version:     "",
 				Resource:    "pods",
@@ -286,7 +286,7 @@ func (c *Collect) AccessReviewSpecs(overrideNS string) []authorizationv1.SelfSub
 		result = append(result, authorizationv1.SelfSubjectAccessReviewSpec{
 			ResourceAttributes: &authorizationv1.ResourceAttributes{
 				Namespace:   pickNamespaceOrDefault(c.Copy.Namespace, overrideNS),
-				Verb:        "get",
+				Verb:        "create",
 				Group:       "",
 				Version:     "",
 				Resource:    "pods",
@@ -18,6 +18,12 @@ type StorageClass struct {
 	StorageClassName string     `json:"storageClassName,omitempty" yaml:"storageClassName,omitempty"`
 }

+type IngressClass struct {
+	AnalyzeMeta      `json:",inline" yaml:",inline"`
+	Outcomes         []*Outcome `json:"outcomes" yaml:"outcomes"`
+	IngressClassName string     `json:"ingressClassName,omitempty" yaml:"ingressClassName,omitempty"`
+}
+
 type CustomResourceDefinition struct {
 	AnalyzeMeta                  `json:",inline" yaml:",inline"`
 	Outcomes                     []*Outcome `json:"outcomes" yaml:"outcomes"`
@@ -124,9 +130,10 @@ type Distribution struct {
 }

 type NodeResources struct {
-	AnalyzeMeta `json:",inline" yaml:",inline"`
-	Outcomes    []*Outcome           `json:"outcomes" yaml:"outcomes"`
-	Filters     *NodeResourceFilters `json:"filters,omitempty" yaml:"filters,omitempty"`
+	AnalyzeMeta     `json:",inline" yaml:",inline"`
+	Outcomes        []*Outcome           `json:"outcomes" yaml:"outcomes"`
+	Filters         *NodeResourceFilters `json:"filters,omitempty" yaml:"filters,omitempty"`
+	IgnoreIfNoFiles bool                 `json:"ignoreIfNoFiles,omitempty" yaml:"ignoreIfNoFiles,omitempty"`
 }

 type NodeResourceFilters struct {
@@ -276,6 +283,7 @@ type PVCRef struct {
 type Analyze struct {
 	ClusterVersion           *ClusterVersion           `json:"clusterVersion,omitempty" yaml:"clusterVersion,omitempty"`
 	StorageClass             *StorageClass             `json:"storageClass,omitempty" yaml:"storageClass,omitempty"`
+	IngressClass             *IngressClass             `json:"ingressClass,omitempty" yaml:"ingressClass,omitempty"`
 	CustomResourceDefinition *CustomResourceDefinition `json:"customResourceDefinition,omitempty" yaml:"customResourceDefinition,omitempty"`
 	Ingress                  *Ingress                  `json:"ingress,omitempty" yaml:"ingress,omitempty"`
 	Secret                   *AnalyzeSecret            `json:"secret,omitempty" yaml:"secret,omitempty"`
@@ -297,6 +305,7 @@ type Analyze struct {
 	Mssql                    *DatabaseAnalyze          `json:"mssql,omitempty" yaml:"mssql,omitempty"`
 	Mysql                    *DatabaseAnalyze          `json:"mysql,omitempty" yaml:"mysql,omitempty"`
 	Redis                    *DatabaseAnalyze          `json:"redis,omitempty" yaml:"redis,omitempty"`
+	ClickHouse               *DatabaseAnalyze          `json:"clickhouse,omitempty" yaml:"clickhouse,omitempty"`
 	CephStatus               *CephStatusAnalyze        `json:"cephStatus,omitempty" yaml:"cephStatus,omitempty"`
 	Velero                   *VeleroAnalyze            `json:"velero,omitempty" yaml:"velero,omitempty"`
 	Longhorn                 *LonghornAnalyze          `json:"longhorn,omitempty" yaml:"longhorn,omitempty"`
@@ -309,4 +318,5 @@ type Analyze struct {
 	Event                    *EventAnalyze             `json:"event,omitempty" yaml:"event,omitempty"`
 	NodeMetrics              *NodeMetricsAnalyze       `json:"nodeMetrics,omitempty" yaml:"nodeMetrics,omitempty"`
 	HTTP                     *HTTPAnalyze              `json:"http,omitempty" yaml:"http,omitempty"`
+	S3Status                 *DatabaseAnalyze          `json:"s3Status,omitempty" yaml:"s3Status,omitempty"`
 }
@@ -318,37 +318,56 @@ type Etcd struct {
 	Image         string `json:"image" yaml:"image"`
 }

+type SupportBundleMetadata struct {
+	CollectorMeta `json:",inline" yaml:",inline"`
+	Namespace     string `json:"namespace" yaml:"namespace"`
+}
+
+type S3Status struct {
+	CollectorMeta   `json:",inline" yaml:",inline"`
+	BucketName      string `json:"bucketName" yaml:"bucketName"`
+	Region          string `json:"region,omitempty" yaml:"region,omitempty"`
+	Endpoint        string `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
+	AccessKeyID     string `json:"accessKeyID,omitempty" yaml:"accessKeyID,omitempty"`
+	SecretAccessKey string `json:"secretAccessKey,omitempty" yaml:"secretAccessKey,omitempty"`
+	UsePathStyle    bool   `json:"usePathStyle,omitempty" yaml:"usePathStyle,omitempty"`
+	Insecure        bool   `json:"insecure,omitempty" yaml:"insecure,omitempty"`
+}
+
 type Collect struct {
-	ClusterInfo      *ClusterInfo      `json:"clusterInfo,omitempty" yaml:"clusterInfo,omitempty"`
-	ClusterResources *ClusterResources `json:"clusterResources,omitempty" yaml:"clusterResources,omitempty"`
-	Secret           *Secret           `json:"secret,omitempty" yaml:"secret,omitempty"`
-	CustomMetrics    *CustomMetrics    `json:"customMetrics,omitempty" yaml:"customMetrics,omitempty"`
-	ConfigMap        *ConfigMap        `json:"configMap,omitempty" yaml:"configMap,omitempty"`
-	Logs             *Logs             `json:"logs,omitempty" yaml:"logs,omitempty"`
-	Run              *Run              `json:"run,omitempty" yaml:"run,omitempty"`
-	RunPod           *RunPod           `json:"runPod,omitempty" yaml:"runPod,omitempty"`
-	RunDaemonSet     *RunDaemonSet     `json:"runDaemonSet,omitempty" yaml:"runDaemonSet,omitempty"`
-	Exec             *Exec             `json:"exec,omitempty" yaml:"exec,omitempty"`
-	Data             *Data             `json:"data,omitempty" yaml:"data,omitempty"`
-	Copy             *Copy             `json:"copy,omitempty" yaml:"copy,omitempty"`
-	CopyFromHost     *CopyFromHost     `json:"copyFromHost,omitempty" yaml:"copyFromHost,omitempty"`
-	HTTP             *HTTP             `json:"http,omitempty" yaml:"http,omitempty"`
-	Postgres         *Database         `json:"postgres,omitempty" yaml:"postgres,omitempty"`
-	Mssql            *Database         `json:"mssql,omitempty" yaml:"mssql,omitempty"`
-	Mysql            *Database         `json:"mysql,omitempty" yaml:"mysql,omitempty"`
-	Redis            *Database         `json:"redis,omitempty" yaml:"redis,omitempty"`
-	Collectd         *Collectd         `json:"collectd,omitempty" yaml:"collectd,omitempty"`
-	Ceph             *Ceph             `json:"ceph,omitempty" yaml:"ceph,omitempty"`
-	Longhorn         *Longhorn         `json:"longhorn,omitempty" yaml:"longhorn,omitempty"`
-	RegistryImages   *RegistryImages   `json:"registryImages,omitempty" yaml:"registryImages,omitempty"`
-	Sysctl           *Sysctl           `json:"sysctl,omitempty" yaml:"sysctl,omitempty"`
-	Certificates     *Certificates     `json:"certificates,omitempty" yaml:"certificates,omitempty"`
-	Helm             *Helm             `json:"helm,omitempty" yaml:"helm,omitempty"`
-	Goldpinger       *Goldpinger       `json:"goldpinger,omitempty" yaml:"goldpinger,omitempty"`
-	Sonobuoy         *Sonobuoy         `json:"sonobuoy,omitempty" yaml:"sonobuoy,omitempty"`
-	NodeMetrics      *NodeMetrics      `json:"nodeMetrics,omitempty" yaml:"nodeMetrics,omitempty"`
-	DNS              *DNS              `json:"dns,omitempty" yaml:"dns,omitempty"`
-	Etcd             *Etcd             `json:"etcd,omitempty" yaml:"etcd,omitempty"`
+	ClusterInfo           *ClusterInfo           `json:"clusterInfo,omitempty" yaml:"clusterInfo,omitempty"`
+	ClusterResources      *ClusterResources      `json:"clusterResources,omitempty" yaml:"clusterResources,omitempty"`
+	Secret                *Secret                `json:"secret,omitempty" yaml:"secret,omitempty"`
+	CustomMetrics         *CustomMetrics         `json:"customMetrics,omitempty" yaml:"customMetrics,omitempty"`
+	ConfigMap             *ConfigMap             `json:"configMap,omitempty" yaml:"configMap,omitempty"`
+	Logs                  *Logs                  `json:"logs,omitempty" yaml:"logs,omitempty"`
+	Run                   *Run                   `json:"run,omitempty" yaml:"run,omitempty"`
+	RunPod                *RunPod                `json:"runPod,omitempty" yaml:"runPod,omitempty"`
+	RunDaemonSet          *RunDaemonSet          `json:"runDaemonSet,omitempty" yaml:"runDaemonSet,omitempty"`
+	Exec                  *Exec                  `json:"exec,omitempty" yaml:"exec,omitempty"`
+	Data                  *Data                  `json:"data,omitempty" yaml:"data,omitempty"`
+	Copy                  *Copy                  `json:"copy,omitempty" yaml:"copy,omitempty"`
+	CopyFromHost          *CopyFromHost          `json:"copyFromHost,omitempty" yaml:"copyFromHost,omitempty"`
+	HTTP                  *HTTP                  `json:"http,omitempty" yaml:"http,omitempty"`
+	Postgres              *Database              `json:"postgres,omitempty" yaml:"postgres,omitempty"`
+	Mssql                 *Database              `json:"mssql,omitempty" yaml:"mssql,omitempty"`
+	Mysql                 *Database              `json:"mysql,omitempty" yaml:"mysql,omitempty"`
+	Redis                 *Database              `json:"redis,omitempty" yaml:"redis,omitempty"`
+	ClickHouse            *Database              `json:"clickhouse,omitempty" yaml:"clickhouse,omitempty"`
+	Collectd              *Collectd              `json:"collectd,omitempty" yaml:"collectd,omitempty"`
+	Ceph                  *Ceph                  `json:"ceph,omitempty" yaml:"ceph,omitempty"`
+	Longhorn              *Longhorn              `json:"longhorn,omitempty" yaml:"longhorn,omitempty"`
+	RegistryImages        *RegistryImages        `json:"registryImages,omitempty" yaml:"registryImages,omitempty"`
+	Sysctl                *Sysctl                `json:"sysctl,omitempty" yaml:"sysctl,omitempty"`
+	Certificates          *Certificates          `json:"certificates,omitempty" yaml:"certificates,omitempty"`
+	Helm                  *Helm                  `json:"helm,omitempty" yaml:"helm,omitempty"`
+	Goldpinger            *Goldpinger            `json:"goldpinger,omitempty" yaml:"goldpinger,omitempty"`
+	Sonobuoy              *Sonobuoy              `json:"sonobuoy,omitempty" yaml:"sonobuoy,omitempty"`
+	NodeMetrics           *NodeMetrics           `json:"nodeMetrics,omitempty" yaml:"nodeMetrics,omitempty"`
+	DNS                   *DNS                   `json:"dns,omitempty" yaml:"dns,omitempty"`
+	Etcd                  *Etcd                  `json:"etcd,omitempty" yaml:"etcd,omitempty"`
+	SupportBundleMetadata *SupportBundleMetadata `json:"supportBundleMetadata,omitempty" yaml:"supportBundleMetadata,omitempty"`
+	S3Status              *S3Status              `json:"s3Status,omitempty" yaml:"s3Status,omitempty"`
 }

 func (c *Collect) AccessReviewSpecs(overrideNS string) []authorizationv1.SelfSubjectAccessReviewSpec {
@@ -511,7 +530,7 @@ func (c *Collect) AccessReviewSpecs(overrideNS string) []authorizationv1.SelfSub
 		result = append(result, authorizationv1.SelfSubjectAccessReviewSpec{
 			ResourceAttributes: &authorizationv1.ResourceAttributes{
 				Namespace:   pickNamespaceOrDefault(c.Exec.Namespace, overrideNS),
-				Verb:        "get",
+				Verb:        "create",
 				Group:       "",
 				Version:     "",
 				Resource:    "pods",
@@ -536,7 +555,7 @@ func (c *Collect) AccessReviewSpecs(overrideNS string) []authorizationv1.SelfSub
 		result = append(result, authorizationv1.SelfSubjectAccessReviewSpec{
 			ResourceAttributes: &authorizationv1.ResourceAttributes{
 				Namespace:   pickNamespaceOrDefault(c.Copy.Namespace, overrideNS),
-				Verb:        "get",
+				Verb:        "create",
 				Group:       "",
 				Version:     "",
 				Resource:    "pods",
@@ -568,6 +587,21 @@ func (c *Collect) AccessReviewSpecs(overrideNS string) []authorizationv1.SelfSub
 		})
 	} else if c.Sysctl != nil {
 		// TODO
+	} else if c.SupportBundleMetadata != nil {
+		result = append(result, authorizationv1.SelfSubjectAccessReviewSpec{
+			ResourceAttributes: &authorizationv1.ResourceAttributes{
+				Namespace:   pickNamespaceOrDefault(c.SupportBundleMetadata.Namespace, overrideNS),
+				Verb:        "get",
+				Group:       "",
+				Version:     "",
+				Resource:    "secrets",
+				Subresource: "",
+				Name:        "replicated-support-metadata",
+			},
+			NonResourceAttributes: nil,
+		})
+	} else if c.S3Status != nil {
+		// NOOP
 	}

 	return result
@@ -647,6 +681,10 @@ func (c *Collect) GetName() string {
 		collector = "redis"
 		name = c.Redis.CollectorName
 	}
+	if c.ClickHouse != nil {
+		collector = "clickhouse"
+		name = c.ClickHouse.CollectorName
+	}
 	if c.Collectd != nil {
 		collector = "collectd"
 		name = c.Collectd.CollectorName
@@ -671,6 +709,14 @@ func (c *Collect) GetName() string {
 		collector = "certificates"
 		name = c.Certificates.CollectorName
 	}
+	if c.SupportBundleMetadata != nil {
+		collector = "support-bundle-metadata"
+		name = c.SupportBundleMetadata.CollectorName
+	}
+	if c.S3Status != nil {
+		collector = "s3Status"
+		name = c.S3Status.CollectorName
+	}

 	if collector == "" {
 		return "<none>"
@@ -60,12 +60,16 @@ type TimeAnalyze struct {
 	Outcomes      []*Outcome `json:"outcomes" yaml:"outcomes"`
 }

+// BlockDevicesAnalyze evaluates host-collected block device listings (lsblk-based).
 type BlockDevicesAnalyze struct {
 	AnalyzeMeta                `json:",inline" yaml:",inline"`
-	CollectorName              string     `json:"collectorName,omitempty" yaml:"collectorName,omitempty"`
-	MinimumAcceptableSize      uint64     `json:"minimumAcceptableSize" yaml:"minimumAcceptableSize"`
-	IncludeUnmountedPartitions bool       `json:"includeUnmountedPartitions" yaml:"includeUnmountedPartitions"`
-	Outcomes                   []*Outcome `json:"outcomes" yaml:"outcomes"`
+	CollectorName              string `json:"collectorName,omitempty" yaml:"collectorName,omitempty"`
+	MinimumAcceptableSize      uint64 `json:"minimumAcceptableSize" yaml:"minimumAcceptableSize"`
+	IncludeUnmountedPartitions bool   `json:"includeUnmountedPartitions" yaml:"includeUnmountedPartitions"`
+	// AdditionalDeviceTypes are extra lsblk TYPE values (e.g. loop, lvm) that may count toward outcomes,
+	// in addition to whole disks and (when IncludeUnmountedPartitions is set) partitions.
+	AdditionalDeviceTypes []string   `json:"additionalDeviceTypes,omitempty" yaml:"additionalDeviceTypes,omitempty"`
+	Outcomes              []*Outcome `json:"outcomes" yaml:"outcomes"`
 }

 type SystemPackagesAnalyze struct {
@@ -149,6 +153,12 @@ type HostSysctlAnalyze struct {
 	Outcomes      []*Outcome `json:"outcomes" yaml:"outcomes"`
 }

+type HostRegistryImagesAnalyze struct {
+	AnalyzeMeta   `json:",inline" yaml:",inline"`
+	CollectorName string     `json:"collectorName,omitempty" yaml:"collectorName,omitempty"`
+	Outcomes      []*Outcome `json:"outcomes" yaml:"outcomes"`
+}
+
 type HostAnalyze struct {
 	CPU                          *CPUAnalyze                          `json:"cpu,omitempty" yaml:"cpu,omitempty"`
 	TCPLoadBalancer              *TCPLoadBalancerAnalyze              `json:"tcpLoadBalancer,omitempty" yaml:"tcpLoadBalancer,omitempty"`
@@ -176,4 +186,5 @@ type HostAnalyze struct {
 	JsonCompare                  *JsonCompare                         `json:"jsonCompare,omitempty" yaml:"jsonCompare,omitempty"`
 	NetworkNamespaceConnectivity *NetworkNamespaceConnectivityAnalyze `json:"networkNamespaceConnectivity,omitempty" yaml:"networkNamespaceConnectivity,omitempty"`
 	Sysctl                       *HostSysctlAnalyze                   `json:"sysctl,omitempty" yaml:"sysctl,omitempty"`
+	RegistryImages               *HostRegistryImagesAnalyze           `json:"registryImages,omitempty" yaml:"registryImages,omitempty"`
 }
@@ -235,6 +235,16 @@ type HostSysctl struct {
 	HostCollectorMeta `json:",inline" yaml:",inline"`
 }

+// HostRegistryImages checks whether images are accessible from the host,
+// without requiring a Kubernetes cluster. Auth can be supplied inline via
+// Username/Password or omitted to rely on ambient credentials (e.g. ~/.docker/config.json).
+type HostRegistryImages struct {
+	HostCollectorMeta `json:",inline" yaml:",inline"`
+	Images            []string `json:"images" yaml:"images"`
+	Username          string   `json:"username,omitempty" yaml:"username,omitempty"`
+	Password          string   `json:"password,omitempty" yaml:"password,omitempty"`
+}
+
 type HostCollect struct {
 	CPU                          *CPU                              `json:"cpu,omitempty" yaml:"cpu,omitempty"`
 	Memory                       *Memory                           `json:"memory,omitempty" yaml:"memory,omitempty"`
@@ -265,6 +275,7 @@ type HostCollect struct {
 	HostDNS                      *HostDNS                          `json:"dns,omitempty" yaml:"dns,omitempty"`
 	NetworkNamespaceConnectivity *HostNetworkNamespaceConnectivity `json:"networkNamespaceConnectivity,omitempty" yaml:"networkNamespaceConnectivity,omitempty"`
 	HostSysctl                   *HostSysctl                       `json:"sysctl,omitempty" yaml:"sysctl,omitempty"`
+	RegistryImages               *HostRegistryImages               `json:"registryImages,omitempty" yaml:"registryImages,omitempty"`
 }

 // GetName gets the name of the collector
@@ -65,6 +65,11 @@ func (in *Analyze) DeepCopyInto(out *Analyze) {
 		*out = new(StorageClass)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.IngressClass != nil {
+		in, out := &in.IngressClass, &out.IngressClass
+		*out = new(IngressClass)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.CustomResourceDefinition != nil {
 		in, out := &in.CustomResourceDefinition, &out.CustomResourceDefinition
 		*out = new(CustomResourceDefinition)
@@ -170,6 +175,11 @@ func (in *Analyze) DeepCopyInto(out *Analyze) {
 		*out = new(DatabaseAnalyze)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ClickHouse != nil {
+		in, out := &in.ClickHouse, &out.ClickHouse
+		*out = new(DatabaseAnalyze)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.CephStatus != nil {
 		in, out := &in.CephStatus, &out.CephStatus
 		*out = new(CephStatusAnalyze)
@@ -230,6 +240,11 @@ func (in *Analyze) DeepCopyInto(out *Analyze) {
 		*out = new(HTTPAnalyze)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.S3Status != nil {
+		in, out := &in.S3Status, &out.S3Status
+		*out = new(DatabaseAnalyze)
+		(*in).DeepCopyInto(*out)
+	}
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Analyze.
@@ -443,6 +458,11 @@ func (in *AnalyzerStatus) DeepCopy() *AnalyzerStatus {
 func (in *BlockDevicesAnalyze) DeepCopyInto(out *BlockDevicesAnalyze) {
 	*out = *in
 	in.AnalyzeMeta.DeepCopyInto(&out.AnalyzeMeta)
+	if in.AdditionalDeviceTypes != nil {
+		in, out := &in.AdditionalDeviceTypes, &out.AdditionalDeviceTypes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	if in.Outcomes != nil {
 		in, out := &in.Outcomes, &out.Outcomes
 		*out = make([]*Outcome, len(*in))
@@ -920,6 +940,11 @@ func (in *Collect) DeepCopyInto(out *Collect) {
 		*out = new(Database)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ClickHouse != nil {
+		in, out := &in.ClickHouse, &out.ClickHouse
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.Collectd != nil {
 		in, out := &in.Collectd, &out.Collectd
 		*out = new(Collectd)
@@ -980,6 +1005,16 @@ func (in *Collect) DeepCopyInto(out *Collect) {
 		*out = new(Etcd)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.SupportBundleMetadata != nil {
+		in, out := &in.SupportBundleMetadata, &out.SupportBundleMetadata
+		*out = new(SupportBundleMetadata)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.S3Status != nil {
+		in, out := &in.S3Status, &out.S3Status
+		*out = new(S3Status)
+		(*in).DeepCopyInto(*out)
+	}
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Collect.
@@ -1974,6 +2009,11 @@ func (in *HostAnalyze) DeepCopyInto(out *HostAnalyze) {
 		*out = new(HostSysctlAnalyze)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.RegistryImages != nil {
+		in, out := &in.RegistryImages, &out.RegistryImages
+		*out = new(HostRegistryImagesAnalyze)
+		(*in).DeepCopyInto(*out)
+	}
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostAnalyze.
@@ -2214,6 +2254,11 @@ func (in *HostCollect) DeepCopyInto(out *HostCollect) {
 		*out = new(HostSysctl)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.RegistryImages != nil {
+		in, out := &in.RegistryImages, &out.RegistryImages
+		*out = new(HostRegistryImages)
+		(*in).DeepCopyInto(*out)
+	}
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostCollect.
@@ -2659,6 +2704,54 @@ func (in *HostPreflightStatus) DeepCopy() *HostPreflightStatus {
 	return out
 }

+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HostRegistryImages) DeepCopyInto(out *HostRegistryImages) {
+	*out = *in
+	in.HostCollectorMeta.DeepCopyInto(&out.HostCollectorMeta)
+	if in.Images != nil {
+		in, out := &in.Images, &out.Images
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostRegistryImages.
+func (in *HostRegistryImages) DeepCopy() *HostRegistryImages {
+	if in == nil {
+		return nil
+	}
+	out := new(HostRegistryImages)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HostRegistryImagesAnalyze) DeepCopyInto(out *HostRegistryImagesAnalyze) {
+	*out = *in
+	in.AnalyzeMeta.DeepCopyInto(&out.AnalyzeMeta)
+	if in.Outcomes != nil {
+		in, out := &in.Outcomes, &out.Outcomes
+		*out = make([]*Outcome, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Outcome)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostRegistryImagesAnalyze.
+func (in *HostRegistryImagesAnalyze) DeepCopy() *HostRegistryImagesAnalyze {
+	if in == nil {
+		return nil
+	}
+	out := new(HostRegistryImagesAnalyze)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HostRun) DeepCopyInto(out *HostRun) {
 	*out = *in
@@ -3039,6 +3132,33 @@ func (in *Ingress) DeepCopy() *Ingress {
 	return out
 }

+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IngressClass) DeepCopyInto(out *IngressClass) {
+	*out = *in
+	in.AnalyzeMeta.DeepCopyInto(&out.AnalyzeMeta)
+	if in.Outcomes != nil {
+		in, out := &in.Outcomes, &out.Outcomes
+		*out = make([]*Outcome, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Outcome)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressClass.
+func (in *IngressClass) DeepCopy() *IngressClass {
+	if in == nil {
+		return nil
+	}
+	out := new(IngressClass)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *JobStatus) DeepCopyInto(out *JobStatus) {
 	*out = *in
@@ -4671,6 +4791,22 @@ func (in *RunPod) DeepCopy() *RunPod {
 	return out
 }

+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *S3Status) DeepCopyInto(out *S3Status) {
+	*out = *in
+	in.CollectorMeta.DeepCopyInto(&out.CollectorMeta)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new S3Status.
+func (in *S3Status) DeepCopy() *S3Status {
+	if in == nil {
+		return nil
+	}
+	out := new(S3Status)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Secret) DeepCopyInto(out *Secret) {
 	*out = *in
@@ -4911,6 +5047,22 @@ func (in *SupportBundleList) DeepCopyObject() runtime.Object {
 	return nil
 }

+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundleMetadata) DeepCopyInto(out *SupportBundleMetadata) {
+	*out = *in
+	in.CollectorMeta.DeepCopyInto(&out.CollectorMeta)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundleMetadata.
+func (in *SupportBundleMetadata) DeepCopy() *SupportBundleMetadata {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundleMetadata)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SupportBundleSpec) DeepCopyInto(out *SupportBundleSpec) {
 	*out = *in
@@ -0,0 +1,79 @@
+package v1beta3
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/multitype"
+)
+
+// CollectorMeta contains metadata for collectors
+type CollectorMeta struct {
+	CollectorName string `json:"collectorName,omitempty" yaml:"collectorName,omitempty"`
+	// +optional
+	Exclude *multitype.BoolOrString `json:"exclude,omitempty" yaml:"exclude,omitempty"`
+}
+
+// Database represents database collectors (PostgreSQL, MySQL, Redis, MSSQL)
+// In v1beta3, URI and TLS fields support valueFrom references
+type Database struct {
+	CollectorMeta `json:",inline" yaml:",inline"`
+	// URI can be a literal value or reference to a Secret/ConfigMap
+	URI StringOrValueFrom `json:"uri" yaml:"uri"`
+	// Parameters for the database connection
+	Parameters []string `json:"parameters,omitempty"`
+	// TLS configuration with support for valueFrom references
+	TLS *TLSParams `json:"tls,omitempty" yaml:"tls,omitempty"`
+}
+
+// TLSParams contains TLS configuration
+// In v1beta3, certificate fields support valueFrom references
+type TLSParams struct {
+	// SkipVerify disables TLS verification
+	SkipVerify bool `json:"skipVerify,omitempty" yaml:"skipVerify,omitempty"`
+	// Secret references a Kubernetes Secret containing TLS materials (v1beta2 compatibility)
+	Secret *TLSSecret `json:"secret,omitempty" yaml:"secret,omitempty"`
+	// CACert can be a literal value or reference to a Secret/ConfigMap
+	CACert StringOrValueFrom `json:"cacert,omitempty" yaml:"cacert,omitempty"`
+	// ClientCert can be a literal value or reference to a Secret/ConfigMap
+	ClientCert StringOrValueFrom `json:"clientCert,omitempty" yaml:"clientCert,omitempty"`
+	// ClientKey can be a literal value or reference to a Secret/ConfigMap
+	ClientKey StringOrValueFrom `json:"clientKey,omitempty" yaml:"clientKey,omitempty"`
+}
+
+// TLSSecret references a Kubernetes Secret containing TLS materials
+// Maintained for backward compatibility
+type TLSSecret struct {
+	Name      string `json:"name" yaml:"name"`
+	Namespace string `json:"namespace" yaml:"namespace"`
+}
+
+// Temporary placeholder types for minimal v1beta3 implementation
+// These will be properly defined as we expand v1beta3 support
+type AfterCollection struct {
+	CollectorMeta `json:",inline" yaml:",inline"`
+	// TODO: Add fields as needed
+}
+
+type Analyze struct {
+	// TODO: Add fields as needed
+}
+
+type HostAnalyze struct {
+	// TODO: Add fields as needed
+}
+
+type HostCollect struct {
+	// TODO: Add fields as needed
+}
+
+// Collect contains all collector definitions
+// For phase 1, we're focusing on Database collectors with StringOrValueFrom support
+type Collect struct {
+	// Database collectors with v1beta3 StringOrValueFrom support
+	Postgres   *Database `json:"postgres,omitempty" yaml:"postgres,omitempty"`
+	Mssql      *Database `json:"mssql,omitempty" yaml:"mssql,omitempty"`
+	Mysql      *Database `json:"mysql,omitempty" yaml:"mysql,omitempty"`
+	Redis      *Database `json:"redis,omitempty" yaml:"redis,omitempty"`
+	ClickHouse *Database `json:"clickhouse,omitempty" yaml:"clickhouse,omitempty"`
+
+	// TODO: Add remaining collector types as we expand v1beta3 support
+	// For now, these are placeholders to make the types compile
+}
@@ -0,0 +1,170 @@
+package v1beta3
+
+import (
+	"context"
+	"fmt"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"k8s.io/client-go/kubernetes"
+)
+
+// ConvertToV1Beta2WithResolution converts a v1beta3 SupportBundleSpec to v1beta2
+// by resolving all StringOrValueFrom fields to their actual values
+func ConvertToV1Beta2WithResolution(
+	ctx context.Context,
+	v3spec *SupportBundleSpec,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (*troubleshootv1beta2.SupportBundleSpec, error) {
+	v2spec := &troubleshootv1beta2.SupportBundleSpec{
+		Uri:                    v3spec.Uri,
+		RunHostCollectorsInPod: v3spec.RunHostCollectorsInPod,
+	}
+
+	// Convert collectors
+	if v3spec.Collectors != nil {
+		v2collectors := make([]*troubleshootv1beta2.Collect, 0, len(v3spec.Collectors))
+		for _, v3collector := range v3spec.Collectors {
+			v2collector, err := convertCollector(ctx, v3collector, client, defaultNamespace)
+			if err != nil {
+				return nil, fmt.Errorf("failed to convert collector: %w", err)
+			}
+			v2collectors = append(v2collectors, v2collector)
+		}
+		v2spec.Collectors = v2collectors
+	}
+
+	// TODO: Convert AfterCollection, HostCollectors, Analyzers, HostAnalyzers when v1beta3 support is expanded
+
+	return v2spec, nil
+}
+
+// convertCollector converts a v1beta3 Collect to v1beta2 Collect
+func convertCollector(
+	ctx context.Context,
+	v3collector *Collect,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (*troubleshootv1beta2.Collect, error) {
+	v2collector := &troubleshootv1beta2.Collect{}
+
+	// Convert database collectors
+	if v3collector.Postgres != nil {
+		db, err := convertDatabase(ctx, v3collector.Postgres, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert postgres collector: %w", err)
+		}
+		v2collector.Postgres = db
+	}
+
+	if v3collector.Mysql != nil {
+		db, err := convertDatabase(ctx, v3collector.Mysql, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert mysql collector: %w", err)
+		}
+		v2collector.Mysql = db
+	}
+
+	if v3collector.Mssql != nil {
+		db, err := convertDatabase(ctx, v3collector.Mssql, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert mssql collector: %w", err)
+		}
+		v2collector.Mssql = db
+	}
+
+	if v3collector.Redis != nil {
+		db, err := convertDatabase(ctx, v3collector.Redis, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert redis collector: %w", err)
+		}
+		v2collector.Redis = db
+	}
+
+	if v3collector.ClickHouse != nil {
+		db, err := convertDatabase(ctx, v3collector.ClickHouse, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert clickhouse collector: %w", err)
+		}
+		v2collector.ClickHouse = db
+	}
+
+	// TODO: Add conversion for other collector types as v1beta3 support expands
+
+	return v2collector, nil
+}
+
+// convertDatabase converts a v1beta3 Database to v1beta2 Database
+func convertDatabase(
+	ctx context.Context,
+	v3db *Database,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (*troubleshootv1beta2.Database, error) {
+	// Resolve URI
+	uri, err := ResolveStringOrValueFrom(ctx, v3db.URI, client, defaultNamespace)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve database URI: %w", err)
+	}
+
+	v2db := &troubleshootv1beta2.Database{
+		CollectorMeta: troubleshootv1beta2.CollectorMeta{
+			CollectorName: v3db.CollectorName,
+			Exclude:       v3db.Exclude,
+		},
+		URI:        uri,
+		Parameters: v3db.Parameters,
+	}
+
+	// Convert TLS params if present
+	if v3db.TLS != nil {
+		tlsParams, err := convertTLSParams(ctx, v3db.TLS, client, defaultNamespace)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert TLS params: %w", err)
+		}
+		v2db.TLS = tlsParams
+	}
+
+	return v2db, nil
+}
+
+// convertTLSParams converts v1beta3 TLSParams to v1beta2 TLSParams
+func convertTLSParams(
+	ctx context.Context,
+	v3tls *TLSParams,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (*troubleshootv1beta2.TLSParams, error) {
+	v2tls := &troubleshootv1beta2.TLSParams{
+		SkipVerify: v3tls.SkipVerify,
+	}
+
+	// Preserve v1beta2 Secret reference if present (backward compatibility)
+	if v3tls.Secret != nil {
+		v2tls.Secret = &troubleshootv1beta2.TLSSecret{
+			Name:      v3tls.Secret.Name,
+			Namespace: v3tls.Secret.Namespace,
+		}
+	}
+
+	// Resolve v1beta3 StringOrValueFrom fields
+	caCert, err := ResolveStringOrValueFrom(ctx, v3tls.CACert, client, defaultNamespace)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve CA cert: %w", err)
+	}
+	v2tls.CACert = caCert
+
+	clientCert, err := ResolveStringOrValueFrom(ctx, v3tls.ClientCert, client, defaultNamespace)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve client cert: %w", err)
+	}
+	v2tls.ClientCert = clientCert
+
+	clientKey, err := ResolveStringOrValueFrom(ctx, v3tls.ClientKey, client, defaultNamespace)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve client key: %w", err)
+	}
+	v2tls.ClientKey = clientKey
+
+	return v2tls, nil
+}
@@ -0,0 +1,410 @@
+package v1beta3
+
+import (
+	"context"
+	"testing"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+func TestConvertToV1Beta2WithResolution_PostgresWithLiteralValue(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	uri := "postgresql://user:pass@localhost:5432/db"
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						Value: &uri,
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	assert.Equal(t, "postgresql://user:pass@localhost:5432/db", v2spec.Collectors[0].Postgres.URI)
+}
+
+func TestConvertToV1Beta2WithResolution_PostgresWithSecretRef(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "db-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("postgresql://user:secret-pass@db.example.com:5432/mydb"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "db-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	assert.Equal(t, "postgresql://user:secret-pass@db.example.com:5432/mydb", v2spec.Collectors[0].Postgres.URI)
+}
+
+func TestConvertToV1Beta2WithResolution_PostgresWithTLS(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "tls-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"ca.crt":     []byte("-----BEGIN CERTIFICATE-----\nCA_CERT_DATA\n-----END CERTIFICATE-----"),
+			"client.crt": []byte("-----BEGIN CERTIFICATE-----\nCLIENT_CERT_DATA\n-----END CERTIFICATE-----"),
+			"client.key": []byte("-----BEGIN PRIVATE KEY-----\nCLIENT_KEY_DATA\n-----END PRIVATE KEY-----"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+	uri := "postgresql://user:pass@localhost:5432/db"
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						Value: &uri,
+					},
+					TLS: &TLSParams{
+						CACert: StringOrValueFrom{
+							ValueFrom: &ValueFromSource{
+								SecretKeyRef: &SecretKeyRef{
+									Name: "tls-secret",
+									Key:  "ca.crt",
+								},
+							},
+						},
+						ClientCert: StringOrValueFrom{
+							ValueFrom: &ValueFromSource{
+								SecretKeyRef: &SecretKeyRef{
+									Name: "tls-secret",
+									Key:  "client.crt",
+								},
+							},
+						},
+						ClientKey: StringOrValueFrom{
+							ValueFrom: &ValueFromSource{
+								SecretKeyRef: &SecretKeyRef{
+									Name: "tls-secret",
+									Key:  "client.key",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	require.NotNil(t, v2spec.Collectors[0].Postgres.TLS)
+
+	assert.Equal(t, "-----BEGIN CERTIFICATE-----\nCA_CERT_DATA\n-----END CERTIFICATE-----", v2spec.Collectors[0].Postgres.TLS.CACert)
+	assert.Equal(t, "-----BEGIN CERTIFICATE-----\nCLIENT_CERT_DATA\n-----END CERTIFICATE-----", v2spec.Collectors[0].Postgres.TLS.ClientCert)
+	assert.Equal(t, "-----BEGIN PRIVATE KEY-----\nCLIENT_KEY_DATA\n-----END PRIVATE KEY-----", v2spec.Collectors[0].Postgres.TLS.ClientKey)
+}
+
+func TestConvertToV1Beta2WithResolution_MultipleDatabases(t *testing.T) {
+	pgSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "postgres-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("postgresql://user:pass@pg.example.com:5432/db"),
+		},
+	}
+
+	mysqlSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mysql-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("mysql://user:pass@mysql.example.com:3306/db"),
+		},
+	}
+
+	redisSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "redis-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("redis://redis.example.com:6379"),
+		},
+	}
+
+	clickhouseSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "clickhouse-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("http://clickhouse.example.com:9000"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(pgSecret, mysqlSecret, redisSecret, clickhouseSecret)
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "postgres-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+			{
+				Mysql: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "mysql-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+			{
+				Redis: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "redis-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+			{
+				ClickHouse: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "clickhouse-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 4)
+
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	assert.Equal(t, "postgresql://user:pass@pg.example.com:5432/db", v2spec.Collectors[0].Postgres.URI)
+
+	require.NotNil(t, v2spec.Collectors[1].Mysql)
+	assert.Equal(t, "mysql://user:pass@mysql.example.com:3306/db", v2spec.Collectors[1].Mysql.URI)
+
+	require.NotNil(t, v2spec.Collectors[2].Redis)
+	assert.Equal(t, "redis://redis.example.com:6379", v2spec.Collectors[2].Redis.URI)
+	require.NotNil(t, v2spec.Collectors[3].ClickHouse)
+	assert.Equal(t, "http://clickhouse.example.com:9000", v2spec.Collectors[3].ClickHouse.URI)
+}
+
+func TestConvertToV1Beta2WithResolution_SecretNotFound(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						ValueFrom: &ValueFromSource{
+							SecretKeyRef: &SecretKeyRef{
+								Name: "nonexistent-secret",
+								Key:  "uri",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	_, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to convert collector")
+	assert.Contains(t, err.Error(), "failed to resolve database URI")
+}
+
+func TestConvertToV1Beta2WithResolution_PreservesCollectorMeta(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	uri := "postgresql://user:pass@localhost:5432/db"
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					CollectorMeta: CollectorMeta{
+						CollectorName: "my-postgres-collector",
+					},
+					URI: StringOrValueFrom{
+						Value: &uri,
+					},
+					Parameters: []string{"sslmode=require"},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+
+	assert.Equal(t, "my-postgres-collector", v2spec.Collectors[0].Postgres.CollectorName)
+	assert.Equal(t, []string{"sslmode=require"}, v2spec.Collectors[0].Postgres.Parameters)
+}
+
+func TestConvertToV1Beta2WithResolution_TLSBackwardCompatibility(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	uri := "postgresql://user:pass@localhost:5432/db"
+
+	v3spec := &SupportBundleSpec{
+		Collectors: []*Collect{
+			{
+				Postgres: &Database{
+					URI: StringOrValueFrom{
+						Value: &uri,
+					},
+					TLS: &TLSParams{
+						SkipVerify: true,
+						Secret: &TLSSecret{
+							Name:      "old-tls-secret",
+							Namespace: "default",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	require.Len(t, v2spec.Collectors, 1)
+	require.NotNil(t, v2spec.Collectors[0].Postgres)
+	require.NotNil(t, v2spec.Collectors[0].Postgres.TLS)
+
+	assert.True(t, v2spec.Collectors[0].Postgres.TLS.SkipVerify)
+	require.NotNil(t, v2spec.Collectors[0].Postgres.TLS.Secret)
+	assert.Equal(t, "old-tls-secret", v2spec.Collectors[0].Postgres.TLS.Secret.Name)
+	assert.Equal(t, "default", v2spec.Collectors[0].Postgres.TLS.Secret.Namespace)
+}
+
+func TestConvertToV1Beta2WithResolution_EmptySpec(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	v3spec := &SupportBundleSpec{}
+
+	v2spec, err := ConvertToV1Beta2WithResolution(context.Background(), v3spec, client, "default")
+	require.NoError(t, err)
+	require.NotNil(t, v2spec)
+	assert.Nil(t, v2spec.Collectors)
+}
+
+func TestConvertDatabase_AllDatabaseTypes(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "db-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"uri": []byte("test-uri"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	v3db := &Database{
+		URI: StringOrValueFrom{
+			ValueFrom: &ValueFromSource{
+				SecretKeyRef: &SecretKeyRef{
+					Name: "db-secret",
+					Key:  "uri",
+				},
+			},
+		},
+	}
+
+	// Test that the same database struct works for all DB types
+	ctx := context.Background()
+
+	pgDB, err := convertDatabase(ctx, v3db, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "test-uri", pgDB.URI)
+
+	mysqlDB, err := convertDatabase(ctx, v3db, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "test-uri", mysqlDB.URI)
+
+	mssqlDB, err := convertDatabase(ctx, v3db, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "test-uri", mssqlDB.URI)
+
+	redisDB, err := convertDatabase(ctx, v3db, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "test-uri", redisDB.URI)
+}
+
+// Helper function to convert v2spec back to ensure type compatibility
+func ensureV2SpecCompatibility(v2spec *troubleshootv1beta2.SupportBundleSpec) {
+	// This function just exists to ensure the types are compatible
+	// If this compiles, we know the conversion produces valid v1beta2 types
+	_ = v2spec.Uri
+	_ = v2spec.Collectors
+	_ = v2spec.Analyzers
+}
@@ -0,0 +1,6 @@
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=troubleshoot.sh
+
+// Package v1beta3 is the v1beta3 version of the API.
+package v1beta3
@@ -0,0 +1,46 @@
+/*
+Copyright 2019 Replicated, Inc..
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// NOTE: Boilerplate only.  Ignore this file.
+
+// Package v1beta3 contains API Schema definitions for the troubleshoot v1beta3 API group
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package,register
+// +k8s:conversion-gen=github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=troubleshoot.sh
+package v1beta3
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// SchemeGroupVersion is group version used to register these objects
+	SchemeGroupVersion = schema.GroupVersion{Group: "troubleshoot.sh", Version: "v1beta3"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
+
+	// AddToScheme is required by pkg/client/...
+	AddToScheme = SchemeBuilder.AddToScheme
+)
+
+// Resource is required by pkg/client/listers/...
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
@@ -0,0 +1,117 @@
+package v1beta3
+
+import (
+	"context"
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+// ResolveStringOrValueFrom resolves a StringOrValueFrom to its actual string value
+// by fetching from Secrets or ConfigMaps as needed.
+//
+// Parameters:
+//   - ctx: Context for the resolution operation
+//   - sov: The StringOrValueFrom to resolve
+//   - client: Kubernetes client for fetching Secrets/ConfigMaps
+//   - defaultNamespace: Namespace to use when not specified in the reference
+//
+// Returns:
+//   - The resolved string value
+//   - An error if resolution fails (unless Optional is true)
+func ResolveStringOrValueFrom(
+	ctx context.Context,
+	sov StringOrValueFrom,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (string, error) {
+	// If Value is directly specified, use it
+	if sov.Value != nil {
+		return *sov.Value, nil
+	}
+
+	// If ValueFrom is not specified, return empty string
+	if sov.ValueFrom == nil {
+		return "", nil
+	}
+
+	// Resolve from SecretKeyRef
+	if sov.ValueFrom.SecretKeyRef != nil {
+		return resolveSecretKeyRef(ctx, sov.ValueFrom.SecretKeyRef, client, defaultNamespace)
+	}
+
+	// Resolve from ConfigMapKeyRef
+	if sov.ValueFrom.ConfigMapKeyRef != nil {
+		return resolveConfigMapKeyRef(ctx, sov.ValueFrom.ConfigMapKeyRef, client, defaultNamespace)
+	}
+
+	return "", nil
+}
+
+// resolveSecretKeyRef fetches a value from a Kubernetes Secret
+func resolveSecretKeyRef(
+	ctx context.Context,
+	ref *SecretKeyRef,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (string, error) {
+	namespace := ref.Namespace
+	if namespace == "" {
+		namespace = defaultNamespace
+	}
+
+	secret, err := client.CoreV1().Secrets(namespace).Get(ctx, ref.Name, metav1.GetOptions{})
+	if err != nil {
+		if isOptional(ref.Optional) {
+			return "", nil
+		}
+		return "", fmt.Errorf("failed to get secret %s/%s: %w", namespace, ref.Name, err)
+	}
+
+	value, ok := secret.Data[ref.Key]
+	if !ok {
+		if isOptional(ref.Optional) {
+			return "", nil
+		}
+		return "", fmt.Errorf("key %q not found in secret %s/%s", ref.Key, namespace, ref.Name)
+	}
+
+	return string(value), nil
+}
+
+// resolveConfigMapKeyRef fetches a value from a Kubernetes ConfigMap
+func resolveConfigMapKeyRef(
+	ctx context.Context,
+	ref *ConfigMapKeyRef,
+	client kubernetes.Interface,
+	defaultNamespace string,
+) (string, error) {
+	namespace := ref.Namespace
+	if namespace == "" {
+		namespace = defaultNamespace
+	}
+
+	configMap, err := client.CoreV1().ConfigMaps(namespace).Get(ctx, ref.Name, metav1.GetOptions{})
+	if err != nil {
+		if isOptional(ref.Optional) {
+			return "", nil
+		}
+		return "", fmt.Errorf("failed to get configmap %s/%s: %w", namespace, ref.Name, err)
+	}
+
+	value, ok := configMap.Data[ref.Key]
+	if !ok {
+		if isOptional(ref.Optional) {
+			return "", nil
+		}
+		return "", fmt.Errorf("key %q not found in configmap %s/%s", ref.Key, namespace, ref.Name)
+	}
+
+	return value, nil
+}
+
+// isOptional checks if the optional flag is set to true
+func isOptional(optional *bool) bool {
+	return optional != nil && *optional
+}
@@ -0,0 +1,333 @@
+package v1beta3
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+func TestResolveStringOrValueFrom_LiteralValue(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	value := "literal-value"
+
+	sov := StringOrValueFrom{
+		Value: &value,
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "literal-value", result)
+}
+
+func TestResolveStringOrValueFrom_EmptyValue(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	sov := StringOrValueFrom{}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"password": []byte("super-secret-password"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name: "test-secret",
+				Key:  "password",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "super-secret-password", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_WithNamespace(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "custom-namespace",
+		},
+		Data: map[string][]byte{
+			"password": []byte("secret-from-custom-ns"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name:      "test-secret",
+				Key:       "password",
+				Namespace: "custom-namespace",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "secret-from-custom-ns", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_NotFound(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name: "nonexistent-secret",
+				Key:  "password",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to get secret")
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_KeyNotFound(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"password": []byte("secret-value"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name: "test-secret",
+				Key:  "nonexistent-key",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "key \"nonexistent-key\" not found")
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_Optional(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	optional := true
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name:     "nonexistent-secret",
+				Key:      "password",
+				Optional: &optional,
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_SecretKeyRef_OptionalKeyNotFound(t *testing.T) {
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "default",
+		},
+		Data: map[string][]byte{
+			"password": []byte("secret-value"),
+		},
+	}
+
+	client := fake.NewSimpleClientset(secret)
+	optional := true
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			SecretKeyRef: &SecretKeyRef{
+				Name:     "test-secret",
+				Key:      "nonexistent-key",
+				Optional: &optional,
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef(t *testing.T) {
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-configmap",
+			Namespace: "default",
+		},
+		Data: map[string]string{
+			"config-key": "config-value",
+		},
+	}
+
+	client := fake.NewSimpleClientset(configMap)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name: "test-configmap",
+				Key:  "config-key",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "config-value", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_WithNamespace(t *testing.T) {
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-configmap",
+			Namespace: "custom-namespace",
+		},
+		Data: map[string]string{
+			"config-key": "config-from-custom-ns",
+		},
+	}
+
+	client := fake.NewSimpleClientset(configMap)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name:      "test-configmap",
+				Key:       "config-key",
+				Namespace: "custom-namespace",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "config-from-custom-ns", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_NotFound(t *testing.T) {
+	client := fake.NewSimpleClientset()
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name: "nonexistent-configmap",
+				Key:  "config-key",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to get configmap")
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_KeyNotFound(t *testing.T) {
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-configmap",
+			Namespace: "default",
+		},
+		Data: map[string]string{
+			"config-key": "config-value",
+		},
+	}
+
+	client := fake.NewSimpleClientset(configMap)
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name: "test-configmap",
+				Key:  "nonexistent-key",
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "key \"nonexistent-key\" not found")
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_Optional(t *testing.T) {
+	client := fake.NewSimpleClientset()
+	optional := true
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name:     "nonexistent-configmap",
+				Key:      "config-key",
+				Optional: &optional,
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
+
+func TestResolveStringOrValueFrom_ConfigMapKeyRef_OptionalKeyNotFound(t *testing.T) {
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-configmap",
+			Namespace: "default",
+		},
+		Data: map[string]string{
+			"config-key": "config-value",
+		},
+	}
+
+	client := fake.NewSimpleClientset(configMap)
+	optional := true
+
+	sov := StringOrValueFrom{
+		ValueFrom: &ValueFromSource{
+			ConfigMapKeyRef: &ConfigMapKeyRef{
+				Name:     "test-configmap",
+				Key:      "nonexistent-key",
+				Optional: &optional,
+			},
+		},
+	}
+
+	result, err := ResolveStringOrValueFrom(context.Background(), sov, client, "default")
+	require.NoError(t, err)
+	assert.Equal(t, "", result)
+}
@@ -0,0 +1,64 @@
+package v1beta3
+
+// StringOrValueFrom represents a string value that can either be specified
+// directly or sourced from a Kubernetes Secret or ConfigMap
+type StringOrValueFrom struct {
+	// Value is a literal string value
+	// +optional
+	Value *string `json:"value,omitempty" yaml:"value,omitempty"`
+
+	// ValueFrom is a reference to a value in a Secret or ConfigMap
+	// +optional
+	ValueFrom *ValueFromSource `json:"valueFrom,omitempty" yaml:"valueFrom,omitempty"`
+}
+
+// ValueFromSource represents the source of a value from a Secret or ConfigMap
+type ValueFromSource struct {
+	// SecretKeyRef references a key in a Secret
+	// +optional
+	SecretKeyRef *SecretKeyRef `json:"secretKeyRef,omitempty" yaml:"secretKeyRef,omitempty"`
+
+	// ConfigMapKeyRef references a key in a ConfigMap
+	// +optional
+	ConfigMapKeyRef *ConfigMapKeyRef `json:"configMapKeyRef,omitempty" yaml:"configMapKeyRef,omitempty"`
+}
+
+// SecretKeyRef references a specific key in a Kubernetes Secret
+type SecretKeyRef struct {
+	// Name is the name of the Secret
+	Name string `json:"name" yaml:"name"`
+
+	// Key is the key within the Secret to read
+	Key string `json:"key" yaml:"key"`
+
+	// Namespace is the namespace of the Secret
+	// If not specified, defaults to the namespace where the SupportBundle is running
+	// +optional
+	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+
+	// Optional specifies whether the Secret must exist
+	// If true and the Secret or key doesn't exist, resolves to empty string
+	// If false (default) and the Secret or key doesn't exist, resolution fails
+	// +optional
+	Optional *bool `json:"optional,omitempty" yaml:"optional,omitempty"`
+}
+
+// ConfigMapKeyRef references a specific key in a Kubernetes ConfigMap
+type ConfigMapKeyRef struct {
+	// Name is the name of the ConfigMap
+	Name string `json:"name" yaml:"name"`
+
+	// Key is the key within the ConfigMap to read
+	Key string `json:"key" yaml:"key"`
+
+	// Namespace is the namespace of the ConfigMap
+	// If not specified, defaults to the namespace where the SupportBundle is running
+	// +optional
+	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+
+	// Optional specifies whether the ConfigMap must exist
+	// If true and the ConfigMap or key doesn't exist, resolves to empty string
+	// If false (default) and the ConfigMap or key doesn't exist, resolution fails
+	// +optional
+	Optional *bool `json:"optional,omitempty" yaml:"optional,omitempty"`
+}
@@ -0,0 +1,65 @@
+/*
+Copyright 2019 Replicated, Inc..
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// SupportBundleSpec defines the desired state of SupportBundle
+type SupportBundleSpec struct {
+	AfterCollection []*AfterCollection `json:"afterCollection,omitempty" yaml:"afterCollection,omitempty"`
+	Collectors      []*Collect         `json:"collectors,omitempty" yaml:"collectors,omitempty"`
+	HostCollectors  []*HostCollect     `json:"hostCollectors,omitempty" yaml:"hostCollectors,omitempty"`
+	Analyzers       []*Analyze         `json:"analyzers,omitempty" yaml:"analyzers,omitempty"`
+	HostAnalyzers   []*HostAnalyze     `json:"hostAnalyzers,omitempty" yaml:"hostAnalyzers,omitempty"`
+	// URI optionally defines a location which is the source of this spec to allow updating of the spec at runtime
+	Uri                    string `json:"uri,omitempty" yaml:"uri,omitempty"`
+	RunHostCollectorsInPod bool   `json:"runHostCollectorsInPod,omitempty" yaml:"runHostCollectorsInPod,omitempty"`
+}
+
+// SupportBundleStatus defines the observed state of SupportBundle
+type SupportBundleStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+}
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// SupportBundle is the Schema for the SupportBundles API
+// +k8s:openapi-gen=true
+type SupportBundle struct {
+	metav1.TypeMeta   `json:",inline" yaml:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+
+	Spec   SupportBundleSpec   `json:"spec,omitempty" yaml:"spec,omitempty"`
+	Status SupportBundleStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// SupportBundleList contains a list of SupportBundle
+type SupportBundleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []SupportBundle `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&SupportBundle{}, &SupportBundleList{})
+}
@@ -0,0 +1,446 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2019 Replicated, Inc..
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1beta3
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/multitype"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AfterCollection) DeepCopyInto(out *AfterCollection) {
+	*out = *in
+	in.CollectorMeta.DeepCopyInto(&out.CollectorMeta)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AfterCollection.
+func (in *AfterCollection) DeepCopy() *AfterCollection {
+	if in == nil {
+		return nil
+	}
+	out := new(AfterCollection)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Analyze) DeepCopyInto(out *Analyze) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Analyze.
+func (in *Analyze) DeepCopy() *Analyze {
+	if in == nil {
+		return nil
+	}
+	out := new(Analyze)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Collect) DeepCopyInto(out *Collect) {
+	*out = *in
+	if in.Postgres != nil {
+		in, out := &in.Postgres, &out.Postgres
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Mssql != nil {
+		in, out := &in.Mssql, &out.Mssql
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Mysql != nil {
+		in, out := &in.Mysql, &out.Mysql
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Redis != nil {
+		in, out := &in.Redis, &out.Redis
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ClickHouse != nil {
+		in, out := &in.ClickHouse, &out.ClickHouse
+		*out = new(Database)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Collect.
+func (in *Collect) DeepCopy() *Collect {
+	if in == nil {
+		return nil
+	}
+	out := new(Collect)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CollectorMeta) DeepCopyInto(out *CollectorMeta) {
+	*out = *in
+	if in.Exclude != nil {
+		in, out := &in.Exclude, &out.Exclude
+		*out = new(multitype.BoolOrString)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CollectorMeta.
+func (in *CollectorMeta) DeepCopy() *CollectorMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(CollectorMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConfigMapKeyRef) DeepCopyInto(out *ConfigMapKeyRef) {
+	*out = *in
+	if in.Optional != nil {
+		in, out := &in.Optional, &out.Optional
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigMapKeyRef.
+func (in *ConfigMapKeyRef) DeepCopy() *ConfigMapKeyRef {
+	if in == nil {
+		return nil
+	}
+	out := new(ConfigMapKeyRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Database) DeepCopyInto(out *Database) {
+	*out = *in
+	in.CollectorMeta.DeepCopyInto(&out.CollectorMeta)
+	in.URI.DeepCopyInto(&out.URI)
+	if in.Parameters != nil {
+		in, out := &in.Parameters, &out.Parameters
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSParams)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
+func (in *Database) DeepCopy() *Database {
+	if in == nil {
+		return nil
+	}
+	out := new(Database)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HostAnalyze) DeepCopyInto(out *HostAnalyze) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostAnalyze.
+func (in *HostAnalyze) DeepCopy() *HostAnalyze {
+	if in == nil {
+		return nil
+	}
+	out := new(HostAnalyze)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HostCollect) DeepCopyInto(out *HostCollect) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostCollect.
+func (in *HostCollect) DeepCopy() *HostCollect {
+	if in == nil {
+		return nil
+	}
+	out := new(HostCollect)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SecretKeyRef) DeepCopyInto(out *SecretKeyRef) {
+	*out = *in
+	if in.Optional != nil {
+		in, out := &in.Optional, &out.Optional
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretKeyRef.
+func (in *SecretKeyRef) DeepCopy() *SecretKeyRef {
+	if in == nil {
+		return nil
+	}
+	out := new(SecretKeyRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StringOrValueFrom) DeepCopyInto(out *StringOrValueFrom) {
+	*out = *in
+	if in.Value != nil {
+		in, out := &in.Value, &out.Value
+		*out = new(string)
+		**out = **in
+	}
+	if in.ValueFrom != nil {
+		in, out := &in.ValueFrom, &out.ValueFrom
+		*out = new(ValueFromSource)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StringOrValueFrom.
+func (in *StringOrValueFrom) DeepCopy() *StringOrValueFrom {
+	if in == nil {
+		return nil
+	}
+	out := new(StringOrValueFrom)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundle) DeepCopyInto(out *SupportBundle) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	out.Status = in.Status
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundle.
+func (in *SupportBundle) DeepCopy() *SupportBundle {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundle)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *SupportBundle) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundleList) DeepCopyInto(out *SupportBundleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]SupportBundle, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundleList.
+func (in *SupportBundleList) DeepCopy() *SupportBundleList {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *SupportBundleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundleSpec) DeepCopyInto(out *SupportBundleSpec) {
+	*out = *in
+	if in.AfterCollection != nil {
+		in, out := &in.AfterCollection, &out.AfterCollection
+		*out = make([]*AfterCollection, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(AfterCollection)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Collectors != nil {
+		in, out := &in.Collectors, &out.Collectors
+		*out = make([]*Collect, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Collect)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.HostCollectors != nil {
+		in, out := &in.HostCollectors, &out.HostCollectors
+		*out = make([]*HostCollect, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HostCollect)
+				**out = **in
+			}
+		}
+	}
+	if in.Analyzers != nil {
+		in, out := &in.Analyzers, &out.Analyzers
+		*out = make([]*Analyze, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Analyze)
+				**out = **in
+			}
+		}
+	}
+	if in.HostAnalyzers != nil {
+		in, out := &in.HostAnalyzers, &out.HostAnalyzers
+		*out = make([]*HostAnalyze, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HostAnalyze)
+				**out = **in
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundleSpec.
+func (in *SupportBundleSpec) DeepCopy() *SupportBundleSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundleSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SupportBundleStatus) DeepCopyInto(out *SupportBundleStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SupportBundleStatus.
+func (in *SupportBundleStatus) DeepCopy() *SupportBundleStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(SupportBundleStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSParams) DeepCopyInto(out *TLSParams) {
+	*out = *in
+	if in.Secret != nil {
+		in, out := &in.Secret, &out.Secret
+		*out = new(TLSSecret)
+		**out = **in
+	}
+	in.CACert.DeepCopyInto(&out.CACert)
+	in.ClientCert.DeepCopyInto(&out.ClientCert)
+	in.ClientKey.DeepCopyInto(&out.ClientKey)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSParams.
+func (in *TLSParams) DeepCopy() *TLSParams {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSParams)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSSecret) DeepCopyInto(out *TLSSecret) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSSecret.
+func (in *TLSSecret) DeepCopy() *TLSSecret {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSSecret)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ValueFromSource) DeepCopyInto(out *ValueFromSource) {
+	*out = *in
+	if in.SecretKeyRef != nil {
+		in, out := &in.SecretKeyRef, &out.SecretKeyRef
+		*out = new(SecretKeyRef)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ConfigMapKeyRef != nil {
+		in, out := &in.ConfigMapKeyRef, &out.ConfigMapKeyRef
+		*out = new(ConfigMapKeyRef)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValueFromSource.
+func (in *ValueFromSource) DeepCopy() *ValueFromSource {
+	if in == nil {
+		return nil
+	}
+	out := new(ValueFromSource)
+	in.DeepCopyInto(out)
+	return out
+}
@@ -23,6 +23,7 @@ import (

 	troubleshootv1beta1 "github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/typed/troubleshoot/v1beta1"
 	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/typed/troubleshoot/v1beta2"
+	troubleshootv1beta3 "github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/typed/troubleshoot/v1beta3"
 	discovery "k8s.io/client-go/discovery"
 	rest "k8s.io/client-go/rest"
 	flowcontrol "k8s.io/client-go/util/flowcontrol"
@@ -32,6 +33,7 @@ type Interface interface {
 	Discovery() discovery.DiscoveryInterface
 	TroubleshootV1beta1() troubleshootv1beta1.TroubleshootV1beta1Interface
 	TroubleshootV1beta2() troubleshootv1beta2.TroubleshootV1beta2Interface
+	TroubleshootV1beta3() troubleshootv1beta3.TroubleshootV1beta3Interface
 }

 // Clientset contains the clients for groups.
@@ -39,6 +41,7 @@ type Clientset struct {
 	*discovery.DiscoveryClient
 	troubleshootV1beta1 *troubleshootv1beta1.TroubleshootV1beta1Client
 	troubleshootV1beta2 *troubleshootv1beta2.TroubleshootV1beta2Client
+	troubleshootV1beta3 *troubleshootv1beta3.TroubleshootV1beta3Client
 }

 // TroubleshootV1beta1 retrieves the TroubleshootV1beta1Client
@@ -51,6 +54,11 @@ func (c *Clientset) TroubleshootV1beta2() troubleshootv1beta2.TroubleshootV1beta
 	return c.troubleshootV1beta2
 }

+// TroubleshootV1beta3 retrieves the TroubleshootV1beta3Client
+func (c *Clientset) TroubleshootV1beta3() troubleshootv1beta3.TroubleshootV1beta3Interface {
+	return c.troubleshootV1beta3
+}
+
 // Discovery retrieves the DiscoveryClient
 func (c *Clientset) Discovery() discovery.DiscoveryInterface {
 	if c == nil {
@@ -103,6 +111,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset,
 	if err != nil {
 		return nil, err
 	}
+	cs.troubleshootV1beta3, err = troubleshootv1beta3.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}

 	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
@@ -126,6 +138,7 @@ func New(c rest.Interface) *Clientset {
 	var cs Clientset
 	cs.troubleshootV1beta1 = troubleshootv1beta1.New(c)
 	cs.troubleshootV1beta2 = troubleshootv1beta2.New(c)
+	cs.troubleshootV1beta3 = troubleshootv1beta3.New(c)

 	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
 	return &cs
--- a/Show More
+++ b/Show More