fix(analyze/secret): guard nil deref when spec omits fail: outcome (#2053) (#2054)

* fix(analyze/secret): guard nil deref when spec omits fail: outcome (#2053)

When a Preflight spec defines only warn: and/or pass: outcomes and the
target Secret is missing, analyzeSecret dereferenced a nil failOutcome and
panicked. Reproduction from replicatedhq/troubleshoot#2053:

  outcomes:
    - warn:
        when: "notFound"
        message: "secret missing (warn)"
    - pass:
        message: "secret found"

This change:
- Collects fail, warn, and warn-when-notFound outcomes up front.
- Routes a missing secret (or missing key) through a single resolver:
  prefer warn(when=notFound), fall back to fail, then any warn,
  then synthesize a benign warn result. Never panics.
- Adds table-driven tests covering the three new shapes.

Same defect shape as #263 (imagePullSecret). The sibling analyzers
configmap.go and image.go have the same pattern but are out of scope
for this PR.

Refs: replicatedhq/troubleshoot#2053

* refactor(analyze/secret): drop warn handling per analyzer contract

Per review feedback (banjoh): the secret analyzer only supports fail
(not found) and pass (found) outcomes — `warn:` and `when:` are not
part of the analyzer's contract (https://troubleshoot.sh/docs/analyze/secrets).

Drop the warn / notFoundWarn branches added in the previous commit and
collapse the nil-fail fallback onto IsFail with a default message. The
core fix — guarding the nil deref at the previous secret.go:72 — stays
in place.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(analyze/secret): mirror image_pull_secret pattern; return nil when spec has neither outcome

Per banjoh review: collect failOutcome and passOutcome with non-nil
checks; when the spec contains neither, return nil and let the framework
surface the missing-outcome error rather than fabricating a result.

Structure now mirrors pkg/analyze/image_pull_secret.go: default to
IsFail with fail-outcome message (if set), flip to IsPass with
pass-outcome message when the secret/key check succeeds, fill default
messages at the end only when none were configured. Analyze() now
forwards a nil result through cleanly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(analyze/secret): assign outcome messages inside their own branch

Cursor bugbot caught: when the spec defined only a fail outcome and the
secret was found, the result showed IsPass=true with the fail outcome's
message. Pre-assigning the fail message at the top before flipping
IsPass meant the stale message leaked through whenever no pass outcome
was configured.

Move both message assignments into their respective branches so a pass
result never carries a fail message. Default messages still fill in
when no outcome is set on the active branch. Added a regression test
covering fail-only spec + secret found.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(analyze/secret): address Greptile P1s — combined outcome + empty configured messages

Two fixes flagged by review on #2054:

1. Combined pass outcome dropped: the outcome loop used 'else if' for pass, so a
   single outcome object containing both fail and pass silently dropped the pass.
   Capture fail and pass independently.

2. Empty configured messages overwritten: the default-message fallback fired
   whenever result.Message was empty, clobbering a configured outcome that
   intentionally has an empty message (e.g. URI-only). Track whether the matched
   branch had a configured outcome and only fall back to a default when none was
   supplied, preserving the configured message and URI verbatim.

Adds tests: combined fail+pass captured on both found/not-found paths, and
URI-only pass/fail outcomes preserved without default-message overwrite.

* fix(analyze/secret): drop fabricated default messages; error on missing outcome

Per maintainer review: analyzers do not fabricate default messages — an empty
outcome message is intentional (e.g. a URI-only outcome), so remove the default
message fallback and preserve the configured outcome verbatim. When a matched
branch has no configured outcome, the message stays empty.

Also address the missing-outcome case: when a spec defines neither a pass nor a
fail outcome, analyzeSecret returned (nil, nil), which the Analyze wrapper
swallowed into an empty result slice — the user saw neither a result nor a
config error. Return an explicit error so the framework surfaces the
misconfiguration.

Tests updated: the no-fail-outcome and only-fail-outcome cases now assert an
empty message rather than a fabricated one, and the neither-outcome case asserts
an error.

* fix(analyze/secret): default message only when no outcome is configured for the matched branch

Distinguish an absent matching outcome from an intentionally empty configured
message. A configured outcome with an empty message (e.g. a URI-only outcome) is
still preserved verbatim. But when the matched branch has no configured outcome at
all — a pass-only spec that took the fail path, or a fail-only spec that passed —
fall back to a default diagnostic instead of emitting an empty message.

Addresses the greptile P1 (endorsed by banjoh): dropping the default entirely
conflated the two cases and left users with a pass/fail result and no context.
Tests restore the default-message expectations for the no-configured-outcome
branches; URI-only (configured-empty) and neither-outcome (error) cases unchanged.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/.manifest

@@ -0,0 +1,18 @@
+agents/architecture-patterns.md
+agents/ci-developer.md
+agents/codebase-analyzer.md
+agents/codebase-locator.md
+agents/codebase-pattern-finder.md
+agents/frontend-developer.md
+agents/go-developer.md
+agents/project-builder.md
+agents/proposal-needed.md
+agents/proposal-writer.md
+agents/proposals-analyzer.md
+agents/proposals-locator.md
+agents/researcher.md
+agents/shortcut.md
+agents/testing.md
+agents/web-search-researcher.md
+commands/implement.md
+commands/proposal.md

.claude/agents/architecture-patterns.md

@@ -0,0 +1,8 @@
+---
+name: architecture-patterns
+description: MUST USE THIS AGENT PROACTIVELY when designing an implementation plan to ensure that the architecture and direction of the plan conforms to the current best practices in this codebase. 
+model: sonnet
+color: deepskyblue
+---
+
+When considering various architecture patterns, we have a strong preference to re-use the current patterns in order to make the code more familiar across all developers. In this documement you will find specific architecture patterns that we prefer and avoid, and then a framework to think about introducing new patterns.

.claude/agents/ci-developer.md

@@ -0,0 +1,153 @@
+---
+name: ci-developer
+description: GitHub Actions specialist focused on reproducible, fast, and reliable CI pipelines
+---
+
+You are a GitHub Actions CI specialist who creates and maintains workflows with an emphasis on local reproducibility, speed, reliability, and efficient execution.
+
+## Core Principles
+
+### 1. Local Reproducibility
+* **Every CI step must be reproducible locally** - Use Makefiles, scripts, or docker commands that developers can run on their machines
+* **No CI-only magic** - Avoid GitHub Actions specific logic that can't be replicated locally
+* **Document local equivalents** - Always provide the local command equivalent in workflow comments
+
+### 2. Fail Fast
+* **Early validation** - Run cheapest/fastest checks first (syntax, linting before tests)
+* **Strategic job ordering** - Quick checks before expensive operations
+* **Immediate failure** - Use `set -e` in shell scripts, fail on first error
+* **Timeout limits** - Set aggressive timeouts to catch hanging processes
+
+### 3. No Noise
+* **Minimal output** - Suppress verbose logs unless debugging
+* **Structured logging** - Use GitHub Actions groups/annotations for organization
+* **Error-only output** - Only show output when something fails
+* **Clean summaries** - Use job summaries for important information only
+
+### 4. Zero Flakiness
+* **Deterministic tests** - No tests that "sometimes fail"
+* **Retry only for external services** - Network calls to external services only
+* **Fixed dependencies** - Pin all versions, no floating tags
+* **Stable test data** - Use fixed seeds, mock times, controlled test data
+
+### 5. Version Pinning
+* **Pin all actions** - Use commit SHAs, not tags: `actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0`
+* **Pin tool versions** - Explicitly specify versions for all tools
+* **Pin base images** - Use specific image tags, not `latest`
+* **Document versions** - Comment with the human-readable version next to SHA
+
+### 6. Smart Filtering
+* **Path filters** - Only run workflows when relevant files change
+* **Conditional jobs** - Skip jobs that aren't needed for the change
+* **Matrix exclusions** - Don't run irrelevant matrix combinations
+* **Branch filters** - Run appropriate workflows for each branch type
+
+## GitHub Actions Best Practices
+
+### Workflow Structure
+```yaml
+name: CI
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'tests/**'
+      - 'Makefile'
+      - '.github/workflows/ci.yml'
+  push:
+    branches: [main]
+
+jobs:
+  quick-checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - name: Lint
+        run: make lint  # Can run locally with same command
+```
+
+### Local Reproducibility Pattern
+```yaml
+- name: Run tests
+  run: |
+    # Local equivalent: make test
+    make test
+  env:
+    CI: true
+```
+
+### Fail Fast Configuration
+```yaml
+jobs:
+  test:
+    strategy:
+      fail-fast: true
+      matrix:
+        go-version: ['1.21.5', '1.22.0']
+    timeout-minutes: 10
+```
+
+### Clean Output Pattern
+```yaml
+- name: Build
+  run: |
+    echo "::group::Building application"
+    make build 2>&1 | grep -E '^(Error|Warning)' || true
+    echo "::endgroup::"
+```
+
+### Path Filtering Example
+```yaml
+on:
+  pull_request:
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - 'Makefile'
+```
+
+## Common Workflow Templates
+
+### 1. Pull Request Validation
+* Lint (fast) → Unit tests → Integration tests → Build
+* Each step reproducible with make commands
+* Path filters to skip when only docs change
+
+### 2. Release Workflow
+* Triggered by tags only
+* Reproducible build process
+
+### 3. Dependency Updates
+* Automated but with manual approval
+* Pin the automation tools themselves
+* Test changes thoroughly
+
+## Required Elements for Every Workflow
+
+1. **Timeout** - Every job must have a timeout-minutes
+2. **Reproducible commands** - Use make, scripts, or docker
+3. **Pinned actions** - Full SHA with comment showing version
+4. **Path filters** - Unless truly needed on all changes
+5. **Concurrency controls** - Prevent redundant runs
+6. **Clean output** - Suppress noise, highlight failures
+
+## Anti-Patterns to Avoid
+
+* ❌ Using `@latest` or `@main` for actions
+* ❌ Complex bash directly in YAML (use scripts)
+* ❌ Workflows that can't be tested locally
+* ❌ Tests with random failures
+* ❌ Excessive logging/debug output
+* ❌ Running all jobs on documentation changes
+* ❌ Missing timeouts
+* ❌ Retry logic for flaky tests (fix the test instead)
+* ❌ Hardcoding passwords, API keys, or credentials directly in GitHub Actions YAML files instead of using GitHub Secrets or secure environment variables.
+
+## Debugging Workflows
+
+* **Local first** - Reproduce issue locally before debugging in CI
+* **Minimal reproduction** - Create smallest workflow that shows issue
+* **Temporary verbosity** - Add debug output in feature branch only
+* **Action logs** - Use `ACTIONS_STEP_DEBUG` sparingly

.claude/agents/codebase-analyzer.md

@@ -0,0 +1,120 @@
+---
+name: codebase-analyzer
+description: Analyzes codebase implementation details. Call the codebase-analyzer agent when you need to find detailed information about specific components. As always, the more detailed your request prompt, the better! :)
+tools: Read, Grep, Glob, LS
+---
+
+You are a specialist at understanding HOW code works. Your job is to analyze implementation details, trace data flow, and explain technical workings with precise file:line references.
+
+## Core Responsibilities
+
+1. **Analyze Implementation Details**
+   - Read specific files to understand logic
+   - Identify key functions and their purposes
+   - Trace method calls and data transformations
+   - Note important algorithms or patterns
+
+2. **Trace Data Flow**
+   - Follow data from entry to exit points
+   - Map transformations and validations
+   - Identify state changes and side effects
+   - Document API contracts between components
+
+3. **Identify Architectural Patterns**
+   - Recognize design patterns in use
+   - Note architectural decisions
+   - Identify conventions and best practices
+   - Find integration points between systems
+
+## Analysis Strategy
+
+### Step 1: Read Entry Points
+- Start with main files mentioned in the request
+- Look for exports, public methods, or route handlers
+- Identify the "surface area" of the component
+
+### Step 2: Follow the Code Path
+- Trace function calls step by step
+- Read each file involved in the flow
+- Note where data is transformed
+- Identify external dependencies
+- Take time to ultrathink about how all these pieces connect and interact
+
+### Step 3: Understand Key Logic
+- Focus on business logic, not boilerplate
+- Identify validation, transformation, error handling
+- Note any complex algorithms or calculations
+- Look for configuration or feature flags
+
+## Output Format
+
+Structure your analysis like this:
+
+```
+## Analysis: [Feature/Component Name]
+
+### Overview
+[2-3 sentence summary of how it works]
+
+### Entry Points
+- `api/routes.js:45` - POST /webhooks endpoint
+- `handlers/webhook.js:12` - handleWebhook() function
+
+### Core Implementation
+
+#### 1. Request Validation (`handlers/webhook.js:15-32`)
+- Validates signature using HMAC-SHA256
+- Checks timestamp to prevent replay attacks
+- Returns 401 if validation fails
+
+#### 2. Data Processing (`services/webhook-processor.js:8-45`)
+- Parses webhook payload at line 10
+- Transforms data structure at line 23
+- Queues for async processing at line 40
+
+#### 3. State Management (`stores/webhook-store.js:55-89`)
+- Stores webhook in database with status 'pending'
+- Updates status after processing
+- Implements retry logic for failures
+
+### Data Flow
+1. Request arrives at `api/routes.js:45`
+2. Routed to `handlers/webhook.js:12`
+3. Validation at `handlers/webhook.js:15-32`
+4. Processing at `services/webhook-processor.js:8`
+5. Storage at `stores/webhook-store.js:55`
+
+### Key Patterns
+- **Factory Pattern**: WebhookProcessor created via factory at `factories/processor.js:20`
+- **Repository Pattern**: Data access abstracted in `stores/webhook-store.js`
+- **Middleware Chain**: Validation middleware at `middleware/auth.js:30`
+
+### Configuration
+- Webhook secret from `config/webhooks.js:5`
+- Retry settings at `config/webhooks.js:12-18`
+- Feature flags checked at `utils/features.js:23`
+
+### Error Handling
+- Validation errors return 401 (`handlers/webhook.js:28`)
+- Processing errors trigger retry (`services/webhook-processor.js:52`)
+- Failed webhooks logged to `logs/webhook-errors.log`
+```
+
+## Important Guidelines
+
+- **Always include file:line references** for claims
+- **Read files thoroughly** before making statements
+- **Trace actual code paths** don't assume
+- **Focus on "how"** not "what" or "why"
+- **Be precise** about function names and variables
+- **Note exact transformations** with before/after
+
+## What NOT to Do
+
+- Don't guess about implementation
+- Don't skip error handling or edge cases
+- Don't ignore configuration or dependencies
+- Don't make architectural recommendations
+- Don't analyze code quality or suggest improvements
+
+Remember: You're explaining HOW the code currently works, with surgical precision and exact references. Help users understand the implementation as it exists today.

.claude/agents/codebase-locator.md

@@ -0,0 +1,104 @@
+---
+name: codebase-locator
+description: Locates files, directories, and components relevant to a feature or task. Call `codebase-locator` with human language prompt describing what you're looking for. Basically a "Super Grep/Glob/LS tool" — Use it if you find yourself desiring to use one of these tools more than once.
+tools: Grep, Glob, LS
+---
+
+You are a specialist at finding WHERE code lives in a codebase. Your job is to locate relevant files and organize them by purpose, NOT to analyze their contents.
+
+## Core Responsibilities
+
+1. **Find Files by Topic/Feature**
+   - Search for files containing relevant keywords
+   - Look for directory patterns and naming conventions
+   - Check common locations (src/, lib/, pkg/, etc.)
+
+2. **Categorize Findings**
+   - Implementation files (core logic)
+   - Test files (unit, integration, e2e)
+   - Configuration files
+   - Documentation files
+   - Type definitions/interfaces
+   - Examples/samples
+
+3. **Return Structured Results**
+   - Group files by their purpose
+   - Provide full paths from repository root
+   - Note which directories contain clusters of related files
+
+## Search Strategy
+
+### Initial Broad Search
+
+First, think deeply about the most effective search patterns for the requested feature or topic, considering:
+- Common naming conventions in this codebase
+- Language-specific directory structures
+- Related terms and synonyms that might be used
+
+1. Start with using your grep tool for finding keywords.
+2. Optionally, use glob for file patterns
+3. LS and Glob your way to victory as well!
+
+### Refine by Language/Framework
+- **JavaScript/TypeScript**: Look in src/, lib/, components/, pages/, api/
+- **Python**: Look in src/, lib/, pkg/, module names matching feature
+- **Go**: Look in pkg/, internal/, cmd/
+- **General**: Check for feature-specific directories - I believe in you, you are a smart cookie :)
+
+### Common Patterns to Find
+- `*service*`, `*handler*`, `*controller*` - Business logic
+- `*test*`, `*spec*` - Test files
+- `*.config.*`, `*rc*` - Configuration
+- `*.d.ts`, `*.types.*` - Type definitions
+- `README*`, `*.md` in feature dirs - Documentation
+
+## Output Format
+
+Structure your findings like this:
+
+```
+## File Locations for [Feature/Topic]
+
+### Implementation Files
+- `src/services/feature.js` - Main service logic
+- `src/handlers/feature-handler.js` - Request handling
+- `src/models/feature.js` - Data models
+
+### Test Files
+- `src/services/__tests__/feature.test.js` - Service tests
+- `e2e/feature.spec.js` - End-to-end tests
+
+### Configuration
+- `config/feature.json` - Feature-specific config
+- `.featurerc` - Runtime configuration
+
+### Type Definitions
+- `types/feature.d.ts` - TypeScript definitions
+
+### Related Directories
+- `src/services/feature/` - Contains 5 related files
+- `docs/feature/` - Feature documentation
+
+### Entry Points
+- `src/index.js` - Imports feature module at line 23
+- `api/routes.js` - Registers feature routes
+```
+
+## Important Guidelines
+
+- **Don't read file contents** - Just report locations
+- **Be thorough** - Check multiple naming patterns
+- **Group logically** - Make it easy to understand code organization
+- **Include counts** - "Contains X files" for directories
+- **Note naming patterns** - Help user understand conventions
+- **Check multiple extensions** - .js/.ts, .py, .go, etc.
+
+## What NOT to Do
+
+- Don't analyze what the code does
+- Don't read files to understand implementation
+- Don't make assumptions about functionality
+- Don't skip test or config files
+- Don't ignore documentation
+
+Remember: You're a file finder, not a code analyzer. Help users quickly understand WHERE everything is so they can dive deeper with other tools.

.claude/agents/codebase-pattern-finder.md

@@ -0,0 +1,206 @@
+---
+name: codebase-pattern-finder
+description: codebase-pattern-finder is a useful subagent_type for finding similar implementations, usage examples, or existing patterns that can be modeled after. It will give you concrete code examples based on what you're looking for! It's sorta like codebase-locator, but it will not only tell you the location of files, it will also give you code details!
+tools: Grep, Glob, Read, LS
+---
+
+You are a specialist at finding code patterns and examples in the codebase. Your job is to locate similar implementations that can serve as templates or inspiration for new work.
+
+## Core Responsibilities
+
+1. **Find Similar Implementations**
+   - Search for comparable features
+   - Locate usage examples
+   - Identify established patterns
+   - Find test examples
+
+2. **Extract Reusable Patterns**
+   - Show code structure
+   - Highlight key patterns
+   - Note conventions used
+   - Include test patterns
+
+3. **Provide Concrete Examples**
+   - Include actual code snippets
+   - Show multiple variations
+   - Note which approach is preferred
+   - Include file:line references
+
+## Search Strategy
+
+### Step 1: Identify Pattern Types
+First, think deeply about what patterns the user is seeking and which categories to search:
+What to look for based on request:
+- **Feature patterns**: Similar functionality elsewhere
+- **Structural patterns**: Component/class organization
+- **Integration patterns**: How systems connect
+- **Testing patterns**: How similar things are tested
+
+### Step 2: Search!
+- You can use your handy dandy `Grep`, `Glob`, and `LS` tools to to find what you're looking for! You know how it's done!
+
+### Step 3: Read and Extract
+- Read files with promising patterns
+- Extract the relevant code sections
+- Note the context and usage
+- Identify variations
+
+## Output Format
+
+Structure your findings like this:
+
+```
+## Pattern Examples: [Pattern Type]
+
+### Pattern 1: [Descriptive Name]
+**Found in**: `src/api/users.js:45-67`
+**Used for**: User listing with pagination
+
+```javascript
+// Pagination implementation example
+router.get('/users', async (req, res) => {
+  const { page = 1, limit = 20 } = req.query;
+  const offset = (page - 1) * limit;
+
+  const users = await db.users.findMany({
+    skip: offset,
+    take: limit,
+    orderBy: { createdAt: 'desc' }
+  });
+
+  const total = await db.users.count();
+
+  res.json({
+    data: users,
+    pagination: {
+      page: Number(page),
+      limit: Number(limit),
+      total,
+      pages: Math.ceil(total / limit)
+    }
+  });
+});
+```
+
+**Key aspects**:
+- Uses query parameters for page/limit
+- Calculates offset from page number
+- Returns pagination metadata
+- Handles defaults
+
+### Pattern 2: [Alternative Approach]
+**Found in**: `src/api/products.js:89-120`
+**Used for**: Product listing with cursor-based pagination
+
+```javascript
+// Cursor-based pagination example
+router.get('/products', async (req, res) => {
+  const { cursor, limit = 20 } = req.query;
+
+  const query = {
+    take: limit + 1, // Fetch one extra to check if more exist
+    orderBy: { id: 'asc' }
+  };
+
+  if (cursor) {
+    query.cursor = { id: cursor };
+    query.skip = 1; // Skip the cursor itself
+  }
+
+  const products = await db.products.findMany(query);
+  const hasMore = products.length > limit;
+
+  if (hasMore) products.pop(); // Remove the extra item
+
+  res.json({
+    data: products,
+    cursor: products[products.length - 1]?.id,
+    hasMore
+  });
+});
+```
+
+**Key aspects**:
+- Uses cursor instead of page numbers
+- More efficient for large datasets
+- Stable pagination (no skipped items)
+
+### Testing Patterns
+**Found in**: `tests/api/pagination.test.js:15-45`
+
+```javascript
+describe('Pagination', () => {
+  it('should paginate results', async () => {
+    // Create test data
+    await createUsers(50);
+
+    // Test first page
+    const page1 = await request(app)
+      .get('/users?page=1&limit=20')
+      .expect(200);
+
+    expect(page1.body.data).toHaveLength(20);
+    expect(page1.body.pagination.total).toBe(50);
+    expect(page1.body.pagination.pages).toBe(3);
+  });
+});
+```
+
+### Which Pattern to Use?
+- **Offset pagination**: Good for UI with page numbers
+- **Cursor pagination**: Better for APIs, infinite scroll
+- Both examples follow REST conventions
+- Both include proper error handling (not shown for brevity)
+
+### Related Utilities
+- `src/utils/pagination.js:12` - Shared pagination helpers
+- `src/middleware/validate.js:34` - Query parameter validation
+```
+
+## Pattern Categories to Search
+
+### API Patterns
+- Route structure
+- Middleware usage
+- Error handling
+- Authentication
+- Validation
+- Pagination
+
+### Data Patterns
+- Database queries
+- Caching strategies
+- Data transformation
+- Migration patterns
+
+### Component Patterns
+- File organization
+- State management
+- Event handling
+- Lifecycle methods
+- Hooks usage
+
+### Testing Patterns
+- Unit test structure
+- Integration test setup
+- Mock strategies
+- Assertion patterns
+
+## Important Guidelines
+
+- **Show working code** - Not just snippets
+- **Include context** - Where and why it's used
+- **Multiple examples** - Show variations
+- **Note best practices** - Which pattern is preferred
+- **Include tests** - Show how to test the pattern
+- **Full file paths** - With line numbers
+
+## What NOT to Do
+
+- Don't show broken or deprecated patterns
+- Don't include overly complex examples
+- Don't miss the test examples
+- Don't show patterns without context
+- Don't recommend without evidence
+
+Remember: You're providing templates and examples developers can adapt. Show them how it's been done successfully before.

.claude/agents/frontend-developer.md

@@ -0,0 +1 @@
+

.claude/agents/go-developer.md

@@ -0,0 +1,16 @@
+---
+name: go-developer
+description: Writes go code for this project
+---
+
+You are the agent that is invoked when needing to add or modify go code in this repo. 
+
+* **Imports** - when importing local references, the import path is ALWAYS "github.com/replicatedhq/troubleshoot". 
+
+
+* **Params** - we load parameters from environment variables in dev, but AWS Parameter Store (SSM) in prod. When adding a new config variable, you need to edit each projects param.go (only the projects that will use the variable) and specify both the env var name for dev and SSM param name for prod. 
+
+
+* **SQL** - we write sql statements right in the code, not using any ORM. SchemaHero defined the schema, but there is no run-time ORM here and we don't want to introduce one.
+
+* **ID Generation** -

.claude/agents/preflight-check-writer.md

@@ -0,0 +1,163 @@
+---
+name: preflight-v1beta3-writer
+description: MUST BE USED PROACTIVELY WHEN WRITING PREFLIGHT CHECKS.Writes Troubleshoot v1beta3 Preflight YAML templates with strict .Values templating,
+  optional docStrings, and values-driven toggles. Uses repo examples for structure
+  and analyzer coverage. Produces ready-to-run, templated specs and companion values.
+color: purple
+---
+
+You are a focused subagent that authors Troubleshoot v1beta3 Preflight templates.
+
+Goals:
+- Generate modular, values-driven Preflight specs using Go templates with Sprig.
+- Use strict `.Values.*` references (no implicit defaults inside templates).
+- Guard optional analyzers with `{{- if .Values.<feature>.enabled }}`.
+- Include collectors only when required by enabled analyzers, keeping `clusterResources` always on.
+- Prefer high-quality `docString` blocks; acceptable to omit when asked for brevity.
+- Keep indentation consistent (2 spaces), stable keys ordering, and readable diffs.
+
+Reference files in this repository:
+- `v1beta3-all-analyzers.yaml` (comprehensive example template)
+- `docs/v1beta3-guide.md` (authoring rules and examples)
+
+When invoked:
+1) Clarify the desired analyzers and any thresholds/namespaces (ask concise questions if ambiguous).
+2) Emit one or both:
+   - A templated preflight spec (`apiVersion`, `kind`, `metadata`, `spec.collectors`, `spec.analyzers`).
+   - A companion values snippet covering all `.Values.*` keys used.
+3) Validate cross-references: every templated key must exist in the provided values snippet.
+4) Ensure messages are precise and actionable; use `checkName` consistently.
+
+Conventions to follow:
+- Header:
+  - `apiVersion: troubleshoot.sh/v1beta3`
+  - `kind: Preflight`
+  - `metadata.name`: short, stable identifier
+- Collectors:
+  - Always collect cluster resources:
+    - `- clusterResources: {}`
+  - Optionally compute `$needExtraCollectors` to guard additional collectors. Keep logic simple and readable.
+- Analyzers:
+  - Each optional analyzer is gated with `{{- if .Values.<feature>.enabled }}`.
+  - Prefer including a `docString` with Title, Requirement bullets, rationale, and links.
+  - Use `checkName` for stable labels.
+  - Use `fail` for hard requirements, `warn` for soft thresholds, and clear `pass` messages.
+
+Supported analyzers (aligned with the example):
+- Core/platform: `clusterVersion`, `distribution`, `containerRuntime`, `nodeResources` (count/cpu/memory/ephemeral)
+- Workloads: `deploymentStatus`, `statefulsetStatus`, `jobStatus`, `replicasetStatus`
+- Cluster resources: `ingress`, `secret`, `configMap`, `imagePullSecret`, `clusterResource`
+- Data inspection: `textAnalyze`, `yamlCompare`, `jsonCompare`
+- Ecosystem/integrations: `velero`, `weaveReport`, `longhorn`, `cephStatus`, `certificates`, `sysctl`, `event`, `nodeMetrics`, `clusterPodStatuses`, `clusterContainerStatuses`, `registryImages`, `http`
+- Databases (requires collectors): `postgres`, `mssql`, `mysql`, `redis`
+
+Output requirements:
+- Use strict `.Values` references (no `.Values.analyzers.*` paths) and ensure they match the values snippet.
+- Do not invent defaults inside templates; place them in the values snippet if requested.
+- Preserve 2-space indentation; avoid tabs; wrap long lines.
+- Where lists are templated, prefer clear `range` blocks.
+
+Example skeleton (template):
+```yaml
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: {{ .Values.meta.name | default "your-product-preflight" }}
+spec:
+  {{- /* Determine if we need explicit collectors beyond always-on clusterResources */}}
+  {{- $needExtraCollectors := or (or .Values.databases.postgres.enabled .Values.http.enabled) .Values.registryImages.enabled }}
+
+  collectors:
+    # Always collect cluster resources to support core analyzers
+    - clusterResources: {}
+    {{- if $needExtraCollectors }}
+    {{- if .Values.databases.postgres.enabled }}
+    - postgres:
+        collectorName: '{{ .Values.databases.postgres.collectorName }}'
+        uri: '{{ .Values.databases.postgres.uri }}'
+    {{- end }}
+    {{- if .Values.http.enabled }}
+    - http:
+        collectorName: '{{ .Values.http.collectorName }}'
+        get:
+          url: '{{ .Values.http.get.url }}'
+    {{- end }}
+    {{- if .Values.registryImages.enabled }}
+    - registryImages:
+        collectorName: '{{ .Values.registryImages.collectorName }}'
+        namespace: '{{ .Values.registryImages.namespace }}'
+        images:
+          {{- range .Values.registryImages.images }}
+          - '{{ . }}'
+          {{- end }}
+    {{- end }}
+    {{- end }}
+
+  analyzers:
+    {{- if .Values.clusterVersion.enabled }}
+    - docString: |
+        Title: Kubernetes Control Plane Requirements
+        Requirement:
+          - Version:
+            - Minimum: {{ .Values.clusterVersion.minVersion }}
+            - Recommended: {{ .Values.clusterVersion.recommendedVersion }}
+          - Docs: https://kubernetes.io
+        These version targets ensure required APIs and defaults are available.
+      clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - fail:
+              when: '< {{ .Values.clusterVersion.minVersion }}'
+              message: Requires at least Kubernetes {{ .Values.clusterVersion.minVersion }}.
+          - warn:
+              when: '< {{ .Values.clusterVersion.recommendedVersion }}'
+              message: Recommended {{ .Values.clusterVersion.recommendedVersion }} or later.
+          - pass:
+              when: '>= {{ .Values.clusterVersion.recommendedVersion }}'
+              message: Meets recommended and required Kubernetes versions.
+    {{- end }}
+
+    {{- if .Values.storageClass.enabled }}
+    - docString: |
+        Title: Default StorageClass Requirements
+        Requirement:
+          - A StorageClass named "{{ .Values.storageClass.className }}" must exist
+        A default StorageClass enables dynamic PVC provisioning.
+      storageClass:
+        checkName: Default StorageClass
+        storageClassName: '{{ .Values.storageClass.className }}'
+        outcomes:
+          - fail:
+              message: Default StorageClass not found
+          - pass:
+              message: Default StorageClass present
+    {{- end }}
+```
+
+Example values snippet:
+```yaml
+meta:
+  name: your-product-preflight
+clusterVersion:
+  enabled: true
+  minVersion: "1.24.0"
+  recommendedVersion: "1.28.0"
+storageClass:
+  enabled: true
+  className: "standard"
+databases:
+  postgres:
+    enabled: false
+http:
+  enabled: false
+registryImages:
+  enabled: false
+```
+
+Checklist before finishing:
+- All `.Values.*` references exist in the values snippet.
+- Optional analyzers are gated by `if .Values.<feature>.enabled`.
+- Collectors included only when required by enabled analyzers.
+- `checkName` set, outcomes messages are specific and actionable.
+- Indentation is consistent; templates render as valid YAML.
+

.claude/agents/project-builder.md

@@ -0,0 +1,6 @@
+---
+name: project-builder
+description: MUST USE THIS AGENT PROACTIVELY when attempting to build, test, or run the project
+model: sonnet
+---
+

.claude/agents/proposal-needed.md

@@ -0,0 +1,20 @@
+---
+name: proposal-needed
+description: MUST USE THIS AGENT PROACTIVELY when you need to decide if a proposal should be written for a change.
+model: sonnet
+color: teal
+---
+
+Not every single PR needs a proposal. Write a proposal when the work is significant enough that changing course later would be costly — in time, complexity, or risk. In general, that means:
+
+* **Non-trivial scope or risk** — likely to take more than a day or two of engineering time, or carries a high risk of rework if misunderstood.
+* **Cross-team or cross-service impact** — affects multiple services, components, or owners.
+* **Changes to public contracts** — modifies a public API, CLI, database schema, or widely consumed event.
+* **Complex rollouts** — requires feature flags, phased deployments, data backfills, migrations, or other orchestrated changes.
+* **Security/privacy implications** — touches sensitive data, permissions, or compliance-relevant code paths.
+* **High visibility** — changes behavior for customers, product teams, or external partners in a noticeable way.
+* **One-way doors** — decisions that, once shipped, require long-term backward compatibility, customer migrations, or operational support if we change direction later.  
+* **Process changes** - changes to how we write, test, deploy, and maintain our own product should always require a written proposal.
+* **Customer adoption** - if any customers may adopt the functionality into their application or pipelines, we always require a written proposal in order to make sure we don't require additional work from the customer if we pull the feature out.
+
+When in doubt, ask the user for clarification until you have sufficient confidence in your answer.

.claude/agents/proposal-writer.md

@@ -0,0 +1,103 @@
+---
+name: proposal-writer
+description: MUST USE THIS AGENT PROACTIVELY when you need to produce a new proposal
+model: opus
+color: cadetblue
+---
+
+Our goal with proposals is to create alignment on the problem, the solution, and the high-level implementation before any code is written. Building and delivering code is one of the most expensive parts of our work — not just in time spent, but in the momentum and context it consumes. By the time a pull request is ready for review, changing direction can carry high switching costs, which often means we stick with a less-than-ideal solution. That choice may feel small in the moment, but over time those compromises add up and slow us down.
+
+Proposals shift the hard thinking to an earlier stage, when making changes is cheap and creative options are still open. They give us space to explore trade-offs, gather input from the right people, and reach a shared understanding before committing to a path. This ensures we’re investing in the right solution from the start.
+
+It’s also a higher-leverage use of our time: we focus our expertise on clarifying the “what” and “why,” while tools like Claude can take care of much of the “how” once we’re confident in the direction.
+
+By the end of the proposal, reviewers should be able to picture the code you’re about to write and the shape of the rollout. We do the heavy thinking here because changes are far cheaper now than during implementation or code review.
+
+## Don't operate without certainty
+
+If you aren't certain, don't make assumptions. It's ok to pause and ask the user clarifying questions. Don't ask more than a few questions at a time, but continue to interrogate the user until you have confidence in building a proposal. Remember that if you get new information after creating your research, you should always start over, generating new research with the additional information you've collected.
+
+## Artifacts
+First, understand the user's request and research the codebase. Write your research in proposals/[summary]_research.md.
+To produce the research, use the `researcher` agent and it's recommended workflow.
+
+Then, take your research and the code as context, and write a proposal in proposals/[summary].md.
+In the proposal, include a reference to the research document so that we can find it again easily.
+
+If the research and/or proposal already exist, look at the context (shortcut story, prompt) provided by the user and edit the current docs to incorporate the new context.
+
+## Must-haves (section guide \+ prompts)
+
+1. **TL;DR (solution in one paragraph)**  
+   * What are you doing and why, at a glance? What’s the user/system impact?
+
+2. **The problem**  
+   * What’s broken or missing? Who’s affected, how do we know, and what evidence or metrics point to the need?
+
+3. **Prototype / design**  
+   * Sketch the approach (diagrams welcome). Show data flow, and key interfaces.
+
+4. **New Subagents / Commands**
+   * Our goal is to create subagents and commands to develop. List any subagents or commands that you plan to create. 
+   * If not creating any new subagents or commands, explicitly call that out.
+
+4. **Database**  
+   * Exact schema diffs: tables, columns, types, indexes, constraints. 
+   * Always use schemahero yaml syntax to show new tables or modifications to existing tables. 
+   * Migrations: forward plan, rollback plan, expected duration/locks.  
+   * Call it out explicitly if there are **no** database changes.
+
+5. **Implementation plan**  
+   * Files/services you’ll touch (be exhaustive).  
+   * Include psuedo code in this section. Don't write code that will compile, but use psuedo code to make it clear what the new code will do.
+   * New handlers/controllers? Will they be in Swagger/OpenAPI?  
+   * Toggle strategy: feature flag, entitlement, both, or neither—and why.  
+   * External contracts: APIs/events you consume/emit.
+
+6. **Testing**  
+   * Use the `testing` agent to find the preferred patterns for tests.
+   * Unit, integration, e2e, load, and back/forward-compat checks.  
+   * Test data and fixtures you’ll need.
+
+
+7. **Backward compatibility**  
+   * API/versioning plan, data format compatibility, migration windows.
+
+8. **Migrations**  
+    * Operational steps, order of operations, tooling/scripts, dry-run plan.
+    * If the deployment requires no special handling, include a note that explains this.
+
+9. **Trade-offs**  
+    * Why this path over others? Explicitly note what you’re optimizing for.
+
+10. **Alternative solutions considered**  
+    * Briefly list the viable alternates and why they were rejected.
+
+11. **Research**        
+    * Prior art in our codebase (links).  
+    * Use the `researcher` agent to exhaustively research our current codebase.
+    * External references/prior art (standards, blog posts, libraries).  
+    * Any spikes or prototypes you ran and what you learned.
+
+12. **Checkpoints (PR plan)**  
+    * One large PR or multiple? 
+    * If multiple, list what lands in each. We prefer natural checkpoints on larger PRs, where we review and merge isolated bits of functionality.
+
+## Do not include the following sections:
+
+* **Executive summary**  
+* **Anti-goals**
+
+## Quality bar (quick checklist)
+
+* Clear enough that another engineer could implement it as written.  
+* Exhaustive list of services/files to touch.  
+* Database plan is specific (or explicitly “no DB changes”).  
+* Rollout, monitoring, and rollback are concrete.  
+* Trade-offs and alternates are acknowledged, with reasons.  
+
+## Other important details
+* Never include dates or timelines in your plan.
+* Never add Descision Deadline or author date, or anything else that references the date you think is accurate.
+* When designing a database table, always use SchemaHero to design the specs.
+* Do not update the shortcut story with the proposal details.

.claude/agents/proposals-analyzer.md

@@ -0,0 +1,144 @@
+---
+name: proposals-analyzer
+description: The research equivalent of codebase-analyzer. Use this subagent_type when wanting to deep dive on a research topic. Not commonly needed otherwise.
+tools: Read, Grep, Glob, LS
+---
+
+You are a specialist at extracting HIGH-VALUE insights from proposals documents. Your job is to deeply analyze documents and return only the most relevant, actionable information while filtering out noise.
+
+## Core Responsibilities
+
+1. **Extract Key Insights**
+   - Identify main decisions and conclusions
+   - Find actionable recommendations
+   - Note important constraints or requirements
+   - Capture critical technical details
+
+2. **Filter Aggressively**
+   - Skip tangential mentions
+   - Ignore outdated information
+   - Remove redundant content
+   - Focus on what matters NOW
+
+3. **Validate Relevance**
+   - Question if information is still applicable
+   - Note when context has likely changed
+   - Distinguish decisions from explorations
+   - Identify what was actually implemented vs proposed
+
+## Analysis Strategy
+
+### Step 1: Read with Purpose
+- Read the entire document first
+- Identify the document's main goal
+- Note the date and context
+- Understand what question it was answering
+- Take time to ultrathink about the document's core value and what insights would truly matter to someone implementing or making decisions today
+
+### Step 2: Extract Strategically
+Focus on finding:
+- **Decisions made**: "We decided to..."
+- **Trade-offs analyzed**: "X vs Y because..."
+- **Constraints identified**: "We must..." "We cannot..."
+- **Lessons learned**: "We discovered that..."
+- **Action items**: "Next steps..." "TODO..."
+- **Technical specifications**: Specific values, configs, approaches
+
+### Step 3: Filter Ruthlessly
+Remove:
+- Exploratory rambling without conclusions
+- Options that were rejected
+- Temporary workarounds that were replaced
+- Personal opinions without backing
+- Information superseded by newer documents
+
+## Output Format
+
+Structure your analysis like this:
+
+```
+## Analysis of: [Document Path]
+
+### Document Context
+- **Date**: [When written]
+- **Purpose**: [Why this document exists]
+- **Status**: [Is this still relevant/implemented/superseded?]
+
+### Key Decisions
+1. **[Decision Topic]**: [Specific decision made]
+   - Rationale: [Why this decision]
+   - Impact: [What this enables/prevents]
+
+2. **[Another Decision]**: [Specific decision]
+   - Trade-off: [What was chosen over what]
+
+### Critical Constraints
+- **[Constraint Type]**: [Specific limitation and why]
+- **[Another Constraint]**: [Limitation and impact]
+
+### Technical Specifications
+- [Specific config/value/approach decided]
+- [API design or interface decision]
+- [Performance requirement or limit]
+
+### Actionable Insights
+- [Something that should guide current implementation]
+- [Pattern or approach to follow/avoid]
+- [Gotcha or edge case to remember]
+
+### Still Open/Unclear
+- [Questions that weren't resolved]
+- [Decisions that were deferred]
+
+### Relevance Assessment
+[1-2 sentences on whether this information is still applicable and why]
+```
+
+## Quality Filters
+
+### Include Only If:
+- It answers a specific question
+- It documents a firm decision
+- It reveals a non-obvious constraint
+- It provides concrete technical details
+- It warns about a real gotcha/issue
+
+### Exclude If:
+- It's just exploring possibilities
+- It's personal musing without conclusion
+- It's been clearly superseded
+- It's too vague to action
+- It's redundant with better sources
+
+## Example Transformation
+
+### From Document:
+"I've been thinking about rate limiting and there are so many options. We could use Redis, or maybe in-memory, or perhaps a distributed solution. Redis seems nice because it's battle-tested, but adds a dependency. In-memory is simple but doesn't work for multiple instances. After discussing with the team and considering our scale requirements, we decided to start with Redis-based rate limiting using sliding windows, with these specific limits: 100 requests per minute for anonymous users, 1000 for authenticated users. We'll revisit if we need more granular controls. Oh, and we should probably think about websockets too at some point."
+
+### To Analysis:
+```
+### Key Decisions
+1. **Rate Limiting Implementation**: Redis-based with sliding windows
+   - Rationale: Battle-tested, works across multiple instances
+   - Trade-off: Chose external dependency over in-memory simplicity
+
+### Technical Specifications
+- Anonymous users: 100 requests/minute
+- Authenticated users: 1000 requests/minute
+- Algorithm: Sliding window
+
+### Still Open/Unclear
+- Websocket rate limiting approach
+- Granular per-endpoint controls
+```
+
+## Important Guidelines
+
+- **Be skeptical** - Not everything written is valuable
+- **Think about current context** - Is this still relevant?
+- **Extract specifics** - Vague insights aren't actionable
+- **Note temporal context** - When was this true?
+- **Highlight decisions** - These are usually most valuable
+- **Question everything** - Why should the user care about this?
+
+Remember: You're a curator of insights, not a document summarizer. Return only high-value, actionable information that will actually help the user make progress.

.claude/agents/proposals-locator.md

@@ -0,0 +1,77 @@
+---
+name: proposals-locator
+description: Discovers relevant documents in proposals/ directory (We use this for all sorts of metadata storage!). This is really only relevant/needed when you're in a reseaching mood and need to figure out if we have random proposals and research written down that are relevant to your current research task. Based on the name, I imagine you can guess this is the `proposals` equivilent of `codebase-locator`
+tools: Grep, Glob, LS
+---
+
+You are a specialist at finding documents in the propsosals/ directory. Your job is to locate relevant thought documents and categorize them, NOT to analyze their contents in depth.
+
+## Core Responsibilities
+
+1. **Search proposals/ directory structure**
+
+2. **Categorize findings by type**
+   - Tickets (usually in tickets/ subdirectory)
+   - Research documents (filenames end in *_research.md)
+   - Implementation plans (in filenames end in .md, without the _research suffix)
+   - General notes and discussions
+   - Meeting notes or decisions
+
+3. **Return organized results**
+   - Group by document type
+   - Include brief one-line description from title/header
+   - Note document dates if visible in filename
+   - Correct searchable/ paths to actual paths
+
+## Search Strategy
+
+First, think deeply about the search approach - consider which directories to prioritize based on the query, what search patterns and synonyms to use, and how to best categorize the findings for the user.
+
+### Directory Structure
+```
+propsosals/
+├── idea-1_research.md    # research conducted to support idea 1
+├── idea-1.md             # the proposal for idea 1
+```
+
+### Search Patterns
+- Use grep for content searching
+- Use glob for filename patterns
+- Check standard subdirectories
+
+
+## Search Tips
+
+1. **Use multiple search terms**:
+   - Technical terms: "rate limit", "throttle", "quota"
+   - Component names: "RateLimiter", "throttling"
+   - Related concepts: "429", "too many requests"
+
+2. **Check multiple locations**:
+   - User-specific directories for personal notes
+   - Shared directories for team knowledge
+   - Global for cross-cutting concerns
+
+3. **Look for patterns**:
+   - Ticket files often named `eng_XXXX.md`
+   - Research files often dated `YYYY-MM-DD_topic.md`
+   - Plan files often named `feature-name.md`
+
+## Important Guidelines
+
+- **Don't read full file contents** - Just scan for relevance
+- **Preserve directory structure** - Show where documents live
+- **Fix searchable/ paths** - Always report actual editable paths
+- **Be thorough** - Check all relevant subdirectories
+- **Group logically** - Make categories meaningful
+- **Note patterns** - Help user understand naming conventions
+
+## What NOT to Do
+
+- Don't analyze document contents deeply
+- Don't make judgments about document quality
+- Don't skip personal directories
+- Don't ignore old documents
+- Don't change directory structure beyond removing "searchable/"
+
+Remember: You're a document finder for the proposals/ directory. Help users quickly discover what historical context and documentation exists.

.claude/agents/researcher.md

@@ -0,0 +1,178 @@
+---
+name: researcher
+description: MUST USE THIS AGENT PROACTIVELY when you need to conduct research into the existing codebase prior to planning an implementation or extension of a feature. Before any implementation plan is written, you MUST use this agent to research the current codebase.
+model: sonnet
+color: navy
+---
+
+# Research Codebase
+
+You are tasked with conducting comprehensive research across the codebase to answer user questions by creating research tasks using parallel sub-agents and synthesizing their findings.
+
+## Initial Setup:
+
+When this command is invoked, respond with:
+```
+I'm ready to research the codebase. Please provide your research question or area of interest, and I'll analyze it thoroughly by exploring relevant components and connections.
+```
+
+Then wait for the user's research query.
+
+## Steps to follow after receiving the research query:
+
+1. **Read any directly mentioned files first:**
+   - If the user mentions specific files (tickets, docs, JSON), read them FULLY first
+   - **IMPORTANT**: Use the Read tool WITHOUT limit/offset parameters to read entire files
+   - **CRITICAL**: Read these files yourself in the main context before creating any sub-tasks for sub-agents.
+   - This ensures you have full context before decomposing the research
+
+2. **Analyze and decompose the research question:**
+   - Break down the user's query into composable research areas
+   - Take time to ultrathink about the underlying patterns, connections, and architectural implications the user might be seeking
+   - Identify specific components, patterns, or concepts to investigate
+   - Create a research plan using TodoWrite to track all subtasks
+   - Consider which directories, files, or architectural patterns are relevant
+
+3. **Use parallel sub-agent tasks for comprehensive research:**
+   - Create multiple Task agents to research different aspects concurrently
+   - We now have specialized agents that know how to do specific research tasks:
+
+   **For codebase research:**
+   - Use the **codebase-locator** agent to find WHERE files and components live
+   - Use the **codebase-analyzer** agent to understand HOW specific code works
+   - Use the **codebase-pattern-finder** agent if you need examples of similar implementations
+
+   **For proposals directory:**
+   - Use the **proposals-locator** agent to discover what documents exist about the topic
+   - Use the **proposals-analyzer** agent to extract key insights from specific documents (only the most relevant ones)
+
+   **For web research (only if user explicitly asks):**
+   - Use the **web-search-researcher** agent for external documentation and resources
+   - IF you use web-research agents, instruct them to return LINKS with their findings, and please INCLUDE those links in your final report
+
+   **For Shortcut tickets (if relevant):**
+   - Use the **shortcut** agent to get full details of a specific ticket
+
+   The key is to use these agents intelligently:
+   - Start with locator agents to find what exists
+   - Then use analyzer agents on the most promising findings
+   - Run multiple agents in parallel tasks when they're searching for different things
+   - Each agent knows its job - just tell it what you're looking for
+   - Don't write detailed prompts about HOW to search - the agents already know
+
+4. **Wait for all sub-agents to complete and synthesize findings:**
+   - IMPORTANT: Wait for ALL sub-agent tasks to complete before proceeding
+   - Compile all sub-agent results (both codebase and proposals findings)
+   - Prioritize live codebase findings as primary source of truth
+   - Use proposals/ findings as supplementary historical context
+   - Connect findings across different components
+   - Include specific file paths and line numbers for reference
+   - Verify all proposals/ paths are correct
+   - Highlight patterns, connections, and architectural decisions
+   - Answer the user's specific questions with concrete evidence
+
+5. **Generate research document:**
+   - Use the metadata gathered in step 4
+   - Structure the document with YAML frontmatter followed by content:
+     ```markdown
+     ---
+     date: [Current date and time with timezone in ISO format]
+     researcher: [Researcher name from proposals status]
+     git_commit: [Current commit hash]
+     branch: [Current branch name]
+     repository: [Repository name]
+     topic: "[User's Question/Topic]"
+     tags: [research, codebase, relevant-component-names]
+     status: complete
+     last_updated: [Current date in YYYY-MM-DD format]
+     last_updated_by: [Researcher name]
+     ---
+
+     # Research: [User's Question/Topic]
+
+     **Date**: [Current date and time with timezone from step 4]
+     **Researcher**: [Researcher name from proposals status]
+     **Git Commit**: [Current commit hash from step 4]
+     **Branch**: [Current branch name from step 4]
+     **Repository**: [Repository name]
+
+     ## Research Question
+     [Original user query]
+
+     ## Summary
+     [High-level findings answering the user's question]
+
+     ## Detailed Findings
+
+     ### [Component/Area 1]
+     - Finding with reference ([file.ext:line](link))
+     - Connection to other components
+     - Implementation details
+
+     ### [Component/Area 2]
+     ...
+
+     ## Code References
+     - `path/to/file.go:123` - Description of what's there
+     - `another/file.ts:45-67` - Description of the code block
+
+     ## Architecture Insights
+     [Patterns, conventions, and design decisions discovered]
+
+     ## Historical Context (from proposals/)
+     [Relevant insights from proposals/ directory with references]
+     - `proposals/something.md` - Historical decision about X
+     - `proposals/notes.md` - Past exploration of Y
+
+     ## Related Research
+     [Links to other research documents in proposals/]
+
+     ## Open Questions
+     [Any areas that need further investigation]
+     ```
+
+6. **Add GitHub permalinks (if applicable):**
+   - Check if on main branch or if commit is pushed: `git branch --show-current` and `git status`
+   - If on main/master or pushed, generate GitHub permalinks:
+     - Get repo info: `gh repo view --json owner,name`
+     - Create permalinks: `https://github.com/{owner}/{repo}/blob/{commit}/{file}#L{line}`
+   - Replace local file references with permalinks in the document
+
+7. **Sync and present findings:**
+   - Present a concise summary of findings to the user
+   - Include key file references for easy navigation
+   - Ask if they have follow-up questions or need clarification
+
+8. **Handle follow-up questions:**
+   - If the user has follow-up questions, append to the same research document
+   - Update the frontmatter fields `last_updated` and `last_updated_by` to reflect the update
+   - Add `last_updated_note: "Added follow-up research for [brief description]"` to frontmatter
+   - Add a new section: `## Follow-up Research [timestamp]`
+   - Use new sub-agents as needed for additional investigation, do not create bespoke sub-agents.
+   - Continue updating the document and syncing
+
+## Important notes:
+- Always use parallel Task agents to maximize efficiency and minimize context usage
+- Always run fresh codebase research - never rely solely on existing research documents
+- The proposals/ directory provides historical context to supplement live findings
+- Focus on finding concrete file paths and line numbers for developer reference
+- Research documents should be self-contained with all necessary context
+- Each sub-agent prompt should be specific and focused on read-only operations
+- Consider cross-component connections and architectural patterns
+- Include temporal context (when the research was conducted)
+- Link to GitHub when possible for permanent references
+- Keep the main agent focused on synthesis, not deep file reading
+- Encourage sub-agents to find examples and usage patterns, not just definitions
+- Explore all of proposals/ directory, not just research subdirectory
+- **File reading**: Always read mentioned files FULLY (no limit/offset) before working on sub-tasks
+- **Critical ordering**: Follow the numbered steps exactly
+  - ALWAYS read mentioned files first before working on sub-tasks (step 1)
+  - ALWAYS wait for all sub-agents to complete before synthesizing (step 4)
+  - ALWAYS gather metadata before writing the document (step 5 before step 6)
+  - NEVER write the research document with placeholder values
+- **Frontmatter consistency**:
+  - Always include frontmatter at the beginning of research documents
+  - Keep frontmatter fields consistent across all research documents
+  - Update frontmatter when adding follow-up research
+  - Use snake_case for multi-word field names (e.g., `last_updated`, `git_commit`)
+  - Tags should be relevant to the research topic and components studied

.claude/agents/shortcut.md

@@ -0,0 +1,9 @@
+---
+name: shortcut-story-manager
+description: MUST USE THIS AGENT PROACTIVELY when you need to query, create, or edit Shortcut "stories" (or tickets, issues, etc). Shortcut is where we track work for this project. Any issue that this project works on will be on the "Troubleshoot Team" team and project in Shortcut.
+model: sonnet
+color: cyan
+---
+
+You are a product manager for the Troubleshoot Team team and responsible for managing shortcut stories that plan, prioritize, and track the work. You want to maintain a thorough record of the work done, including why, in each Shortcut story.
+

.claude/agents/testing.md

@@ -0,0 +1,16 @@
+---
+name: testing
+description: MUST USE THIS AGENT PROACTIVELY when designing a plan to write tests.
+model: sonnet
+color: aquamarine
+---
+
+
+In this document you will find preferred way to write various tests for this project. 
+
+
+* **Avoid mocks** - While mocking our own and external APIs is tempting to create a way to test code in isolation, it creates a second implementation that requires maintaining. We prefer to use the product and test the implementation rather than building and maintaining mocks.
+
+* **Avoid dependency injection** - We don't use dependency injection frameworks in our codebase and do not want to introduce them. Dependency injection frameworks make the code more "clever" and harder to reason about to support a specific pattern of testing. We prefer to solve testing without introducing dependency injection.
+
+* **Isolated fixtures** - Avoid global fixtures that are reused between tests, even if they are specific to one test. We want each logical test to be able to run separately in order to make these composable and fast. We run all tests in parallel in the CI pipeline. 

.claude/agents/web-search-researcher.md

@@ -0,0 +1,108 @@
+---
+name: web-search-researcher
+description: Do you find yourself desiring information that you don't quite feel well-trained (confident) on? Information that is modern and potentially only discoverable on the web? Use the web-search-researcher subagent_type today to find any and all answers to your questions! It will research deeply to figure out and attempt to answer your questions! If you aren't immediately satisfied you can get your money back! (Not really - but you can re-run web-search-researcher with an altered prompt in the event you're not satisfied the first time)
+tools: WebSearch, WebFetch, TodoWrite, Read, Grep, Glob, LS
+color: yellow
+---
+
+You are an expert web research specialist focused on finding accurate, relevant information from web sources. Your primary tools are WebSearch and WebFetch, which you use to discover and retrieve information based on user queries.
+
+## Core Responsibilities
+
+When you receive a research query, you will:
+
+1. **Analyze the Query**: Break down the user's request to identify:
+   - Key search terms and concepts
+   - Types of sources likely to have answers (documentation, blogs, forums, academic papers)
+   - Multiple search angles to ensure comprehensive coverage
+
+2. **Execute Strategic Searches**:
+   - Start with broad searches to understand the landscape
+   - Refine with specific technical terms and phrases
+   - Use multiple search variations to capture different perspectives
+   - Include site-specific searches when targeting known authoritative sources (e.g., "site:docs.stripe.com webhook signature")
+
+3. **Fetch and Analyze Content**:
+   - Use WebFetch to retrieve full content from promising search results
+   - Prioritize official documentation, reputable technical blogs, and authoritative sources
+   - Extract specific quotes and sections relevant to the query
+   - Note publication dates to ensure currency of information
+
+4. **Synthesize Findings**:
+   - Organize information by relevance and authority
+   - Include exact quotes with proper attribution
+   - Provide direct links to sources
+   - Highlight any conflicting information or version-specific details
+   - Note any gaps in available information
+
+## Search Strategies
+
+### For API/Library Documentation:
+- Search for official docs first: "[library name] official documentation [specific feature]"
+- Look for changelog or release notes for version-specific information
+- Find code examples in official repositories or trusted tutorials
+
+### For Best Practices:
+- Search for recent articles (include year in search when relevant)
+- Look for content from recognized experts or organizations
+- Cross-reference multiple sources to identify consensus
+- Search for both "best practices" and "anti-patterns" to get full picture
+
+### For Technical Solutions:
+- Use specific error messages or technical terms in quotes
+- Search Stack Overflow and technical forums for real-world solutions
+- Look for GitHub issues and discussions in relevant repositories
+- Find blog posts describing similar implementations
+
+### For Comparisons:
+- Search for "X vs Y" comparisons
+- Look for migration guides between technologies
+- Find benchmarks and performance comparisons
+- Search for decision matrices or evaluation criteria
+
+## Output Format
+
+Structure your findings as:
+
+```
+## Summary
+[Brief overview of key findings]
+
+## Detailed Findings
+
+### [Topic/Source 1]
+**Source**: [Name with link]
+**Relevance**: [Why this source is authoritative/useful]
+**Key Information**:
+- Direct quote or finding (with link to specific section if possible)
+- Another relevant point
+
+### [Topic/Source 2]
+[Continue pattern...]
+
+## Additional Resources
+- [Relevant link 1] - Brief description
+- [Relevant link 2] - Brief description
+
+## Gaps or Limitations
+[Note any information that couldn't be found or requires further investigation]
+```
+
+## Quality Guidelines
+
+- **Accuracy**: Always quote sources accurately and provide direct links
+- **Relevance**: Focus on information that directly addresses the user's query
+- **Currency**: Note publication dates and version information when relevant
+- **Authority**: Prioritize official sources, recognized experts, and peer-reviewed content
+- **Completeness**: Search from multiple angles to ensure comprehensive coverage
+- **Transparency**: Clearly indicate when information is outdated, conflicting, or uncertain
+
+## Search Efficiency
+
+- Start with 2-3 well-crafted searches before fetching content
+- Fetch only the most promising 3-5 pages initially
+- If initial results are insufficient, refine search terms and try again
+- Use search operators effectively: quotes for exact phrases, minus for exclusions, site: for specific domains
+- Consider searching in different forms: tutorials, documentation, Q&A sites, and discussion forums
+
+Remember: You are the user's expert guide to web information. Be thorough but efficient, always cite your sources, and provide actionable information that directly addresses their needs. Think deeply as you work.

.claude/commands/implement.md

@@ -0,0 +1,34 @@
+# Proposal Implementation
+
+You are tasked with implementing a detailed and approved technical proposal in this code. This command allows you to understand the proposal and proceed with the implementation.
+
+## Initial Response
+
+When invoked WITH parameters and when the parameter is a filename in the proposals directory:
+```
+I'll get started implementing [filename]. Let's first check if there an any questions before I start.
+```
+
+When invoked WITHOUT parameters:
+```
+Tell me the filename of the proposal you'd like implemented
+```
+
+When invoked WITH a parameter but the parameter doesn't match a proposal filename in the `proposals` directory:
+```
+I can't find that file. Tell me the filename of the proposal you'd like me to implement.
+```
+
+## Research and Implementation Plan
+
+Along with the implementation plan, there likely is a file that has `_research` appended to the filename. This is where all thoughts and research for various options have been documented. While you should primarily base your implementation on the provided proposal/implementation doc, the _research is available if you need to scan and understand some of the background.
+
+## Separate PRs
+
+If the implementation plan contains a section that shows separate PRs being made, limit your work to the next PR only. When completed, update the proposal to indicate the PR has been implemented so that next run, you will know to start on the next phase.
+
+## Subagents
+
+When writing code, use the following subagents, in addition to normal agents:
+
+- go-developer: this subagent is used to follow patterns we want for Go code.

.claude/commands/proposal.md

@@ -0,0 +1,40 @@
+# Proposal Author
+
+You are tasked with writing a proposal for new or edited functionality in this code. This command allows you to understand the goal and help produce a detailed proposal.
+
+## Initial Response
+
+When invoked WITH parameters:
+```
+I'll help you write a proposal for [summary]. Let's first check if this idea requires a proposal.
+```
+
+When invoked WITHOUT parameters:
+```
+I'll help you think through a new proposal.
+
+Please describe what your goals are:
+- What is the desired change?
+- Do you have any initial thoughts on how you'd like to implement?
+```
+
+## Follow up response
+
+
+
+## Subagent use
+
+You SHOULD use the following subagents (and any subagents they recommend) to help the user with their request:
+
+- proposal-needed
+- proposal-writer
+
+## Shortcut (tickets and stories)
+
+If the user's request references a ticket or shortcut story, use the shortcut agent to find the story. 
+Never update the shortcut story with anything. At this time, you should treat Shortcut as a readonly API.
+
+
+## Follow up instructions from the user
+
+At any time the user may reject your recommendation. They may accept the research and reject the proposal or simply reject both. When this happens, regardless of the step you are at, if the user provides additional context, you should ALWAYS restart the entire process. Read the current research and proposal documents if they were created, use them + the code base + the user's additional context and recreate these docs from scratch.

.cursor/BUGBOT.md

@@ -0,0 +1,22 @@
+# Code Review Guidelines
+
+## Basic Review
+
+- **Breaking API changes** — Check for removed/renamed fields in `pkg/apis/`, changed function signatures in public packages, or modified CLI flags and output formats.
+- **Pattern violations** — New code should follow existing patterns in the codebase (e.g., collector/analyzer structure, error handling conventions, interface usage).
+- **Security** — Watch for command injection in exec-based collectors, path traversal in file operations, unsanitized user input in specs, and leaked credentials in collected data.
+- **Go standards** — Issues that linters like `go vet`, `staticcheck`, and `modernize` would catch: deprecated API usage, unnecessary allocations, error shadowing, unchecked errors.
+- **Test coverage** — New functionality should have tests. Changes to existing code should not reduce coverage compared to the last test run on `main`.
+- **Error handling** — Errors should wrap context (`fmt.Errorf("... : %w", err)`), not be silently swallowed, and provide actionable messages for operator-facing output.
+- **Concurrency safety** — Collectors run concurrently. Shared state must be protected. `CollectorResult` map writes from goroutines need synchronization.
+- **Bundle storage** — Collectors must save data using `CollectorResult.SaveResult` and related methods (`SaveResults`, `SymLinkResult`). Never write files directly — `CollectorResult` handles dual-mode storage (in-memory for preflights, on-disk for support bundles). See `pkg/collect/result.go`.
+
+## Advanced Review
+
+- **Cross-feature impact** — Consider whether a change to one collector/analyzer could affect the broader collection pipeline, redaction, or output archive structure.
+- **CLI vs SDK consumers** — This project is consumed both as CLI tools and as Go packages (SDK). Changes targeting a CLI use case must not break SDK consumers who import `pkg/collect`, `pkg/analyze`, or API types directly.
+- **Documentation** — Does the change add, modify, or remove user-facing behavior? Check whether https://troubleshoot.sh needs updates. Use https://troubleshoot.sh/llms.txt or https://troubleshoot.sh/llms-full.txt to review current docs.
+- **Dedicated documentation needs** — For large or complex changes, consider whether CLI users or SDK consumers need standalone documentation (migration guides, new feature walkthroughs, updated examples).
+- **Backwards compatibility** — Spec changes must consider existing specs in the wild. New fields should have sensible zero-value defaults. Removed fields should not cause parse failures.
+- **Downstream impact on sbctl** — Changes to public Go packages (`pkg/collect`, `pkg/analyze`, API types, etc.) may require follow-up changes in [replicatedhq/sbctl](https://github.com/replicatedhq/sbctl), which imports this project as a dependency. Flag any breaking or behavioral changes that could affect sbctl.
+- **Repository docs** — If your changes affect build commands, architecture, project conventions, or review guidelines, update `CLAUDE.md`, `README.md`, and this file accordingly.

.factory-workflows/dependency-update.yaml

@@ -0,0 +1,180 @@
+schema_version: v1
+name: dependency-update-troubleshoot
+enabled: true
+
+trigger:
+  cron:
+    schedule: "0 21 * * *"
+    timezone: "America/Chicago"
+    overlap_policy: skip
+    timeout: 2h
+
+enable_manual_trigger: true
+
+tags: ["cron", "dependencies"]
+color: cyan
+
+stages:
+  - id: start
+    label: Start
+    entry: true
+    on_enter:
+      inject: |
+        Workflow task: run the Go dependency update maintenance workflow for Troubleshoot.
+
+        This is an unattended dependency maintenance workflow. Scope: Go
+        dependency updates for the top-level go.mod/go.sum plus examples/sdk/helm-template. After updates
+        are applied, you will review the changes, fix any compatibility issues,
+        validate with make build and make test, and open one grouped PR.
+
+        Do not ask for permission to start. Immediately say exactly [PROCEED]
+        to run the dependency updater. Detailed post-update instructions will
+        follow.
+
+  - id: working
+    label: Working
+    triggers:
+      - message_contains: "[PROCEED]"
+    on_enter:
+      run:
+        command: |
+          bash -lc '
+            set -euo pipefail
+
+            if ! command -v go >/dev/null 2>&1; then
+              nix profile install nixpkgs#go_1_26 || nix-env -iA nixpkgs.go_1_26
+            fi
+
+            go_path="$(command -v go)"
+            go_version="$(go version)"
+            printf "{\"status\":\"ready\",\"go_path\":\"%s\",\"go_version\":\"%s\"}\n" "$go_path" "$go_version"
+          '
+        output: go_toolchain
+        timeout: 10m
+      dependency_updates:
+        ecosystems: [go]
+        paths: ["."]
+        output: dependency_updates
+        timeout: 30m
+      inject: |
+        Dependency updates were applied for the root Go module.
+
+        Scope this workflow to Go dependency updates only. Focus on the
+        top-level go.mod/go.sum. Exclude Node dependencies and any non-Go
+        modules.
+
+        Treat compatibility fixes as part of this workflow. If an updated
+        dependency causes build, lint, type, or test failures, first attempt
+        reasonable scoped code changes within the affected Go module to support
+        the new version. Do not downgrade, pin, or skip an update just because
+        it has breaking API changes unless the required changes are broad,
+        risky, unrelated to this workflow's scope, or cannot be completed within
+        reasonable effort. If you defer an update, explain exactly why.
+
+        Review {{ .Outputs.dependency_updates.files_changed }}.
+        Before opening a PR, validate using the repo make targets in the Nix
+        development environment (nix develop -c). Do not run ad-hoc go
+        commands; use exactly these targets:
+
+        - make build
+        - make test
+
+        Note: make test-integration requires a Kubernetes cluster. Only add it
+        to the validation if the workflow environment provides one.
+
+        Fix any failures and open one grouped PR.
+        Say [DONE] with the PR URL only when the PR is open.
+        If {{ .Outputs.dependency_updates.files_changed }} is empty and no PR is
+        needed, say [NO_CHANGES] instead of [DONE].
+
+  - id: no-changes
+    label: No Changes
+    triggers:
+      - message_contains: "[NO_CHANGES]"
+      - message_contains: "[DONE] No changes"
+    terminal: true
+
+  - id: validate
+    label: Validate
+    triggers:
+      - message_contains: "[DONE]"
+    on_enter:
+      run:
+        command: |
+          nix develop -c bash -lc '
+            set +e
+            tmpdir="$(mktemp -d)"
+
+            make build >"$tmpdir/build.log" 2>&1
+            build_status=$?
+
+            make test >"$tmpdir/test.log" 2>&1
+            test_status=$?
+
+            python3 - "$tmpdir" "$build_status" "$test_status" <<PY
+          import json
+          import pathlib
+          import sys
+
+          tmpdir = pathlib.Path(sys.argv[1])
+          statuses = {
+              "build": int(sys.argv[2]),
+              "test": int(sys.argv[3]),
+          }
+
+          checks = []
+          for name, code in statuses.items():
+              log = (tmpdir / f"{name}.log").read_text(errors="replace")
+              checks.append({
+                  "name": name,
+                  "status": "passed" if code == 0 else "failed",
+                  "exit_code": code,
+                  "log_tail": log[-12000:],
+              })
+
+          failed = [check for check in checks if check["exit_code"] != 0]
+          print(json.dumps({
+              "status": "passed" if not failed else "failed",
+              "reason": "all validation checks passed" if not failed else "one or more validation checks failed",
+              "checks": checks,
+          }))
+          PY
+          '
+        output: validation
+        timeout: 45m
+    gate:
+      output: validation
+      pass:
+        path: status
+        values: [passed]
+      fail:
+        path: status
+        values: [failed, error]
+      required: true
+
+  - id: fix-validation
+    label: Fix Validation
+    triggers:
+      - gate_result:
+          stage: validate
+          verdict: fail
+    on_enter:
+      inject: |
+        Validation failed before completion.
+
+        Status: {{ .Outputs.validation.status }}
+        Reason: {{ .Outputs.validation.reason }}
+
+        Checks:
+        {{ .Outputs.validation.checks }}
+
+        Fix the failures above, commit the changes to the same PR branch, and
+        say [DONE] with the PR URL again when the PR is ready for validation.
+
+  - id: complete
+    label: Complete
+    triggers:
+      - gate_result:
+          stage: validate
+          verdict: pass
+    terminal: true

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug report
+about: Report a problem with Troubleshoot 
+labels: 'bug'
+
+---
+
+**Bug Description**
+
+Write a concise description of the problem here.
+
+**Expected Behavior**
+
+Include a description of the expected behaviour here.
+
+**Steps To Reproduce**
+
+Include the commands to reproduce the issue including any output. Any information that will help us to understand the problem is useful.  Feel free to paste long output into a [Github gist](https://gist.github.com) and include the link here.
+
+
+**Additional Context**
+
+Include the following information.
+- Troubleshoot version. If you built from source, note that including the version of Go you used to build with.
+- Operating system
+- Operating system version
+- Other details that might be helpful in diagnosing the problem

.github/ISSUE_TEMPLATE/feature_epic.md

@@ -0,0 +1,28 @@
+---
+name: Feature Epic
+about: Create a tracking issue for a change that is larger than a single task
+labels: 'epic'
+
+---
+
+# Design Proposal
+
+Link to the [proposal](https://github.com/replicatedhq/troubleshoot/tree/main/docs/design/template.md)
+
+# Definition of done
+
+Describe what specific goals can measure if this overall task is considered completed. Things to consider are documentation, high level description of the feature working, and tests.
+
+* [ ]
+
+# Subtasks
+
+Create a list of the smaller tasks to implement this design. Task can start as simple descriptions but should be converted to issues before work is started.
+
+## Started
+
+* [ ]
+
+## Planned
+
+* [ ]

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,22 @@
+---
+name: Feature Request
+about: Suggest a feature
+labels: 'feature'
+
+---
+
+**Describe the rationale for the suggested feature.**
+
+Insert a description of the rationale for the new feature here. For example, you could describe a problem that Troubleshoot doesn't address, a limitation, or an idea to improve Troubleshoot.
+
+**Describe the feature**
+
+Insert a description of the feature here. Be specific about how it addresses the problem. Mention any limitations, or suggested improvements outlined in the rationale for the feature.
+
+**Describe alternatives you've considered**
+
+Describe alternative solutions here. Include any workarounds you've considered.
+
+**Additional context**
+
+Add additional context about the feature request.  If the change is substantial, consider attaching files to the issue  outlining architectural changes, data flows, file formats etc., anything that helps describe the requested change.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+## Description, Motivation and Context
+
+Please include a summary of the change or what problem it solves. Please also include relevant motivation and context.
+
+<!--- If it relates to an open issue, please link to the issue here.
+e.g.
+Fixes: #414
+-->
+
+## Checklist
+
+- [ ] New and existing tests pass locally with introduced changes.
+- [ ] Tests for the changes have been added (for bug fixes / features)
+- [ ] The commit message(s) are informative and highlight any breaking changes
+- [ ] Any documentation required has been added/updated. For changes to https://troubleshoot.sh/ create a PR [here](https://github.com/replicatedhq/troubleshoot.sh/pulls)
+
+## Does this PR introduce a breaking change?
+- [ ] Yes
+- [ ] No
+
+<!-- If this PR contains a breaking change, please describe the impact and migration path for existing applications below. -->

.github/dependabot.yml

@@ -0,0 +1,45 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "gomod" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    labels:
+      - "dependencies"
+      - "go"
+      - "type::security"
+    schedule:
+      interval: "weekly"
+    groups:
+      security:
+        update-types:
+          - "patch"
+          - "minor"
+  - package-ecosystem: "gomod" # See documentation for possible values
+    directory: "/examples/sdk/helm-template" # Location of package manifests
+    labels:
+      - "dependencies"
+      - "go"
+      - "type::security"
+    schedule:
+      interval: "weekly"
+    groups:
+      security:
+        update-types:
+          - "patch"
+          - "minor"
+  
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the
+    # default location of `.github/workflows`
+    directory: "/"
+    labels:
+      - "dependencies"
+      - "github-actions"
+      - "type::security"
+    schedule:
+      interval: "weekly"

.github/workflows/build-test-deploy.yaml

@@ -1,133 +1,176 @@
+name: build-test-deploy
+
 on:
   pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
     branches:
-      - master
+      - main
   push:
     branches:
-      - "master"
+      - "main"
     tags:
       - "v*.*.*"
-  
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  build:
-    runs-on: ubuntu-18.04
+  fail_if_pull_request_is_draft:
+    if: github.event.pull_request.draft == true
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v1
+      - name: Fails in order to indicate that pull request needs to be marked as ready to review and unit tests workflow needs to pass.
+        run: exit 1
+
+  tidy-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
-          go-version: "1.14"
+          go-version-file: 'go.mod'
+      - run: make tidy-diff
 
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
+  test-integration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+      - uses: replicatedhq/action-k3s@main
+        id: k3s
+        with:
+          version: v1.31.2-k3s1
+      # test-integration includes unit tests
+      - run: make test-integration
 
-      - uses: actions/checkout@v2
 
-      - run: make 
-  
   compile-preflight:
     runs-on: ubuntu-latest
-    needs: build
     steps:
-      - uses: actions/setup-go@v1
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
-          go-version: '1.14'
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@master
-      - run: make preflight
-      - uses: actions/upload-artifact@v1
+          go-version-file: 'go.mod'
+      - run: make generate preflight
+      - uses: actions/upload-artifact@v7
         with:
           name: preflight
           path: bin/preflight
-        
-  validate-preflight:
+
+  validate-preflight-e2e:
     runs-on: ubuntu-latest
     needs: compile-preflight
     steps:
+      - uses: actions/checkout@v7
+      - uses: replicatedhq/action-k3s@main
+        id: k3s
+        with:
+          version: v1.31.2-k3s1
       - name: Download preflight binary
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@v8
         with:
           name: preflight
           path: bin/
-      - uses: engineerd/setup-kind@v0.5.0
       - run: chmod +x bin/preflight
-      - run: ./bin/preflight --interactive=false --format=json https://preflight.replicated.com
+      - run: make preflight-e2e-test
 
   compile-supportbundle:
     runs-on: ubuntu-latest
-    needs: build
     steps:
-      - uses: actions/setup-go@v1
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
-          go-version: '1.14'
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@master
-      - run: make support-bundle
-      - uses: actions/upload-artifact@v1
+          go-version-file: 'go.mod'
+      - run: make generate support-bundle
+      - uses: actions/upload-artifact@v7
         with:
           name: support-bundle
           path: bin/support-bundle
 
-  validate-supportbundle:
+  compile-collect:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+      - run: make generate collect
+      - uses: actions/upload-artifact@v7
+        with:
+          name: collect
+          path: bin/collect
+
+  validate-supportbundle-e2e:
     runs-on: ubuntu-latest
     needs: compile-supportbundle
     steps:
-      - uses: actions/checkout@v1
-      - name: Download support-bundle binary
-        uses: actions/download-artifact@v1
+      - uses: actions/checkout@v7
+      - uses: replicatedhq/action-k3s@main
+        id: k3s
+        with:
+          version: v1.31.2-k3s1
+      - name: Download support bundle binary
+        uses: actions/download-artifact@v8
         with:
           name: support-bundle
           path: bin/
-      - uses: engineerd/setup-kind@v0.5.0
       - run: chmod +x bin/support-bundle
-      - run: ./bin/support-bundle ./examples/support-bundle/sample-collectors.yaml
-      - run: ./bin/support-bundle ./examples/support-bundle/sample-supportbundle.yaml
-      - run: ./bin/support-bundle https://kots.io
+      - run: make support-bundle-e2e-test
 
-  goreleaser:
+  # Additional e2e tests for support bundle that run in Go, these create a Kind cluster
+  validate-supportbundle-e2e-go:
+     runs-on: ubuntu-latest
+     needs: [compile-supportbundle, compile-collect, compile-preflight]
+     steps:
+      - uses: actions/checkout@v7
+      - name: Download support bundle binary
+        uses: actions/download-artifact@v8
+        with:
+          name: support-bundle
+          path: bin/
+      - run: chmod +x bin/support-bundle
+      - name: Download preflight binary
+        uses: actions/download-artifact@v8
+        with:
+          name: preflight
+          path: bin/
+      - run: chmod +x bin/preflight
+      - run: make support-bundle-e2e-go-test
+
+# summary jobs, these jobs will only run if all the other jobs have succeeded
+  validate-pr-tests:
     runs-on: ubuntu-latest
     needs:
-      - validate-preflight
-    if: startsWith(github.ref, 'refs/tags/v')
+      - tidy-check
+      - test-integration
+      - validate-preflight-e2e
+      - validate-supportbundle-e2e
+      - validate-supportbundle-e2e-go
     steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-  
-      - uses: azure/docker-login@v1
-        with:
-          username: repldeploy2
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-      - name: Unshallow
-        run: git fetch --prune --unshallow
-  
-      - uses: actions/setup-go@v1
-        with:
-          go-version: "1.14"
-   
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
-        with:
-          version: latest
-          args: release --rm-dist --config deploy/.goreleaser.yaml
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: echo "All PR tests passed"
 
 
-      - name: Update new preflight version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.38
-        with:
-          krew_template_file: deploy/krew/preflight.yaml
-      - name: Update new support-bundle version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.38
-        with:
-          krew_template_file: deploy/krew/support-bundle.yaml
+  # this job will validate that the validation did not fail and that all pr-tests succeed
+  # it is used for the github branch protection rule
+  validate-success:
+    runs-on: ubuntu-latest
+    needs:
+      - validate-pr-tests
+    if: always()
+    steps:
+      # https://docs.github.com/en/actions/learn-github-actions/contexts#needs-context
+      # if the validate-pr-tests job was not successful, this job will fail
+      - name: fail if validate-pr-tests job was not successful
+        if: needs.validate-pr-tests.result != 'success'
+        run: exit 1
+      # if the validate-pr-tests job was successful, this job will succeed
+      - name: succeed if validate-pr-tests job succeeded
+        if: needs.validate-pr-tests.result == 'success'
+        run: echo "Validation succeeded"

.github/workflows/build-test.yaml

@@ -0,0 +1,299 @@
+name: build-test
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Detect changes to optimize test execution
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      go-files: ${{ steps.filter.outputs.go-files }}
+      preflight: ${{ steps.filter.outputs.preflight }}
+      support-bundle: ${{ steps.filter.outputs.support-bundle }}
+      examples: ${{ steps.filter.outputs.examples }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            go-files:
+              - '**/*.go'
+              - 'go.{mod,sum}'
+              - 'Makefile'
+            preflight:
+              - 'cmd/preflight/**'
+              - 'pkg/preflight/**'
+            support-bundle:
+              - 'cmd/troubleshoot/**'
+              - 'pkg/supportbundle/**'
+
+  # Lint
+  lint:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Check go mod tidy
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum || {
+            echo "::error::Please run 'go mod tidy' and commit changes"
+            exit 1
+          }
+
+      - name: Format and vet
+        run: |
+          make fmt
+          git diff --exit-code || {
+            echo "::error::Please run 'make fmt' and commit changes"
+            exit 1
+          }
+          make vet
+
+  # Unit and integration tests
+  test:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Setup K3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Run tests
+        run: make test-integration
+
+  # Build binaries
+  build:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+      - run: make build
+      - uses: actions/upload-artifact@v7
+        with:
+          name: binaries
+          path: bin/
+          retention-days: 1
+
+  # Minimal linux architecture smoke tests
+  linux-arch-smoke:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goarch: amd64
+            docker_platform: linux/amd64
+            expected_machine: x86_64
+          - goarch: arm64
+            docker_platform: linux/arm64
+            expected_machine: aarch64
+          - goarch: arm
+            goarm: "7"
+            docker_platform: linux/arm/v7
+            expected_machine: armv7l
+          - goarch: riscv64
+            docker_platform: linux/riscv64
+            expected_machine: riscv64
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+      - name: Setup K3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+      - uses: docker/setup-qemu-action@v4
+        with:
+          platforms: arm64,arm,riscv64
+
+      - name: Build linux/${{ matrix.goarch }} binaries
+        env:
+          CGO_ENABLED: "0"
+          GOOS: linux
+          GOARCH: ${{ matrix.goarch }}
+          GOARM: ${{ matrix.goarm }}
+        run: |
+          if [ -n "${GOARM}" ]; then
+            echo "Building for GOARCH=${GOARCH} GOARM=${GOARM}"
+          else
+            echo "Building for GOARCH=${GOARCH}"
+          fi
+          make build
+
+      - name: Collect a minimal support bundle on ${{ matrix.docker_platform }}
+        env:
+          PREFLIGHT_AUTO_UPDATE: "false"
+          TROUBLESHOOT_AUTO_UPDATE: "false"
+        run: |
+          set -euo pipefail
+          tmpdir="$(mktemp -d)"
+          trap 'rm -rf "$tmpdir"' EXIT
+          kubeconfig_path="${KUBECONFIG:-$HOME/.kube/config}"
+
+          assert_tar_member() {
+            local pattern="$1"
+            local label="$2"
+            local member
+            member="$(grep -m1 "$pattern" "$tmpdir/archive-members.txt" || true)"
+            if [ -z "$member" ]; then
+              echo "Expected ${label} was not found in ${archive}"
+              exit 1
+            fi
+            echo "Found ${label}: ${member}"
+          }
+
+          echo "Using kubeconfig at ${kubeconfig_path}"
+          test -f "${kubeconfig_path}"
+          cp "${kubeconfig_path}" "$tmpdir/kubeconfig"
+
+          echo "Verifying K3s cluster is reachable on the host"
+          kubectl --kubeconfig "$tmpdir/kubeconfig" get nodes -o wide
+
+          docker run --rm \
+            --platform ${{ matrix.docker_platform }} \
+            --network host \
+            -v "$PWD:/src" \
+            -v "$tmpdir:/tmp/linux-arch-smoke" \
+            -w /src \
+            alpine:3.23 \
+            sh -ec '
+              export PREFLIGHT_AUTO_UPDATE=false
+              export TROUBLESHOOT_AUTO_UPDATE=false
+              /src/bin/support-bundle \
+                --kubeconfig /tmp/linux-arch-smoke/kubeconfig \
+                --interactive=false \
+                /src/test/e2e/support-bundle/spec/linuxArchSmokeLocalHostCollectors.yaml \
+                --output /tmp/linux-arch-smoke/linux-arch-support-bundle.tar.gz
+            '
+
+          archive="$tmpdir/linux-arch-support-bundle.tar.gz"
+          test -f "$archive"
+          echo "Generated support bundle archive: $archive"
+          tar -tf "$archive" > "$tmpdir/archive-members.txt"
+
+          assert_tar_member '/host-collectors/system/cpu.json$' 'cpu.json'
+          assert_tar_member '/host-collectors/system/memory.json$' 'memory.json'
+          assert_tar_member '/host-collectors/run-host/uname.txt$' 'uname.txt'
+          assert_tar_member '/cluster-resources/nodes.json$' 'cluster-resources nodes.json'
+          assert_tar_member '/cluster-resources/resources.json$' 'cluster-resources resources.json'
+          assert_tar_member '/analysis.json$' 'analysis.json'
+
+          echo "Checking uname -m output"
+          uname_path="$(grep -m1 '/host-collectors/run-host/uname.txt$' "$tmpdir/archive-members.txt")"
+          uname_machine="$(tar -xOf "$archive" "$uname_path" | tr -d '\r\n')"
+          if [ "$uname_machine" != '${{ matrix.expected_machine }}' ]; then
+            echo "Unexpected uname -m output: ${uname_machine}"
+            exit 1
+          fi
+          echo "Analyzer input check passed: uname -m reported ${uname_machine}"
+
+          echo "Checking analysis.json"
+          analysis_path="$(grep -m1 '/analysis.json$' "$tmpdir/archive-members.txt")"
+          tar -xOf "$archive" "$analysis_path" > "$tmpdir/analysis.json"
+          jq -e '
+            .[]
+            | select(.insight.primary == "Linux arch smoke node count")
+            | select(.insight.detail == "This cluster has exactly 1 node")
+            | select(.severity == "debug")
+          ' "$tmpdir/analysis.json" >/dev/null
+          echo "Found expected analyzer result: Linux arch smoke node count -> This cluster has exactly 1 node"
+
+  # E2E tests
+  e2e:
+    if: needs.changes.outputs.go-files == 'true' || github.event_name == 'push'
+    needs: [changes, build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: preflight
+            target: preflight-e2e-test
+            needs-k3s: true
+          - name: support-bundle-shell
+            target: support-bundle-e2e-test
+            needs-k3s: true
+          - name: support-bundle-go
+            target: support-bundle-e2e-go-test
+            needs-k3s: false
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup K3s
+        if: matrix.needs-k3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - uses: actions/download-artifact@v8
+        with:
+          name: binaries
+          path: bin/
+
+      - run: chmod +x bin/*
+      - run: make ${{ matrix.target }}
+
+  # Success summary
+  success:
+    if: always()
+    needs: [lint, test, build, linux-arch-smoke, e2e]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check results
+        run: |
+          # Check if any required jobs failed
+          if [[ "${{ needs.lint.result }}" == "failure" ]] || \
+             [[ "${{ needs.test.result }}" == "failure" ]] || \
+             [[ "${{ needs.build.result }}" == "failure" ]] || \
+             [[ "${{ needs.linux-arch-smoke.result }}" == "failure" ]] || \
+             [[ "${{ needs.e2e.result }}" == "failure" ]]; then
+            echo "::error::Some jobs failed or were cancelled"
+            exit 1
+          fi
+          
+          # Check if any required jobs were cancelled  
+          if [[ "${{ needs.lint.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.test.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.build.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.linux-arch-smoke.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.e2e.result }}" == "cancelled" ]]; then
+            echo "::error::Some jobs failed or were cancelled"
+            exit 1
+          fi
+          
+          echo "✅ All tests passed!"

.github/workflows/factory-update.yaml

@@ -0,0 +1,31 @@
+name: Publish ElasticClaw Workflow
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".factory-workflows/dependency-update.yaml"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: Publish workflow (${{ matrix.workflow }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        workflow:
+          - .factory-workflows/dependency-update.yaml
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Publish workflow (dependency-update)
+        uses: elasticclaw/actions/publish-workflow@main
+        with:
+          hub-endpoint: https://factory.repldev.com
+          token: ${{ secrets.ELASTICCLAW_TOKEN }}
+          workspace: replicated-troubleshoot
+          path: ${{ matrix.workflow }}

.github/workflows/publish-securebuild.yml

@@ -0,0 +1,101 @@
+name: publish-securebuild
+
+env:
+  SECUREBUILD_CLI_VERSION: v0.0.498
+  SECUREBUILD_CLI_SHA256: d259aa99d85aef957fe1e40c6f26e1983cc7fd72277e08599a82adc6681d3b37
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: Stable version tag to build (for example, v0.130.0)
+        required: true
+        type: string
+    secrets:
+      SECUREBUILD_API_TOKEN:
+        required: true
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Stable version tag to build (for example, v0.130.0)
+        required: true
+        type: string
+
+jobs:
+  validate-version:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Require a stable release version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "SecureBuild only supports stable release versions (for example, v0.130.0): $VERSION"
+            exit 1
+          fi
+
+  build-package:
+    needs: validate-version
+    runs-on: ubuntu-22.04
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Set version
+        id: version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Install SecureBuild CLI
+        run: |
+          curl --fail --silent --show-error --location \
+            "https://github.com/securebuildhq/securebuild/releases/download/${SECUREBUILD_CLI_VERSION}/securebuild-cli-linux-amd64" \
+            --output securebuild
+          echo "${SECUREBUILD_CLI_SHA256}  securebuild" | sha256sum --check --strict
+          chmod +x securebuild
+
+      - name: Build package
+        env:
+          SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          ./securebuild build package \
+            --package-family-name troubleshoot \
+            --tag "$VERSION" \
+            --api-token "$SECUREBUILD_API_TOKEN"
+
+  build-image:
+    needs: build-package
+    if: ${{ !cancelled() && needs.build-package.result == 'success' }}
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        image-name:
+          - troubleshoot
+          - preflight
+    steps:
+      - name: Install SecureBuild CLI
+        run: |
+          curl --fail --silent --show-error --location \
+            "https://github.com/securebuildhq/securebuild/releases/download/${SECUREBUILD_CLI_VERSION}/securebuild-cli-linux-amd64" \
+            --output securebuild
+          echo "${SECUREBUILD_CLI_SHA256}  securebuild" | sha256sum --check --strict
+          chmod +x securebuild
+
+      - name: Build image
+        env:
+          IMAGE_NAME: ${{ matrix.image-name }}
+          SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+          VERSION: ${{ needs.build-package.outputs.version }}
+        run: |
+          IMAGE_VERSION="${VERSION#v}"
+          MAJOR_MINOR_VERSION="${IMAGE_VERSION%.*}"
+          MAJOR_VERSION="${IMAGE_VERSION%%.*}"
+
+          ./securebuild build image \
+            --image-name "$IMAGE_NAME" \
+            --tag "$VERSION" \
+            --image-tag "$MAJOR_MINOR_VERSION" \
+            --image-tag "$MAJOR_VERSION" \
+            --image-tag latest \
+            --api-token "$SECUREBUILD_API_TOKEN"

.github/workflows/regression-test.yaml

@@ -0,0 +1,497 @@
+name: Regression Test Suite
+
+on:
+  push:
+    branches: [main, v1beta3]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+    inputs:
+      update_baselines:
+        description: 'Update baselines after run (use with caution)'
+        type: boolean
+        default: false
+
+jobs:
+  # Build binaries once (shared by all test jobs)
+  build-binaries:
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Build binaries
+        run: |
+          echo "Building preflight and support-bundle binaries..."
+          make bin/preflight bin/support-bundle
+          ./bin/preflight version
+          ./bin/support-bundle version
+
+      - name: Upload binaries
+        uses: actions/upload-artifact@v7
+        with:
+          name: binaries-${{ github.run_id }}
+          path: |
+            bin/preflight
+            bin/support-bundle
+          retention-days: 1
+
+  # Preflight v1beta3 test (parallel job 1)
+  test-preflight-v1beta3:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/preflight version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Run preflight v1beta3
+        continue-on-error: true
+        run: |
+          echo "Running preflight v1beta3..."
+          ./bin/preflight \
+            examples/preflight/complex-v1beta3.yaml \
+            --values examples/preflight/values-complex-full.yaml \
+            --interactive=false \
+            --format=json \
+            --auto-update=false \
+            --output=test/output/preflight-results-v1beta3.json 2>&1 | tee test/output/v1beta3.log || true
+
+          BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
+          if [ -n "$BUNDLE" ]; then
+            mv "$BUNDLE" test/output/preflight-v1beta3-bundle.tar.gz
+            echo "✓ v1beta3 bundle saved"
+          fi
+
+      - name: Compare preflight v1beta3 bundle
+        id: compare
+        continue-on-error: true
+        run: |
+          echo "Comparing v1beta3 preflight bundle against baseline..."
+          if [ ! -f test/baselines/preflight-v1beta3/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for v1beta3 - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/preflight-v1beta3/baseline.tar.gz \
+            --current test/output/preflight-v1beta3-bundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-v1beta3.json \
+            --spec-type preflight
+
+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-v1beta3-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/preflight-v1beta3-bundle.tar.gz
+            test/output/preflight-results-v1beta3.json
+            test/output/diff-report-v1beta3.json
+            test/output/v1beta3.log
+          retention-days: 30
+
+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Preflight v1beta2 test (parallel job 2)
+  test-preflight-v1beta2:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/preflight version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Run preflight v1beta2
+        continue-on-error: true
+        run: |
+          echo "Running preflight v1beta2..."
+          ./bin/preflight \
+            examples/preflight/all-analyzers-v1beta2.yaml \
+            --interactive=false \
+            --format=json \
+            --auto-update=false \
+            --output=test/output/preflight-results-v1beta2.json 2>&1 | tee test/output/v1beta2.log || true
+
+          BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
+          if [ -n "$BUNDLE" ]; then
+            mv "$BUNDLE" test/output/preflight-v1beta2-bundle.tar.gz
+            echo "✓ v1beta2 bundle saved"
+          fi
+
+      - name: Compare preflight v1beta2 bundle
+        id: compare
+        continue-on-error: true
+        run: |
+          echo "Comparing v1beta2 preflight bundle against baseline..."
+          if [ ! -f test/baselines/preflight-v1beta2/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for v1beta2 - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/preflight-v1beta2/baseline.tar.gz \
+            --current test/output/preflight-v1beta2-bundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-v1beta2.json \
+            --spec-type preflight
+
+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-v1beta2-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/preflight-v1beta2-bundle.tar.gz
+            test/output/preflight-results-v1beta2.json
+            test/output/diff-report-v1beta2.json
+            test/output/v1beta2.log
+          retention-days: 30
+
+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Support bundle test (parallel job 3)
+  test-supportbundle:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/support-bundle version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Run support bundle
+        continue-on-error: true
+        run: |
+          echo "Running support bundle..."
+          ./bin/support-bundle \
+            examples/collect/host/all-kubernetes-collectors.yaml \
+            --interactive=false \
+            --auto-update=false \
+            --output=test/output/supportbundle.tar.gz 2>&1 | tee test/output/supportbundle.log || true
+
+          if [ -f test/output/supportbundle.tar.gz ]; then
+            echo "✓ Support bundle saved"
+          fi
+
+      - name: Compare support bundle
+        id: compare
+        continue-on-error: true
+        run: |
+          echo "Comparing support bundle against baseline..."
+          if [ ! -f test/baselines/supportbundle/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for support bundle - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/supportbundle/baseline.tar.gz \
+            --current test/output/supportbundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-supportbundle.json \
+            --spec-type supportbundle
+
+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-supportbundle-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/supportbundle.tar.gz
+            test/output/diff-report-supportbundle.json
+            test/output/supportbundle.log
+          retention-days: 30
+
+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Report results (runs after all tests complete)
+  report-results:
+    needs: [test-preflight-v1beta3, test-preflight-v1beta2, test-supportbundle]
+    if: ${{ !cancelled() && github.actor != 'dependabot[bot]' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Download all test artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: test/output
+          pattern: test-results-*
+
+      - name: Reorganize artifacts
+        run: |
+          # Move artifacts from nested directories to test/output
+          # Use shopt to handle glob patterns that don't match
+          shopt -s nullglob
+          for dir in test/output/test-results-*; do
+            if [ -d "$dir" ]; then
+              find "$dir" -type f -exec mv {} test/output/ \;
+            fi
+          done
+          # Clean up empty directories
+          for dir in test/output/test-results-*; do
+            if [ -d "$dir" ]; then
+              find "$dir" -type d -empty -delete || true
+            fi
+          done
+          shopt -u nullglob
+
+      - name: Generate summary report
+        run: |
+          # Handle case where no reports exist
+          shopt -s nullglob
+          REPORTS=(test/output/diff-report-*.json)
+          shopt -u nullglob
+          
+          if [ ${#REPORTS[@]} -eq 0 ]; then
+            echo "⚠ No comparison reports found - test jobs may have failed before generating reports"
+            echo "## Summary Report" >> $GITHUB_STEP_SUMMARY
+            echo "No comparison reports available. Check individual test job results." >> $GITHUB_STEP_SUMMARY
+          else
+            python3 scripts/generate_summary.py \
+              --reports test/output/diff-report-*.json \
+              --output-file $GITHUB_STEP_SUMMARY \
+              --output-console
+          fi
+
+      - name: Check for regressions
+        run: |
+          echo "Checking comparison results..."
+
+          FAILURES=0
+
+          if [ "${{ needs.test-preflight-v1beta3.result }}" == "failure" ] || [ "${{ needs.test-preflight-v1beta3.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-preflight-v1beta3.result }}" == "skipped" ]; then
+              echo "❌ v1beta3 test was skipped (likely due to build failure)"
+            else
+              echo "❌ v1beta3 comparison failed"
+            fi
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ "${{ needs.test-preflight-v1beta2.result }}" == "failure" ] || [ "${{ needs.test-preflight-v1beta2.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-preflight-v1beta2.result }}" == "skipped" ]; then
+              echo "❌ v1beta2 test was skipped (likely due to build failure)"
+            else
+              echo "❌ v1beta2 comparison failed"
+            fi
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ "${{ needs.test-supportbundle.result }}" == "failure" ] || [ "${{ needs.test-supportbundle.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-supportbundle.result }}" == "skipped" ]; then
+              echo "❌ Support bundle test was skipped (likely due to build failure)"
+            else
+              echo "❌ Support bundle comparison failed"
+            fi
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ $FAILURES -gt 0 ]; then
+            echo ""
+            echo "❌ $FAILURES regression(s) detected!"
+            echo "Review the comparison reports in the artifacts."
+            exit 1
+          else
+            echo "✅ All comparisons passed or skipped (no baseline)"
+          fi
+
+      - name: Update baselines
+        if: ${{ !cancelled() && github.event.inputs.update_baselines == 'true' && github.event_name == 'workflow_dispatch' }}
+        run: |
+          echo "Updating baselines with current bundles..."
+
+          # Copy new bundles as baselines
+          if [ -f test/output/preflight-v1beta3-bundle.tar.gz ]; then
+            mkdir -p test/baselines/preflight-v1beta3
+            cp test/output/preflight-v1beta3-bundle.tar.gz test/baselines/preflight-v1beta3/baseline.tar.gz
+            echo "✓ Updated v1beta3 baseline"
+          fi
+
+          if [ -f test/output/preflight-v1beta2-bundle.tar.gz ]; then
+            mkdir -p test/baselines/preflight-v1beta2
+            cp test/output/preflight-v1beta2-bundle.tar.gz test/baselines/preflight-v1beta2/baseline.tar.gz
+            echo "✓ Updated v1beta2 baseline"
+          fi
+
+          if [ -f test/output/supportbundle.tar.gz ]; then
+            mkdir -p test/baselines/supportbundle
+            cp test/output/supportbundle.tar.gz test/baselines/supportbundle/baseline.tar.gz
+            echo "✓ Updated support bundle baseline"
+          fi
+
+          # Create metadata file
+          cat > test/baselines/metadata.json <<EOF
+          {
+            "updated_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "git_sha": "${{ github.sha }}",
+            "k8s_version": "v1.31.2-k3s1",
+            "workflow_run": "${{ github.run_id }}"
+          }
+          EOF
+
+          # Commit and push
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add test/baselines/
+          git commit -m "chore: update regression test baselines from run ${{ github.run_id }}"
+          git push

.github/workflows/release.yaml

@@ -0,0 +1,71 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  goreleaser:
+    runs-on: troubleshoot_release
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v7
+        with:
+          go-version: '1.26'
+          check-latest: true
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.2
+        with:
+          cosign-release: 'v3.1.3'
+
+      - name: Generate and sign SBOM
+        run: make sbom
+        env:
+          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          version: "v2.12.3"
+          args: release --clean --config deploy/.goreleaser.yaml
+        env:
+          GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_TOKEN }}
+
+      - name: Update new preflight version in krew-index
+        if: ${{ !contains(github.ref_name, '-') }}
+        uses: rajatjindal/krew-release-bot@v0.0.51
+        with:
+          krew_template_file: deploy/krew/preflight.yaml
+
+      - name: Update new support-bundle version in krew-index
+        if: ${{ !contains(github.ref_name, '-') }}
+        uses: rajatjindal/krew-release-bot@v0.0.51
+        with:
+          krew_template_file: deploy/krew/support-bundle.yaml
+
+  securebuild:
+    if: ${{ !contains(github.ref_name, '-') }}
+    uses: ./.github/workflows/publish-securebuild.yml
+    with:
+      version: ${{ github.ref_name }}
+    secrets:
+      SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+
+  notify:
+    if: ${{ !contains(github.ref_name, '-') }}
+    uses: replicatedhq/reusable-workflows/.github/workflows/notify-release.yml@0432fb838fc83852b78be97a150b35991a85d56f
+    with:
+      tag: ${{ github.ref_name }}
+    secrets:
+      slack_webhook: ${{ secrets.RELEASE_SLACK_WEBHOOK }}

.gitignore

@@ -6,6 +6,11 @@
 *.so
 *.dylib
 bin
+.DS_Store
+
+# npm generated files
+node_modules/
+package*.json
 
 # Test binary, build with `go test -c`
 *.test
@@ -25,5 +30,34 @@ vendor
 *.swp
 *.swo
 *~
+.envrc
+
 
 dist
+try.sh
+
+.vscode/
+workspace.*
+
+cosign.key
+sbom/
+
+# Ignore local pre-commit config
+.pre-commit-config.yaml
+
+# Ignore generated support bundles
+*.tar.gz
+!testdata/supportbundle/*.tar.gz
+!test/baselines/**/baseline.tar.gz
+
+# Ignore built binaries (use / prefix to avoid catching source files)
+/troubleshoot
+/troubleshoot-test
+cmd/troubleshoot/troubleshoot
+cmd/*/troubleshoot
+/support-bundle
+/.worktrees/
+
+# IDEs
+## IntelliJ / GoLand
+/troubleshoot.iml

.grype.tmpl

@@ -0,0 +1,4 @@
+NAME	INSTALLED	FIXED-IN	TYPE	VULNERABILITY	SEVERITY	EPSS	RISK	PATH
+{{- range .Matches}}
+{{.Artifact.Name}}	{{.Artifact.Version}}	{{join .Vulnerability.Fix.Versions ","}}	{{.Artifact.Type}}	{{.Vulnerability.ID}}	{{.Vulnerability.Severity}}	{{.Vulnerability.EPSS}}	{{.Vulnerability.Risk}}	{{range .Artifact.Locations}}{{.AccessPath}}{{end}}
+{{- end}}

.grype.yaml

@@ -0,0 +1,3 @@
+exclude:
+  - ./examples/**
+  - ./bin/**

AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS.md
+
+ALWAYS read and follow the instructions in CLAUDE.md before starting any work in this repository.

CLAUDE.md

@@ -0,0 +1,30 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Replicated Troubleshoot is a Kubernetes diagnostic framework providing two kubectl plugins: `preflight` (pre-installation cluster validation) and `support-bundle` (post-installation diagnostics with log collection, redaction, and analysis). Specs use the Kubernetes custom resource format (as a serialization convention, not installed in-cluster) and are defined by application vendors and executed by cluster operators.
+
+## Build & Test Commands
+
+```bash
+make build                        # Build bin/support-bundle and bin/preflight
+make test                         # Unit tests (includes generate, fmt, vet)
+make test RUN=TestMyFunction      # Run a single test
+make test-integration             # Integration tests (requires k8s cluster)
+make e2e                          # All e2e tests
+make generate                     # Regenerate types/clients after modifying pkg/apis/
+```
+
+## Architecture
+
+The core data flow is: **Spec loading → Collection → Redaction → Analysis → Results**. The two main workflows are orchestrated by `pkg/supportbundle/` and `pkg/preflight/`.
+
+Three API versions coexist in `pkg/apis/troubleshoot/`: v1beta1, v1beta2 (primary, all types defined here), and v1beta3 (in-progress, adds `StringOrValueFrom` for Secret/ConfigMap references, converts to v1beta2 at runtime).
+
+Collectors live in `pkg/collect/`, analyzers in `pkg/analyze/`. When adding either, follow the pattern of existing implementations and run `make generate` after modifying API types.
+
+## Code Review
+
+See [.cursor/BUGBOT.md](.cursor/BUGBOT.md) for the full review checklist covering basic checks (API breaks, pattern violations, security, test coverage) and advanced checks (cross-feature impact, CLI vs SDK consumers, documentation needs).

CONTRIBUTING.md

@@ -0,0 +1,76 @@
+# Contributing to Troubleshoot
+
+Thank you for your interest in Troubleshoot, we welcome your participation. There are a number of ways to participate in Troubleshoot as outlined below:
+
+# Community
+
+For discussions about developing Troubleshoot, there's an [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot).
+
+## Issues
+
+- [Request a New Feature](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=feature&template=feature_enhancement.md) Create an issue to add functionality that addresses a problem or adds an enhancement.
+- [Report a Bug](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=bug&template=bug_report.md) Report a problem or unexpected behaviour with Troubleshoot.
+
+## Design Principles
+
+When implementing a new feature please review the [design principles](./docs/design/design-principles.md) to help guide the approach.
+
+## Development Environment
+
+To get started we recommend:
+
+1. Go (v1.24 or later)
+2. For cluster-based collectors, you will need access to a Kubernetes cluster
+3. Fork and clone repo
+4. Run `make clean build` to generate binaries
+5. You can now run `./bin/preflight` and/or `./bin/support-bundle` to use the code you've been writing
+
+> Note: to cross-compile a Linux binary from MacOS:
+> `GOOS=linux GOARCH=amd64 make clean build`
+
+### Testing
+
+To run the tests locally run the following:
+
+```bash
+make test
+make test RUN=TestClusterResources_Merge
+```
+
+Additionally, e2e tests can be run with:
+
+```bash
+make support-bundle preflight e2e-test
+```
+
+A running Kubernetes cluster as well as `jq` are required to run e2e tests.
+
+### Profiling
+
+You are able to collect CPU & memory runtime properties and store the data for analysis in a file. To do so, pass in the file paths using `--cpuprofile` and `--memprofile` flags in the CLI. Once you have your data collected, you can analyse it using [pprof visualization tool](https://github.com/google/pprof/blob/main/doc/README.md). Here is how
+
+Run support bundle and with CPU & memory profile flags
+
+```sh
+./bin/support-bundle examples/support-bundle/sample-supportbundle.yaml --cpuprofile=cpu.prof --memprofile=mem.prof
+```
+
+Visualize using [pprof](https://github.com/google/pprof/blob/main/doc/README.md)
+
+```sh
+go tool pprof -http=":8000" cpu.prof
+
+go tool pprof -http=":8001" mem.prof
+```
+
+**Additional flags for memory profiling**
+- `inuse_space`: Amount of memory allocated and not released yet (default).
+- `inuse_objects`: Amount of objects allocated and not released yet.
+- `alloc_space`: Total amount of memory allocated (regardless of released).
+- `alloc_objects`: Total amount of objects allocated (regardless of released).
+
+More on profiling please visit https://go.dev/doc/diagnostics#profiling
+
+## Contribution workflow
+
+We'd love to talk before you dig into a a large feature. 

Makefile

@@ -1,13 +1,12 @@
 
 # Image URL to use all building/pushing image targets
 IMG ?= controller:latest
-export GO111MODULE=on
-export GOPROXY=https://proxy.golang.org
 
-SHELL := /bin/bash -o pipefail
+SHELL := bash -o pipefail
 VERSION_PACKAGE = github.com/replicatedhq/troubleshoot/pkg/version
 VERSION ?=`git describe --tags --dirty`
 DATE=`date -u +"%Y-%m-%dT%H:%M:%SZ"`
+RUN?=""
 
 GIT_TREE = $(shell git rev-parse --is-inside-work-tree 2>/dev/null)
 ifneq "$(GIT_TREE)" ""
@@ -35,105 +34,252 @@ define LDFLAGS
 "
 endef
 
-BUILDFLAGS = -tags "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp" -installsuffix netgo
+BUILDTAGS = "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp"
+BUILDFLAGS = -tags ${BUILDTAGS} -installsuffix netgo
+BUILDPATHS = ./pkg/... ./cmd/... ./internal/...
+E2EPATHS = ./test/e2e/...
+TESTFLAGS ?= -v -coverprofile cover.out
 
-all: test
+.DEFAULT_GOAL := all
+all: clean build test
 
 .PHONY: ffi
 ffi: fmt vet
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/troubleshoot.so -buildmode=c-shared ffi/main.go
 
-# Run tests
+.PHONY: test
 test: generate fmt vet
-	go test ${BUILDFLAGS} ./pkg/... ./cmd/... -coverprofile cover.out
+	if [ -n $(RUN) ]; then \
+		go test ${BUILDFLAGS} ${BUILDPATHS} ${TESTFLAGS} -run $(RUN); \
+	else \
+		go test ${BUILDFLAGS} ${BUILDPATHS} ${TESTFLAGS}; \
+	fi
 
-.PHONY: support-bundle
-support-bundle: generate fmt vet
+# Go tests that require a K8s instance
+# TODOLATER: merge with test, so we get unified coverage reports? it'll add 21~sec to the test job though...
+.PHONY: test-integration
+test-integration: generate fmt vet
+	go test -v --tags="integration exclude_graphdriver_devicemapper exclude_graphdriver_btrfs" ${BUILDPATHS}
+
+.PHONY: e2e
+e2e: preflight-e2e-test support-bundle-e2e-test support-bundle-e2e-go-test
+
+.PHONY: preflight-e2e-test
+preflight-e2e-test:
+	./test/validate-preflight-e2e.sh
+
+.PHONY: run-examples
+run-examples:
+	./test/run-examples.sh
+
+.PHONY: support-bundle-e2e-test
+support-bundle-e2e-test:
+	./test/validate-support-bundle-e2e.sh
+
+.PHONY: support-bundle-e2e-go-test
+support-bundle-e2e-go-test:
+	if [ -n $(RUN) ]; then \
+		go test ${BUILDFLAGS} ${E2EPATHS} -v -run $(RUN); \
+	else \
+		go test ${BUILDFLAGS} ${E2EPATHS} -v; \
+	fi
+
+rebuild: clean build
+
+# Build all binaries in parallel ( -j )
+build: tidy
+	@echo "Build cli binaries"
+	$(MAKE) -j bin/support-bundle bin/preflight
+
+.PHONY: clean
+clean:
+	@rm -f bin/analyze
+	@rm -f bin/support-bundle
+	@rm -f bin/collect
+	@rm -f bin/preflight
+	@rm -f bin/troubleshoot.h
+	@rm -f bin/troubleshoot.so
+	@rm -f bin/schemagen
+	@rm -f bin/docsgen
+
+.PHONY: tidy
+tidy:
+	go mod tidy
+
+# Prints  the diff of the changes that would be made by `go mod tidy`. Used in CI
+.PHONY: tidy-diff
+tidy-diff:
+	go mod tidy -diff
+
+# Only build when any of the files in SOURCES changes, or if bin/<file> is absent
+MAKEFILE_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+SOURCES := $(shell find $(MAKEFILE_DIR) -type f \( -name "*.go" -o -name "go.mod" -o -name "go.sum" \))
+bin/support-bundle: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/support-bundle github.com/replicatedhq/troubleshoot/cmd/troubleshoot
 
-.PHONY: preflight
-preflight: generate fmt vet
+bin/preflight: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/preflight github.com/replicatedhq/troubleshoot/cmd/preflight
 
-.PHONY: analyze
-analyze: generate fmt vet
+bin/analyze: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/analyze github.com/replicatedhq/troubleshoot/cmd/analyze
 
+bin/collect: $(SOURCES)
+	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/collect github.com/replicatedhq/troubleshoot/cmd/collect
+
+.PHONY: support-bundle
+support-bundle: bin/support-bundle
+
+.PHONY: preflight
+preflight: bin/preflight
+
+.PHONY: analyze
+analyze: bin/analyze
+
+.PHONY: collect
+collect: bin/collect
+
+build-linux: tidy
+	@echo "Build cli binaries for Linux"
+	GOOS=linux GOARCH=amd64 $(MAKE) -j bin/support-bundle bin/preflight bin/analyze bin/collect
+
 .PHONY: fmt
 fmt:
-	go fmt ./pkg/... ./cmd/...
+	go fmt ${BUILDPATHS}
 
 .PHONY: vet
 vet:
-	go vet ${BUILDFLAGS} ./pkg/... ./cmd/...
+	go vet ${BUILDFLAGS} ${BUILDPATHS}
 
 .PHONY: generate
 generate: controller-gen client-gen
-	$(CONTROLLER_GEN) \
-		object:headerFile=./hack/boilerplate.go.txt paths=./pkg/apis/...
-	$(CLIENT_GEN) \
-		--output-package=github.com/replicatedhq/troubleshoot/pkg/client \
-		--clientset-name troubleshootclientset \
-		--input-base github.com/replicatedhq/troubleshoot/pkg/apis \
-		--input troubleshoot/v1beta1 \
-		--input troubleshoot/v1beta2 \
-		-h ./hack/boilerplate.go.txt
+	$(CONTROLLER_GEN) object:headerFile=./hack/boilerplate.go.txt paths=./pkg/apis/...
+	$(CLIENT_GEN) --output-dir=. --output-pkg=github.com/replicatedhq/troubleshoot/pkg/client --clientset-name troubleshootclientset --input-base github.com/replicatedhq/troubleshoot/pkg/apis --input troubleshoot/v1beta1 --input troubleshoot/v1beta2 --input troubleshoot/v1beta3 --go-header-file ./hack/boilerplate.go.txt
+	cp -r troubleshootclientset pkg/client
+	rm -rf troubleshootclientset
 
 .PHONY: openapischema
 openapischema: controller-gen
 	controller-gen crd +output:dir=./config/crds  paths=./pkg/apis/troubleshoot/v1beta1
 	controller-gen crd +output:dir=./config/crds  paths=./pkg/apis/troubleshoot/v1beta2
 
+check-schemas: generate schemas
+	@if [ -n "$$(git status --short)" ]; then \
+    	echo -e "\033[31mThe git repo is dirty :( Ensure all generated files are committed e.g CRD schema files\033[0;m"; \
+    	git status --short; \
+    	exit 1; \
+	fi
+
 .PHONY: schemas
-schemas: fmt vet openapischema
-	go build ${LDFLAGS} -o bin/schemagen github.com/replicatedhq/troubleshoot/cmd/schemagen
+schemas: openapischema bin/schemagen
 	./bin/schemagen --output-dir ./schemas
 
-.PHONY: contoller-gen
+bin/schemagen:
+	go build ${LDFLAGS} -o bin/schemagen github.com/replicatedhq/troubleshoot/cmd/schemagen
+
+.PHONY: docs
+docs: fmt vet bin/docsgen
+	./bin/docsgen
+
+bin/docsgen:
+	go build ${LDFLAGS} -o bin/docsgen github.com/replicatedhq/troubleshoot/cmd/docsgen
+
 controller-gen:
-ifeq (, $(shell which controller-gen))
-	go get sigs.k8s.io/controller-tools/cmd/controller-gen@v0.3.0
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.19.0
 CONTROLLER_GEN=$(shell go env GOPATH)/bin/controller-gen
-else
-CONTROLLER_GEN=$(shell which controller-gen)
-endif
 
 .PHONY: client-gen
 client-gen:
-ifeq (, $(shell which client-gen))
-	go get k8s.io/code-generator/cmd/client-gen@kubernetes-1.18.0
+	go install k8s.io/code-generator/cmd/client-gen@v0.34.0
 CLIENT_GEN=$(shell go env GOPATH)/bin/client-gen
-else
-CLIENT_GEN=$(shell which client-gen)
-endif
 
 .PHONY: release
 release: export GITHUB_TOKEN = $(shell echo ${GITHUB_TOKEN_TROUBLESHOOT})
 release:
 	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --config deploy/.goreleaser.yml
 
-.PHONY: snapshot-release
-snapshot-release:
-	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --snapshot --config deploy/.goreleaser.snapshot.yml
-	docker push replicated/troubleshoot:alpha
-	docker push replicated/preflight:alpha
-
-.PHONY: local-release
-local-release:
-	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --snapshot --config deploy/.goreleaser.yaml
-	docker tag replicated/troubleshoot:alpha localhost:32000/troubleshoot:alpha
-	docker tag replicated/preflight:alpha localhost:32000/preflight:alpha
-	docker push localhost:32000/troubleshoot:alpha
-	docker push localhost:32000/preflight:alpha
-
 .PHONY: run-preflight
-run-preflight: preflight
+run-preflight: bin/preflight
 	./bin/preflight ./examples/preflight/sample-preflight.yaml
 
-.PHONY: run-troubleshoot
-run-troubleshoot: support-bundle
+.PHONY: run-support-bundle
+run-support-bundle: bin/support-bundle
 	./bin/support-bundle ./examples/support-bundle/sample-supportbundle.yaml
 
 .PHONY: run-analyze
-run-analyze: analyze
+run-analyze: bin/analyze
 	./bin/analyze --analyzers ./examples/support-bundle/sample-analyzers.yaml ./support-bundle.tar.gz
+
+.PHONY: init-sbom
+init-sbom:
+	mkdir -p sbom/spdx sbom/assets
+
+.PHONY: install-spdx-sbom-generator
+install-spdx-sbom-generator: init-sbom
+	./scripts/initialize-sbom-build.sh
+
+SPDX_GENERATOR=./sbom/spdx-sbom-generator
+
+.PHONY: generate-sbom
+generate-sbom: install-spdx-sbom-generator
+	$(SPDX_GENERATOR) -o ./sbom/spdx
+
+sbom/assets/troubleshoot-sbom.tgz: generate-sbom
+	tar -czf sbom/assets/troubleshoot-sbom.tgz sbom/spdx/*.spdx
+
+sbom: sbom/assets/troubleshoot-sbom.tgz
+	cosign sign-blob \
+		--key ./cosign.key \
+		--tlog-upload \
+		--yes \
+		--rekor-url=https://rekor.sigstore.dev \
+		--bundle sbom/assets/troubleshoot-sbom.tgz.bundle \
+		sbom/assets/troubleshoot-sbom.tgz
+	cosign public-key --key cosign.key --outfile sbom/assets/key.pub
+
+.PHONY: get-govulncheck
+get-govulncheck:
+	@command -v govulncheck >/dev/null 2>&1 || go install golang.org/x/vuln/cmd/govulncheck@latest
+
+.PHONY: get-grype
+get-grype:
+	@command -v grype >/dev/null 2>&1 || curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b $(GOPATH)/bin
+
+.PHONY: scan
+scan: get-govulncheck get-grype
+	govulncheck ./...
+	grype db update
+	grype dir:. --only-fixed --fail-on high -o template -t .grype.tmpl
+
+.PHONY: watch
+watch: npm-install
+	bin/watch.js
+
+## Syncronize the code with a remote server. More info: CONTRIBUTING.md
+.PHONY: watchrsync
+watchrsync: npm-install
+	bin/watchrsync.js
+
+.PHONY: npm-install
+npm-install:
+	npm --version 2>&1 >/dev/null || ( echo "npm not installed; install npm to set up watchrsync" && exit 1 )
+	npm list gaze-run-interrupt || npm install install --no-save gaze-run-interrupt@~2.0.0
+
+
+######## Lagacy make targets ###########
+# Deprecated: These can be removed
+.PHONY: run-troubleshoot
+run-troubleshoot: run-support-bundle
+
+longhorn:
+	git clone https://github.com/longhorn/longhorn-manager.git
+	cd longhorn-manager && git checkout v1.2.2 && cd ..
+	rm -rf pkg/longhorn
+	mv longhorn-manager/k8s/pkg pkg/longhorn
+	mv longhorn-manager/types pkg/longhorn/types
+	mv longhorn-manager/util pkg/longhorn/util
+	rm -rf pkg/longhorn/util/daemon
+	rm -rf pkg/longhorn/util/server
+	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/k8s\/pkg/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn/g"
+	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/types/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn\/types/g"
+	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/util/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn\/util/g"
+	rm -rf longhorn-manager

README.md

@@ -4,38 +4,64 @@ Replicated Troubleshoot is a framework for collecting, redacting, and analyzing
 
 Troubleshoot provides two CLI tools as kubectl plugins (using [Krew](https://krew.dev)): `kubectl preflight` and `kubectl support-bundle`. Preflight provides pre-installation cluster conformance testing and validation (preflight checks) and support-bundle provides post-installation troubleshooting and diagnostics (support bundles).
 
+To know more about troubleshoot, please visit: https://troubleshoot.sh/
+
 ## Preflight Checks
 Preflight checks are an easy-to-run set of conformance tests that can be written to verify that specific requirements in a cluster are met.
 
 To run a sample preflight check from a sample application, install the preflight kubectl plugin:
 
-```shell
+```
 curl https://krew.sh/preflight | bash
 ```
- and run:
- 
-```shell
+ and run, where https://preflight.replicated.com provides an **example** preflight spec:
+
+```
 kubectl preflight https://preflight.replicated.com
 ```
 
-For a details on creating the custom resource files that drive preflight checks, visit [creating preflight checks](https://troubleshoot.sh/docs/preflight/introduction/).
+**NOTE** this is an example. Do **not** use to validate real scenarios.
+
+For more details on creating the custom resource files that drive preflight checks, visit [creating preflight checks](https://troubleshoot.sh/docs/preflight/introduction/).
 
 
 ## Support Bundle
-A support bundle is an archive that's created in-cluster, by collecting logs and cluster information, and executing specified commands (including redaction of sensitive information). After creating a support bundle, the cluster operator will normally deliver it to the 3rd-party application vendor for analysis and disconnected debugging. Another Replicated project, [Kotsadm](https://github.com/replicatedhq/kotsadm), provides cluster operators with an in-cluster UI for processing support bundles and viewing analyzers (as well as support bundle collection).
+A support bundle is an archive that's created in-cluster, by collecting logs and cluster information, and executing specified commands (including redaction of sensitive information). After creating a support bundle, the cluster operator will normally deliver it to the 3rd-party application vendor for analysis and disconnected debugging. Another Replicated project, [KOTS](https://github.com/replicatedhq/kots), provides k8s apps an in-cluster UI for processing support bundles and viewing analyzers (as well as support bundle collection).
 
 To collect a sample support bundle, install the troubleshoot kubectl plugin:
 
-```shell
+```
 curl https://krew.sh/support-bundle | bash
 ```
- and run:
- 
-```shell
+ and run, where https://support-bundle.replicated.com provides an **example** support bundle spec:
+
+```
 kubectl support-bundle https://support-bundle.replicated.com
 ```
-For details on creating the custom resource files that drive support-bundle collection, visit [creating collectors](https://troubleshoot.sh/docs/collect/) and [creating analyzers](https://troubleshoot.sh/docs/analyze/).
+
+**NOTE** this is an example. Do **not** use to validate real scenarios.
+
+For more details on creating the custom resource files that drive support-bundle collection, visit [creating collectors](https://troubleshoot.sh/docs/collect/) and [creating analyzers](https://troubleshoot.sh/docs/analyze/).
+
+And see our other tool [sbctl](https://github.com/replicatedhq/sbctl) that makes it easier to interact with support bundles using `kubectl` commands you already know
 
 # Community
 
-For questions about using Troubleshoot, there's a [Replicated Community](https://help.replicated.com/community) forum, and a [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot).
+For questions about using Troubleshoot, how to contribute and engaging with the project in any other way, please refer to the following resources and channels.
+
+- [Replicated Community](https://help.replicated.com/community) forum
+- [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot)
+- [#Community meetings calendar](https://calendar.google.com/calendar/u/0?cid=Y19mMGx1aGhiZGtscGllOGo5dWpicXMwNnN1a0Bncm91cC5jYWxlbmRhci5nb29nbGUuY29t). This happen monthly but dates may change and would be kept upto date in the calendar.
+
+# Software Bill of Materials
+A signed SBOM  that includes Troubleshoot dependencies is included in each release.
+- **troubleshoot-sbom.tgz** contains a software bill of materials for Troubleshoot.
+- **troubleshoot-sbom.tgz.bundle** contains the signature and transparency log material used by Cosign.
+- **key.pub** is the public key from the key pair used to sign troubleshoot-sbom.tgz
+
+The following example illustrates using [cosign](https://github.com/sigstore/cosign) to verify that **troubleshoot-sbom.tgz** has
+not been tampered with. Install [Cosign v3](https://github.com/sigstore/cosign/releases).
+```sh
+$ cosign verify-blob --key key.pub --bundle troubleshoot-sbom.tgz.bundle troubleshoot-sbom.tgz
+Verified OK
+```

cmd/analyze/cli/root.go

@@ -1,44 +1,105 @@
 package cli
 
 import (
+	"fmt"
 	"os"
 	"strings"
 
+	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
+// validateArgs allows certain flags to run without requiring bundle arguments
+func validateArgs(cmd *cobra.Command, args []string) error {
+	// Special flags that don't require bundle arguments
+	if cmd.Flags().Changed("check-ollama") || cmd.Flags().Changed("setup-ollama") ||
+		cmd.Flags().Changed("list-models") || cmd.Flags().Changed("pull-model") {
+		return nil
+	}
+
+	// For all other cases, require at least 1 argument (the bundle path)
+	if len(args) < 1 {
+		return fmt.Errorf("requires at least 1 arg(s), only received %d. Usage: analyze [bundle-path] or use --check-ollama/--setup-ollama", len(args))
+	}
+
+	return nil
+}
+
 func RootCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:          "analyze [url]",
-		Args:         cobra.MinimumNArgs(1),
+		Args:         validateArgs,
 		Short:        "Analyze a support bundle",
 		Long:         `Run a series of analyzers on a support bundle archive`,
 		SilenceUsage: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+			v := viper.GetViper()
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+
+			if err := util.StartProfiling(); err != nil {
+				klog.Errorf("Failed to start profiling: %v", err)
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
-			logger.SetQuiet(v.GetBool("quiet"))
+			// Handle cases where no bundle argument is provided (for utility flags)
+			var bundlePath string
+			if len(args) > 0 {
+				bundlePath = args[0]
+			}
 
-			return runAnalyzers(v, args[0])
+			return runAnalyzers(v, bundlePath)
+		},
+		PostRun: func(cmd *cobra.Command, args []string) {
+			if err := util.StopProfiling(); err != nil {
+				klog.Errorf("Failed to stop profiling: %v", err)
+			}
 		},
 	}
 
 	cobra.OnInitialize(initConfig)
 
+	cmd.AddCommand(util.VersionCmd())
+
 	cmd.Flags().String("analyzers", "", "filename or url of the analyzers to use")
+	cmd.Flags().Bool("debug", false, "enable debug logging")
+
+	// Advanced analysis flags
+	cmd.Flags().Bool("advanced-analysis", false, "use advanced analysis engine with AI capabilities")
+	cmd.Flags().StringSlice("agents", []string{"local"}, "analysis agents to use: local, hosted, ollama")
+	cmd.Flags().Bool("enable-ollama", false, "enable Ollama AI-powered analysis")
+	cmd.Flags().Bool("disable-ollama", false, "explicitly disable Ollama AI-powered analysis")
+	cmd.Flags().String("ollama-endpoint", "http://localhost:11434", "Ollama server endpoint")
+	cmd.Flags().String("ollama-model", "llama2:7b", "Ollama model to use for analysis")
+	cmd.Flags().Bool("use-codellama", false, "use CodeLlama model for code-focused analysis")
+	cmd.Flags().Bool("use-mistral", false, "use Mistral model for fast analysis")
+	cmd.Flags().Bool("auto-pull-model", true, "automatically pull model if not available")
+	cmd.Flags().Bool("list-models", false, "list all available/installed Ollama models and exit")
+	cmd.Flags().Bool("pull-model", false, "pull the specified model and exit")
+	cmd.Flags().Bool("setup-ollama", false, "automatically setup and configure Ollama")
+	cmd.Flags().Bool("check-ollama", false, "check Ollama installation status and exit")
+	cmd.Flags().Bool("include-remediation", true, "include remediation suggestions in analysis results")
+	cmd.Flags().String("output-file", "", "save analysis results to file (e.g., --output-file results.json)")
 
 	viper.BindPFlags(cmd.Flags())
 
 	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
 
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
 	k8sutil.AddFlags(cmd.Flags())
 
+	// CPU and memory profiling flags
+	util.AddProfilingFlags(cmd)
+
 	return cmd
 }
 

cmd/analyze/cli/run.go

@@ -1,24 +1,414 @@
 package cli
 
 import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"encoding/json"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
 
 	"github.com/pkg/errors"
-	"github.com/replicatedhq/troubleshoot/cmd/util"
+	"github.com/replicatedhq/troubleshoot/internal/util"
 	analyzer "github.com/replicatedhq/troubleshoot/pkg/analyze"
+	"github.com/replicatedhq/troubleshoot/pkg/analyze/agents/local"
+	"github.com/replicatedhq/troubleshoot/pkg/analyze/agents/ollama"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/yaml"
 )
 
 func runAnalyzers(v *viper.Viper, bundlePath string) error {
+	// Handle Ollama-specific commands first (these don't require a bundle)
+	if v.GetBool("setup-ollama") {
+		return handleOllamaSetup(v)
+	}
+
+	if v.GetBool("check-ollama") {
+		return handleOllamaStatus(v)
+	}
+
+	if v.GetBool("list-models") {
+		return handleListModels(v)
+	}
+
+	if v.GetBool("pull-model") {
+		return handlePullModel(v)
+	}
+
+	// For all other operations, we need a bundle path
+	if bundlePath == "" {
+		return errors.New("bundle path is required for analysis operations")
+	}
+
+	// Check if advanced analysis is requested
+	useAdvanced := v.GetBool("advanced-analysis") ||
+		v.GetBool("enable-ollama") ||
+		(len(v.GetStringSlice("agents")) > 1 ||
+			(len(v.GetStringSlice("agents")) == 1 && v.GetStringSlice("agents")[0] != "local"))
+
+	if useAdvanced {
+		return runAdvancedAnalysis(v, bundlePath)
+	}
+
+	// Only fall back to legacy analysis if no advanced flags are used at all
+	return runLegacyAnalysis(v, bundlePath)
+}
+
+// handleOllamaSetup automatically sets up Ollama for the user
+func handleOllamaSetup(v *viper.Viper) error {
+	fmt.Println("🚀 Ollama Setup Assistant")
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	helper := analyzer.NewOllamaHelper()
+
+	// Check current status
+	status := helper.GetHealthStatus()
+	fmt.Print(status.String())
+
+	if !status.Installed {
+		fmt.Println("\n🔧 Installing Ollama...")
+		if err := helper.DownloadAndInstall(); err != nil {
+			return errors.Wrap(err, "failed to install Ollama")
+		}
+		fmt.Println("✅ Ollama installed successfully!")
+	}
+
+	if !status.Running {
+		fmt.Println("\n🚀 Starting Ollama service...")
+		if err := helper.StartService(); err != nil {
+			return errors.Wrap(err, "failed to start Ollama service")
+		}
+		fmt.Println("✅ Ollama service started!")
+	}
+
+	if len(status.Models) == 0 {
+		fmt.Println("\n📚 Downloading recommended model...")
+		helper.PrintModelRecommendations()
+
+		model := v.GetString("ollama-model")
+		if model == "" {
+			model = "llama2:7b"
+		}
+
+		fmt.Printf("\n⬇️  Pulling model: %s (this may take several minutes)...\n", model)
+		if err := helper.PullModel(model); err != nil {
+			return errors.Wrapf(err, "failed to pull model %s", model)
+		}
+	}
+
+	fmt.Println("\n🎉 Ollama setup complete!")
+	fmt.Println("\n💡 Next steps:")
+	fmt.Printf("   troubleshoot analyze --enable-ollama %s\n", filepath.Base(os.Args[len(os.Args)-1]))
+
+	return nil
+}
+
+// handleOllamaStatus shows current Ollama installation and service status
+func handleOllamaStatus(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	fmt.Println("🔍 Ollama Status Report")
+	fmt.Println("=" + strings.Repeat("=", 50))
+	fmt.Print(status.String())
+
+	if !status.Installed {
+		fmt.Println("\n🔧 Setup Instructions:")
+		fmt.Println(helper.GetInstallInstructions())
+		return nil
+	}
+
+	if !status.Running {
+		fmt.Println("\n🚀 To start Ollama service:")
+		fmt.Println("   ollama serve &")
+		fmt.Println("   # or")
+		fmt.Println("   troubleshoot analyze --setup-ollama")
+		return nil
+	}
+
+	if len(status.Models) == 0 {
+		fmt.Println("\n📚 No models installed. Recommended models:")
+		helper.PrintModelRecommendations()
+	} else {
+		fmt.Println("\n✅ Ready for AI-powered analysis!")
+		fmt.Printf("   troubleshoot analyze --enable-ollama your-bundle.tar.gz\n")
+	}
+
+	return nil
+}
+
+// handleListModels lists available and installed Ollama models
+func handleListModels(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	fmt.Println("🤖 Ollama Model Management")
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	if !status.Installed {
+		fmt.Println("❌ Ollama is not installed")
+		fmt.Println("💡 Install with: troubleshoot analyze --setup-ollama")
+		return nil
+	}
+
+	if !status.Running {
+		fmt.Println("⚠️  Ollama service is not running")
+		fmt.Println("🚀 Start with: ollama serve &")
+		return nil
+	}
+
+	// Show installed models
+	fmt.Println("📚 Installed Models:")
+	if len(status.Models) == 0 {
+		fmt.Println("   No models installed")
+	} else {
+		for _, model := range status.Models {
+			fmt.Printf("   ✅ %s\n", model)
+		}
+	}
+
+	// Show available models for download
+	fmt.Println("\n🌐 Available Models:")
+	helper.PrintModelRecommendations()
+
+	// Show usage examples
+	fmt.Println("💡 Usage Examples:")
+	fmt.Println("   # Use specific model:")
+	fmt.Printf("   troubleshoot analyze --ollama-model llama2:13b bundle.tar.gz\n")
+	fmt.Println("   # Use preset models:")
+	fmt.Printf("   troubleshoot analyze --use-codellama bundle.tar.gz\n")
+	fmt.Printf("   troubleshoot analyze --use-mistral bundle.tar.gz\n")
+	fmt.Println("   # Pull a new model:")
+	fmt.Printf("   troubleshoot analyze --ollama-model llama2:13b --pull-model\n")
+
+	return nil
+}
+
+// handlePullModel pulls a specific model
+func handlePullModel(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	if !status.Installed {
+		fmt.Println("❌ Ollama is not installed")
+		fmt.Println("💡 Install with: troubleshoot analyze --setup-ollama")
+		return errors.New("Ollama must be installed to pull models")
+	}
+
+	if !status.Running {
+		fmt.Println("❌ Ollama service is not running")
+		fmt.Println("🚀 Start with: ollama serve &")
+		return errors.New("Ollama service must be running to pull models")
+	}
+
+	// Determine which model to pull
+	model := determineOllamaModel(v)
+
+	fmt.Printf("📥 Pulling model: %s\n", model)
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	if err := helper.PullModel(model); err != nil {
+		return errors.Wrapf(err, "failed to pull model %s", model)
+	}
+
+	fmt.Printf("\n✅ Model %s ready for analysis!\n", model)
+	fmt.Println("\n💡 Test it with:")
+	fmt.Printf("   troubleshoot analyze --ollama-model %s bundle.tar.gz\n", model)
+
+	return nil
+}
+
+// runAdvancedAnalysis uses the new analysis engine with agent support
+func runAdvancedAnalysis(v *viper.Viper, bundlePath string) error {
+	ctx := context.Background()
+
+	// Create the analysis engine
+	engine := analyzer.NewAnalysisEngine()
+
+	// Determine which agents to use
+	agents := v.GetStringSlice("agents")
+
+	// Handle Ollama flags
+	enableOllama := v.GetBool("enable-ollama")
+	disableOllama := v.GetBool("disable-ollama")
+
+	if enableOllama && !disableOllama {
+		// Add ollama to agents if not already present
+		hasOllama := false
+		for _, agent := range agents {
+			if agent == "ollama" {
+				hasOllama = true
+				break
+			}
+		}
+		if !hasOllama {
+			agents = append(agents, "ollama")
+		}
+	}
+
+	if disableOllama {
+		// Remove ollama from agents
+		filteredAgents := []string{}
+		for _, agent := range agents {
+			if agent != "ollama" {
+				filteredAgents = append(filteredAgents, agent)
+			}
+		}
+		agents = filteredAgents
+	}
+
+	// Register requested agents
+	registeredAgents := []string{}
+	for _, agentName := range agents {
+		switch agentName {
+		case "ollama":
+			if err := registerOllamaAgent(engine, v); err != nil {
+				return err
+			}
+			registeredAgents = append(registeredAgents, agentName)
+
+		case "local":
+			opts := &local.LocalAgentOptions{}
+			agent := local.NewLocalAgent(opts)
+			if err := engine.RegisterAgent("local", agent); err != nil {
+				return errors.Wrap(err, "failed to register local agent")
+			}
+			registeredAgents = append(registeredAgents, agentName)
+
+		default:
+			klog.Warningf("Unknown agent type: %s", agentName)
+		}
+	}
+
+	if len(registeredAgents) == 0 {
+		return errors.New("no analysis agents available - check your configuration")
+	}
+
+	fmt.Printf("🔍 Using analysis agents: %s\n", strings.Join(registeredAgents, ", "))
+
+	// Load support bundle
+	bundle, err := loadSupportBundle(bundlePath)
+	if err != nil {
+		return errors.Wrap(err, "failed to load support bundle")
+	}
+
+	// Load analyzer specs if provided
+	var customAnalyzers []*troubleshootv1beta2.Analyze
+	if specPath := v.GetString("analyzers"); specPath != "" {
+		customAnalyzers, err = loadAnalyzerSpecs(specPath)
+		if err != nil {
+			return errors.Wrap(err, "failed to load analyzer specs")
+		}
+	}
+
+	// Configure analysis options
+	opts := analyzer.AnalysisOptions{
+		Agents:             registeredAgents,
+		IncludeRemediation: v.GetBool("include-remediation"),
+		CustomAnalyzers:    customAnalyzers,
+		Timeout:            5 * time.Minute,
+		Concurrency:        2,
+	}
+
+	// Run analysis
+	fmt.Printf("🚀 Starting advanced analysis of bundle: %s\n", bundlePath)
+	result, err := engine.Analyze(ctx, bundle, opts)
+	if err != nil {
+		return errors.Wrap(err, "analysis failed")
+	}
+
+	// Display results
+	return displayAdvancedResults(result, v.GetString("output"), v.GetString("output-file"))
+}
+
+// registerOllamaAgent creates and registers an Ollama agent
+func registerOllamaAgent(engine analyzer.AnalysisEngine, v *viper.Viper) error {
+	// Check if Ollama is available
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	if !status.Installed {
+		return showOllamaSetupHelp("Ollama is not installed")
+	}
+
+	if !status.Running {
+		return showOllamaSetupHelp("Ollama service is not running")
+	}
+
+	if len(status.Models) == 0 {
+		return showOllamaSetupHelp("No Ollama models are installed")
+	}
+
+	// Determine which model to use
+	selectedModel := determineOllamaModel(v)
+
+	// Auto-pull model if requested and not available
+	if v.GetBool("auto-pull-model") {
+		if err := ensureModelAvailable(selectedModel); err != nil {
+			return errors.Wrapf(err, "failed to ensure model %s is available", selectedModel)
+		}
+	}
+
+	// Create Ollama agent
+	opts := &ollama.OllamaAgentOptions{
+		Endpoint:    v.GetString("ollama-endpoint"),
+		Model:       selectedModel,
+		Timeout:     5 * time.Minute,
+		MaxTokens:   2000,
+		Temperature: 0.2,
+	}
+
+	agent, err := ollama.NewOllamaAgent(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to create Ollama agent")
+	}
+
+	// Register with engine
+	if err := engine.RegisterAgent("ollama", agent); err != nil {
+		return errors.Wrap(err, "failed to register Ollama agent")
+	}
+
+	return nil
+}
+
+// showOllamaSetupHelp displays helpful setup instructions when Ollama is not available
+func showOllamaSetupHelp(reason string) error {
+	fmt.Printf("❌ Ollama AI analysis not available: %s\n\n", reason)
+
+	helper := analyzer.NewOllamaHelper()
+	fmt.Println("🔧 Quick Setup:")
+	fmt.Println("   troubleshoot analyze --setup-ollama")
+	fmt.Println()
+	fmt.Println("📋 Manual Setup:")
+	fmt.Println("   1. Install: curl -fsSL https://ollama.ai/install.sh | sh")
+	fmt.Println("   2. Start service: ollama serve &")
+	fmt.Println("   3. Pull model: ollama pull llama2:7b")
+	fmt.Println("   4. Retry analysis with: --enable-ollama")
+	fmt.Println()
+	fmt.Println("💡 Check status: troubleshoot analyze --check-ollama")
+	fmt.Println()
+	fmt.Println(helper.GetInstallInstructions())
+
+	return errors.New("Ollama setup required for AI-powered analysis")
+}
+
+// runLegacyAnalysis runs the original analysis logic for backward compatibility
+func runLegacyAnalysis(v *viper.Viper, bundlePath string) error {
 	specPath := v.GetString("analyzers")
 
 	specContent := ""
 	var err error
 	if _, err = os.Stat(specPath); err == nil {
-		b, err := ioutil.ReadFile(specPath)
+		b, err := os.ReadFile(specPath)
 		if err != nil {
 			return err
 		}
@@ -26,7 +416,8 @@ func runAnalyzers(v *viper.Viper, bundlePath string) error {
 		specContent = string(b)
 	} else {
 		if !util.IsURL(specPath) {
-			return fmt.Errorf("%s is not a URL and was not found (err %s)", specPath, err)
+			// TODO: Better error message when we do not have a file/url etc
+			return fmt.Errorf("%s is not a URL and was not found", specPath)
 		}
 
 		req, err := http.NewRequest("GET", specPath, nil)
@@ -65,3 +456,302 @@ func runAnalyzers(v *viper.Viper, bundlePath string) error {
 
 	return nil
 }
+
+// loadSupportBundle loads and parses a support bundle from file
+func loadSupportBundle(bundlePath string) (*analyzer.SupportBundle, error) {
+	if _, err := os.Stat(bundlePath); os.IsNotExist(err) {
+		return nil, errors.Errorf("support bundle not found: %s", bundlePath)
+	}
+
+	klog.Infof("Loading support bundle: %s", bundlePath)
+
+	// Open the tar.gz file
+	file, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to open support bundle")
+	}
+	defer file.Close()
+
+	// Create gzip reader
+	gzipReader, err := gzip.NewReader(file)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create gzip reader")
+	}
+	defer gzipReader.Close()
+
+	// Create tar reader
+	tarReader := tar.NewReader(gzipReader)
+
+	// Create bundle structure
+	bundle := &analyzer.SupportBundle{
+		Files: make(map[string][]byte),
+		Metadata: &analyzer.SupportBundleMetadata{
+			CreatedAt:   time.Now(),
+			Version:     "1.0.0",
+			GeneratedBy: "troubleshoot-cli",
+		},
+	}
+
+	// Extract all files from tar
+	for {
+		header, err := tarReader.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read tar entry")
+		}
+
+		// Skip directories
+		if header.Typeflag == tar.TypeDir {
+			continue
+		}
+
+		// Read file content
+		content, err := io.ReadAll(tarReader)
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to read file %s", header.Name)
+		}
+
+		// Remove bundle directory prefix from file path for consistent access
+		// e.g., "live-cluster-bundle/cluster-info/version.json" → "cluster-info/version.json"
+		cleanPath := header.Name
+		if parts := strings.SplitN(header.Name, "/", 2); len(parts) == 2 {
+			cleanPath = parts[1]
+		}
+
+		bundle.Files[cleanPath] = content
+		klog.V(2).Infof("Loaded file: %s (%d bytes)", cleanPath, len(content))
+	}
+
+	klog.Infof("Successfully loaded support bundle with %d files", len(bundle.Files))
+
+	return bundle, nil
+}
+
+// loadAnalyzerSpecs loads analyzer specifications from file or URL
+func loadAnalyzerSpecs(specPath string) ([]*troubleshootv1beta2.Analyze, error) {
+	klog.Infof("Loading analyzer specs from: %s", specPath)
+
+	// Read the analyzer spec file (same logic as runLegacyAnalysis)
+	specContent := ""
+	var err error
+	if _, err = os.Stat(specPath); err == nil {
+		b, err := os.ReadFile(specPath)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read analyzer spec file")
+		}
+		specContent = string(b)
+	} else {
+		if !util.IsURL(specPath) {
+			return nil, errors.Errorf("analyzer spec %s is not a URL and was not found", specPath)
+		}
+
+		req, err := http.NewRequest("GET", specPath, nil)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to create HTTP request")
+		}
+		req.Header.Set("User-Agent", "Replicated_Analyzer/v1beta2")
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to fetch analyzer spec")
+		}
+		defer resp.Body.Close()
+
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read analyzer spec response")
+		}
+		specContent = string(body)
+	}
+
+	// Parse the YAML/JSON into troubleshoot analyzer struct
+	var analyzerSpec troubleshootv1beta2.Analyzer
+	if err := yaml.Unmarshal([]byte(specContent), &analyzerSpec); err != nil {
+		return nil, errors.Wrap(err, "failed to parse analyzer spec")
+	}
+
+	// Return the analyzer specs from the parsed document
+	return analyzerSpec.Spec.Analyzers, nil
+}
+
+// displayAdvancedResults formats and displays analysis results
+func displayAdvancedResults(result *analyzer.AnalysisResult, outputFormat, outputFile string) error {
+	if result == nil {
+		return errors.New("no analysis results to display")
+	}
+
+	// Display summary
+	fmt.Println("\n📊 Analysis Summary")
+	fmt.Println("=" + strings.Repeat("=", 50))
+	fmt.Printf("Total Analyzers: %d\n", result.Summary.TotalAnalyzers)
+	fmt.Printf("✅ Pass: %d\n", result.Summary.PassCount)
+	fmt.Printf("⚠️  Warn: %d\n", result.Summary.WarnCount)
+	fmt.Printf("❌ Fail: %d\n", result.Summary.FailCount)
+	fmt.Printf("🚫 Errors: %d\n", result.Summary.ErrorCount)
+	fmt.Printf("⏱️  Duration: %s\n", result.Summary.Duration)
+	fmt.Printf("🤖 Agents Used: %s\n", strings.Join(result.Summary.AgentsUsed, ", "))
+
+	if result.Summary.Confidence > 0 {
+		fmt.Printf("🎯 Confidence: %.1f%%\n", result.Summary.Confidence*100)
+	}
+
+	// Display results based on format
+	switch outputFormat {
+	case "json":
+		jsonData, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal results to JSON")
+		}
+		fmt.Println("\n📄 Full Results (JSON):")
+		fmt.Println(string(jsonData))
+
+	default:
+		// Human-readable format
+		fmt.Println("\n🔍 Analysis Results")
+		fmt.Println("=" + strings.Repeat("=", 50))
+
+		for _, analyzerResult := range result.Results {
+			status := "❓"
+			if analyzerResult.IsPass {
+				status = "✅"
+			} else if analyzerResult.IsWarn {
+				status = "⚠️"
+			} else if analyzerResult.IsFail {
+				status = "❌"
+			}
+
+			fmt.Printf("\n%s %s", status, analyzerResult.Title)
+			if analyzerResult.AgentName != "" {
+				fmt.Printf(" [%s]", analyzerResult.AgentName)
+			}
+			if analyzerResult.Confidence > 0 {
+				fmt.Printf(" (%.0f%% confidence)", analyzerResult.Confidence*100)
+			}
+			fmt.Println()
+
+			if analyzerResult.Message != "" {
+				fmt.Printf("   %s\n", analyzerResult.Message)
+			}
+
+			if analyzerResult.Category != "" {
+				fmt.Printf("   Category: %s\n", analyzerResult.Category)
+			}
+
+			// Display insights if available
+			if len(analyzerResult.Insights) > 0 {
+				fmt.Println("   💡 Insights:")
+				for _, insight := range analyzerResult.Insights {
+					fmt.Printf("   • %s\n", insight)
+				}
+			}
+
+			// Display remediation if available
+			if analyzerResult.Remediation != nil {
+				fmt.Printf("   🔧 Remediation: %s\n", analyzerResult.Remediation.Description)
+				if analyzerResult.Remediation.Command != "" {
+					fmt.Printf("   💻 Command: %s\n", analyzerResult.Remediation.Command)
+				}
+			}
+		}
+
+		// Display overall remediation suggestions
+		if len(result.Remediation) > 0 {
+			fmt.Println("\n🔧 Recommended Actions")
+			fmt.Println("=" + strings.Repeat("=", 50))
+			for i, remedy := range result.Remediation {
+				fmt.Printf("%d. %s\n", i+1, remedy.Description)
+				if remedy.Command != "" {
+					fmt.Printf("   Command: %s\n", remedy.Command)
+				}
+				if remedy.Documentation != "" {
+					fmt.Printf("   Docs: %s\n", remedy.Documentation)
+				}
+			}
+		}
+
+		// Display errors if any
+		if len(result.Errors) > 0 {
+			fmt.Println("\n⚠️  Errors During Analysis")
+			fmt.Println("=" + strings.Repeat("=", 30))
+			for _, analysisError := range result.Errors {
+				fmt.Printf("• [%s] %s: %s\n", analysisError.Agent, analysisError.Category, analysisError.Error)
+			}
+		}
+
+		// Display agent metadata
+		if len(result.Metadata.Agents) > 0 {
+			fmt.Println("\n🤖 Agent Performance")
+			fmt.Println("=" + strings.Repeat("=", 40))
+			for _, agent := range result.Metadata.Agents {
+				fmt.Printf("• %s: %d results, %s duration", agent.Name, agent.ResultCount, agent.Duration)
+				if agent.ErrorCount > 0 {
+					fmt.Printf(" (%d errors)", agent.ErrorCount)
+				}
+				fmt.Println()
+			}
+		}
+	}
+
+	// Save results to file if requested
+	if outputFile != "" {
+		jsonData, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal results for file output")
+		}
+
+		if err := os.WriteFile(outputFile, jsonData, 0644); err != nil {
+			return errors.Wrapf(err, "failed to write results to %s", outputFile)
+		}
+
+		fmt.Printf("\n💾 Analysis results saved to: %s\n", outputFile)
+	}
+
+	return nil
+}
+
+// determineOllamaModel selects the appropriate model based on flags
+func determineOllamaModel(v *viper.Viper) string {
+	// Check for specific model flags first
+	if v.GetBool("use-codellama") {
+		return "codellama:7b"
+	}
+	if v.GetBool("use-mistral") {
+		return "mistral:7b"
+	}
+
+	// Fall back to explicit model specification or default
+	return v.GetString("ollama-model")
+}
+
+// ensureModelAvailable checks if model exists and pulls it if needed
+func ensureModelAvailable(model string) error {
+	// Check if model is already available
+	cmd := exec.Command("ollama", "list")
+	output, err := cmd.Output()
+	if err != nil {
+		return errors.Wrap(err, "failed to check available models")
+	}
+
+	// Parse model list to see if our model exists
+	lines := strings.Split(string(output), "\n")
+	for _, line := range lines {
+		if strings.Contains(line, model) {
+			klog.Infof("Model %s is already available", model)
+			return nil
+		}
+	}
+
+	// Model not found, pull it
+	fmt.Printf("📚 Model %s not found, pulling automatically...\n", model)
+	pullCmd := exec.Command("ollama", "pull", model)
+	pullCmd.Stdout = os.Stdout
+	pullCmd.Stderr = os.Stderr
+
+	if err := pullCmd.Run(); err != nil {
+		return errors.Wrapf(err, "failed to pull model %s", model)
+	}
+
+	fmt.Printf("✅ Model %s pulled successfully!\n", model)
+	return nil
+}

cmd/analyze/main.go

@@ -1,10 +1,13 @@
 package main
 
 import (
-	"github.com/replicatedhq/troubleshoot/cmd/analyze/cli"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	"os"
+
+	analyzecli "github.com/replicatedhq/troubleshoot/cmd/analyze/cli"
 )
 
 func main() {
-	cli.InitAndExecute()
+	if err := analyzecli.RootCmd().Execute(); err != nil {
+		os.Exit(1)
+	}
 }

cmd/collect/cli/chroot_darwin.go

@@ -0,0 +1,21 @@
+package cli
+
+import (
+	"errors"
+	"syscall"
+
+	"github.com/replicatedhq/troubleshoot/internal/util"
+)
+
+func checkAndSetChroot(newroot string) error {
+	if newroot == "" {
+		return nil
+	}
+	if !util.IsRunningAsRoot() {
+		return errors.New("Can only chroot when run as root")
+	}
+	if err := syscall.Chroot(newroot); err != nil {
+		return err
+	}
+	return nil
+}

cmd/collect/cli/chroot_linux.go

@@ -0,0 +1,21 @@
+package cli
+
+import (
+	"errors"
+	"syscall"
+
+	"github.com/replicatedhq/troubleshoot/internal/util"
+)
+
+func checkAndSetChroot(newroot string) error {
+	if newroot == "" {
+		return nil
+	}
+	if !util.IsRunningAsRoot() {
+		return errors.New("Can only chroot when run as root")
+	}
+	if err := syscall.Chroot(newroot); err != nil {
+		return err
+	}
+	return nil
+}

cmd/collect/cli/chroot_windows.go

@@ -0,0 +1,9 @@
+package cli
+
+import (
+	"errors"
+)
+
+func checkAndSetChroot(newroot string) error {
+	return errors.New("chroot is only implimented in linux/darwin")
+}

cmd/collect/cli/clickhouse.go

@@ -0,0 +1,88 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// ClickhouseCmd runs the clickhouse collector against a single database and
+// prints the native result JSON ({"isConnected":..,"version":..,"error":..}).
+func ClickhouseCmd() *cobra.Command {
+	var (
+		uri             string
+		skipVerify      bool
+		caCert          string
+		clientCert      string
+		clientKey       string
+		secretName      string
+		secretNamespace string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "clickhouse",
+		Short: "Run the clickhouse collector against a database",
+		Long: `Run the clickhouse collector: connect to a ClickHouse server, run "SELECT version()",
+and print the collector result as JSON.
+
+--uri is a clickhouse-go DSN:
+  clickhouse://user:password@host:9000/dbname
+
+TLS material may be provided inline / by file path (--tls-cacert, --tls-client-cert,
+--tls-client-key) or sourced from a Secret (--tls-secret-name), which requires
+cluster access.
+
+Example:
+  collect clickhouse --uri "clickhouse://default:@ch.default.svc:9000/default"`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "clickhouse"},
+				URI:           uri,
+			}
+
+			var (
+				client kubernetes.Interface
+				cfg    *rest.Config
+			)
+			if skipVerify || caCert != "" || clientCert != "" || clientKey != "" || secretName != "" {
+				tls := &troubleshootv1beta2.TLSParams{
+					SkipVerify: skipVerify,
+					CACert:     caCert,
+					ClientCert: clientCert,
+					ClientKey:  clientKey,
+				}
+				if secretName != "" {
+					tls.Secret = &troubleshootv1beta2.TLSSecret{Name: secretName, Namespace: secretNamespace}
+					var err error
+					client, cfg, err = k8sClientForCollectors()
+					if err != nil {
+						return err
+					}
+				}
+				db.TLS = tls
+			}
+
+			c := &collect.CollectClickhouse{Collector: db, ClientConfig: cfg, Client: client, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&uri, "uri", "", "ClickHouse connection DSN, e.g. clickhouse://user:pass@host:9000/db (required)")
+	cmd.MarkFlagRequired("uri")
+	f.BoolVar(&skipVerify, "tls-skip-verify", false, "skip TLS certificate verification")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate (PEM contents or a file path)")
+	f.StringVar(&clientCert, "tls-client-cert", "", "client certificate (PEM contents or a file path)")
+	f.StringVar(&clientKey, "tls-client-key", "", "client key (PEM contents or a file path)")
+	f.StringVar(&secretName, "tls-secret-name", "", "name of a Secret holding TLS material (requires cluster access)")
+	f.StringVar(&secretNamespace, "tls-secret-namespace", "default", "namespace of the TLS Secret")
+
+	return cmd
+}

cmd/collect/cli/collectors_common.go

@@ -0,0 +1,47 @@
+// Package cli implements the `collect` command and its subcommands.
+//
+// The per-collector subcommands (http, postgres, mysql, mssql, redis) run a
+// single collector and print its native result JSON to stdout. This lets a
+// collector run inside a Pod using the troubleshoot image — e.g. as a runPod
+// collector — so the check executes from within the cluster instead of from
+// wherever the CLI happens to be invoked.
+package cli
+
+import (
+	"fmt"
+
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/version"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// printCollectorResult writes the native collector result JSON to stdout.
+// The single-collector subcommands run with an empty BundlePath, so the result
+// is held in memory (map value = the JSON bytes) rather than written to disk.
+func printCollectorResult(res collect.CollectorResult) error {
+	for _, b := range res {
+		fmt.Println(string(b))
+	}
+	return nil
+}
+
+// k8sClientForCollectors builds a Kubernetes client from the ambient kubeconfig
+// or in-cluster config. Only the collectors that resolve TLS material from a
+// Secret need this; plain connections and inline/file TLS do not.
+func k8sClientForCollectors() (kubernetes.Interface, *rest.Config, error) {
+	cfg, err := k8sutil.GetRESTConfig()
+	if err != nil {
+		return nil, nil, err
+	}
+	cfg.QPS = constants.DEFAULT_CLIENT_QPS
+	cfg.Burst = constants.DEFAULT_CLIENT_BURST
+	cfg.UserAgent = fmt.Sprintf("%s/%s", constants.DEFAULT_CLIENT_USER_AGENT, version.Version())
+	client, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		return nil, nil, err
+	}
+	return client, cfg, nil
+}

cmd/collect/cli/http.go

@@ -0,0 +1,79 @@
+package cli
+
+import (
+	"fmt"
+	"strings"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+)
+
+// HTTPCmd runs the http collector against a single endpoint and prints the
+// native result JSON ({"response":{"status":...}} or {"error":{...}}).
+func HTTPCmd() *cobra.Command {
+	var (
+		method   string
+		url      string
+		headers  map[string]string
+		body     string
+		timeout  string
+		proxy    string
+		insecure bool
+		caCert   string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "http",
+		Short: "Run the http collector against an endpoint",
+		Long: `Run the http collector: issue an HTTP request and print the collector result as JSON.
+
+The result contains the response status, body and headers, or an error object.
+
+Examples:
+  collect http --url http://myapp.default.svc:8080/healthz
+  collect http --method POST --url https://api.internal/ping \
+      --header 'Content-Type=application/json' --body '{"ping":true}'`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			var tls *troubleshootv1beta2.TLSParams
+			if caCert != "" {
+				tls = &troubleshootv1beta2.TLSParams{CACert: caCert}
+			}
+
+			spec := &troubleshootv1beta2.HTTP{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "http"},
+			}
+			switch strings.ToUpper(method) {
+			case "GET":
+				spec.Get = &troubleshootv1beta2.Get{URL: url, Headers: headers, Timeout: timeout, Proxy: proxy, InsecureSkipVerify: insecure, TLS: tls}
+			case "POST":
+				spec.Post = &troubleshootv1beta2.Post{URL: url, Headers: headers, Body: body, Timeout: timeout, Proxy: proxy, InsecureSkipVerify: insecure, TLS: tls}
+			case "PUT":
+				spec.Put = &troubleshootv1beta2.Put{URL: url, Headers: headers, Body: body, Timeout: timeout, Proxy: proxy, InsecureSkipVerify: insecure, TLS: tls}
+			default:
+				return fmt.Errorf("unsupported --method %q (use GET, POST, or PUT)", method)
+			}
+
+			c := &collect.CollectHTTP{Collector: spec}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&url, "url", "", "request URL (required)")
+	cmd.MarkFlagRequired("url")
+	f.StringVar(&method, "method", "GET", "HTTP method: GET, POST, or PUT")
+	f.StringToStringVar(&headers, "header", nil, "request header as key=value (repeatable)")
+	f.StringVar(&body, "body", "", "request body (POST/PUT only)")
+	f.StringVar(&timeout, "timeout", "", "request timeout, e.g. 15s (empty = no timeout)")
+	f.StringVar(&proxy, "proxy", "", "proxy URL to use for the request")
+	f.BoolVar(&insecure, "insecure-skip-verify", false, "do not verify the server's TLS certificate")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate to trust (PEM contents or a file path)")
+
+	return cmd
+}

cmd/collect/cli/mssql.go

@@ -0,0 +1,49 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+)
+
+// MssqlCmd runs the mssql collector against a single database and prints the
+// native result JSON ({"isConnected":..,"version":..,"error":..}).
+//
+// Unlike the other database collectors, the mssql collector does not honor a
+// separate TLS field — TLS is configured through the connection URI query
+// parameters (e.g. encrypt=true) — so this subcommand only takes --uri.
+func MssqlCmd() *cobra.Command {
+	var uri string
+
+	cmd := &cobra.Command{
+		Use:   "mssql",
+		Short: "Run the mssql collector against a database",
+		Long: `Run the mssql collector: connect to a Microsoft SQL Server, run "select @@VERSION",
+and print the collector result as JSON.
+
+--uri is a go-mssqldb connection URL; TLS options are passed as query parameters:
+  sqlserver://user:password@host:1433?database=app&encrypt=true
+
+Example:
+  collect mssql --uri "sqlserver://sa:pass@mssql.default.svc:1433?encrypt=true"`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "mssql"},
+				URI:           uri,
+			}
+
+			c := &collect.CollectMssql{Collector: db, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	cmd.Flags().StringVar(&uri, "uri", "", "SQL Server connection URI, e.g. sqlserver://user:pass@host:1433 (required)")
+	cmd.MarkFlagRequired("uri")
+
+	return cmd
+}

cmd/collect/cli/mysql.go

@@ -0,0 +1,90 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// MysqlCmd runs the mysql collector against a single database and prints the
+// native result JSON ({"isConnected":..,"version":..,"variables":..,"error":..}).
+func MysqlCmd() *cobra.Command {
+	var (
+		uri             string
+		parameters      []string
+		skipVerify      bool
+		caCert          string
+		clientCert      string
+		clientKey       string
+		secretName      string
+		secretNamespace string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "mysql",
+		Short: "Run the mysql collector against a database",
+		Long: `Run the mysql collector: connect to a MySQL server, run "select version()",
+optionally collect server variables, and print the collector result as JSON.
+
+--uri is a go-sql-driver DSN (note: not a URL):
+  user:password@tcp(host:3306)/dbname
+
+--parameters names server variables to collect via "SHOW VARIABLES"; the matching
+values are returned under "variables" in the result. This flag is unique to mysql.
+
+Example:
+  collect mysql --uri "root:pass@tcp(mysql.default.svc:3306)/" --parameters max_connections,version`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "mysql"},
+				URI:           uri,
+				Parameters:    parameters,
+			}
+
+			var (
+				client kubernetes.Interface
+				cfg    *rest.Config
+			)
+			if skipVerify || caCert != "" || clientCert != "" || clientKey != "" || secretName != "" {
+				tls := &troubleshootv1beta2.TLSParams{
+					SkipVerify: skipVerify,
+					CACert:     caCert,
+					ClientCert: clientCert,
+					ClientKey:  clientKey,
+				}
+				if secretName != "" {
+					tls.Secret = &troubleshootv1beta2.TLSSecret{Name: secretName, Namespace: secretNamespace}
+					var err error
+					client, cfg, err = k8sClientForCollectors()
+					if err != nil {
+						return err
+					}
+				}
+				db.TLS = tls
+			}
+
+			c := &collect.CollectMysql{Collector: db, ClientConfig: cfg, Client: client, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&uri, "uri", "", "MySQL connection DSN, e.g. user:pass@tcp(host:3306)/db (required)")
+	cmd.MarkFlagRequired("uri")
+	f.StringSliceVar(&parameters, "parameters", nil, "server variables to collect via SHOW VARIABLES (comma-separated or repeatable)")
+	f.BoolVar(&skipVerify, "tls-skip-verify", false, "skip TLS certificate verification")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate (PEM contents or a file path)")
+	f.StringVar(&clientCert, "tls-client-cert", "", "client certificate (PEM contents or a file path)")
+	f.StringVar(&clientKey, "tls-client-key", "", "client key (PEM contents or a file path)")
+	f.StringVar(&secretName, "tls-secret-name", "", "name of a Secret holding TLS material (requires cluster access)")
+	f.StringVar(&secretNamespace, "tls-secret-namespace", "default", "namespace of the TLS Secret")
+
+	return cmd
+}

cmd/collect/cli/postgres.go

@@ -0,0 +1,88 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// PostgresCmd runs the postgres collector against a single database and prints
+// the native result JSON ({"isConnected":..,"version":..,"error":..}).
+func PostgresCmd() *cobra.Command {
+	var (
+		uri             string
+		skipVerify      bool
+		caCert          string
+		clientCert      string
+		clientKey       string
+		secretName      string
+		secretNamespace string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "postgres",
+		Short: "Run the postgres collector against a database",
+		Long: `Run the postgres collector: connect to a PostgreSQL server, run "select version()",
+and print the collector result as JSON.
+
+--uri is a libpq/pgx connection URI:
+  postgres://user:password@host:5432/dbname?sslmode=disable
+
+TLS material may be provided inline / by file path (--tls-cacert, --tls-client-cert,
+--tls-client-key) or sourced from a Secret (--tls-secret-name), which requires
+cluster access.
+
+Example:
+  collect postgres --uri "postgres://user:pass@pg.default.svc:5432/app?sslmode=disable"`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "postgres"},
+				URI:           uri,
+			}
+
+			var (
+				client kubernetes.Interface
+				cfg    *rest.Config
+			)
+			if skipVerify || caCert != "" || clientCert != "" || clientKey != "" || secretName != "" {
+				tls := &troubleshootv1beta2.TLSParams{
+					SkipVerify: skipVerify,
+					CACert:     caCert,
+					ClientCert: clientCert,
+					ClientKey:  clientKey,
+				}
+				if secretName != "" {
+					tls.Secret = &troubleshootv1beta2.TLSSecret{Name: secretName, Namespace: secretNamespace}
+					var err error
+					client, cfg, err = k8sClientForCollectors()
+					if err != nil {
+						return err
+					}
+				}
+				db.TLS = tls
+			}
+
+			c := &collect.CollectPostgres{Collector: db, ClientConfig: cfg, Client: client, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&uri, "uri", "", "PostgreSQL connection URI (required)")
+	cmd.MarkFlagRequired("uri")
+	f.BoolVar(&skipVerify, "tls-skip-verify", false, "skip TLS certificate verification")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate (PEM contents or a file path)")
+	f.StringVar(&clientCert, "tls-client-cert", "", "client certificate (PEM contents or a file path)")
+	f.StringVar(&clientKey, "tls-client-key", "", "client key (PEM contents or a file path)")
+	f.StringVar(&secretName, "tls-secret-name", "", "name of a Secret holding TLS material (requires cluster access)")
+	f.StringVar(&secretNamespace, "tls-secret-namespace", "default", "namespace of the TLS Secret")
+
+	return cmd
+}

cmd/collect/cli/redis.go

@@ -0,0 +1,89 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// RedisCmd runs the redis collector against a single instance and prints the
+// native result JSON ({"isConnected":..,"version":..,"error":..}).
+func RedisCmd() *cobra.Command {
+	var (
+		uri             string
+		skipVerify      bool
+		caCert          string
+		clientCert      string
+		clientKey       string
+		secretName      string
+		secretNamespace string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "redis",
+		Short: "Run the redis collector against an instance",
+		Long: `Run the redis collector: connect to a Redis server, read "INFO server" (server
+version), and print the collector result as JSON.
+
+--uri is a go-redis connection URL:
+  redis://host:6379            (plaintext)
+  rediss://user:pass@host:6379 (TLS)
+
+TLS material may be provided inline / by file path (--tls-cacert, --tls-client-cert,
+--tls-client-key) or sourced from a Secret (--tls-secret-name), which requires
+cluster access.
+
+Example:
+  collect redis --uri "redis://redis.default.svc:6379"`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "redis"},
+				URI:           uri,
+			}
+
+			var (
+				client kubernetes.Interface
+				cfg    *rest.Config
+			)
+			if skipVerify || caCert != "" || clientCert != "" || clientKey != "" || secretName != "" {
+				tls := &troubleshootv1beta2.TLSParams{
+					SkipVerify: skipVerify,
+					CACert:     caCert,
+					ClientCert: clientCert,
+					ClientKey:  clientKey,
+				}
+				if secretName != "" {
+					tls.Secret = &troubleshootv1beta2.TLSSecret{Name: secretName, Namespace: secretNamespace}
+					var err error
+					client, cfg, err = k8sClientForCollectors()
+					if err != nil {
+						return err
+					}
+				}
+				db.TLS = tls
+			}
+
+			c := &collect.CollectRedis{Collector: db, ClientConfig: cfg, Client: client, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&uri, "uri", "", "Redis connection URL, e.g. redis://host:6379 (required)")
+	cmd.MarkFlagRequired("uri")
+	f.BoolVar(&skipVerify, "tls-skip-verify", false, "skip TLS certificate verification")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate (PEM contents or a file path)")
+	f.StringVar(&clientCert, "tls-client-cert", "", "client certificate (PEM contents or a file path)")
+	f.StringVar(&clientKey, "tls-client-key", "", "client key (PEM contents or a file path)")
+	f.StringVar(&secretName, "tls-secret-name", "", "name of a Secret holding TLS material (requires cluster access)")
+	f.StringVar(&secretNamespace, "tls-secret-namespace", "default", "namespace of the TLS Secret")
+
+	return cmd
+}

cmd/collect/cli/root.go

@@ -0,0 +1,103 @@
+package cli
+
+import (
+	"os"
+	"strings"
+
+	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+)
+
+func RootCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:          "collect [url]",
+		Args:         cobra.MinimumNArgs(1),
+		Short:        "Run a collector",
+		Long:         `Run a collector and output the results.`,
+		SilenceUsage: true,
+		// PersistentPreRun/PersistentPostRun (rather than PreRun/PostRun) so this
+		// setup also runs for the per-collector subcommands, not just `collect [url]`.
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			v := viper.GetViper()
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+
+			if err := util.StartProfiling(); err != nil {
+				klog.Errorf("Failed to start profiling: %v", err)
+			}
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			if err := checkAndSetChroot(v.GetString("chroot")); err != nil {
+				return err
+			}
+
+			return runCollect(v, args[0])
+		},
+		PersistentPostRun: func(cmd *cobra.Command, args []string) {
+			if err := util.StopProfiling(); err != nil {
+				klog.Errorf("Failed to stop profiling: %v", err)
+			}
+		},
+	}
+
+	cobra.OnInitialize(initConfig)
+
+	cmd.AddCommand(util.VersionCmd())
+
+	// Per-collector subcommands: run a single collector and print its native
+	// result JSON. Each has its own flags and help. These let a collector run
+	// inside a Pod via the troubleshoot image (e.g. as a runPod collector), so
+	// the check executes from within the cluster rather than wherever the CLI runs.
+	cmd.AddCommand(HTTPCmd())
+	cmd.AddCommand(PostgresCmd())
+	cmd.AddCommand(MysqlCmd())
+	cmd.AddCommand(MssqlCmd())
+	cmd.AddCommand(RedisCmd())
+	cmd.AddCommand(ClickhouseCmd())
+
+	cmd.Flags().StringSlice("redactors", []string{}, "names of the additional redactors to use")
+	cmd.Flags().Bool("redact", true, "enable/disable default redactions")
+	cmd.Flags().String("format", "json", "output format, one of json or raw.")
+	cmd.Flags().String("collector-image", "", "the full name of the collector image to use")
+	cmd.Flags().String("collector-pull-policy", "", "the pull policy of the collector image")
+	cmd.Flags().String("selector", "", "selector (label query) to filter remote collection nodes on.")
+	cmd.Flags().Bool("collect-without-permissions", false, "always generate a support bundle, even if it some require additional permissions")
+	cmd.PersistentFlags().Bool("debug", false, "enable debug logging")
+	cmd.Flags().String("chroot", "", "Chroot to path")
+
+	// hidden in favor of the `insecure-skip-tls-verify` flag
+	cmd.Flags().Bool("allow-insecure-connections", false, "when set, do not verify TLS certs when retrieving spec and reporting results")
+	cmd.Flags().MarkHidden("allow-insecure-connections")
+
+	viper.BindPFlags(cmd.Flags())
+
+	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+
+	k8sutil.AddFlags(cmd.PersistentFlags())
+
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
+	// CPU and memory profiling flags
+	util.AddProfilingFlags(cmd)
+
+	return cmd
+}
+
+func InitAndExecute() {
+	if err := RootCmd().Execute(); err != nil {
+		os.Exit(1)
+	}
+}
+
+func initConfig() {
+	viper.SetEnvPrefix("TROUBLESHOOT")
+	viper.AutomaticEnv()
+}

cmd/collect/cli/run.go

@@ -0,0 +1,189 @@
+package cli
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/internal/util"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/replicatedhq/troubleshoot/pkg/docrewrite"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/specs"
+	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
+	"github.com/spf13/viper"
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+const (
+	defaultTimeout = 30 * time.Second
+)
+
+func runCollect(v *viper.Viper, arg string) error {
+	go func() {
+		signalChan := make(chan os.Signal, 1)
+		signal.Notify(signalChan, os.Interrupt)
+		<-signalChan
+		os.Exit(0)
+	}()
+
+	var collectorContent []byte
+	var err error
+	if strings.HasPrefix(arg, "secret/") {
+		// format secret/namespace-name/secret-name
+		pathParts := strings.Split(arg, "/")
+		if len(pathParts) != 3 {
+			return errors.Errorf("path %s must have 3 components", arg)
+		}
+
+		spec, err := specs.LoadFromSecret(pathParts[1], pathParts[2], "collect-spec")
+		if err != nil {
+			return errors.Wrap(err, "failed to get spec from secret")
+		}
+
+		collectorContent = spec
+	} else if arg == "-" {
+		b, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = b
+	} else if _, err = os.Stat(arg); err == nil {
+		b, err := os.ReadFile(arg)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = b
+	} else {
+		if !util.IsURL(arg) {
+			return fmt.Errorf("%s is not a URL and was not found", arg)
+		}
+
+		req, err := http.NewRequest("GET", arg, nil)
+		if err != nil {
+			return err
+		}
+		req.Header.Set("User-Agent", "Replicated_Collect/v1beta2")
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = body
+	}
+
+	collectorContent, err = docrewrite.ConvertToV1Beta2(collectorContent)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert to v1beta2")
+	}
+
+	multidocs := strings.Split(string(collectorContent), "\n---\n")
+
+	decode := scheme.Codecs.UniversalDeserializer().Decode
+
+	redactors, err := supportbundle.GetRedactorsFromURIs(v.GetStringSlice("redactors"))
+	if err != nil {
+		return errors.Wrap(err, "failed to get redactors")
+	}
+
+	additionalRedactors := &troubleshootv1beta2.Redactor{
+		Spec: troubleshootv1beta2.RedactorSpec{
+			Redactors: redactors,
+		},
+	}
+
+	for i, additionalDoc := range multidocs {
+		if i == 0 {
+			continue
+		}
+		additionalDoc, err := docrewrite.ConvertToV1Beta2([]byte(additionalDoc))
+		if err != nil {
+			return errors.Wrap(err, "failed to convert to v1beta2")
+		}
+		obj, _, err := decode(additionalDoc, nil, nil)
+		if err != nil {
+			return errors.Wrapf(err, "failed to parse additional doc %d", i)
+		}
+		multidocRedactors, ok := obj.(*troubleshootv1beta2.Redactor)
+		if !ok {
+			continue
+		}
+		additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, multidocRedactors.Spec.Redactors...)
+	}
+
+	// make sure we don't block any senders
+	progressCh := make(chan interface{})
+	defer close(progressCh)
+	go func() {
+		for range progressCh {
+		}
+	}()
+
+	restConfig, err := k8sutil.GetRESTConfig()
+	if err != nil {
+		return errors.Wrap(err, "failed to convert kube flags to rest config")
+	}
+
+	labelSelector, err := labels.Parse(v.GetString("selector"))
+	if err != nil {
+		return errors.Wrap(err, "unable to parse selector")
+	}
+
+	namespace := v.GetString("namespace")
+	if namespace == "" {
+		namespace = "default"
+	}
+
+	timeout := v.GetDuration("request-timeout")
+	if timeout == 0 {
+		timeout = defaultTimeout
+	}
+
+	createOpts := collect.CollectorRunOpts{
+		CollectWithoutPermissions: v.GetBool("collect-without-permissions"),
+		KubernetesRestConfig:      restConfig,
+		Image:                     v.GetString("collector-image"),
+		PullPolicy:                v.GetString("collector-pullpolicy"),
+		LabelSelector:             labelSelector.String(),
+		Namespace:                 namespace,
+		Timeout:                   timeout,
+		ProgressChan:              progressCh,
+	}
+
+	// we only support HostCollector or RemoteCollector kinds.
+	hostCollector, err := collect.ParseHostCollectorFromDoc([]byte(multidocs[0]))
+	if err == nil {
+		results, err := collect.CollectHost(hostCollector, additionalRedactors, createOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to collect from host")
+		}
+		return showHostStdoutResults(v.GetString("format"), hostCollector.Name, results)
+	}
+
+	remoteCollector, err := collect.ParseRemoteCollectorFromDoc([]byte(multidocs[0]))
+	if err == nil {
+		results, err := collect.CollectRemote(remoteCollector, additionalRedactors, createOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to collect from remote host(s)")
+		}
+		return showRemoteStdoutResults(v.GetString("format"), remoteCollector.Name, results)
+	}
+
+	return errors.New("failed to parse hostCollector or remoteCollector")
+}

cmd/collect/cli/stdout_results.go

@@ -0,0 +1,103 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+)
+
+const (
+	// FormatJSON is intended for CLI output.
+	FormatJSON = "json"
+
+	// FormatRaw is intended for consumption by a remote collector.  Output is a
+	// string of quoted JSON.
+	FormatRaw = "raw"
+)
+
+func showHostStdoutResults(format string, collectName string, results *collect.HostCollectResult) error {
+	switch format {
+	case FormatJSON:
+		return showHostStdoutResultsJSON(collectName, results.AllCollectedData)
+	case FormatRaw:
+		return showHostStdoutResultsRaw(collectName, results.AllCollectedData)
+	default:
+		return errors.Errorf("unknown output format: %q", format)
+	}
+}
+
+func showRemoteStdoutResults(format string, collectName string, results *collect.RemoteCollectResult) error {
+	switch format {
+	case FormatJSON:
+		return showRemoteStdoutResultsJSON(collectName, results.AllCollectedData)
+	case FormatRaw:
+		return errors.Errorf("raw format not supported for remote collectors")
+	default:
+		return errors.Errorf("unknown output format: %q", format)
+	}
+}
+
+func showHostStdoutResultsJSON(collectName string, results map[string][]byte) error {
+	output := make(map[string]interface{})
+	for file, collectorResult := range results {
+		var collectedItems map[string]interface{}
+		if err := json.Unmarshal([]byte(collectorResult), &collectedItems); err != nil {
+			return errors.Wrap(err, "failed to marshal collector results")
+		}
+		output[file] = collectedItems
+	}
+
+	formatted, err := json.MarshalIndent(output, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+
+	fmt.Print(string(formatted))
+	return nil
+}
+
+// showHostStdoutResultsRaw outputs the collector output as a string of quoted json.
+func showHostStdoutResultsRaw(collectName string, results map[string][]byte) error {
+	strData := map[string]string{}
+	for k, v := range results {
+		strData[k] = string(v)
+	}
+	formatted, err := json.MarshalIndent(strData, "", "    ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+	fmt.Print(string(formatted))
+	return nil
+}
+
+func showRemoteStdoutResultsJSON(collectName string, results map[string][]byte) error {
+	type CollectorResult map[string]interface{}
+	type NodeResult map[string]CollectorResult
+
+	var output = make(map[string]NodeResult)
+
+	for node, result := range results {
+		var nodeResult map[string]string
+		if err := json.Unmarshal(result, &nodeResult); err != nil {
+			return errors.Wrap(err, "failed to marshal node results")
+		}
+		nr := make(NodeResult)
+		for file, collectorResult := range nodeResult {
+			var collectedItems map[string]interface{}
+			if err := json.Unmarshal([]byte(collectorResult), &collectedItems); err != nil {
+				return errors.Wrap(err, "failed to marshal collector results")
+			}
+			nr[file] = collectedItems
+		}
+		output[node] = nr
+	}
+
+	formatted, err := json.MarshalIndent(output, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+	fmt.Print(string(formatted))
+	return nil
+}

cmd/collect/main.go

@@ -0,0 +1,10 @@
+package main
+
+import (
+	"github.com/replicatedhq/troubleshoot/cmd/collect/cli"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+)
+
+func main() {
+	cli.InitAndExecute()
+}

cmd/internal/util/profilers.go

@@ -0,0 +1,83 @@
+package util
+
+import (
+	"fmt"
+	"os"
+	"runtime"
+	"runtime/pprof"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+var (
+	cpuProfileFile *os.File
+)
+
+// StartProfiling starts profiling CPU and memory usage if either --cpuprofile or
+// --memprofile flags were set and bound to viper configurations respectively.
+func StartProfiling() error {
+	v := viper.GetViper()
+	if v.GetString("cpuprofile") != "" {
+		var err error
+		cpuProfileFile, err = os.Create(v.GetString("cpuprofile"))
+		if err != nil {
+			return fmt.Errorf("could not create CPU profile: %w", err)
+		}
+		if err := pprof.StartCPUProfile(cpuProfileFile); err != nil {
+			cpuProfileFile.Close()
+			cpuProfileFile = nil
+			return fmt.Errorf("could not start CPU profile: %w", err)
+		}
+	}
+	return nil
+}
+
+// StopProfiling stops profiling CPU and memory usage and writes the results to
+// the files specified by --cpuprofile and --memprofile flags respectively.
+func StopProfiling() error {
+	v := viper.GetViper()
+	errs := []string{}
+
+	// Stop CPU profiling if it was started
+	if cpuProfileFile != nil {
+		pprof.StopCPUProfile()
+		err := cpuProfileFile.Close()
+		if err != nil {
+			errs = append(errs, err.Error())
+		}
+		cpuProfileFile = nil
+	}
+
+	if v.GetString("memprofile") != "" {
+		f, err := os.Create(v.GetString("memprofile"))
+		if err != nil {
+			errs = append(errs, err.Error())
+			goto BREAK_FROM_MEMPROFILE_IF
+		}
+		runtime.GC() // get up-to-date statistics
+		if err := pprof.WriteHeapProfile(f); err != nil {
+			errs = append(errs, err.Error())
+			goto BREAK_FROM_MEMPROFILE_IF
+		}
+		err = f.Close()
+		if err != nil {
+			errs = append(errs, err.Error())
+		}
+	}
+
+BREAK_FROM_MEMPROFILE_IF:
+	if len(errs) > 0 {
+		return fmt.Errorf("errors while stopping profiling: [%s]", strings.Join(errs, ", "))
+	}
+
+	return nil
+}
+
+// AddProfilingFlags adds the --cpuprofile and --memprofile flags to the given command.
+func AddProfilingFlags(cmd *cobra.Command) {
+	// Persistent flags to make available to subcommands
+	cmd.PersistentFlags().String("cpuprofile", "", "File path to write cpu profiling data")
+	cmd.PersistentFlags().String("memprofile", "", "File path to write memory profiling data")
+}

cmd/internal/util/version.go

@@ -1,11 +1,10 @@
-package cli
+package util
 
 import (
 	"fmt"
 
-	"github.com/spf13/cobra"
-
 	"github.com/replicatedhq/troubleshoot/pkg/version"
+	"github.com/spf13/cobra"
 )
 
 func VersionCmd() *cobra.Command {
@@ -14,7 +13,7 @@ func VersionCmd() *cobra.Command {
 		Short: "Print the current version and exit",
 		Long:  `Print the current version and exit`,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			fmt.Printf("Replicated Preflight %s\n", version.Version())
+			fmt.Printf("Replicated Troubleshoot %s\n", version.Version())
 
 			return nil
 		},

cmd/preflight/cli/convert.go

@@ -0,0 +1,132 @@
+package cli
+
+import (
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/convert"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func ConvertCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "convert [input-file]",
+		Args:  cobra.ExactArgs(1),
+		Short: "Convert v1beta2 preflight specs to v1beta3 format",
+		Long: `Convert v1beta2 preflight specs to v1beta3 format with templating and values.
+
+This command converts a v1beta2 preflight spec to the new v1beta3 templated format. It will:
+- Update the apiVersion to troubleshoot.sh/v1beta3
+- Extract hardcoded values and create a values.yaml file
+- Add conditional templating ({{- if .Values.feature.enabled }})
+- Add placeholder docString comments for you to fill in
+- Template hardcoded values with {{ .Values.* }} expressions
+
+The conversion will create two files:
+- [input-file]-v1beta3.yaml: The templated v1beta3 spec
+- [input-file]-values.yaml: The values file with extracted configuration
+
+Example:
+  preflight convert my-preflight.yaml
+
+This creates:
+  my-preflight-v1beta3.yaml
+  my-preflight-values.yaml`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			inputFile := args[0]
+			outputSpec := v.GetString("output-spec")
+			outputValues := v.GetString("output-values")
+
+			// Generate default output filenames if not specified
+			if outputSpec == "" {
+				ext := filepath.Ext(inputFile)
+				base := strings.TrimSuffix(inputFile, ext)
+				outputSpec = base + "-v1beta3" + ext
+			}
+
+			if outputValues == "" {
+				ext := filepath.Ext(inputFile)
+				base := strings.TrimSuffix(inputFile, ext)
+				outputValues = base + "-values" + ext
+			}
+
+			return runConvert(v, inputFile, outputSpec, outputValues)
+		},
+	}
+
+	cmd.Flags().String("output-spec", "", "Output file for the templated v1beta3 spec (default: [input]-v1beta3.yaml)")
+	cmd.Flags().String("output-values", "", "Output file for the values (default: [input]-values.yaml)")
+	cmd.Flags().Bool("dry-run", false, "Preview the conversion without writing files")
+
+	return cmd
+}
+
+func runConvert(v *viper.Viper, inputFile, outputSpec, outputValues string) error {
+	// Read input file
+	inputData, err := ioutil.ReadFile(inputFile)
+	if err != nil {
+		return errors.Wrapf(err, "failed to read input file %s", inputFile)
+	}
+
+	// Check if it's a valid v1beta2 preflight spec
+	if !strings.Contains(string(inputData), "troubleshoot.sh/v1beta2") {
+		return fmt.Errorf("input file does not appear to be a v1beta2 troubleshoot spec")
+	}
+
+	if !strings.Contains(string(inputData), "kind: Preflight") {
+		return fmt.Errorf("input file does not appear to be a Preflight spec")
+	}
+
+	// Convert to v1beta3
+	result, err := convert.ConvertToV1Beta3(inputData)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert spec")
+	}
+
+	dryRun := v.GetBool("dry-run")
+
+	if dryRun {
+		fmt.Println("=== Templated v1beta3 Spec ===")
+		fmt.Println(result.TemplatedSpec)
+		fmt.Println("\n=== Values File ===")
+		fmt.Println(result.ValuesFile)
+		fmt.Println("\n=== Conversion Summary ===")
+		fmt.Printf("Would write templated spec to: %s\n", outputSpec)
+		fmt.Printf("Would write values to: %s\n", outputValues)
+		return nil
+	}
+
+	// Write templated spec
+	err = ioutil.WriteFile(outputSpec, []byte(result.TemplatedSpec), 0644)
+	if err != nil {
+		return errors.Wrapf(err, "failed to write templated spec to %s", outputSpec)
+	}
+
+	// Write values file
+	err = ioutil.WriteFile(outputValues, []byte(result.ValuesFile), 0644)
+	if err != nil {
+		return errors.Wrapf(err, "failed to write values to %s", outputValues)
+	}
+
+	fmt.Printf("Successfully converted %s to v1beta3 format:\n", inputFile)
+	fmt.Printf("  Templated spec: %s\n", outputSpec)
+	fmt.Printf("  Values file: %s\n", outputValues)
+	fmt.Println("\nNext steps:")
+	fmt.Println("1. Add docStrings with Title, Requirement, and rationale for each check")
+	fmt.Println("2. Customize the values in the values file")
+	fmt.Println("3. Test the conversion with:")
+	fmt.Printf("   preflight template %s --values %s\n", outputSpec, outputValues)
+	fmt.Println("4. Run the templated preflight:")
+	fmt.Printf("   preflight run %s --values %s\n", outputSpec, outputValues)
+
+	return nil
+}

cmd/preflight/cli/docs.go

@@ -0,0 +1,368 @@
+package cli
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+	"text/template"
+
+	"github.com/Masterminds/sprig/v3"
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"gopkg.in/yaml.v2"
+	"helm.sh/helm/v3/pkg/strvals"
+)
+
+func DocsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "docs [preflight-file...]",
+		Short: "Extract and display documentation from a preflight spec",
+		Long: `Extract all docString fields from enabled requirements in one or more preflight YAML files.
+This command processes templated preflight specs, evaluates conditionals, and outputs
+only the documentation for requirements that would be included based on the provided values.
+
+Examples:
+  # Extract docs with default values
+  preflight docs ml-platform-preflight.yaml
+
+  # Extract docs from multiple specs with values from files
+  preflight docs spec1.yaml spec2.yaml --values base-values.yaml --values prod-values.yaml
+
+  # Extract docs with inline values
+  preflight docs ml-platform-preflight.yaml --set jupyter.enabled=true --set monitoring.enabled=false
+
+  # Extract docs and save to file
+  preflight docs ml-platform-preflight.yaml --output requirements.md`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			templateFiles := args
+			valuesFiles := v.GetStringSlice("values")
+			outputFile := v.GetString("output")
+			setValues := v.GetStringSlice("set")
+
+			return extractDocs(templateFiles, valuesFiles, setValues, outputFile)
+		},
+	}
+
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line (can be used multiple times)")
+	cmd.Flags().StringP("output", "o", "", "Output file (default: stdout)")
+
+	// Bind flags to viper
+	viper.BindPFlag("values", cmd.Flags().Lookup("values"))
+	viper.BindPFlag("set", cmd.Flags().Lookup("set"))
+	viper.BindPFlag("output", cmd.Flags().Lookup("output"))
+
+	return cmd
+}
+
+// PreflightDoc supports both legacy (requirements) and beta3 (spec.analyzers)
+type PreflightDoc struct {
+	APIVersion string                 `yaml:"apiVersion"`
+	Kind       string                 `yaml:"kind"`
+	Metadata   map[string]interface{} `yaml:"metadata"`
+	Spec       struct {
+		Analyzers []map[string]interface{} `yaml:"analyzers"`
+	} `yaml:"spec"`
+	// Legacy (pre-beta3 drafts)
+	Requirements []Requirement `yaml:"requirements"`
+}
+
+type Requirement struct {
+	Name      string                   `yaml:"name"`
+	DocString string                   `yaml:"docString"`
+	Checks    []map[string]interface{} `yaml:"checks,omitempty"`
+}
+
+func extractDocs(templateFiles []string, valuesFiles []string, setValues []string, outputFile string) error {
+	// Prepare the values map (merge all files, then apply sets)
+	values := make(map[string]interface{})
+
+	for _, valuesFile := range valuesFiles {
+		fileValues, err := loadValuesFile(valuesFile)
+		if err != nil {
+			return errors.Wrapf(err, "failed to load values file %s", valuesFile)
+		}
+		values = preflight.MergeMaps(values, fileValues)
+	}
+
+	// Normalize maps for Helm set merging
+	values = normalizeStringMaps(values)
+
+	for _, setValue := range setValues {
+		if err := applySetValue(values, setValue); err != nil {
+			return errors.Wrapf(err, "failed to apply set value: %s", setValue)
+		}
+	}
+
+	var combinedDocs strings.Builder
+
+	for _, templateFile := range templateFiles {
+		templateContent, err := os.ReadFile(templateFile)
+		if err != nil {
+			return errors.Wrapf(err, "failed to read template file %s", templateFile)
+		}
+
+		useHelm := shouldUseHelmEngine(string(templateContent))
+		var rendered string
+		if useHelm {
+			// Seed default-false for referenced boolean values to avoid nil map errors
+			preflight.SeedDefaultBooleans(string(templateContent), values)
+			rendered, err = preflight.RenderWithHelmTemplate(string(templateContent), values)
+			if err != nil {
+				execValues := legacyContext(values)
+				rendered, err = renderTemplate(string(templateContent), execValues)
+				if err != nil {
+					return errors.Wrap(err, "failed to render template (helm fallback also failed)")
+				}
+			}
+		} else {
+			execValues := legacyContext(values)
+			rendered, err = renderTemplate(string(templateContent), execValues)
+			if err != nil {
+				return errors.Wrap(err, "failed to render template")
+			}
+		}
+
+		docs, err := extractDocStrings(rendered)
+		if err != nil {
+			return errors.Wrap(err, "failed to extract documentation")
+		}
+
+		if strings.TrimSpace(docs) != "" {
+			if combinedDocs.Len() > 0 {
+				combinedDocs.WriteString("\n\n")
+			}
+			combinedDocs.WriteString(docs)
+		}
+	}
+
+	if outputFile != "" {
+		if err := os.WriteFile(outputFile, []byte(combinedDocs.String()), 0644); err != nil {
+			return errors.Wrapf(err, "failed to write output file %s", outputFile)
+		}
+		fmt.Printf("Documentation extracted successfully to %s\n", outputFile)
+	} else {
+		fmt.Print(combinedDocs.String())
+	}
+
+	return nil
+}
+
+func shouldUseHelmEngine(content string) bool {
+	return strings.Contains(content, ".Values")
+}
+
+func legacyContext(values map[string]interface{}) map[string]interface{} {
+	ctx := make(map[string]interface{}, len(values)+1)
+	for k, v := range values {
+		ctx[k] = v
+	}
+	ctx["Values"] = values
+	return ctx
+}
+
+func normalizeStringMaps(v interface{}) map[string]interface{} {
+	// Avoid unsafe type assertion; normalizeMap may return non-map types.
+	if v == nil {
+		return map[string]interface{}{}
+	}
+	normalized := normalizeMap(v)
+	if m, ok := normalized.(map[string]interface{}); ok {
+		return m
+	}
+	return map[string]interface{}{}
+}
+
+func normalizeMap(v interface{}) interface{} {
+	switch t := v.(type) {
+	case map[string]interface{}:
+		m := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			m[k] = normalizeMap(val)
+		}
+		return m
+	case map[interface{}]interface{}:
+		m := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			key := fmt.Sprintf("%v", k)
+			m[key] = normalizeMap(val)
+		}
+		return m
+	case []interface{}:
+		a := make([]interface{}, len(t))
+		for i, val := range t {
+			a[i] = normalizeMap(val)
+		}
+		return a
+	default:
+		return v
+	}
+}
+
+func extractDocStrings(yamlContent string) (string, error) {
+	var preflightDoc PreflightDoc
+	if err := yaml.Unmarshal([]byte(yamlContent), &preflightDoc); err != nil {
+		return "", errors.Wrap(err, "failed to parse YAML")
+	}
+
+	var docs strings.Builder
+	first := true
+
+	// Prefer beta3 analyzers docStrings
+	if len(preflightDoc.Spec.Analyzers) > 0 {
+		for _, analyzer := range preflightDoc.Spec.Analyzers {
+			if raw, ok := analyzer["docString"]; ok {
+				text, _ := raw.(string)
+				text = strings.TrimSpace(text)
+				if text == "" {
+					continue
+				}
+				if !first {
+					docs.WriteString("\n\n")
+				}
+				first = false
+				writeMarkdownSection(&docs, text, "")
+			}
+		}
+		return docs.String(), nil
+	}
+
+	// Fallback: legacy requirements with docString
+	for _, req := range preflightDoc.Requirements {
+		if strings.TrimSpace(req.DocString) == "" {
+			continue
+		}
+		if !first {
+			docs.WriteString("\n\n")
+		}
+		first = false
+		writeMarkdownSection(&docs, req.DocString, req.Name)
+	}
+
+	return docs.String(), nil
+}
+
+// writeMarkdownSection prints a heading from Title: or name, then the rest
+func writeMarkdownSection(b *strings.Builder, docString string, fallbackName string) {
+	lines := strings.Split(docString, "\n")
+	title := strings.TrimSpace(fallbackName)
+	contentStart := 0
+	for i, line := range lines {
+		trim := strings.TrimSpace(line)
+		if strings.HasPrefix(trim, "Title:") {
+			parts := strings.SplitN(trim, ":", 2)
+			if len(parts) == 2 {
+				t := strings.TrimSpace(parts[1])
+				if t != "" {
+					title = t
+				}
+			}
+			contentStart = i + 1
+			break
+		}
+	}
+	if title != "" {
+		b.WriteString("### ")
+		b.WriteString(title)
+		b.WriteString("\n\n")
+	}
+	remaining := strings.Join(lines[contentStart:], "\n")
+	remaining = strings.TrimSpace(remaining)
+	if remaining != "" {
+		b.WriteString(remaining)
+		b.WriteString("\n")
+	}
+}
+
+// loadValuesFile loads values from a YAML file
+func loadValuesFile(filename string) (map[string]interface{}, error) {
+	data, err := os.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+
+	var values map[string]interface{}
+	if err := yaml.Unmarshal(data, &values); err != nil {
+		return nil, errors.Wrap(err, "failed to parse values file as YAML")
+	}
+
+	return values, nil
+}
+
+// applySetValue applies a single --set value to the values map (Helm semantics)
+func applySetValue(values map[string]interface{}, setValue string) error {
+	if idx := strings.Index(setValue, "="); idx > 0 {
+		key := setValue[:idx]
+		val := setValue[idx+1:]
+		if strings.HasPrefix(key, "Values.") {
+			key = strings.TrimPrefix(key, "Values.")
+			setValue = key + "=" + val
+		}
+	}
+	if err := strvals.ParseInto(setValue, values); err != nil {
+		return fmt.Errorf("parsing --set: %w", err)
+	}
+	return nil
+}
+
+// setNestedValue sets a value in a nested map structure
+func setNestedValue(m map[string]interface{}, keys []string, value interface{}) {
+	if len(keys) == 0 {
+		return
+	}
+	if len(keys) == 1 {
+		m[keys[0]] = value
+		return
+	}
+	if _, ok := m[keys[0]]; !ok {
+		m[keys[0]] = make(map[string]interface{})
+	}
+	if nextMap, ok := m[keys[0]].(map[string]interface{}); ok {
+		setNestedValue(nextMap, keys[1:], value)
+	} else {
+		m[keys[0]] = make(map[string]interface{})
+		setNestedValue(m[keys[0]].(map[string]interface{}), keys[1:], value)
+	}
+}
+
+func renderTemplate(templateContent string, values map[string]interface{}) (string, error) {
+	tmpl := template.New("preflight").Funcs(sprig.FuncMap())
+	tmpl, err := tmpl.Parse(templateContent)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to parse template")
+	}
+	var buf bytes.Buffer
+	if err := tmpl.Execute(&buf, values); err != nil {
+		return "", errors.Wrap(err, "failed to execute template")
+	}
+	result := cleanRenderedYAML(buf.String())
+	return result, nil
+}
+
+func cleanRenderedYAML(content string) string {
+	lines := strings.Split(content, "\n")
+	var cleaned []string
+	var lastWasEmpty bool
+	for _, line := range lines {
+		trimmed := strings.TrimRight(line, " \t")
+		if trimmed == "" {
+			if !lastWasEmpty {
+				cleaned = append(cleaned, "")
+				lastWasEmpty = true
+			}
+		} else {
+			cleaned = append(cleaned, trimmed)
+			lastWasEmpty = false
+		}
+	}
+	for len(cleaned) > 0 && cleaned[len(cleaned)-1] == "" {
+		cleaned = cleaned[:len(cleaned)-1]
+	}
+	return strings.Join(cleaned, "\n") + "\n"
+}

cmd/preflight/cli/lint.go

@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/lint"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func LintCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lint [spec-files...]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Lint v1beta2/v1beta3 preflight specs for syntax and structural errors",
+		Long: `Lint v1beta2/v1beta3 preflight specs for syntax and structural errors.
+
+This command validates v1beta2/v1beta3 preflight specs and checks for:
+- YAML syntax errors
+- Missing required fields (apiVersion, kind, metadata, spec)
+- Invalid template syntax ({{ .Values.* }})
+- Missing analyzers or collectors
+- Common structural issues
+- Missing docStrings (warning)
+
+Examples:
+  # Lint a single spec file
+  preflight lint my-preflight.yaml
+
+  # Lint multiple spec files
+  preflight lint spec1.yaml spec2.yaml spec3.yaml
+
+  # Lint with automatic fixes
+  preflight lint --fix my-preflight.yaml
+
+  # Lint and output as JSON for CI/CD integration
+  preflight lint --format json my-preflight.yaml
+
+Notes:
+- v1beta2 does not support templating; template syntax in v1beta2 files will be flagged as errors.
+- v1beta3 supports templating and is linted with template-awareness.
+
+Exit codes:
+  0 - No errors found
+  2 - Validation errors found`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			opts := lint.LintOptions{
+				FilePaths:   args,
+				Fix:         v.GetBool("fix"),
+				Format:      v.GetString("format"),
+				ValuesFiles: v.GetStringSlice("values"),
+				SetValues:   v.GetStringSlice("set"),
+			}
+
+			return runLint(opts)
+		},
+	}
+
+	cmd.Flags().Bool("fix", false, "Automatically fix issues where possible")
+	cmd.Flags().String("format", "text", "Output format: text or json")
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files with template values (required for v1beta3 specs)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values via command line (e.g., --set key=value)")
+
+	return cmd
+}
+
+func runLint(opts lint.LintOptions) error {
+	// Validate file paths exist
+	for _, filePath := range opts.FilePaths {
+		if _, err := os.Stat(filePath); err != nil {
+			return errors.Wrapf(err, "file not found: %s", filePath)
+		}
+	}
+
+	// Run linting
+	results, err := lint.LintFiles(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to lint files")
+	}
+
+	// Format and print results
+	output := lint.FormatResults(results, opts.Format)
+	fmt.Print(output)
+
+	// Return appropriate exit code
+	if lint.HasErrors(results) {
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES, nil)
+	}
+
+	return nil
+}

cmd/preflight/cli/oci_fetch.go

@@ -0,0 +1,40 @@
+package cli
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/oci"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func OciFetchCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "oci-fetch [URI]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Fetch a preflight from an OCI registry and print it to standard out",
+		PreRun: func(cmd *cobra.Command, args []string) {
+			v := viper.GetViper()
+			v.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uri := args[0]
+			data, err := oci.PullPreflightFromOCI(uri)
+			if err != nil {
+				return err
+			}
+			fmt.Println(string(data))
+			return nil
+		},
+	}
+
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
+	return cmd
+}

cmd/preflight/cli/root.go

@@ -1,12 +1,22 @@
 package cli
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"strings"
 
+	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
+	"github.com/replicatedhq/troubleshoot/internal/traces"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/replicatedhq/troubleshoot/pkg/updater"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
 func RootCmd() *cobra.Command {
@@ -15,38 +25,120 @@ func RootCmd() *cobra.Command {
 		Args:  cobra.MinimumNArgs(1),
 		Short: "Run and retrieve preflight checks in a cluster",
 		Long: `A preflight check is a set of validations that can and should be run to ensure
-that a cluster meets the requirements to run an application.`,
-		SilenceUsage: true,
+that a cluster meets the requirements to run an application.
+
+Unlike support-bundle, preflight does not support --load-cluster-specs because
+preflight checks are designed to run before an application is installed or
+upgraded. Since no deployment has occurred yet, there are no in-cluster specs
+to discover. Preflight specs must be provided via a URL, local file path, or
+stdin (e.g. "helm template ... | kubectl preflight -").`,
+		SilenceUsage:  true,
+		SilenceErrors: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+			v := viper.GetViper()
+			v.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+
+			if err := util.StartProfiling(); err != nil {
+				klog.Errorf("Failed to start profiling: %v", err)
+			}
+
+			// Auto-update preflight unless disabled by flag or env
+			envAuto := os.Getenv("PREFLIGHT_AUTO_UPDATE")
+			autoFromEnv := true
+			if envAuto != "" {
+				if strings.EqualFold(envAuto, "0") || strings.EqualFold(envAuto, "false") {
+					autoFromEnv = false
+				}
+			}
+			if v.GetBool("auto-update") && autoFromEnv {
+				exe, err := os.Executable()
+				if err == nil {
+					_ = updater.CheckAndUpdate(cmd.Context(), updater.Options{
+						BinaryName:  "preflight",
+						CurrentPath: exe,
+						Printf:      func(f string, a ...interface{}) { fmt.Fprintf(os.Stderr, f, a...) },
+					})
+				}
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
-			return runPreflights(v, args[0])
+			closer, err := traces.ConfigureTracing("preflight")
+			if err != nil {
+				// Do not fail running preflights if tracing fails
+				klog.Errorf("Failed to initialize open tracing provider: %v", err)
+			} else {
+				defer closer()
+			}
+
+			err = preflight.RunPreflights(v.GetBool("interactive"), v.GetString("output"), v.GetString("format"), args)
+			if !v.GetBool("dry-run") && (v.GetBool("debug") || v.IsSet("v")) {
+				fmt.Fprintf(os.Stderr, "\n%s", traces.GetExporterInstance().GetSummary())
+			}
+
+			return err
+		},
+		PostRun: func(cmd *cobra.Command, args []string) {
+			if err := util.StopProfiling(); err != nil {
+				klog.Errorf("Failed to stop profiling: %v", err)
+			}
 		},
 	}
 
 	cobra.OnInitialize(initConfig)
 
-	cmd.AddCommand(VersionCmd())
+	cmd.AddCommand(util.VersionCmd())
+	cmd.AddCommand(OciFetchCmd())
+	cmd.AddCommand(TemplateCmd())
+	cmd.AddCommand(DocsCmd())
+	cmd.AddCommand(ConvertCmd())
+	cmd.AddCommand(LintCmd())
 
-	cmd.Flags().Bool("interactive", true, "interactive preflights")
-	cmd.Flags().String("format", "human", "output format, one of human, json, yaml. only used when interactive is set to false")
-	cmd.Flags().String("collector-image", "", "the full name of the collector image to use")
-	cmd.Flags().String("collector-pullpolicy", "", "the pull policy of the collector image")
-	cmd.Flags().Bool("collect-without-permissions", false, "always run preflight checks even if some require permissions that preflight does not have")
-	cmd.Flags().String("since-time", "", "force pod logs collectors to return logs after a specific date (RFC3339)")
-	cmd.Flags().String("since", "", "force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.")
+	preflight.AddFlags(cmd.PersistentFlags())
 
-	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+	// Dry run flag should be in cmd.PersistentFlags() flags made available to all subcommands
+	// Adding here to avoid that
+	cmd.Flags().Bool("dry-run", false, "print the preflight spec without running preflight checks")
+	cmd.Flags().Bool("no-uri", false, "When this flag is used, Preflight does not attempt to retrieve the spec referenced by the uri: field`")
+	cmd.Flags().Bool("auto-update", true, "enable automatic binary self-update check and install")
+
+	// Template values for v1beta3 specs
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values for v1beta3 specs (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line for v1beta3 specs (can be used multiple times)")
 
 	k8sutil.AddFlags(cmd.Flags())
 
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
+	// CPU and memory profiling flags
+	util.AddProfilingFlags(cmd)
+
 	return cmd
 }
 
 func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
+	cmd := RootCmd()
+	err := cmd.Execute()
+
+	if err != nil {
+		var exitErr types.ExitError
+		if errors.As(err, &exitErr) {
+			// We need to do this, there's situations where we need the non-zero exit code (which comes as part of the custom error struct)
+			// but there's no actual error, just an exit code.
+			// If there's also an error to output (eg. invalid format etc) then print it as well
+			if exitErr.ExitStatus() != constants.EXIT_CODE_FAIL && exitErr.ExitStatus() != constants.EXIT_CODE_WARN {
+				cmd.PrintErrln("Error:", err.Error())
+			}
+
+			os.Exit(exitErr.ExitStatus())
+		}
+
+		// Fallback, should almost never be used (the above Exit() should handle almost all situations
+		cmd.PrintErrln("Error:", err.Error())
 		os.Exit(1)
 	}
 }

cmd/preflight/cli/run.go

@@ -1,270 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"os"
-	"strings"
-	"time"
-
-	cursor "github.com/ahmetalpbalkan/go-cursor"
-	"github.com/fatih/color"
-	"github.com/pkg/errors"
-	"github.com/replicatedhq/troubleshoot/cmd/util"
-	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
-	troubleshootclientsetscheme "github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
-	"github.com/replicatedhq/troubleshoot/pkg/docrewrite"
-	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
-	"github.com/replicatedhq/troubleshoot/pkg/preflight"
-	"github.com/replicatedhq/troubleshoot/pkg/specs"
-	"github.com/spf13/viper"
-	spin "github.com/tj/go-spin"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes/scheme"
-)
-
-func runPreflights(v *viper.Viper, arg string) error {
-	fmt.Print(cursor.Hide())
-	defer fmt.Print(cursor.Show())
-
-	var preflightContent []byte
-	var err error
-	if strings.HasPrefix(arg, "secret/") {
-		// format secret/namespace-name/secret-name
-		pathParts := strings.Split(arg, "/")
-		if len(pathParts) != 3 {
-			return errors.Errorf("path %s must have 3 components", arg)
-		}
-
-		spec, err := specs.LoadFromSecret(pathParts[1], pathParts[2], "preflight-spec")
-		if err != nil {
-			return errors.Wrap(err, "failed to get spec from secret")
-		}
-
-		preflightContent = spec
-	} else if _, err = os.Stat(arg); err == nil {
-		b, err := ioutil.ReadFile(arg)
-		if err != nil {
-			return err
-		}
-
-		preflightContent = b
-	} else {
-		if !util.IsURL(arg) {
-			return fmt.Errorf("%s is not a URL and was not found (err %s)", arg, err)
-		}
-
-		req, err := http.NewRequest("GET", arg, nil)
-		if err != nil {
-			return err
-		}
-		req.Header.Set("User-Agent", "Replicated_Preflight/v1beta2")
-		resp, err := http.DefaultClient.Do(req)
-		if err != nil {
-			return err
-		}
-		defer resp.Body.Close()
-
-		body, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return err
-		}
-
-		preflightContent = body
-	}
-
-	preflightContent, err = docrewrite.ConvertToV1Beta2(preflightContent)
-	if err != nil {
-		return errors.Wrap(err, "failed to convert to v1beta2")
-	}
-
-	troubleshootclientsetscheme.AddToScheme(scheme.Scheme)
-	decode := scheme.Codecs.UniversalDeserializer().Decode
-	obj, _, err := decode([]byte(preflightContent), nil, nil)
-	if err != nil {
-		return errors.Wrapf(err, "failed to parse %s", arg)
-	}
-
-	var collectResults preflight.CollectResult
-	preflightSpecName := ""
-	finishedCh := make(chan bool, 1)
-	progressCh := make(chan interface{}, 0) // non-zero buffer will result in missed messages
-
-	if v.GetBool("interactive") {
-		s := spin.New()
-		go func() {
-			lastMsg := ""
-			for {
-				select {
-				case msg, ok := <-progressCh:
-					if !ok {
-						continue
-					}
-					switch msg := msg.(type) {
-					case error:
-						c := color.New(color.FgHiRed)
-						c.Println(fmt.Sprintf("%s\r * %v", cursor.ClearEntireLine(), msg))
-					case string:
-						if lastMsg == msg {
-							break
-						}
-						lastMsg = msg
-						c := color.New(color.FgCyan)
-						c.Println(fmt.Sprintf("%s\r * %s", cursor.ClearEntireLine(), msg))
-					}
-				case <-time.After(time.Millisecond * 100):
-					fmt.Printf("\r  \033[36mRunning Preflight checks\033[m %s ", s.Next())
-				case <-finishedCh:
-					fmt.Printf("\r%s\r", cursor.ClearEntireLine())
-					return
-				}
-			}
-		}()
-	} else {
-		// make sure we don't block any senders
-		go func() {
-			for {
-				select {
-				case _, ok := <-progressCh:
-					if !ok {
-						return
-					}
-				case <-finishedCh:
-					return
-				}
-			}
-		}()
-	}
-
-	defer func() {
-		close(finishedCh)
-		close(progressCh)
-	}()
-
-	if preflightSpec, ok := obj.(*troubleshootv1beta2.Preflight); ok {
-		r, err := collectInCluster(preflightSpec, finishedCh, progressCh)
-		if err != nil {
-			return errors.Wrap(err, "failed to collect in cluster")
-		}
-		collectResults = *r
-		preflightSpecName = preflightSpec.Name
-	} else if hostPreflightSpec, ok := obj.(*troubleshootv1beta2.HostPreflight); ok {
-		r, err := collectHost(hostPreflightSpec, finishedCh, progressCh)
-		if err != nil {
-			return errors.Wrap(err, "failed to collect from host")
-		}
-		collectResults = *r
-		preflightSpecName = hostPreflightSpec.Name
-	}
-
-	if collectResults == nil {
-		return errors.New("no results")
-	}
-
-	analyzeResults := collectResults.Analyze()
-
-	if preflightSpec, ok := obj.(*troubleshootv1beta2.Preflight); ok {
-		if preflightSpec.Spec.UploadResultsTo != "" {
-			err := uploadResults(preflightSpec.Spec.UploadResultsTo, analyzeResults)
-			if err != nil {
-				progressCh <- err
-			}
-		}
-	}
-
-	finishedCh <- true
-
-	if v.GetBool("interactive") {
-		if len(analyzeResults) == 0 {
-			return errors.New("no data has been collected")
-		}
-		return showInteractiveResults(preflightSpecName, analyzeResults)
-	}
-
-	return showStdoutResults(v.GetString("format"), preflightSpecName, analyzeResults)
-}
-
-func collectInCluster(preflightSpec *troubleshootv1beta2.Preflight, finishedCh chan bool, progressCh chan interface{}) (*preflight.CollectResult, error) {
-	v := viper.GetViper()
-
-	restConfig, err := k8sutil.GetRESTConfig()
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to convert kube flags to rest config")
-	}
-
-	collectOpts := preflight.CollectOpts{
-		Namespace:              v.GetString("namespace"),
-		IgnorePermissionErrors: v.GetBool("collect-without-permissions"),
-		ProgressChan:           progressCh,
-		KubernetesRestConfig:   restConfig,
-	}
-
-	if v.GetString("since") != "" || v.GetString("since-time") != "" {
-		err := parseTimeFlags(v, progressCh, preflightSpec.Spec.Collectors)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	collectResults, err := preflight.Collect(collectOpts, preflightSpec)
-	if err != nil {
-		if !collectResults.IsRBACAllowed() {
-			if preflightSpec.Spec.UploadResultsTo != "" {
-				clusterCollectResults := collectResults.(preflight.ClusterCollectResult)
-				err := uploadErrors(preflightSpec.Spec.UploadResultsTo, clusterCollectResults.Collectors)
-				if err != nil {
-					progressCh <- err
-				}
-			}
-		}
-		return nil, err
-	}
-
-	return &collectResults, nil
-}
-
-func collectHost(hostPreflightSpec *troubleshootv1beta2.HostPreflight, finishedCh chan bool, progressCh chan interface{}) (*preflight.CollectResult, error) {
-	collectOpts := preflight.CollectOpts{
-		ProgressChan: progressCh,
-	}
-
-	collectResults, err := preflight.CollectHost(collectOpts, hostPreflightSpec)
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to collect from host")
-	}
-
-	return &collectResults, nil
-}
-
-func parseTimeFlags(v *viper.Viper, progressChan chan interface{}, collectors []*troubleshootv1beta2.Collect) error {
-	var (
-		sinceTime time.Time
-		err       error
-	)
-	if v.GetString("since-time") != "" {
-		if v.GetString("since") != "" {
-			return errors.Errorf("at most one of `sinceTime` or `since` may be specified")
-		}
-		sinceTime, err = time.Parse(time.RFC3339, v.GetString("since-time"))
-		if err != nil {
-			return errors.Wrap(err, "unable to parse --since-time flag")
-		}
-	} else {
-		parsedDuration, err := time.ParseDuration(v.GetString("since"))
-		if err != nil {
-			return errors.Wrap(err, "unable to parse --since flag")
-		}
-		now := time.Now()
-		sinceTime = now.Add(0 - parsedDuration)
-	}
-	for _, collector := range collectors {
-		if collector.Logs != nil {
-			if collector.Logs.Limits == nil {
-				collector.Logs.Limits = new(troubleshootv1beta2.LogLimits)
-			}
-			collector.Logs.Limits.SinceTime = metav1.NewTime(sinceTime)
-		}
-	}
-	return nil
-}

cmd/preflight/cli/stdout_results.go

@@ -1,97 +0,0 @@
-package cli
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/pkg/errors"
-	analyzerunner "github.com/replicatedhq/troubleshoot/pkg/analyze"
-)
-
-func showStdoutResults(format string, preflightName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
-	if format == "human" {
-		return showStdoutResultsHuman(preflightName, analyzeResults)
-	} else if format == "json" {
-		return showStdoutResultsJSON(preflightName, analyzeResults)
-	}
-
-	return errors.Errorf("unknown output format: %q", format)
-}
-
-func showStdoutResultsHuman(preflightName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
-	fmt.Println("")
-	var failed bool
-	for _, analyzeResult := range analyzeResults {
-		testResultfailed := outputResult(analyzeResult)
-		if testResultfailed {
-			failed = true
-		}
-	}
-	if failed {
-		fmt.Printf("--- FAIL   %s\n", preflightName)
-		fmt.Println("FAILED")
-	} else {
-		fmt.Printf("--- PASS   %s\n", preflightName)
-		fmt.Println("PASS")
-	}
-	return nil
-}
-
-func showStdoutResultsJSON(preflightName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
-	type ResultOutput struct {
-		Title   string `json:"title"`
-		Message string `json:"message"`
-		URI     string `json:"uri,omitempty"`
-	}
-	type Output struct {
-		Pass []ResultOutput `json:"pass,omitempty"`
-		Warn []ResultOutput `json:"warn,omitempty"`
-		Fail []ResultOutput `json:"fail,omitempty"`
-	}
-
-	output := Output{
-		Pass: []ResultOutput{},
-		Warn: []ResultOutput{},
-		Fail: []ResultOutput{},
-	}
-
-	for _, analyzeResult := range analyzeResults {
-		resultOutput := ResultOutput{
-			Title:   analyzeResult.Title,
-			Message: analyzeResult.Message,
-			URI:     analyzeResult.URI,
-		}
-
-		if analyzeResult.IsPass {
-			output.Pass = append(output.Pass, resultOutput)
-		} else if analyzeResult.IsWarn {
-			output.Warn = append(output.Warn, resultOutput)
-		} else if analyzeResult.IsFail {
-			output.Fail = append(output.Fail, resultOutput)
-		}
-	}
-
-	b, err := json.MarshalIndent(output, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "failed to marshal results")
-	}
-
-	fmt.Printf("%s\n", b)
-
-	return nil
-}
-
-func outputResult(analyzeResult *analyzerunner.AnalyzeResult) bool {
-	if analyzeResult.IsPass {
-		fmt.Printf("   --- PASS %s\n", analyzeResult.Title)
-		fmt.Printf("      --- %s\n", analyzeResult.Message)
-	} else if analyzeResult.IsWarn {
-		fmt.Printf("   --- WARN: %s\n", analyzeResult.Title)
-		fmt.Printf("      --- %s\n", analyzeResult.Message)
-	} else if analyzeResult.IsFail {
-		fmt.Printf("   --- FAIL: %s\n", analyzeResult.Title)
-		fmt.Printf("      --- %s\n", analyzeResult.Message)
-		return true
-	}
-	return false
-}

cmd/preflight/cli/template.go

@@ -0,0 +1,42 @@
+package cli
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"github.com/spf13/cobra"
+)
+
+func TemplateCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "template [template-file]",
+		Short: "Render a templated preflight spec with values",
+		Long: `Process a templated preflight YAML file, substituting variables and removing conditional sections based on provided values.
+
+Examples:
+  # Render template with default values
+  preflight template sample-preflight-templated.yaml
+
+  # Render template with values from files
+  preflight template sample-preflight-templated.yaml --values values-base.yaml --values values-prod.yaml
+
+  # Render template with inline values
+  preflight template sample-preflight-templated.yaml --set postgres.enabled=true --set cluster.minNodes=5
+
+  # Render template and save to file
+  preflight template sample-preflight-templated.yaml --output rendered.yaml`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			templateFile := args[0]
+			valuesFiles, _ := cmd.Flags().GetStringSlice("values")
+			outputFile, _ := cmd.Flags().GetString("output")
+			setValues, _ := cmd.Flags().GetStringSlice("set")
+
+			return preflight.RunTemplate(templateFile, valuesFiles, setValues, outputFile)
+		},
+	}
+
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line (can be used multiple times)")
+	cmd.Flags().StringP("output", "o", "", "Output file (default: stdout)")
+
+	return cmd
+}

cmd/schemagen/cli/root.go

@@ -1,165 +0,0 @@
-package cli
-
-import (
-	"encoding/json"
-	"io/ioutil"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-
-	"github.com/pkg/errors"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	extensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
-	extensionsscheme "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/scheme"
-	"k8s.io/client-go/kubernetes/scheme"
-)
-
-func RootCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:          "schemagen",
-		Short:        "Generate openapischemas for the kinds in this project",
-		SilenceUsage: true,
-		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			v := viper.GetViper()
-
-			return generateSchemas(v)
-		},
-	}
-
-	cobra.OnInitialize(initConfig)
-
-	cmd.Flags().String("output-dir", "./schemas", "directory to save the schemas in")
-
-	viper.BindPFlags(cmd.Flags())
-
-	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
-
-	return cmd
-}
-
-func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
-		os.Exit(1)
-	}
-}
-
-func initConfig() {
-	viper.SetEnvPrefix("TROUBLESHOOT")
-	viper.AutomaticEnv()
-}
-
-func generateSchemas(v *viper.Viper) error {
-	// we generate schemas from the config/crds in the root of this project
-	// those crds can be created from controller-gen or by running `make openapischema`
-
-	workdir, err := os.Getwd()
-	if err != nil {
-		return errors.Wrap(err, "failed to get workdir")
-	}
-
-	files := []struct {
-		inFilename  string
-		outFilename string
-	}{
-		{
-			"troubleshoot.replicated.com_preflights.yaml",
-			"preflight-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_analyzers.yaml",
-			"analyzer-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_collectors.yaml",
-			"collector-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_redactors.yaml",
-			"redactor-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_supportbundles.yaml",
-			"supportbundle-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.sh_analyzers.yaml",
-			"analyzer-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_collectors.yaml",
-			"collector-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_preflights.yaml",
-			"preflight-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_redactors.yaml",
-			"redactor-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_supportbundles.yaml",
-			"supportbundle-troubleshoot-v1beta2.json",
-		},
-	}
-
-	for _, file := range files {
-		contents, err := ioutil.ReadFile(filepath.Join(workdir, "config", "crds", file.inFilename))
-		if err != nil {
-			return errors.Wrapf(err, "failed to read crd from %s", file.inFilename)
-		}
-		if err := generateSchemaFromCRD(contents, filepath.Join(workdir, v.GetString("output-dir"), file.outFilename)); err != nil {
-			return errors.Wrapf(err, "failed to write crd schema to %s", file.outFilename)
-		}
-	}
-
-	return nil
-}
-
-func generateSchemaFromCRD(crd []byte, outfile string) error {
-	extensionsscheme.AddToScheme(scheme.Scheme)
-	decode := scheme.Codecs.UniversalDeserializer().Decode
-	obj, _, err := decode(crd, nil, nil)
-	if err != nil {
-		return errors.Wrap(err, "failed to decode crd")
-	}
-
-	customResourceDefinition := obj.(*extensionsv1beta1.CustomResourceDefinition)
-
-	b, err := json.MarshalIndent(customResourceDefinition.Spec.Validation.OpenAPIV3Schema, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "failed to marshal json")
-	}
-
-	_, err = os.Stat(outfile)
-	if err == nil {
-		if err := os.Remove(outfile); err != nil {
-			return errors.Wrap(err, "failed to remove file")
-		}
-	}
-
-	d, _ := path.Split(outfile)
-	_, err = os.Stat(d)
-	if os.IsNotExist(err) {
-		if err = os.MkdirAll(d, 0755); err != nil {
-			return errors.Wrap(err, "failed to mkdir")
-		}
-	}
-
-	// whoa now
-	// working around the fact that controller-gen doesn't have tags to generate oneOf schemas, so this is hacky.
-	// going to work to add an issue there to support and if they accept, this terrible thing can go away
-	boolStringed := strings.ReplaceAll(string(b), `"type": "BoolString"`, `"oneOf": [{"type": "string"},{"type": "boolean"}]`)
-
-	err = ioutil.WriteFile(outfile, []byte(boolStringed), 0644)
-	if err != nil {
-		return errors.Wrap(err, "failed to write file")
-	}
-
-	return nil
-}

cmd/schemagen/main.go

@@ -1,9 +0,0 @@
-package main
-
-import (
-	"github.com/replicatedhq/troubleshoot/cmd/schemagen/cli"
-)
-
-func main() {
-	cli.InitAndExecute()
-}

cmd/troubleshoot/cli/analyze.go

@@ -7,10 +7,9 @@ import (
 	"net/http"
 	"os"
 
-	"github.com/replicatedhq/troubleshoot/cmd/util"
+	"github.com/replicatedhq/troubleshoot/internal/util"
 	analyzer "github.com/replicatedhq/troubleshoot/pkg/analyze"
 	"github.com/replicatedhq/troubleshoot/pkg/convert"
-	"github.com/replicatedhq/troubleshoot/pkg/logger"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"gopkg.in/yaml.v2"
@@ -23,15 +22,11 @@ func Analyze() *cobra.Command {
 		Short: "analyze a support bundle",
 		Long:  `Analyze a support bundle using the Analyzer definitions provided`,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlag("bundle", cmd.Flags().Lookup("bundle"))
-			viper.BindPFlag("output", cmd.Flags().Lookup("output"))
-			viper.BindPFlag("quiet", cmd.Flags().Lookup("quiet"))
+			viper.BindPFlags(cmd.Flags())
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
-			logger.SetQuiet(v.GetBool("quiet"))
-
 			specPath := args[0]
 			analyzerSpec, err := downloadAnalyzerSpec(specPath)
 			if err != nil {
@@ -77,8 +72,6 @@ func Analyze() *cobra.Command {
 	cmd.Flags().MarkHidden("compatibility")
 	cmd.Flags().Bool("quiet", false, "enable/disable error messaging and only show parseable output")
 
-	viper.BindPFlags(cmd.Flags())
-
 	return cmd
 }
 
@@ -98,7 +91,7 @@ func downloadAnalyzerSpec(specPath string) (string, error) {
 		specContent = string(b)
 	} else {
 		if !util.IsURL(specPath) {
-			return "", fmt.Errorf("%s is not a URL and was not found (err %s)", specPath, err)
+			return "", fmt.Errorf("%s is not a URL and was not found", specPath)
 		}
 
 		req, err := http.NewRequest("GET", specPath, nil)

cmd/troubleshoot/cli/auto_discovery.go

@@ -0,0 +1,372 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/autodiscovery"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/images"
+	"github.com/spf13/viper"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/klog/v2"
+)
+
+// AutoDiscoveryConfig contains configuration for auto-discovery
+type AutoDiscoveryConfig struct {
+	Enabled                 bool
+	IncludeImages           bool
+	RBACCheck               bool
+	Profile                 string
+	ExcludeNamespaces       []string
+	IncludeNamespaces       []string
+	IncludeSystemNamespaces bool
+	Timeout                 time.Duration
+}
+
+// DiscoveryProfile defines different levels of auto-discovery
+type DiscoveryProfile struct {
+	Name          string
+	Description   string
+	IncludeImages bool
+	RBACCheck     bool
+	MaxDepth      int
+	Timeout       time.Duration
+}
+
+// GetAutoDiscoveryConfig extracts auto-discovery configuration from viper
+func GetAutoDiscoveryConfig(v *viper.Viper) AutoDiscoveryConfig {
+	return AutoDiscoveryConfig{
+		Enabled:                 v.GetBool("auto"),
+		IncludeImages:           v.GetBool("include-images"),
+		RBACCheck:               v.GetBool("rbac-check"),
+		Profile:                 v.GetString("discovery-profile"),
+		ExcludeNamespaces:       v.GetStringSlice("exclude-namespaces"),
+		IncludeNamespaces:       v.GetStringSlice("include-namespaces"),
+		IncludeSystemNamespaces: v.GetBool("include-system-namespaces"),
+		Timeout:                 30 * time.Second, // Default timeout
+	}
+}
+
+// GetDiscoveryProfiles returns available discovery profiles
+func GetDiscoveryProfiles() map[string]DiscoveryProfile {
+	return map[string]DiscoveryProfile{
+		"minimal": {
+			Name:          "minimal",
+			Description:   "Minimal collection: cluster info, basic logs",
+			IncludeImages: false,
+			RBACCheck:     true,
+			MaxDepth:      1,
+			Timeout:       15 * time.Second,
+		},
+		"standard": {
+			Name:          "standard",
+			Description:   "Standard collection: logs, configs, secrets, events",
+			IncludeImages: false,
+			RBACCheck:     true,
+			MaxDepth:      2,
+			Timeout:       30 * time.Second,
+		},
+		"comprehensive": {
+			Name:          "comprehensive",
+			Description:   "Comprehensive collection: everything + image metadata",
+			IncludeImages: true,
+			RBACCheck:     true,
+			MaxDepth:      3,
+			Timeout:       60 * time.Second,
+		},
+		"paranoid": {
+			Name:          "paranoid",
+			Description:   "Paranoid collection: maximum data with extended timeouts",
+			IncludeImages: true,
+			RBACCheck:     true,
+			MaxDepth:      5,
+			Timeout:       120 * time.Second,
+		},
+	}
+}
+
+// ApplyAutoDiscovery applies auto-discovery to the support bundle spec
+func ApplyAutoDiscovery(ctx context.Context, client kubernetes.Interface, restConfig *rest.Config,
+	mainBundle *troubleshootv1beta2.SupportBundle, config AutoDiscoveryConfig, namespace string) error {
+
+	if !config.Enabled {
+		return nil // Auto-discovery not enabled
+	}
+
+	klog.V(2).Infof("Applying auto-discovery with profile: %s", config.Profile)
+
+	// Get discovery profile
+	profiles := GetDiscoveryProfiles()
+	profile, exists := profiles[config.Profile]
+	if !exists {
+		klog.Warningf("Unknown discovery profile '%s', using 'standard'", config.Profile)
+		profile = profiles["standard"]
+	}
+
+	// Override profile settings with explicit flags
+	if config.IncludeImages {
+		profile.IncludeImages = true
+	}
+	if config.Timeout > 0 {
+		profile.Timeout = config.Timeout
+	}
+
+	// Create auto-discovery options
+	discoveryOpts := autodiscovery.DiscoveryOptions{
+		IncludeImages: profile.IncludeImages,
+		RBACCheck:     config.RBACCheck,
+		MaxDepth:      profile.MaxDepth,
+		Timeout:       profile.Timeout,
+	}
+
+	// Handle namespace filtering
+	if namespace != "" {
+		discoveryOpts.Namespaces = []string{namespace}
+	} else {
+		// Use include/exclude patterns if specified
+		if len(config.IncludeNamespaces) > 0 || len(config.ExcludeNamespaces) > 0 {
+			// Create namespace scanner to resolve include/exclude patterns
+			nsScanner := autodiscovery.NewNamespaceScanner(client)
+			scanOpts := autodiscovery.ScanOptions{
+				IncludePatterns:         config.IncludeNamespaces,
+				ExcludePatterns:         config.ExcludeNamespaces,
+				IncludeSystemNamespaces: config.IncludeSystemNamespaces,
+			}
+
+			targetNamespaces, err := nsScanner.GetTargetNamespaces(ctx, nil, scanOpts)
+			if err != nil {
+				klog.Warningf("Failed to resolve namespace patterns, using all accessible namespaces: %v", err)
+				// Continue with empty namespace list (all namespaces)
+			} else {
+				discoveryOpts.Namespaces = targetNamespaces
+				klog.V(2).Infof("Resolved namespace patterns to %d namespaces: %v", len(targetNamespaces), targetNamespaces)
+			}
+		}
+	}
+
+	// Create autodiscovery instance
+	discoverer, err := autodiscovery.NewDiscoverer(restConfig, client)
+	if err != nil {
+		return errors.Wrap(err, "failed to create auto-discoverer")
+	}
+
+	// Check if we have existing YAML collectors (Path 2) or just auto-discovery (Path 1)
+	hasYAMLCollectors := len(mainBundle.Spec.Collectors) > 0
+
+	var autoCollectors []autodiscovery.CollectorSpec
+
+	if hasYAMLCollectors {
+		// Path 2: Augment existing YAML collectors with foundational collectors
+		klog.V(2).Info("Auto-discovery: Augmenting YAML collectors with foundational collectors (Path 2)")
+
+		// Convert existing collectors to autodiscovery format
+		yamlCollectors, err := convertToCollectorSpecs(mainBundle.Spec.Collectors)
+		if err != nil {
+			return errors.Wrap(err, "failed to convert YAML collectors")
+		}
+
+		discoveryOpts.AugmentMode = true
+		autoCollectors, err = discoverer.AugmentWithFoundational(ctx, yamlCollectors, discoveryOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to augment with foundational collectors")
+		}
+	} else {
+		// Path 1: Pure foundational discovery
+		klog.V(2).Info("Auto-discovery: Collecting foundational data only (Path 1)")
+
+		discoveryOpts.FoundationalOnly = true
+		autoCollectors, err = discoverer.DiscoverFoundational(ctx, discoveryOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to discover foundational collectors")
+		}
+	}
+
+	// Convert auto-discovered collectors back to troubleshoot specs
+	troubleshootCollectors, err := convertToTroubleshootCollectors(autoCollectors)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert auto-discovered collectors")
+	}
+
+	// Update the support bundle spec
+	if hasYAMLCollectors {
+		// Replace existing collectors with augmented set
+		mainBundle.Spec.Collectors = troubleshootCollectors
+	} else {
+		// Set foundational collectors
+		mainBundle.Spec.Collectors = troubleshootCollectors
+	}
+
+	klog.V(2).Infof("Auto-discovery complete: %d collectors configured", len(troubleshootCollectors))
+	return nil
+}
+
+// convertToCollectorSpecs converts troubleshootv1beta2.Collect to autodiscovery.CollectorSpec
+func convertToCollectorSpecs(collectors []*troubleshootv1beta2.Collect) ([]autodiscovery.CollectorSpec, error) {
+	var specs []autodiscovery.CollectorSpec
+
+	for i, collect := range collectors {
+		// Determine collector type and extract relevant information
+		spec := autodiscovery.CollectorSpec{
+			Priority: 100, // High priority for YAML specs
+			Source:   autodiscovery.SourceYAML,
+		}
+
+		// Map troubleshoot collectors to autodiscovery types
+		switch {
+		case collect.Logs != nil:
+			spec.Type = autodiscovery.CollectorTypeLogs
+			spec.Name = fmt.Sprintf("yaml-logs-%d", i)
+			spec.Namespace = collect.Logs.Namespace
+			spec.Spec = collect.Logs
+		case collect.ConfigMap != nil:
+			spec.Type = autodiscovery.CollectorTypeConfigMaps
+			spec.Name = fmt.Sprintf("yaml-configmap-%d", i)
+			spec.Namespace = collect.ConfigMap.Namespace
+			spec.Spec = collect.ConfigMap
+		case collect.Secret != nil:
+			spec.Type = autodiscovery.CollectorTypeSecrets
+			spec.Name = fmt.Sprintf("yaml-secret-%d", i)
+			spec.Namespace = collect.Secret.Namespace
+			spec.Spec = collect.Secret
+		case collect.ClusterInfo != nil:
+			spec.Type = autodiscovery.CollectorTypeClusterInfo
+			spec.Name = fmt.Sprintf("yaml-clusterinfo-%d", i)
+			spec.Spec = collect.ClusterInfo
+		case collect.ClusterResources != nil:
+			spec.Type = autodiscovery.CollectorTypeClusterResources
+			spec.Name = fmt.Sprintf("yaml-clusterresources-%d", i)
+			spec.Spec = collect.ClusterResources
+		default:
+			// For other collector types, create a generic spec
+			spec.Type = "other"
+			spec.Name = fmt.Sprintf("yaml-other-%d", i)
+			spec.Spec = collect
+		}
+
+		specs = append(specs, spec)
+	}
+
+	return specs, nil
+}
+
+// convertToTroubleshootCollectors converts autodiscovery.CollectorSpec to troubleshootv1beta2.Collect
+func convertToTroubleshootCollectors(collectors []autodiscovery.CollectorSpec) ([]*troubleshootv1beta2.Collect, error) {
+	var troubleshootCollectors []*troubleshootv1beta2.Collect
+
+	for _, spec := range collectors {
+		collect, err := spec.ToTroubleshootCollect()
+		if err != nil {
+			klog.Warningf("Failed to convert collector spec %s: %v", spec.Name, err)
+			continue
+		}
+		troubleshootCollectors = append(troubleshootCollectors, collect)
+	}
+
+	return troubleshootCollectors, nil
+}
+
+// ValidateAutoDiscoveryFlags validates auto-discovery flag combinations
+func ValidateAutoDiscoveryFlags(v *viper.Viper) error {
+	// If include-images is used without auto, it's an error
+	if v.GetBool("include-images") && !v.GetBool("auto") {
+		return errors.New("--include-images flag requires --auto flag to be enabled")
+	}
+
+	// Validate discovery profile
+	profile := v.GetString("discovery-profile")
+	profiles := GetDiscoveryProfiles()
+	if _, exists := profiles[profile]; !exists {
+		return fmt.Errorf("unknown discovery profile: %s. Available profiles: minimal, standard, comprehensive, paranoid", profile)
+	}
+
+	// Validate namespace patterns
+	includeNS := v.GetStringSlice("include-namespaces")
+	excludeNS := v.GetStringSlice("exclude-namespaces")
+
+	if len(includeNS) > 0 && len(excludeNS) > 0 {
+		klog.Warning("Both include-namespaces and exclude-namespaces specified. Include patterns take precedence")
+	}
+
+	return nil
+}
+
+// ShouldUseAutoDiscovery determines if auto-discovery should be used
+func ShouldUseAutoDiscovery(v *viper.Viper, args []string) bool {
+	// Auto-discovery is enabled by the --auto flag
+	autoEnabled := v.GetBool("auto")
+
+	if !autoEnabled {
+		return false
+	}
+
+	// Auto-discovery can be used with or without YAML specs
+	return true
+}
+
+// GetAutoDiscoveryMode returns the auto-discovery mode based on arguments
+func GetAutoDiscoveryMode(args []string, autoEnabled bool) string {
+	if !autoEnabled {
+		return "disabled"
+	}
+
+	if len(args) == 0 {
+		return "foundational-only" // Path 1
+	}
+
+	return "yaml-augmented" // Path 2
+}
+
+// CreateImageCollectionOptions creates image collection options from CLI config
+func CreateImageCollectionOptions(config AutoDiscoveryConfig) images.CollectionOptions {
+	options := images.GetDefaultCollectionOptions()
+
+	// Configure based on profile and flags
+	profiles := GetDiscoveryProfiles()
+	if profile, exists := profiles[config.Profile]; exists {
+		options.Timeout = profile.Timeout
+		options.IncludeConfig = profile.Name == "comprehensive" || profile.Name == "paranoid"
+		options.IncludeLayers = profile.Name == "paranoid"
+	}
+
+	// Override based on explicit flags
+	if config.Timeout > 0 {
+		options.Timeout = config.Timeout
+	}
+
+	// For auto-discovery, always continue on error to maximize collection
+	options.ContinueOnError = true
+	options.EnableCache = true
+
+	return options
+}
+
+// PrintAutoDiscoveryInfo prints information about auto-discovery configuration
+func PrintAutoDiscoveryInfo(config AutoDiscoveryConfig, mode string) {
+	if !config.Enabled {
+		return
+	}
+
+	fmt.Printf("Auto-discovery enabled (mode: %s, profile: %s)\n", mode, config.Profile)
+
+	if config.IncludeImages {
+		fmt.Println("  - Container image metadata collection enabled")
+	}
+
+	if len(config.IncludeNamespaces) > 0 {
+		fmt.Printf("  - Including namespaces: %v\n", config.IncludeNamespaces)
+	}
+
+	if len(config.ExcludeNamespaces) > 0 {
+		fmt.Printf("  - Excluding namespaces: %v\n", config.ExcludeNamespaces)
+	}
+
+	if config.IncludeSystemNamespaces {
+		fmt.Println("  - System namespaces included")
+	}
+
+	fmt.Printf("  - RBAC checking: %t\n", config.RBACCheck)
+}

cmd/troubleshoot/cli/auto_discovery_test.go

@@ -0,0 +1,389 @@
+package cli
+
+import (
+	"testing"
+	"time"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/autodiscovery"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/images"
+	"github.com/spf13/viper"
+)
+
+func TestGetAutoDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		viperSetup  func(*viper.Viper)
+		wantEnabled bool
+		wantImages  bool
+		wantRBAC    bool
+		wantProfile string
+	}{
+		{
+			name: "default config",
+			viperSetup: func(v *viper.Viper) {
+				// No flags set, should use defaults
+			},
+			wantEnabled: false,
+			wantImages:  false,
+			wantRBAC:    true, // Default is true
+			wantProfile: "standard",
+		},
+		{
+			name: "auto enabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    true,
+			wantProfile: "standard",
+		},
+		{
+			name: "auto with images",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-images", true)
+			},
+			wantEnabled: true,
+			wantImages:  true,
+			wantRBAC:    true,
+			wantProfile: "standard",
+		},
+		{
+			name: "comprehensive profile",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("discovery-profile", "comprehensive")
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    true,
+			wantProfile: "comprehensive",
+		},
+		{
+			name: "rbac disabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("rbac-check", false)
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    false,
+			wantProfile: "standard",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+
+			// Set defaults
+			v.SetDefault("rbac-check", true)
+			v.SetDefault("discovery-profile", "standard")
+
+			// Apply test-specific setup
+			tt.viperSetup(v)
+
+			config := GetAutoDiscoveryConfig(v)
+
+			if config.Enabled != tt.wantEnabled {
+				t.Errorf("GetAutoDiscoveryConfig() enabled = %v, want %v", config.Enabled, tt.wantEnabled)
+			}
+			if config.IncludeImages != tt.wantImages {
+				t.Errorf("GetAutoDiscoveryConfig() includeImages = %v, want %v", config.IncludeImages, tt.wantImages)
+			}
+			if config.RBACCheck != tt.wantRBAC {
+				t.Errorf("GetAutoDiscoveryConfig() rbacCheck = %v, want %v", config.RBACCheck, tt.wantRBAC)
+			}
+			if config.Profile != tt.wantProfile {
+				t.Errorf("GetAutoDiscoveryConfig() profile = %v, want %v", config.Profile, tt.wantProfile)
+			}
+		})
+	}
+}
+
+func TestGetDiscoveryProfiles(t *testing.T) {
+	profiles := GetDiscoveryProfiles()
+
+	requiredProfiles := []string{"minimal", "standard", "comprehensive", "paranoid"}
+	for _, profileName := range requiredProfiles {
+		if profile, exists := profiles[profileName]; !exists {
+			t.Errorf("Missing required discovery profile: %s", profileName)
+		} else {
+			if profile.Name != profileName {
+				t.Errorf("Profile %s has wrong name: %s", profileName, profile.Name)
+			}
+			if profile.Description == "" {
+				t.Errorf("Profile %s missing description", profileName)
+			}
+			if profile.Timeout <= 0 {
+				t.Errorf("Profile %s has invalid timeout: %v", profileName, profile.Timeout)
+			}
+		}
+	}
+
+	// Check profile progression (more features as we go up)
+	if profiles["comprehensive"].IncludeImages && !profiles["paranoid"].IncludeImages {
+		t.Error("Paranoid profile should include at least everything comprehensive does")
+	}
+}
+
+func TestValidateAutoDiscoveryFlags(t *testing.T) {
+	tests := []struct {
+		name       string
+		viperSetup func(*viper.Viper)
+		wantErr    bool
+	}{
+		{
+			name: "valid auto discovery",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-images", true)
+				v.Set("discovery-profile", "standard")
+			},
+			wantErr: false,
+		},
+		{
+			name: "include-images without auto",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+				v.Set("include-images", true)
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid discovery profile",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("discovery-profile", "invalid-profile")
+			},
+			wantErr: true,
+		},
+		{
+			name: "no auto discovery",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+			},
+			wantErr: false,
+		},
+		{
+			name: "both include and exclude namespaces",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-namespaces", []string{"app1"})
+				v.Set("exclude-namespaces", []string{"system"})
+			},
+			wantErr: false, // Should warn but not error
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+
+			// Set defaults
+			v.SetDefault("rbac-check", true)
+			v.SetDefault("discovery-profile", "standard")
+
+			// Apply test setup
+			tt.viperSetup(v)
+
+			err := ValidateAutoDiscoveryFlags(v)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ValidateAutoDiscoveryFlags() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestShouldUseAutoDiscovery(t *testing.T) {
+	tests := []struct {
+		name       string
+		viperSetup func(*viper.Viper)
+		args       []string
+		want       bool
+	}{
+		{
+			name: "auto flag enabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			args: []string{},
+			want: true,
+		},
+		{
+			name: "auto flag disabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+			},
+			args: []string{},
+			want: false,
+		},
+		{
+			name: "auto with yaml args",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			args: []string{"spec.yaml"},
+			want: true,
+		},
+		{
+			name: "no auto flag",
+			viperSetup: func(v *viper.Viper) {
+				// No auto flag set
+			},
+			args: []string{"spec.yaml"},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+			tt.viperSetup(v)
+
+			got := ShouldUseAutoDiscovery(v, tt.args)
+			if got != tt.want {
+				t.Errorf("ShouldUseAutoDiscovery() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGetAutoDiscoveryMode(t *testing.T) {
+	tests := []struct {
+		name        string
+		args        []string
+		autoEnabled bool
+		want        string
+	}{
+		{
+			name:        "foundational only",
+			args:        []string{},
+			autoEnabled: true,
+			want:        "foundational-only",
+		},
+		{
+			name:        "yaml augmented",
+			args:        []string{"spec.yaml"},
+			autoEnabled: true,
+			want:        "yaml-augmented",
+		},
+		{
+			name:        "disabled",
+			args:        []string{},
+			autoEnabled: false,
+			want:        "disabled",
+		},
+		{
+			name:        "disabled with args",
+			args:        []string{"spec.yaml"},
+			autoEnabled: false,
+			want:        "disabled",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GetAutoDiscoveryMode(tt.args, tt.autoEnabled)
+			if got != tt.want {
+				t.Errorf("GetAutoDiscoveryMode() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCreateImageCollectionOptions(t *testing.T) {
+	tests := []struct {
+		name      string
+		config    AutoDiscoveryConfig
+		checkFunc func(t *testing.T, opts images.CollectionOptions)
+	}{
+		{
+			name: "standard profile",
+			config: AutoDiscoveryConfig{
+				Profile: "standard",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 30*time.Second {
+					t.Errorf("Expected standard profile timeout 30s, got %v", opts.Timeout)
+				}
+				if !opts.ContinueOnError {
+					t.Error("Should continue on error for auto-discovery")
+				}
+			},
+		},
+		{
+			name: "comprehensive profile",
+			config: AutoDiscoveryConfig{
+				Profile: "comprehensive",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 60*time.Second {
+					t.Errorf("Expected comprehensive profile timeout 60s, got %v", opts.Timeout)
+				}
+				if !opts.IncludeConfig {
+					t.Error("Comprehensive profile should include config")
+				}
+			},
+		},
+		{
+			name: "paranoid profile",
+			config: AutoDiscoveryConfig{
+				Profile: "paranoid",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 120*time.Second {
+					t.Errorf("Expected paranoid profile timeout 120s, got %v", opts.Timeout)
+				}
+				if !opts.IncludeLayers {
+					t.Error("Paranoid profile should include layers")
+				}
+			},
+		},
+		{
+			name: "custom timeout",
+			config: AutoDiscoveryConfig{
+				Profile: "standard",
+				Timeout: 45 * time.Second,
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 45*time.Second {
+					t.Errorf("Expected custom timeout 45s, got %v", opts.Timeout)
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			opts := CreateImageCollectionOptions(tt.config)
+			tt.checkFunc(t, opts)
+		})
+	}
+}
+
+func TestConvertToCollectorSpecs(t *testing.T) {
+	// This test would need actual troubleshootv1beta2.Collect instances
+	// For now, test with nil input
+	specs, err := convertToCollectorSpecs([]*troubleshootv1beta2.Collect{})
+	if err != nil {
+		t.Errorf("convertToCollectorSpecs() with empty input should not error: %v", err)
+	}
+	if len(specs) != 0 {
+		t.Errorf("convertToCollectorSpecs() with empty input should return empty slice, got %d items", len(specs))
+	}
+}
+
+func TestConvertToTroubleshootCollectors(t *testing.T) {
+	// This test would need actual autodiscovery.CollectorSpec instances
+	// For now, test with nil input
+	collectors, err := convertToTroubleshootCollectors([]autodiscovery.CollectorSpec{})
+	if err != nil {
+		t.Errorf("convertToTroubleshootCollectors() with empty input should not error: %v", err)
+	}
+	if len(collectors) != 0 {
+		t.Errorf("convertToTroubleshootCollectors() with empty input should return empty slice, got %d items", len(collectors))
+	}
+}

cmd/troubleshoot/cli/diff.go

@@ -0,0 +1,848 @@
+package cli
+
+import (
+	"archive/tar"
+	"bufio"
+	"compress/gzip"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/pmezard/go-difflib/difflib"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+)
+
+const maxInlineDiffBytes = 256 * 1024
+
+// DiffResult represents the result of comparing two support bundles
+type DiffResult struct {
+	Summary      DiffSummary  `json:"summary"`
+	Changes      []Change     `json:"changes"`
+	Metadata     DiffMetadata `json:"metadata"`
+	Significance string       `json:"significance"`
+}
+
+// DiffSummary provides high-level statistics about the diff
+type DiffSummary struct {
+	TotalChanges      int `json:"totalChanges"`
+	FilesAdded        int `json:"filesAdded"`
+	FilesRemoved      int `json:"filesRemoved"`
+	FilesModified     int `json:"filesModified"`
+	HighImpactChanges int `json:"highImpactChanges"`
+}
+
+// Change represents a single difference between bundles
+type Change struct {
+	Type        string                 `json:"type"`     // added, removed, modified
+	Category    string                 `json:"category"` // resource, log, config, etc.
+	Path        string                 `json:"path"`     // file path or resource path
+	Impact      string                 `json:"impact"`   // high, medium, low, none
+	Details     map[string]interface{} `json:"details"`  // change-specific details
+	Remediation *RemediationStep       `json:"remediation,omitempty"`
+}
+
+// RemediationStep represents a suggested remediation action
+type RemediationStep struct {
+	Title       string `json:"title"`
+	Description string `json:"description"`
+	Command     string `json:"command,omitempty"`
+	URL         string `json:"url,omitempty"`
+}
+
+// DiffMetadata contains metadata about the diff operation
+type DiffMetadata struct {
+	OldBundle   BundleMetadata `json:"oldBundle"`
+	NewBundle   BundleMetadata `json:"newBundle"`
+	GeneratedAt string         `json:"generatedAt"`
+	Version     string         `json:"version"`
+}
+
+// BundleMetadata contains metadata about a support bundle
+type BundleMetadata struct {
+	Path      string `json:"path"`
+	Size      int64  `json:"size"`
+	CreatedAt string `json:"createdAt,omitempty"`
+	NumFiles  int    `json:"numFiles"`
+}
+
+func Diff() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "diff <old-bundle.(tar.gz|tgz)> <new-bundle.(tar.gz|tgz)>",
+		Args:  cobra.ExactArgs(2),
+		Short: "Compare two support bundles and identify changes",
+		Long: `Compare two support bundles to identify changes over time.
+This command analyzes differences between two support bundle archives and generates
+a human-readable report showing what has changed, including:
+
+- Added, removed, or modified files
+- Configuration changes
+- Log differences
+- Resource status changes
+- Performance metric changes
+
+Use -o to write the report to a file; otherwise it prints to stdout.`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+			return runBundleDiff(v, args[0], args[1])
+		},
+	}
+
+	cmd.Flags().StringP("output", "o", "", "file path of where to save the diff report (default prints to stdout)")
+	cmd.Flags().Int("max-diff-lines", 200, "maximum total lines to include in an inline diff for a single file")
+	cmd.Flags().Int("max-diff-files", 50, "maximum number of files to include inline diffs for; additional modified files will omit inline diffs")
+	cmd.Flags().Bool("include-log-diffs", false, "include inline diffs for log files as well")
+	cmd.Flags().Int("diff-context", 3, "number of context lines to include around changes in unified diffs")
+	cmd.Flags().Bool("hide-inline-diffs", false, "hide inline unified diffs in the report")
+	cmd.Flags().String("format", "", "output format; set to 'json' to emit machine-readable JSON to stdout or -o")
+
+	return cmd
+}
+
+func runBundleDiff(v *viper.Viper, oldBundle, newBundle string) error {
+	klog.V(2).Infof("Comparing support bundles: %s -> %s", oldBundle, newBundle)
+
+	// Validate input files
+	if err := validateBundleFile(oldBundle); err != nil {
+		return errors.Wrap(err, "invalid old bundle")
+	}
+	if err := validateBundleFile(newBundle); err != nil {
+		return errors.Wrap(err, "invalid new bundle")
+	}
+
+	// Perform the diff (placeholder implementation)
+	diffResult, err := performBundleDiff(oldBundle, newBundle, v)
+	if err != nil {
+		return errors.Wrap(err, "failed to compare bundles")
+	}
+
+	// Output the results
+	if err := outputDiffResult(diffResult, v); err != nil {
+		return errors.Wrap(err, "failed to output diff results")
+	}
+
+	return nil
+}
+
+func validateBundleFile(bundlePath string) error {
+	if bundlePath == "" {
+		return errors.New("bundle path cannot be empty")
+	}
+
+	// Check if file exists
+	if _, err := os.Stat(bundlePath); os.IsNotExist(err) {
+		return fmt.Errorf("bundle file not found: %s", bundlePath)
+	}
+
+	// Support .tar.gz and .tgz bundles
+	lower := strings.ToLower(bundlePath)
+	if !(strings.HasSuffix(lower, ".tar.gz") || strings.HasSuffix(lower, ".tgz")) {
+		return fmt.Errorf("unsupported bundle format. Expected path to end with .tar.gz or .tgz")
+	}
+
+	return nil
+}
+
+func performBundleDiff(oldBundle, newBundle string, v *viper.Viper) (*DiffResult, error) {
+	klog.V(2).Info("Performing bundle diff analysis (streaming)...")
+
+	// Stream inventories
+	oldInv, err := buildInventoryFromTarGz(oldBundle)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to inventory old bundle")
+	}
+	newInv, err := buildInventoryFromTarGz(newBundle)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to inventory new bundle")
+	}
+
+	var changes []Change
+	inlineDiffsIncluded := 0
+	maxDiffLines := v.GetInt("max-diff-lines")
+	if maxDiffLines <= 0 {
+		maxDiffLines = 200
+	}
+	maxDiffFiles := v.GetInt("max-diff-files")
+	if maxDiffFiles <= 0 {
+		maxDiffFiles = 50
+	}
+	includeLogDiffs := v.GetBool("include-log-diffs")
+	diffContext := v.GetInt("diff-context")
+	if diffContext <= 0 {
+		diffContext = 3
+	}
+
+	// Added files
+	for p, nf := range newInv {
+		if _, ok := oldInv[p]; !ok {
+			ch := Change{
+				Type:     "added",
+				Category: categorizePath(p),
+				Path:     "/" + p,
+				Impact:   estimateImpact("added", p),
+				Details: map[string]interface{}{
+					"size": nf.Size,
+				},
+			}
+			if rem := suggestRemediation(ch.Type, p); rem != nil {
+				ch.Remediation = rem
+			}
+			changes = append(changes, ch)
+		}
+	}
+
+	// Removed files
+	for p, of := range oldInv {
+		if _, ok := newInv[p]; !ok {
+			ch := Change{
+				Type:     "removed",
+				Category: categorizePath(p),
+				Path:     "/" + p,
+				Impact:   estimateImpact("removed", p),
+				Details: map[string]interface{}{
+					"size": of.Size,
+				},
+			}
+			if rem := suggestRemediation(ch.Type, p); rem != nil {
+				ch.Remediation = rem
+			}
+			changes = append(changes, ch)
+		}
+	}
+
+	// Modified files
+	for p, of := range oldInv {
+		if nf, ok := newInv[p]; ok {
+			if of.Digest != nf.Digest {
+				ch := Change{
+					Type:     "modified",
+					Category: categorizePath(p),
+					Path:     "/" + p,
+					Impact:   estimateImpact("modified", p),
+					Details:  map[string]interface{}{},
+				}
+				if rem := suggestRemediation(ch.Type, p); rem != nil {
+					ch.Remediation = rem
+				}
+				changes = append(changes, ch)
+			}
+		}
+	}
+
+	// Sort changes deterministically: type, then path
+	sort.Slice(changes, func(i, j int) bool {
+		if changes[i].Type == changes[j].Type {
+			return changes[i].Path < changes[j].Path
+		}
+		return changes[i].Type < changes[j].Type
+	})
+
+	// Populate inline diffs lazily for the first N eligible modified files using streaming approach
+	for i := range changes {
+		if inlineDiffsIncluded >= maxDiffFiles {
+			break
+		}
+		ch := &changes[i]
+		if ch.Type != "modified" {
+			continue
+		}
+		allowLogs := includeLogDiffs || ch.Category != "logs"
+		if !allowLogs {
+			continue
+		}
+		// Use streaming diff generation to avoid loading large files into memory
+		if d := generateStreamingUnifiedDiff(oldBundle, newBundle, ch.Path, diffContext, maxDiffLines); d != "" {
+			if ch.Details == nil {
+				ch.Details = map[string]interface{}{}
+			}
+			ch.Details["diff"] = d
+			inlineDiffsIncluded++
+		}
+	}
+
+	// Summaries
+	summary := DiffSummary{}
+	for _, c := range changes {
+		switch c.Type {
+		case "added":
+			summary.FilesAdded++
+		case "removed":
+			summary.FilesRemoved++
+		case "modified":
+			summary.FilesModified++
+		}
+		if c.Impact == "high" {
+			summary.HighImpactChanges++
+		}
+	}
+	summary.TotalChanges = summary.FilesAdded + summary.FilesRemoved + summary.FilesModified
+
+	oldMeta := getBundleMetadataWithCount(oldBundle, len(oldInv))
+	newMeta := getBundleMetadataWithCount(newBundle, len(newInv))
+
+	result := &DiffResult{
+		Summary:      summary,
+		Changes:      changes,
+		Metadata:     DiffMetadata{OldBundle: oldMeta, NewBundle: newMeta, GeneratedAt: time.Now().Format(time.RFC3339), Version: "v1"},
+		Significance: computeOverallSignificance(changes),
+	}
+	return result, nil
+}
+
+type inventoryFile struct {
+	Size   int64
+	Digest string
+}
+
+func buildInventoryFromTarGz(bundlePath string) (map[string]inventoryFile, error) {
+	f, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to open bundle")
+	}
+	defer f.Close()
+
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create gzip reader")
+	}
+	defer gz.Close()
+
+	tr := tar.NewReader(gz)
+	inv := make(map[string]inventoryFile)
+
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read tar entry")
+		}
+		if !hdr.FileInfo().Mode().IsRegular() {
+			continue
+		}
+
+		norm := normalizePath(hdr.Name)
+		if norm == "" {
+			continue
+		}
+
+		h := sha256.New()
+		var copied int64
+		buf := make([]byte, 32*1024)
+		for copied < hdr.Size {
+			toRead := int64(len(buf))
+			if remain := hdr.Size - copied; remain < toRead {
+				toRead = remain
+			}
+			n, rerr := io.ReadFull(tr, buf[:toRead])
+			if n > 0 {
+				_, _ = h.Write(buf[:n])
+				copied += int64(n)
+			}
+			if rerr == io.EOF || rerr == io.ErrUnexpectedEOF {
+				break
+			}
+			if rerr != nil {
+				return nil, errors.Wrap(rerr, "failed to read file content")
+			}
+		}
+
+		digest := hex.EncodeToString(h.Sum(nil))
+		inv[norm] = inventoryFile{Size: hdr.Size, Digest: digest}
+	}
+
+	return inv, nil
+}
+
+func normalizePath(name string) string {
+	name = strings.TrimPrefix(name, "./")
+	if name == "" {
+		return name
+	}
+	i := strings.IndexByte(name, '/')
+	if i < 0 {
+		return name
+	}
+	first := name[:i]
+	rest := name[i+1:]
+
+	// Known domain roots we do not strip
+	domainRoots := map[string]bool{
+		"cluster-resources": true,
+		"all-logs":          true,
+		"cluster-info":      true,
+		"execution-data":    true,
+	}
+	if domainRoots[first] {
+		return name
+	}
+	// Strip only known container prefixes
+	if first == "root" || strings.HasPrefix(strings.ToLower(first), "support-bundle") {
+		return rest
+	}
+	return name
+}
+
+func isProbablyText(sample []byte) bool {
+	if len(sample) == 0 {
+		return false
+	}
+	for _, b := range sample {
+		if b == 0x00 {
+			return false
+		}
+		if b < 0x09 {
+			return false
+		}
+	}
+	return true
+}
+
+func normalizeNewlines(s string) string {
+	return strings.ReplaceAll(s, "\r\n", "\n")
+}
+
+// generateStreamingUnifiedDiff creates a unified diff by streaming files line-by-line to avoid loading large files into memory
+func generateStreamingUnifiedDiff(oldBundle, newBundle, path string, context, maxTotalLines int) string {
+	oldReader, err := createTarFileReader(oldBundle, strings.TrimPrefix(path, "/"))
+	if err != nil {
+		return ""
+	}
+	defer oldReader.Close()
+
+	newReader, err := createTarFileReader(newBundle, strings.TrimPrefix(path, "/"))
+	if err != nil {
+		return ""
+	}
+	defer newReader.Close()
+
+	// Read files line by line
+	oldLines, err := readLinesFromReader(oldReader, maxInlineDiffBytes)
+	if err != nil {
+		return ""
+	}
+
+	newLines, err := readLinesFromReader(newReader, maxInlineDiffBytes)
+	if err != nil {
+		return ""
+	}
+
+	// Generate diff using the existing difflib
+	ud := difflib.UnifiedDiff{
+		A:        oldLines,
+		B:        newLines,
+		FromFile: "old:" + path,
+		ToFile:   "new:" + path,
+		Context:  context,
+	}
+	s, err := difflib.GetUnifiedDiffString(ud)
+	if err != nil || s == "" {
+		return ""
+	}
+
+	lines := strings.Split(s, "\n")
+	if maxTotalLines > 0 && len(lines) > maxTotalLines {
+		lines = append(lines[:maxTotalLines], "... (diff truncated)")
+	}
+	if len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return strings.Join(lines, "\n")
+}
+
+// readLinesFromReader reads lines from a reader up to maxBytes total, returning normalized lines
+func readLinesFromReader(reader io.Reader, maxBytes int) ([]string, error) {
+	var lines []string
+	var totalBytes int
+	scanner := bufio.NewScanner(reader)
+
+	for scanner.Scan() {
+		line := normalizeNewlines(scanner.Text())
+		lineWithNL := line + "\n"
+		lineBytes := len(lineWithNL)
+
+		if totalBytes+lineBytes > maxBytes {
+			lines = append(lines, "... (content truncated due to size)\n")
+			break
+		}
+
+		lines = append(lines, lineWithNL)
+		totalBytes += lineBytes
+	}
+
+	if err := scanner.Err(); err != nil {
+		return nil, err
+	}
+
+	return lines, nil
+}
+
+// generateUnifiedDiff builds a unified diff with headers and context, then truncates to maxTotalLines
+func generateUnifiedDiff(a, b string, path string, context, maxTotalLines int) string {
+	ud := difflib.UnifiedDiff{
+		A:        difflib.SplitLines(a),
+		B:        difflib.SplitLines(b),
+		FromFile: "old:" + path,
+		ToFile:   "new:" + path,
+		Context:  context,
+	}
+	s, err := difflib.GetUnifiedDiffString(ud)
+	if err != nil || s == "" {
+		return ""
+	}
+	lines := strings.Split(s, "\n")
+	if maxTotalLines > 0 && len(lines) > maxTotalLines {
+		lines = append(lines[:maxTotalLines], "... (diff truncated)")
+	}
+	if len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return strings.Join(lines, "\n")
+}
+
+func categorizePath(p string) string {
+	if strings.HasPrefix(p, "cluster-resources/pods/logs/") || strings.Contains(p, "/logs/") || strings.HasPrefix(p, "all-logs/") || strings.HasPrefix(p, "logs/") {
+		return "logs"
+	}
+	if strings.HasPrefix(p, "cluster-resources/") {
+		rest := strings.TrimPrefix(p, "cluster-resources/")
+		seg := rest
+		if i := strings.IndexByte(rest, '/'); i >= 0 {
+			seg = rest[:i]
+		}
+		if seg == "" {
+			return "resources"
+		}
+		return "resources:" + seg
+	}
+	if strings.HasPrefix(p, "config/") || strings.HasSuffix(p, ".yaml") || strings.HasSuffix(p, ".yml") || strings.HasSuffix(p, ".json") {
+		return "config"
+	}
+	return "files"
+}
+
+// estimateImpact determines impact based on change type and path patterns
+func estimateImpact(changeType, p string) string {
+	// High impact cases
+	if strings.HasPrefix(p, "cluster-resources/custom-resource-definitions") {
+		if changeType == "removed" || changeType == "modified" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/clusterrole") || strings.HasPrefix(p, "cluster-resources/clusterrolebindings") || strings.Contains(p, "/rolebindings/") {
+		if changeType != "added" { // reductions or changes can break access
+			return "high"
+		}
+	}
+	if strings.Contains(p, "/secrets/") || strings.HasSuffix(p, "-secrets.json") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/nodes") {
+		if changeType != "added" { // node status changes can be severe
+			return "high"
+		}
+	}
+	if strings.Contains(p, "/network-policy/") || strings.HasSuffix(p, "/networkpolicies.json") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/") && strings.Contains(p, "/kube-system") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	// Medium default for cluster resources
+	if strings.HasPrefix(p, "cluster-resources/") {
+		return "medium"
+	}
+	// Logs and others default low
+	if strings.Contains(p, "/logs/") || strings.HasPrefix(p, "all-logs/") {
+		return "low"
+	}
+	return "low"
+}
+
+// suggestRemediation returns a basic remediation suggestion based on category and change
+func suggestRemediation(changeType, p string) *RemediationStep {
+	// RBAC
+	if strings.HasPrefix(p, "cluster-resources/clusterrole") || strings.HasPrefix(p, "cluster-resources/clusterrolebindings") || strings.Contains(p, "/rolebindings/") {
+		return &RemediationStep{Description: "Validate RBAC permissions and recent changes", Command: "kubectl auth can-i --list"}
+	}
+	// CRDs
+	if strings.HasPrefix(p, "cluster-resources/custom-resource-definitions") {
+		return &RemediationStep{Description: "Check CRD presence and reconcile operator status", Command: "kubectl get crds"}
+	}
+	// Nodes
+	if strings.HasPrefix(p, "cluster-resources/nodes") {
+		return &RemediationStep{Description: "Inspect node conditions and recent events", Command: "kubectl describe nodes"}
+	}
+	// Network policy
+	if strings.Contains(p, "/network-policy/") || strings.HasSuffix(p, "/networkpolicies.json") {
+		return &RemediationStep{Description: "Validate connectivity and recent NetworkPolicy changes", Command: "kubectl get networkpolicy -A"}
+	}
+	// Secrets/Config
+	if strings.Contains(p, "/secrets/") || strings.HasPrefix(p, "config/") {
+		return &RemediationStep{Description: "Review configuration or secret changes for correctness"}
+	}
+	// Workloads
+	if strings.Contains(p, "/deployments/") || strings.Contains(p, "/statefulsets/") || strings.Contains(p, "/daemonsets/") {
+		return &RemediationStep{Description: "Check rollout and pod status", Command: "kubectl rollout status -n <ns> <kind>/<name>"}
+	}
+	return nil
+}
+
+func computeOverallSignificance(changes []Change) string {
+	high, medium := 0, 0
+	for _, c := range changes {
+		switch c.Impact {
+		case "high":
+			high++
+		case "medium":
+			medium++
+		}
+	}
+	if high > 0 {
+		return "high"
+	}
+	if medium > 0 {
+		return "medium"
+	}
+	if len(changes) > 0 {
+		return "low"
+	}
+	return "none"
+}
+
+func getBundleMetadata(bundlePath string) BundleMetadata {
+	metadata := BundleMetadata{
+		Path: bundlePath,
+	}
+
+	if stat, err := os.Stat(bundlePath); err == nil {
+		metadata.Size = stat.Size()
+		metadata.CreatedAt = stat.ModTime().Format(time.RFC3339)
+	}
+
+	return metadata
+}
+
+// getBundleMetadataWithCount sets NumFiles directly to avoid re-reading the archive
+func getBundleMetadataWithCount(bundlePath string, numFiles int) BundleMetadata {
+	md := getBundleMetadata(bundlePath)
+	md.NumFiles = numFiles
+	return md
+}
+
+func outputDiffResult(result *DiffResult, v *viper.Viper) error {
+	outputPath := v.GetString("output")
+	showInlineDiffs := !v.GetBool("hide-inline-diffs")
+	formatMode := strings.ToLower(v.GetString("format"))
+
+	var output []byte
+	if formatMode == "json" {
+		data, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal diff result to JSON")
+		}
+		output = data
+	} else {
+		output = []byte(generateTextDiffReport(result, showInlineDiffs))
+	}
+
+	if outputPath != "" {
+		// Write to file
+		if err := os.WriteFile(outputPath, output, 0644); err != nil {
+			return errors.Wrap(err, "failed to write diff output to file")
+		}
+		fmt.Printf("Diff report written to: %s\n", outputPath)
+	} else {
+		// Write to stdout
+		fmt.Print(string(output))
+	}
+
+	return nil
+}
+
+func generateTextDiffReport(result *DiffResult, showInlineDiffs bool) string {
+	var report strings.Builder
+
+	report.WriteString("Support Bundle Diff Report\n")
+	report.WriteString("==========================\n\n")
+
+	report.WriteString(fmt.Sprintf("Generated: %s\n", result.Metadata.GeneratedAt))
+	report.WriteString(fmt.Sprintf("Old Bundle: %s (%s)\n", result.Metadata.OldBundle.Path, formatSize(result.Metadata.OldBundle.Size)))
+	report.WriteString(fmt.Sprintf("New Bundle: %s (%s)\n\n", result.Metadata.NewBundle.Path, formatSize(result.Metadata.NewBundle.Size)))
+
+	// Summary
+	report.WriteString("Summary:\n")
+	report.WriteString(fmt.Sprintf("  Total Changes: %d\n", result.Summary.TotalChanges))
+	report.WriteString(fmt.Sprintf("  Files Added: %d\n", result.Summary.FilesAdded))
+	report.WriteString(fmt.Sprintf("  Files Removed: %d\n", result.Summary.FilesRemoved))
+	report.WriteString(fmt.Sprintf("  Files Modified: %d\n", result.Summary.FilesModified))
+	report.WriteString(fmt.Sprintf("  High Impact Changes: %d\n", result.Summary.HighImpactChanges))
+	report.WriteString(fmt.Sprintf("  Significance: %s\n\n", result.Significance))
+
+	if len(result.Changes) == 0 {
+		report.WriteString("No changes detected between bundles.\n")
+	} else {
+		report.WriteString("Changes:\n")
+		for i, change := range result.Changes {
+			report.WriteString(fmt.Sprintf("  %d. [%s] %s (%s impact)\n",
+				i+1, strings.ToUpper(change.Type), change.Path, change.Impact))
+			if change.Remediation != nil {
+				report.WriteString(fmt.Sprintf("     Remediation: %s\n", change.Remediation.Description))
+			}
+			if showInlineDiffs {
+				if diffStr, ok := change.Details["diff"].(string); ok && diffStr != "" {
+					report.WriteString("     Diff:\n")
+					for _, line := range strings.Split(diffStr, "\n") {
+						report.WriteString("       " + line + "\n")
+					}
+				}
+			}
+		}
+	}
+
+	return report.String()
+}
+
+func formatSize(bytes int64) string {
+	const unit = 1024
+	if bytes < unit {
+		return fmt.Sprintf("%d B", bytes)
+	}
+	div, exp := int64(unit), 0
+	for n := bytes / unit; n >= unit; n /= unit {
+		div *= unit
+		exp++
+	}
+	return fmt.Sprintf("%.1f %ciB", float64(bytes)/float64(div), "KMGTPE"[exp])
+}
+
+// tarFileReader provides a streaming interface to read a specific file from a tar.gz archive
+type tarFileReader struct {
+	file   *os.File
+	gz     *gzip.Reader
+	tr     *tar.Reader
+	found  bool
+	header *tar.Header
+}
+
+// createTarFileReader creates a streaming reader for a specific file in a tar.gz archive
+func createTarFileReader(bundlePath, normalizedPath string) (*tarFileReader, error) {
+	f, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, err
+	}
+
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		f.Close()
+		return nil, err
+	}
+
+	tr := tar.NewReader(gz)
+
+	// Find the target file
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			gz.Close()
+			f.Close()
+			return nil, err
+		}
+		if !hdr.FileInfo().Mode().IsRegular() {
+			continue
+		}
+		if normalizePath(hdr.Name) == normalizedPath {
+			// Check if file is probably text
+			sample := make([]byte, 512)
+			n, _ := io.ReadFull(tr, sample[:])
+			if n > 0 && !isProbablyText(sample[:n]) {
+				gz.Close()
+				f.Close()
+				return nil, fmt.Errorf("file is not text")
+			}
+
+			// Reopen to start from beginning of file
+			gz.Close()
+			f.Close()
+
+			f, err = os.Open(bundlePath)
+			if err != nil {
+				return nil, err
+			}
+			gz, err = gzip.NewReader(f)
+			if err != nil {
+				f.Close()
+				return nil, err
+			}
+			tr = tar.NewReader(gz)
+
+			// Find the file again
+			for {
+				hdr, err = tr.Next()
+				if err == io.EOF {
+					gz.Close()
+					f.Close()
+					return nil, fmt.Errorf("file not found on second pass")
+				}
+				if err != nil {
+					gz.Close()
+					f.Close()
+					return nil, err
+				}
+				if normalizePath(hdr.Name) == normalizedPath {
+					return &tarFileReader{
+						file:   f,
+						gz:     gz,
+						tr:     tr,
+						found:  true,
+						header: hdr,
+					}, nil
+				}
+			}
+		}
+	}
+
+	gz.Close()
+	f.Close()
+	return nil, fmt.Errorf("file not found: %s", normalizedPath)
+}
+
+// Read implements io.Reader interface
+func (r *tarFileReader) Read(p []byte) (n int, err error) {
+	if !r.found {
+		return 0, io.EOF
+	}
+	return r.tr.Read(p)
+}
+
+// Close closes the underlying file handles
+func (r *tarFileReader) Close() error {
+	if r.gz != nil {
+		r.gz.Close()
+	}
+	if r.file != nil {
+		return r.file.Close()
+	}
+	return nil
+}

cmd/troubleshoot/cli/diff_test.go

@@ -0,0 +1,552 @@
+package cli
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/spf13/viper"
+)
+
+func TestValidateBundleFile(t *testing.T) {
+	// Create temporary test files
+	tempDir := t.TempDir()
+
+	// Create bundle files
+	validBundle := filepath.Join(tempDir, "test-bundle.tar.gz")
+	if err := os.WriteFile(validBundle, []byte("dummy content"), 0644); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	validTgz := filepath.Join(tempDir, "test-bundle.tgz")
+	if err := os.WriteFile(validTgz, []byte("dummy content"), 0644); err != nil {
+		t.Fatalf("Failed to create test tgz bundle: %v", err)
+	}
+
+	tests := []struct {
+		name       string
+		bundlePath string
+		wantErr    bool
+	}{
+		{
+			name:       "valid tar.gz bundle",
+			bundlePath: validBundle,
+			wantErr:    false,
+		},
+		{
+			name:       "valid tgz bundle",
+			bundlePath: validTgz,
+			wantErr:    false,
+		},
+		{
+			name:       "empty path",
+			bundlePath: "",
+			wantErr:    true,
+		},
+		{
+			name:       "non-existent file",
+			bundlePath: "/path/to/nonexistent.tar.gz",
+			wantErr:    true,
+		},
+		{
+			name:       "invalid extension",
+			bundlePath: filepath.Join(tempDir, "invalid.txt"),
+			wantErr:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// For invalid extension test, create the file
+			if strings.HasSuffix(tt.bundlePath, "invalid.txt") {
+				os.WriteFile(tt.bundlePath, []byte("content"), 0644)
+			}
+
+			err := validateBundleFile(tt.bundlePath)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateBundleFile() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestGetBundleMetadata(t *testing.T) {
+	// Create a temporary test file
+	tempDir := t.TempDir()
+	testBundle := filepath.Join(tempDir, "test-bundle.tar.gz")
+	testContent := []byte("test bundle content")
+
+	if err := os.WriteFile(testBundle, testContent, 0644); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	metadata := getBundleMetadata(testBundle)
+
+	if metadata.Path != testBundle {
+		t.Errorf("getBundleMetadata() path = %v, want %v", metadata.Path, testBundle)
+	}
+
+	if metadata.Size != int64(len(testContent)) {
+		t.Errorf("getBundleMetadata() size = %v, want %v", metadata.Size, len(testContent))
+	}
+
+	if metadata.CreatedAt == "" {
+		t.Error("getBundleMetadata() createdAt should not be empty")
+	}
+
+	// Validate timestamp format
+	if _, err := time.Parse(time.RFC3339, metadata.CreatedAt); err != nil {
+		t.Errorf("getBundleMetadata() createdAt has invalid format: %v", err)
+	}
+}
+
+func TestPerformBundleDiff(t *testing.T) {
+	// Create temporary test bundles
+	tempDir := t.TempDir()
+
+	oldBundle := filepath.Join(tempDir, "old-bundle.tar.gz")
+	newBundle := filepath.Join(tempDir, "new-bundle.tar.gz")
+
+	if err := writeTarGz(oldBundle, map[string]string{
+		"root/cluster-resources/version.txt": "v1\n",
+		"root/logs/app.log":                  "line1\n",
+	}); err != nil {
+		t.Fatalf("Failed to create old bundle: %v", err)
+	}
+
+	if err := writeTarGz(newBundle, map[string]string{
+		"root/cluster-resources/version.txt": "v2\n",
+		"root/logs/app.log":                  "line1\nline2\n",
+		"root/added.txt":                     "new\n",
+	}); err != nil {
+		t.Fatalf("Failed to create new bundle: %v", err)
+	}
+
+	v := viper.New()
+	result, err := performBundleDiff(oldBundle, newBundle, v)
+
+	if err != nil {
+		t.Fatalf("performBundleDiff() error = %v", err)
+	}
+
+	if result == nil {
+		t.Fatal("performBundleDiff() returned nil result")
+	}
+
+	// Verify result structure
+	if result.Metadata.Version != "v1" {
+		t.Errorf("performBundleDiff() version = %v, want v1", result.Metadata.Version)
+	}
+
+	if result.Metadata.OldBundle.Path != oldBundle {
+		t.Errorf("performBundleDiff() old bundle path = %v, want %v", result.Metadata.OldBundle.Path, oldBundle)
+	}
+
+	if result.Metadata.NewBundle.Path != newBundle {
+		t.Errorf("performBundleDiff() new bundle path = %v, want %v", result.Metadata.NewBundle.Path, newBundle)
+	}
+
+	if result.Metadata.GeneratedAt == "" {
+		t.Error("performBundleDiff() generatedAt should not be empty")
+	}
+}
+
+// writeTarGz creates a gzipped tar file at tarPath with the provided files map.
+// Keys are entry names inside the archive, values are file contents.
+func writeTarGz(tarPath string, files map[string]string) error {
+	f, err := os.Create(tarPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	gz := gzip.NewWriter(f)
+	defer gz.Close()
+
+	tw := tar.NewWriter(gz)
+	defer tw.Close()
+
+	for name, content := range files {
+		data := []byte(content)
+		hdr := &tar.Header{
+			Name:     name,
+			Mode:     0644,
+			Size:     int64(len(data)),
+			Typeflag: tar.TypeReg,
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if _, err := bytes.NewReader(data).WriteTo(tw); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func TestGenerateTextDiffReport(t *testing.T) {
+	result := &DiffResult{
+		Summary: DiffSummary{
+			TotalChanges:      3,
+			FilesAdded:        1,
+			FilesRemoved:      1,
+			FilesModified:     1,
+			HighImpactChanges: 1,
+		},
+		Changes: []Change{
+			{
+				Type:     "added",
+				Category: "config",
+				Path:     "/new-config.yaml",
+				Impact:   "medium",
+				Remediation: &RemediationStep{
+					Description: "Review new configuration",
+				},
+			},
+			{
+				Type:     "removed",
+				Category: "resource",
+				Path:     "/old-deployment.yaml",
+				Impact:   "high",
+			},
+		},
+		Metadata: DiffMetadata{
+			OldBundle: BundleMetadata{
+				Path: "/old/bundle.tar.gz",
+				Size: 1024,
+			},
+			NewBundle: BundleMetadata{
+				Path: "/new/bundle.tar.gz",
+				Size: 2048,
+			},
+			GeneratedAt: "2023-01-01T00:00:00Z",
+		},
+		Significance: "high",
+	}
+
+	report := generateTextDiffReport(result, true)
+
+	// Check that report contains expected elements
+	expectedStrings := []string{
+		"Support Bundle Diff Report",
+		"Total Changes: 3",
+		"Files Added: 1",
+		"High Impact Changes: 1",
+		"Significance: high",
+		"/new-config.yaml",
+		"/old-deployment.yaml",
+		"Remediation: Review new configuration",
+	}
+
+	for _, expected := range expectedStrings {
+		if !strings.Contains(report, expected) {
+			t.Errorf("generateTextDiffReport() missing expected string: %s", expected)
+		}
+	}
+}
+
+func TestOutputDiffResult_JSON(t *testing.T) {
+	// Minimal result
+	result := &DiffResult{
+		Summary: DiffSummary{},
+		Metadata: DiffMetadata{
+			OldBundle:   BundleMetadata{Path: "/old.tar.gz"},
+			NewBundle:   BundleMetadata{Path: "/new.tar.gz"},
+			GeneratedAt: time.Now().Format(time.RFC3339),
+			Version:     "v1",
+		},
+		Changes:      []Change{{Type: "modified", Category: "files", Path: "/a", Impact: "low"}},
+		Significance: "low",
+	}
+
+	v := viper.New()
+	v.Set("format", "json")
+
+	// Write to a temp file via -o to exercise file write path
+	tempDir := t.TempDir()
+	outPath := filepath.Join(tempDir, "diff.json")
+	v.Set("output", outPath)
+
+	if err := outputDiffResult(result, v); err != nil {
+		t.Fatalf("outputDiffResult(json) error = %v", err)
+	}
+
+	data, err := os.ReadFile(outPath)
+	if err != nil {
+		t.Fatalf("failed to read output: %v", err)
+	}
+
+	// Basic JSON sanity checks
+	s := string(data)
+	if !strings.Contains(s, "\"summary\"") || !strings.Contains(s, "\"changes\"") {
+		t.Fatalf("json output missing keys: %s", s)
+	}
+	if !strings.Contains(s, "\"path\": \"/a\"") {
+		t.Fatalf("json output missing change path: %s", s)
+	}
+}
+
+func TestGenerateTextDiffReport_DiffVisibility(t *testing.T) {
+	result := &DiffResult{
+		Summary: DiffSummary{TotalChanges: 1, FilesModified: 1},
+		Changes: []Change{
+			{
+				Type:     "modified",
+				Category: "files",
+				Path:     "/path.txt",
+				Impact:   "low",
+				Details:  map[string]interface{}{"diff": "--- old:/path.txt\n+++ new:/path.txt\n@@\n-a\n+b"},
+			},
+		},
+		Metadata: DiffMetadata{GeneratedAt: time.Now().Format(time.RFC3339)},
+	}
+
+	reportShown := generateTextDiffReport(result, true)
+	if !strings.Contains(reportShown, "Diff:") || !strings.Contains(reportShown, "+ new:/path.txt") {
+		t.Fatalf("expected diff to be shown when enabled; got: %s", reportShown)
+	}
+
+	reportHidden := generateTextDiffReport(result, false)
+	if strings.Contains(reportHidden, "Diff:") {
+		t.Fatalf("expected diff to be hidden when disabled; got: %s", reportHidden)
+	}
+}
+
+func TestCategorizePath(t *testing.T) {
+	cases := []struct {
+		in  string
+		out string
+	}{
+		{"cluster-resources/pods/logs/ns/pod/container.log", "logs"},
+		{"some/ns/logs/thing.log", "logs"},
+		{"all-logs/ns/pod/container.log", "logs"},
+		{"logs/app.log", "logs"},
+		{"cluster-resources/configmaps/ns.json", "resources:configmaps"},
+		{"cluster-resources/", "resources"},
+		{"config/settings.yaml", "config"},
+		{"random/file.json", "config"},
+		{"random/file.txt", "files"},
+	}
+	for _, c := range cases {
+		if got := categorizePath(c.in); got != c.out {
+			t.Errorf("categorizePath(%q)=%q want %q", c.in, got, c.out)
+		}
+	}
+}
+
+func TestNormalizePath(t *testing.T) {
+	cases := []struct {
+		in  string
+		out string
+	}{
+		{"root/foo.txt", "foo.txt"},
+		{"support-bundle-123/foo.txt", "foo.txt"},
+		{"Support-Bundle-ABC/bar/baz.txt", "bar/baz.txt"},
+		{"cluster-resources/pods/logs/whatever.log", "cluster-resources/pods/logs/whatever.log"},
+		{"all-logs/whatever.log", "all-logs/whatever.log"},
+	}
+	for _, c := range cases {
+		if got := normalizePath(c.in); got != c.out {
+			t.Errorf("normalizePath(%q)=%q want %q", c.in, got, c.out)
+		}
+	}
+}
+
+func TestGenerateUnifiedDiff_TruncationAndContext(t *testing.T) {
+	old := "line1\nline2\nline3\nline4\nline5\n"
+	newv := "line1\nline2-mod\nline3\nline4\nline5\n"
+	// context=1 should include headers and minimal context; max lines small to force truncation
+	diff := generateUnifiedDiff(old, newv, "/file.txt", 1, 5)
+	if diff == "" {
+		t.Fatal("expected non-empty diff")
+	}
+	if !strings.Contains(diff, "old:/file.txt") || !strings.Contains(diff, "new:/file.txt") {
+		t.Errorf("diff missing headers: %s", diff)
+	}
+	if !strings.Contains(diff, "... (diff truncated)") {
+		t.Errorf("expected truncated marker in diff: %s", diff)
+	}
+}
+
+func TestFormatSize(t *testing.T) {
+	tests := []struct {
+		name  string
+		bytes int64
+		want  string
+	}{
+		{
+			name:  "bytes",
+			bytes: 512,
+			want:  "512 B",
+		},
+		{
+			name:  "kilobytes",
+			bytes: 1536, // 1.5 KB
+			want:  "1.5 KiB",
+		},
+		{
+			name:  "megabytes",
+			bytes: 1572864, // 1.5 MB
+			want:  "1.5 MiB",
+		},
+		{
+			name:  "zero",
+			bytes: 0,
+			want:  "0 B",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := formatSize(tt.bytes)
+			if got != tt.want {
+				t.Errorf("formatSize() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCreateTarFileReader(t *testing.T) {
+	tempDir := t.TempDir()
+	bundlePath := filepath.Join(tempDir, "test-bundle.tar.gz")
+
+	// Create test bundle with text and binary files
+	testFiles := map[string]string{
+		"root/text-file.txt":   "line1\nline2\nline3\n",
+		"root/config.yaml":     "key: value\nother: data\n",
+		"root/binary-file.bin": string([]byte{0x00, 0x01, 0x02, 0xFF}), // Binary content
+	}
+
+	if err := writeTarGz(bundlePath, testFiles); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	// Test reading existing text file
+	reader, err := createTarFileReader(bundlePath, "text-file.txt")
+	if err != nil {
+		t.Fatalf("createTarFileReader() error = %v", err)
+	}
+	defer reader.Close()
+
+	content := make([]byte, 100)
+	n, err := reader.Read(content)
+	if err != nil && err != io.EOF {
+		t.Errorf("Read() error = %v", err)
+	}
+
+	contentStr := string(content[:n])
+	if !strings.Contains(contentStr, "line1") {
+		t.Errorf("Expected file content not found, got: %s", contentStr)
+	}
+
+	// Test reading non-existent file
+	_, err = createTarFileReader(bundlePath, "non-existent.txt")
+	if err == nil {
+		t.Error("Expected error for non-existent file")
+	}
+
+	// Test reading binary file (should fail)
+	_, err = createTarFileReader(bundlePath, "binary-file.bin")
+	if err == nil {
+		t.Error("Expected error for binary file")
+	}
+}
+
+func TestGenerateStreamingUnifiedDiff(t *testing.T) {
+	tempDir := t.TempDir()
+	oldBundle := filepath.Join(tempDir, "old-bundle.tar.gz")
+	newBundle := filepath.Join(tempDir, "new-bundle.tar.gz")
+
+	// Create bundles with different versions of the same file
+	if err := writeTarGz(oldBundle, map[string]string{
+		"root/config.yaml": "version: 1.0\napp: test\nfeature: disabled\n",
+	}); err != nil {
+		t.Fatalf("Failed to create old bundle: %v", err)
+	}
+
+	if err := writeTarGz(newBundle, map[string]string{
+		"root/config.yaml": "version: 2.0\napp: test\nfeature: enabled\n",
+	}); err != nil {
+		t.Fatalf("Failed to create new bundle: %v", err)
+	}
+
+	// Generate streaming diff
+	diff := generateStreamingUnifiedDiff(oldBundle, newBundle, "/config.yaml", 3, 100)
+
+	// Verify diff content
+	if diff == "" {
+		t.Error("Expected non-empty diff")
+	}
+
+	expectedStrings := []string{
+		"old:/config.yaml",
+		"new:/config.yaml",
+		"-version: 1.0",
+		"+version: 2.0",
+		"-feature: disabled",
+		"+feature: enabled",
+	}
+
+	for _, expected := range expectedStrings {
+		if !strings.Contains(diff, expected) {
+			t.Errorf("Diff missing expected string '%s'. Got: %s", expected, diff)
+		}
+	}
+}
+
+func TestReadLinesFromReader(t *testing.T) {
+	tests := []struct {
+		name     string
+		content  string
+		maxBytes int
+		wantLen  int
+		wantLast string
+	}{
+		{
+			name:     "small content",
+			content:  "line1\nline2\nline3\n",
+			maxBytes: 1000,
+			wantLen:  3,
+			wantLast: "line3\n",
+		},
+		{
+			name:     "content exceeds limit",
+			content:  "line1\nline2\nline3\nline4\nline5\n",
+			maxBytes: 15, // Only allows first 2 lines plus truncation marker
+			wantLen:  3,
+			wantLast: "... (content truncated due to size)\n",
+		},
+		{
+			name:     "empty content",
+			content:  "",
+			maxBytes: 1000,
+			wantLen:  0,
+			wantLast: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := strings.NewReader(tt.content)
+			lines, err := readLinesFromReader(reader, tt.maxBytes)
+
+			if err != nil {
+				t.Errorf("readLinesFromReader() error = %v", err)
+			}
+
+			if len(lines) != tt.wantLen {
+				t.Errorf("readLinesFromReader() got %d lines, want %d", len(lines), tt.wantLen)
+			}
+
+			if tt.wantLen > 0 && lines[len(lines)-1] != tt.wantLast {
+				t.Errorf("readLinesFromReader() last line = %s, want %s", lines[len(lines)-1], tt.wantLast)
+			}
+		})
+	}
+}

cmd/troubleshoot/cli/discovery_config.go

@@ -0,0 +1,239 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+	"k8s.io/klog/v2"
+)
+
+// DiscoveryConfig represents the configuration for auto-discovery
+type DiscoveryConfig struct {
+	Version  string                      `json:"version" yaml:"version"`
+	Profiles map[string]DiscoveryProfile `json:"profiles" yaml:"profiles"`
+	Patterns DiscoveryPatterns           `json:"patterns" yaml:"patterns"`
+}
+
+// DiscoveryPatterns defines inclusion/exclusion patterns for discovery
+type DiscoveryPatterns struct {
+	NamespacePatterns    PatternConfig `json:"namespacePatterns" yaml:"namespacePatterns"`
+	ResourceTypePatterns PatternConfig `json:"resourceTypePatterns" yaml:"resourceTypePatterns"`
+	RegistryPatterns     PatternConfig `json:"registryPatterns" yaml:"registryPatterns"`
+}
+
+// PatternConfig defines include/exclude patterns
+type PatternConfig struct {
+	Include []string `json:"include" yaml:"include"`
+	Exclude []string `json:"exclude" yaml:"exclude"`
+}
+
+// LoadDiscoveryConfig loads discovery configuration from file or returns defaults
+func LoadDiscoveryConfig(configPath string) (*DiscoveryConfig, error) {
+	// If no config path specified, use built-in defaults
+	if configPath == "" {
+		return getDefaultDiscoveryConfig(), nil
+	}
+
+	// Check if config file exists
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		klog.V(2).Infof("Discovery config file not found: %s, using defaults", configPath)
+		return getDefaultDiscoveryConfig(), nil
+	}
+
+	// Read config file
+	data, err := ioutil.ReadFile(configPath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to read discovery config file")
+	}
+
+	// Parse config file (support JSON for now)
+	var config DiscoveryConfig
+	if err := json.Unmarshal(data, &config); err != nil {
+		return nil, errors.Wrap(err, "failed to parse discovery config")
+	}
+
+	// Validate config
+	if err := validateDiscoveryConfig(&config); err != nil {
+		return nil, errors.Wrap(err, "invalid discovery config")
+	}
+
+	return &config, nil
+}
+
+// getDefaultDiscoveryConfig returns the built-in default configuration
+func getDefaultDiscoveryConfig() *DiscoveryConfig {
+	return &DiscoveryConfig{
+		Version:  "v1",
+		Profiles: GetDiscoveryProfiles(),
+		Patterns: DiscoveryPatterns{
+			NamespacePatterns: PatternConfig{
+				Include: []string{"*"}, // Include all by default
+				Exclude: []string{
+					"kube-system",
+					"kube-public",
+					"kube-node-lease",
+					"kubernetes-dashboard",
+					"cattle-*",
+					"rancher-*",
+				},
+			},
+			ResourceTypePatterns: PatternConfig{
+				Include: []string{
+					"pods",
+					"deployments",
+					"services",
+					"configmaps",
+					"secrets",
+					"events",
+				},
+				Exclude: []string{
+					"*.tmp",
+					"*.log", // Exclude raw log files in favor of structured logs
+				},
+			},
+			RegistryPatterns: PatternConfig{
+				Include: []string{"*"}, // Include all registries
+				Exclude: []string{},    // No exclusions by default
+			},
+		},
+	}
+}
+
+// validateDiscoveryConfig validates a discovery configuration
+func validateDiscoveryConfig(config *DiscoveryConfig) error {
+	if config.Version == "" {
+		config.Version = "v1" // Default version
+	}
+
+	if config.Profiles == nil {
+		return errors.New("profiles section is required")
+	}
+
+	// Validate each profile
+	requiredProfiles := []string{"minimal", "standard", "comprehensive"}
+	for _, profileName := range requiredProfiles {
+		if _, exists := config.Profiles[profileName]; !exists {
+			return fmt.Errorf("required profile missing: %s", profileName)
+		}
+	}
+
+	return nil
+}
+
+// ApplyDiscoveryPatterns applies include/exclude patterns to a list
+func ApplyDiscoveryPatterns(items []string, patterns PatternConfig) ([]string, error) {
+	if len(patterns.Include) == 0 && len(patterns.Exclude) == 0 {
+		return items, nil // No patterns to apply
+	}
+
+	var result []string
+
+	for _, item := range items {
+		include := true
+
+		// Check exclude patterns first
+		for _, excludePattern := range patterns.Exclude {
+			if matched, err := matchPattern(item, excludePattern); err != nil {
+				return nil, errors.Wrapf(err, "invalid exclude pattern: %s", excludePattern)
+			} else if matched {
+				include = false
+				break
+			}
+		}
+
+		// If not excluded, check include patterns
+		if include && len(patterns.Include) > 0 {
+			include = false // Default to exclude if include patterns exist
+			for _, includePattern := range patterns.Include {
+				if matched, err := matchPattern(item, includePattern); err != nil {
+					return nil, errors.Wrapf(err, "invalid include pattern: %s", includePattern)
+				} else if matched {
+					include = true
+					break
+				}
+			}
+		}
+
+		if include {
+			result = append(result, item)
+		}
+	}
+
+	return result, nil
+}
+
+// matchPattern checks if an item matches a glob pattern
+func matchPattern(item, pattern string) (bool, error) {
+	// Simple glob pattern matching
+	if pattern == "*" {
+		return true, nil
+	}
+
+	if pattern == item {
+		return true, nil
+	}
+
+	// Handle basic wildcard patterns
+	if strings.HasPrefix(pattern, "*") && strings.HasSuffix(pattern, "*") {
+		// Pattern is "*substring*"
+		substring := pattern[1 : len(pattern)-1]
+		return strings.Contains(item, substring), nil
+	}
+
+	if strings.HasPrefix(pattern, "*") {
+		// Pattern is "*suffix"
+		suffix := pattern[1:]
+		return strings.HasSuffix(item, suffix), nil
+	}
+
+	if strings.HasSuffix(pattern, "*") {
+		// Pattern is "prefix*"
+		prefix := pattern[:len(pattern)-1]
+		return strings.HasPrefix(item, prefix), nil
+	}
+
+	return false, nil
+}
+
+// SaveDiscoveryConfig saves discovery configuration to a file
+func SaveDiscoveryConfig(config *DiscoveryConfig, configPath string) error {
+	// Create directory if it doesn't exist
+	dir := filepath.Dir(configPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return errors.Wrap(err, "failed to create config directory")
+	}
+
+	// Marshal to JSON
+	data, err := json.MarshalIndent(config, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to marshal config")
+	}
+
+	// Write to file
+	if err := ioutil.WriteFile(configPath, data, 0644); err != nil {
+		return errors.Wrap(err, "failed to write config file")
+	}
+
+	return nil
+}
+
+// GetDiscoveryConfigPath returns the default path for discovery configuration
+func GetDiscoveryConfigPath() string {
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return "./troubleshoot-discovery.json"
+	}
+
+	return filepath.Join(homeDir, ".troubleshoot", "discovery.json")
+}
+
+// CreateDefaultDiscoveryConfigFile creates a default discovery config file
+func CreateDefaultDiscoveryConfigFile(configPath string) error {
+	config := getDefaultDiscoveryConfig()
+	return SaveDiscoveryConfig(config, configPath)
+}

cmd/troubleshoot/cli/discovery_config_test.go

@@ -0,0 +1,422 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoadDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		setupConfig func(string) error
+		configPath  string
+		wantErr     bool
+		checkFunc   func(*testing.T, *DiscoveryConfig)
+	}{
+		{
+			name:       "no config path - use defaults",
+			configPath: "",
+			wantErr:    false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+				if len(config.Profiles) == 0 {
+					t.Error("Default config should have profiles")
+				}
+			},
+		},
+		{
+			name:       "non-existent config file - use defaults",
+			configPath: "/non/existent/path.json",
+			wantErr:    false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+			},
+		},
+		{
+			name: "valid config file",
+			setupConfig: func(path string) error {
+				configContent := `{
+					"version": "v1",
+					"profiles": {
+						"minimal": {
+							"name": "minimal",
+							"description": "Minimal collection",
+							"includeImages": false,
+							"rbacCheck": true,
+							"maxDepth": 1,
+							"timeout": 15000000000
+						},
+						"standard": {
+							"name": "standard",
+							"description": "Standard collection",
+							"includeImages": false,
+							"rbacCheck": true,
+							"maxDepth": 2,
+							"timeout": 30000000000
+						},
+						"comprehensive": {
+							"name": "comprehensive",
+							"description": "Comprehensive collection",
+							"includeImages": true,
+							"rbacCheck": true,
+							"maxDepth": 3,
+							"timeout": 60000000000
+						}
+					},
+					"patterns": {
+						"namespacePatterns": {
+							"include": ["app-*"],
+							"exclude": ["kube-*"]
+						}
+					}
+				}`
+				return os.WriteFile(path, []byte(configContent), 0644)
+			},
+			wantErr: false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+				if len(config.Profiles) == 0 {
+					t.Error("Config should have profiles")
+				}
+			},
+		},
+		{
+			name: "invalid json config",
+			setupConfig: func(path string) error {
+				return os.WriteFile(path, []byte(`{invalid json`), 0644)
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var configPath string
+			if tt.configPath != "" {
+				configPath = tt.configPath
+			}
+
+			// Setup config file if needed
+			if tt.setupConfig != nil {
+				tempDir := t.TempDir()
+				configPath = filepath.Join(tempDir, "config.json")
+				if err := tt.setupConfig(configPath); err != nil {
+					t.Fatalf("Failed to setup config: %v", err)
+				}
+			}
+
+			config, err := LoadDiscoveryConfig(configPath)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("LoadDiscoveryConfig() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+
+			if !tt.wantErr && tt.checkFunc != nil {
+				tt.checkFunc(t, config)
+			}
+		})
+	}
+}
+
+func TestApplyDiscoveryPatterns(t *testing.T) {
+	tests := []struct {
+		name     string
+		items    []string
+		patterns PatternConfig
+		want     []string
+	}{
+		{
+			name:  "no patterns",
+			items: []string{"app1", "app2", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "app2", "kube-system"},
+		},
+		{
+			name:  "exclude patterns only",
+			items: []string{"app1", "app2", "kube-system", "kube-public"},
+			patterns: PatternConfig{
+				Include: []string{},
+				Exclude: []string{"kube-*"},
+			},
+			want: []string{"app1", "app2"},
+		},
+		{
+			name:  "include patterns only",
+			items: []string{"app1", "app2", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{"app*"},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "app2"},
+		},
+		{
+			name:  "include and exclude patterns",
+			items: []string{"app1", "app2", "app-system", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{"app*"},
+				Exclude: []string{"*system"},
+			},
+			want: []string{"app1", "app2"}, // app-system excluded, kube-system not included
+		},
+		{
+			name:  "exact match patterns",
+			items: []string{"app1", "app2", "special"},
+			patterns: PatternConfig{
+				Include: []string{"special", "app1"},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "special"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ApplyDiscoveryPatterns(tt.items, tt.patterns)
+			if err != nil {
+				t.Errorf("ApplyDiscoveryPatterns() error = %v", err)
+				return
+			}
+
+			if len(got) != len(tt.want) {
+				t.Errorf("ApplyDiscoveryPatterns() length = %v, want %v", len(got), len(tt.want))
+				return
+			}
+
+			// Check that all expected items are present
+			gotMap := make(map[string]bool)
+			for _, item := range got {
+				gotMap[item] = true
+			}
+
+			for _, wantItem := range tt.want {
+				if !gotMap[wantItem] {
+					t.Errorf("ApplyDiscoveryPatterns() missing expected item: %s", wantItem)
+				}
+			}
+		})
+	}
+}
+
+func TestMatchPattern(t *testing.T) {
+	tests := []struct {
+		name    string
+		item    string
+		pattern string
+		want    bool
+		wantErr bool
+	}{
+		{
+			name:    "exact match",
+			item:    "app1",
+			pattern: "app1",
+			want:    true,
+		},
+		{
+			name:    "wildcard all",
+			item:    "anything",
+			pattern: "*",
+			want:    true,
+		},
+		{
+			name:    "prefix wildcard",
+			item:    "app-namespace",
+			pattern: "app*",
+			want:    true,
+		},
+		{
+			name:    "suffix wildcard",
+			item:    "kube-system",
+			pattern: "*system",
+			want:    true,
+		},
+		{
+			name:    "substring wildcard",
+			item:    "my-app-namespace",
+			pattern: "*app*",
+			want:    true,
+		},
+		{
+			name:    "no match",
+			item:    "different",
+			pattern: "app*",
+			want:    false,
+		},
+		{
+			name:    "prefix no match",
+			item:    "other-app",
+			pattern: "app*",
+			want:    false,
+		},
+		{
+			name:    "suffix no match",
+			item:    "system-app",
+			pattern: "*system",
+			want:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := matchPattern(tt.item, tt.pattern)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("matchPattern() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("matchPattern() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSaveDiscoveryConfig(t *testing.T) {
+	config := getDefaultDiscoveryConfig()
+
+	tempDir := t.TempDir()
+	configPath := filepath.Join(tempDir, "test-config.json")
+
+	err := SaveDiscoveryConfig(config, configPath)
+	if err != nil {
+		t.Fatalf("SaveDiscoveryConfig() error = %v", err)
+	}
+
+	// Verify file was created
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		t.Error("SaveDiscoveryConfig() did not create config file")
+	}
+
+	// Verify we can load it back
+	loadedConfig, err := LoadDiscoveryConfig(configPath)
+	if err != nil {
+		t.Fatalf("Failed to reload saved config: %v", err)
+	}
+
+	if loadedConfig.Version != config.Version {
+		t.Errorf("Reloaded config version = %v, want %v", loadedConfig.Version, config.Version)
+	}
+}
+
+func TestGetDiscoveryConfigPath(t *testing.T) {
+	path := GetDiscoveryConfigPath()
+
+	if path == "" {
+		t.Error("GetDiscoveryConfigPath() should not return empty string")
+	}
+
+	// Should end with expected filename
+	expectedSuffix := "discovery.json"
+	if !strings.HasSuffix(path, expectedSuffix) {
+		t.Errorf("GetDiscoveryConfigPath() should end with %s, got %s", expectedSuffix, path)
+	}
+}
+
+func TestValidateDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name    string
+		config  *DiscoveryConfig
+		wantErr bool
+	}{
+		{
+			name: "valid config",
+			config: &DiscoveryConfig{
+				Version:  "v1",
+				Profiles: GetDiscoveryProfiles(),
+			},
+			wantErr: false,
+		},
+		{
+			name: "missing version gets default",
+			config: &DiscoveryConfig{
+				Profiles: GetDiscoveryProfiles(),
+			},
+			wantErr: false,
+		},
+		{
+			name: "nil profiles",
+			config: &DiscoveryConfig{
+				Version:  "v1",
+				Profiles: nil,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing required profile",
+			config: &DiscoveryConfig{
+				Version: "v1",
+				Profiles: map[string]DiscoveryProfile{
+					"custom": {Name: "custom"},
+				},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateDiscoveryConfig(tt.config)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateDiscoveryConfig() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func BenchmarkMatchPattern(b *testing.B) {
+	testCases := []struct {
+		item    string
+		pattern string
+	}{
+		{"app-namespace", "app*"},
+		{"kube-system", "*system"},
+		{"my-app-test", "*app*"},
+		{"exact-match", "exact-match"},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		for _, tc := range testCases {
+			_, err := matchPattern(tc.item, tc.pattern)
+			if err != nil {
+				b.Fatalf("matchPattern failed: %v", err)
+			}
+		}
+	}
+}
+
+func BenchmarkApplyDiscoveryPatterns(b *testing.B) {
+	items := make([]string, 100)
+	for i := 0; i < 100; i++ {
+		if i%3 == 0 {
+			items[i] = fmt.Sprintf("app-%d", i)
+		} else if i%3 == 1 {
+			items[i] = fmt.Sprintf("kube-system-%d", i)
+		} else {
+			items[i] = fmt.Sprintf("other-%d", i)
+		}
+	}
+
+	patterns := PatternConfig{
+		Include: []string{"app*", "other*"},
+		Exclude: []string{"*system*"},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := ApplyDiscoveryPatterns(items, patterns)
+		if err != nil {
+			b.Fatalf("ApplyDiscoveryPatterns failed: %v", err)
+		}
+	}
+}

cmd/troubleshoot/cli/interactive_results.go

@@ -2,30 +2,27 @@ package cli
 
 import (
 	"fmt"
-	"io/ioutil"
-	"os"
-	"path"
-	"time"
 
+	"github.com/mitchellh/go-wordwrap"
 	"github.com/pkg/errors"
 	ui "github.com/replicatedhq/termui/v3"
 	"github.com/replicatedhq/termui/v3/widgets"
-	"github.com/replicatedhq/troubleshoot/cmd/util"
+	"github.com/replicatedhq/troubleshoot/internal/util"
 	analyzerunner "github.com/replicatedhq/troubleshoot/pkg/analyze"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
 )
 
 var (
 	selectedResult = 0
 	table          = widgets.NewTable()
-	isShowingSaved = false
 )
 
-func showInteractiveResults(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
+func showInteractiveResults(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult, archivePath string) error {
 	if err := ui.Init(); err != nil {
 		return errors.Wrap(err, "failed to create terminal ui")
 	}
 	defer ui.Close()
-	drawUI(supportBundleName, analyzeResults)
+	drawUI(supportBundleName, analyzeResults, archivePath)
 
 	uiEvents := ui.PollEvents()
 	for {
@@ -35,29 +32,10 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 			case "<C-c>":
 				return nil
 			case "q":
-				if isShowingSaved == true {
-					isShowingSaved = false
-					ui.Clear()
-					drawUI(supportBundleName, analyzeResults)
-				} else {
-					return nil
-				}
-			case "s":
-				filename, err := save(analyzeResults)
-				if err != nil {
-					// show
-				} else {
-					showSaved(filename)
-					go func() {
-						time.Sleep(time.Second * 5)
-						isShowingSaved = false
-						ui.Clear()
-						drawUI(supportBundleName, analyzeResults)
-					}()
-				}
+				return nil
 			case "<Resize>":
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			case "<Down>":
 				if selectedResult < len(analyzeResults)-1 {
 					selectedResult++
@@ -67,7 +45,7 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 				}
 				table.ScrollDown()
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			case "<Up>":
 				if selectedResult > 0 {
 					selectedResult--
@@ -77,16 +55,16 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 				}
 				table.ScrollUp()
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			}
 		}
 	}
 }
 
-func drawUI(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult) {
+func drawUI(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult, archivePath string) {
 	drawGrid(analyzeResults)
 	drawHeader(supportBundleName)
-	drawFooter()
+	drawFooter(archivePath)
 }
 
 func drawGrid(analyzeResults []*analyzerunner.AnalyzeResult) {
@@ -99,9 +77,7 @@ func drawHeader(supportBundleName string) {
 
 	title := widgets.NewParagraph()
 	title.Text = fmt.Sprintf("%s Support Bundle Analysis", util.AppName(supportBundleName))
-	title.TextStyle.Fg = ui.ColorWhite
-	title.TextStyle.Bg = ui.ColorClear
-	title.TextStyle.Modifier = ui.ModifierBold
+	title.TextStyle = ui.NewStyle(ui.ColorWhite, ui.ColorClear, ui.ModifierBold)
 	title.Border = false
 
 	left := termWidth/2 - 2*len(title.Text)/3
@@ -111,11 +87,18 @@ func drawHeader(supportBundleName string) {
 	ui.Render(title)
 }
 
-func drawFooter() {
+func drawFooter(archivePath string) {
 	termWidth, termHeight := ui.TerminalDimensions()
 
+	archivePathMsg := widgets.NewParagraph()
+	archivePathMsg.Text = "Support bundle archive: " + archivePath
+	archivePathMsg.Border = false
+	archivePathMsg.TextStyle = ui.NewStyle(ui.ColorWhite, ui.ColorClear, ui.ModifierBold)
+
+	archivePathMsg.SetRect(0, termHeight-3, termWidth, termHeight-2)
+
 	instructions := widgets.NewParagraph()
-	instructions.Text = "[q] quit    [s] save    [↑][↓] scroll"
+	instructions.Text = "[q] quit    [↑][↓] scroll"
 	instructions.Border = false
 
 	left := 0
@@ -124,13 +107,13 @@ func drawFooter() {
 	bottom := termHeight
 
 	instructions.SetRect(left, top, right, bottom)
-	ui.Render(instructions)
+	ui.Render(archivePathMsg, instructions)
 }
 
 func drawAnalyzersTable(analyzeResults []*analyzerunner.AnalyzeResult) {
 	termWidth, termHeight := ui.TerminalDimensions()
 
-	table.SetRect(0, 3, termWidth/2, termHeight-6)
+	table.SetRect(0, 3, termWidth/2, termHeight-4)
 	table.FillRow = true
 	table.Border = true
 	table.Rows = [][]string{}
@@ -178,7 +161,10 @@ func drawDetails(analysisResult *analyzerunner.AnalyzeResult) {
 
 	currentTop := 4
 	title := widgets.NewParagraph()
-	title.Text = analysisResult.Title
+	// WrapText is set to false to prevent internal wordwrap which is not accounting for the padding
+	title.WrapText = false
+	// For long title that lead to wrapping text, the terminal width is divided by 2 and deducted by MESSAGE_TEXT_PADDING to account for the padding
+	title.Text = wordwrap.WrapString(analysisResult.Title, uint(termWidth/2-constants.MESSAGE_TEXT_PADDING))
 	title.Border = false
 	if analysisResult.IsPass {
 		title.TextStyle = ui.NewStyle(ui.ColorGreen, ui.ColorClear, ui.ModifierBold)
@@ -187,88 +173,24 @@ func drawDetails(analysisResult *analyzerunner.AnalyzeResult) {
 	} else if analysisResult.IsFail {
 		title.TextStyle = ui.NewStyle(ui.ColorRed, ui.ColorClear, ui.ModifierBold)
 	}
-	height := estimateNumberOfLines(title.Text, termWidth/2)
+	height := util.EstimateNumberOfLines(title.Text)
 	title.SetRect(termWidth/2, currentTop, termWidth, currentTop+height)
 	ui.Render(title)
 	currentTop = currentTop + height + 1
 
 	message := widgets.NewParagraph()
-	message.Text = analysisResult.Message
+	// WrapText is set to false to prevent internal wordwrap which is not accounting for the padding
+	message.WrapText = false
+	// For long text that lead to wrapping text, the terminal width is divided by 2 and deducted by MESSAGE_TEXT_PADDING to account for the padding
+	message.Text = wordwrap.WrapString(analysisResult.Message, uint(termWidth/2-constants.MESSAGE_TEXT_PADDING))
+	if analysisResult.URI != "" {
+		// Add URL to the message with wordwrap
+		// Add emply lines as separator
+		urlText := wordwrap.WrapString(fmt.Sprintf("For more information: %s", analysisResult.URI), uint(termWidth/2-constants.MESSAGE_TEXT_PADDING))
+		message.Text = message.Text + "\n\n" + urlText
+	}
+	height = util.EstimateNumberOfLines(message.Text) + constants.MESSAGE_TEXT_LINES_MARGIN_TO_BOTTOM
 	message.Border = false
-	height = estimateNumberOfLines(message.Text, termWidth/2) + 2
 	message.SetRect(termWidth/2, currentTop, termWidth, currentTop+height)
 	ui.Render(message)
-	currentTop = currentTop + height + 1
-
-	if analysisResult.URI != "" {
-		uri := widgets.NewParagraph()
-		uri.Text = fmt.Sprintf("For more information: %s", analysisResult.URI)
-		uri.Border = false
-		height = estimateNumberOfLines(uri.Text, termWidth/2)
-		uri.SetRect(termWidth/2, currentTop, termWidth, currentTop+height)
-		ui.Render(uri)
-		currentTop = currentTop + height + 1
-	}
-}
-
-func estimateNumberOfLines(text string, width int) int {
-	lines := len(text)/width + 1
-	return lines
-}
-
-func showSaved(filename string) {
-	termWidth, termHeight := ui.TerminalDimensions()
-
-	savedMessage := widgets.NewParagraph()
-	savedMessage.Text = fmt.Sprintf("Support Bundle analysis results saved to\n\n%s", filename)
-	savedMessage.WrapText = true
-	savedMessage.Border = true
-
-	left := termWidth/2 - 20
-	right := termWidth/2 + 20
-	top := termHeight/2 - 4
-	bottom := termHeight/2 + 4
-
-	savedMessage.SetRect(left, top, right, bottom)
-	ui.Render(savedMessage)
-
-	isShowingSaved = true
-}
-
-func save(analyzeResults []*analyzerunner.AnalyzeResult) (string, error) {
-	filename := path.Join(util.HomeDir(), fmt.Sprintf("%s-results.txt", "support-bundle"))
-	_, err := os.Stat(filename)
-	if err == nil {
-		os.Remove(filename)
-	}
-
-	results := ""
-	for _, analyzeResult := range analyzeResults {
-		result := ""
-
-		if analyzeResult.IsPass {
-			result = "Check PASS\n"
-		} else if analyzeResult.IsWarn {
-			result = "Check WARN\n"
-		} else if analyzeResult.IsFail {
-			result = "Check FAIL\n"
-		}
-
-		result = result + fmt.Sprintf("Title: %s\n", analyzeResult.Title)
-		result = result + fmt.Sprintf("Message: %s\n", analyzeResult.Message)
-
-		if analyzeResult.URI != "" {
-			result = result + fmt.Sprintf("URI: %s\n", analyzeResult.URI)
-		}
-
-		result = result + "\n------------\n"
-
-		results = results + result
-	}
-
-	if err := ioutil.WriteFile(filename, []byte(results), 0644); err != nil {
-		return "", errors.Wrap(err, "failed to save preflight results")
-	}
-
-	return filename, nil
 }

cmd/troubleshoot/cli/lint.go

@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/lint"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func LintCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lint [spec-files...]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Lint v1beta2/v1beta3 troubleshoot specs for syntax and structural errors",
+		Long: `Lint v1beta2/v1beta3 troubleshoot specs (both preflight and support-bundle) for syntax and structural errors.
+
+This command validates v1beta2/v1beta3 troubleshoot specs and checks for:
+- YAML syntax errors
+- Missing required fields (apiVersion, kind, metadata, spec)
+- Invalid template syntax ({{ .Values.* }})
+- Missing collectors or hostCollectors
+- Common structural issues
+- Missing docStrings (warning)
+
+Examples:
+  # Lint a single spec file
+  support-bundle lint my-spec.yaml
+
+  # Lint multiple spec files
+  support-bundle lint spec1.yaml spec2.yaml spec3.yaml
+
+  # Lint with automatic fixes
+  support-bundle lint --fix my-spec.yaml
+
+  # Lint and output as JSON for CI/CD integration
+  support-bundle lint --format json my-spec.yaml
+
+Notes:
+- v1beta2 does not support templating; template syntax in v1beta2 files will be flagged as errors.
+- v1beta3 supports templating and is linted with template-awareness.
+
+Exit codes:
+  0 - No errors found
+  2 - Validation errors found`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			opts := lint.LintOptions{
+				FilePaths:   args,
+				Fix:         v.GetBool("fix"),
+				Format:      v.GetString("format"),
+				ValuesFiles: v.GetStringSlice("values"),
+				SetValues:   v.GetStringSlice("set"),
+			}
+
+			return runLint(opts)
+		},
+	}
+
+	cmd.Flags().Bool("fix", false, "Automatically fix issues where possible")
+	cmd.Flags().String("format", "text", "Output format: text or json")
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files with template values (required for v1beta3 specs)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values via command line (e.g., --set key=value)")
+
+	return cmd
+}
+
+func runLint(opts lint.LintOptions) error {
+	// Validate file paths exist
+	for _, filePath := range opts.FilePaths {
+		if _, err := os.Stat(filePath); err != nil {
+			return errors.Wrapf(err, "file not found: %s", filePath)
+		}
+	}
+
+	// Run linting
+	results, err := lint.LintFiles(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to lint files")
+	}
+
+	// Format and print results
+	output := lint.FormatResults(results, opts.Format)
+	fmt.Print(output)
+
+	// Return appropriate exit code
+	if lint.HasErrors(results) {
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES, nil)
+	}
+
+	return nil
+}

cmd/troubleshoot/cli/redact.go

@@ -0,0 +1,82 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/pkg/errors"
+	analyzer "github.com/replicatedhq/troubleshoot/pkg/analyze"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func Redact() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "redact [urls...]",
+		Args:  cobra.MinimumNArgs(1), // TODO
+		Short: "Redact information from a generated support bundle archive",
+		Long: `Redaction is the process of masking sensitive information from collected data in a support bundle.
+This is done using rules defined in the list of redactor manifests provided in the [urls...] command line
+argument. Default built in redactors will also be run, but these would have been run when the support
+bundle was generated. After redaction, the support bundle is archived once more. The resulting file will
+be stored in the current directory in the path provided by the --output flag.
+
+The [urls...] argument is a list of either oci://.., http://.., https://.. or local paths to yaml files.
+
+For more information on redactors visit https://troubleshoot.sh/docs/redact/
+		`,
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			// 1. Decode redactors from provided URLs
+			redactors, err := supportbundle.GetRedactorsFromURIs(args)
+			if err != nil {
+				return err
+			}
+
+			// 2. Download the bundle and extract it
+			tmpDir, bundleDir, err := analyzer.DownloadAndExtractSupportBundle(v.GetString("bundle"))
+			if err != nil {
+				return err
+			}
+			defer os.RemoveAll(tmpDir)
+
+			// 3. Represent bundle as a CollectorResult
+			collectorResult, err := collect.CollectorResultFromBundle(bundleDir)
+			if err != nil {
+				return err
+			}
+
+			// 4. Perform redaction on the bundle
+			err = collect.RedactResult(bundleDir, collectorResult, redactors)
+			if err != nil {
+				return errors.Wrap(err, "failed to redact support bundle")
+			}
+
+			// 5. Compress the bundle once more after redacting
+			output := v.GetString("output")
+			if output == "" {
+				output = fmt.Sprintf("redacted-support-bundle-%s.tar.gz", time.Now().Format("2006-01-02T15_04_05"))
+			}
+			err = collectorResult.ArchiveBundle(bundleDir, output)
+			if err != nil {
+				return errors.Wrap(err, "failed to create support bundle archive")
+			}
+			fmt.Println("Redacted support bundle:", output)
+			return nil
+		},
+	}
+
+	cmd.Flags().String("bundle", "", "file path of the support bundle archive to redact")
+	cmd.MarkFlagRequired("bundle")
+	cmd.Flags().BoolP("quiet", "q", false, "enable/disable error messaging and only show parseable output")
+	cmd.Flags().StringP("output", "o", "", "file path of where to save the redacted support bundle archive (default \"redacted-support-bundle-YYYY-MM-DDTHH_MM_SS.tar.gz\")")
+
+	return cmd
+}

cmd/troubleshoot/cli/root.go

@@ -1,63 +1,189 @@
 package cli
 
 import (
-	"io/ioutil"
+	"fmt"
 	"os"
 	"strings"
 
-	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"errors"
+
+	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
+	"github.com/replicatedhq/troubleshoot/internal/traces"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/replicatedhq/troubleshoot/pkg/updater"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
 func RootCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "support-bundle [url]",
-		Args:  cobra.MinimumNArgs(1),
-		Short: "Generate a support bundle",
-		Long: `A support bundle is an archive of files, output, metrics and state
-from a server that can be used to assist when troubleshooting a Kubernetes cluster.`,
+		Use:   "support-bundle [urls...]",
+		Args:  cobra.MinimumNArgs(0),
+		Short: "Generate a support bundle from a Kubernetes cluster or specified sources",
+		Long: `Generate a support bundle, an archive containing files, output, metrics, and cluster state to aid in troubleshooting Kubernetes clusters.
+
+If no arguments are provided, specs are automatically loaded from the cluster by default.
+
+**Argument Types**:
+1. **Secret**: Load specs from a Kubernetes Secret. Format: "secret/namespace-name/secret-name[/data-key]"
+2. **ConfigMap**: Load specs from a Kubernetes ConfigMap. Format: "configmap/namespace-name/configmap-name[/data-key]"
+3. **File**: Load specs from a local file. Format: Local file path
+4. **Standard Input**: Read specs from stdin. Format: "-"
+5. **URL**: Load specs from a URL. Supports HTTP and OCI registry URLs.`,
 		SilenceUsage: true,
-		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			v := viper.GetViper()
+			v.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+
+			if err := util.StartProfiling(); err != nil {
+				klog.Errorf("Failed to start profiling: %v", err)
+			}
+
+			// Auto-update support-bundle unless disabled by flag or env
+			// Only run auto-update for the root support-bundle command, not subcommands
+			if cmd.Name() == "support-bundle" && !cmd.HasParent() {
+				envAuto := os.Getenv("TROUBLESHOOT_AUTO_UPDATE")
+				autoFromEnv := true
+				if envAuto != "" {
+					if strings.EqualFold(envAuto, "0") || strings.EqualFold(envAuto, "false") {
+						autoFromEnv = false
+					}
+				}
+				if v.GetBool("auto-update") && autoFromEnv {
+					exe, err := os.Executable()
+					if err == nil {
+						_ = updater.CheckAndUpdate(cmd.Context(), updater.Options{
+							BinaryName:  "support-bundle",
+							CurrentPath: exe,
+							Printf:      func(f string, a ...interface{}) { fmt.Fprintf(os.Stderr, f, a...) },
+						})
+					}
+				}
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
-			logger.SetQuiet(v.GetBool("quiet"))
-			return runTroubleshoot(v, args[0])
+			// If there are no locations to load specs from passed in the cli args, we should
+			// load them from the cluster by setting "load-cluster-specs=true". If the caller
+			// provided "--load-cluster-specs" cli option, we should respect it.
+			if len(args) == 0 {
+				// Check if --load-cluster-specs was set by the cli caller to avoid overriding it
+				flg := cmd.Flags().Lookup("load-cluster-specs")
+				if flg != nil && !flg.Changed {
+					// Load specs from the cluster if no spec(s) is(are) provided in the cli args
+					v.Set("load-cluster-specs", true)
+				}
+			}
+
+			closer, err := traces.ConfigureTracing("support-bundle")
+			if err != nil {
+				// Do not fail running support-bundle if tracing fails
+				klog.Errorf("Failed to initialize open tracing provider: %v", err)
+			} else {
+				defer closer()
+			}
+
+			err = runTroubleshoot(v, args)
+			if !v.IsSet("dry-run") && (v.GetBool("debug") || v.IsSet("v")) {
+				fmt.Fprintf(os.Stderr, "\n%s", traces.GetExporterInstance().GetSummary())
+			}
+
+			return err
+		},
+		PersistentPostRun: func(cmd *cobra.Command, args []string) {
+			if err := util.StopProfiling(); err != nil {
+				klog.Errorf("Failed to stop profiling: %v", err)
+			}
 		},
 	}
 
 	cobra.OnInitialize(initConfig)
 
 	cmd.AddCommand(Analyze())
-	cmd.AddCommand(VersionCmd())
+	cmd.AddCommand(Redact())
+	cmd.AddCommand(Diff())
+	cmd.AddCommand(Schedule())
+	cmd.AddCommand(UploadCmd())
+	cmd.AddCommand(LintCmd())
+	cmd.AddCommand(util.VersionCmd())
 
 	cmd.Flags().StringSlice("redactors", []string{}, "names of the additional redactors to use")
 	cmd.Flags().Bool("redact", true, "enable/disable default redactions")
+
+	// Tokenization flags
+	cmd.Flags().Bool("tokenize", false, "enable intelligent tokenization instead of simple masking (replaces ***HIDDEN*** with ***TOKEN_TYPE_HASH***)")
+	cmd.Flags().String("redaction-map", "", "generate redaction mapping file at specified path (enables token→original mapping for authorized access)")
+	cmd.Flags().Bool("encrypt-redaction-map", false, "encrypt the redaction mapping file using AES-256 (requires --redaction-map)")
+	cmd.Flags().String("token-prefix", "", "custom token prefix format (default: ***TOKEN_%s_%s***)")
+	cmd.Flags().Bool("verify-tokenization", false, "validation mode: verify tokenization setup without collecting data")
+	cmd.Flags().String("bundle-id", "", "custom bundle identifier for token correlation (auto-generated if not provided)")
+	cmd.Flags().Bool("tokenization-stats", false, "include detailed tokenization statistics in output")
 	cmd.Flags().Bool("interactive", true, "enable/disable interactive mode")
-	cmd.Flags().Bool("collect-without-permissions", false, "always generate a support bundle, even if it some require additional permissions")
+	cmd.Flags().Bool("collect-without-permissions", true, "always generate a support bundle, even if it some require additional permissions")
+	cmd.Flags().StringSliceP("selector", "l", []string{"troubleshoot.sh/kind=support-bundle"}, "selector to filter on for loading additional support bundle specs found in secrets within the cluster")
+	cmd.Flags().Bool("load-cluster-specs", false, "enable/disable loading additional troubleshoot specs found within the cluster. Do not load by default unless no specs are provided in the cli args")
 	cmd.Flags().String("since-time", "", "force pod logs collectors to return logs after a specific date (RFC3339)")
 	cmd.Flags().String("since", "", "force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.")
+	cmd.Flags().Int("remote-host-collect-timeout", 30, "timeout in seconds for remote host collect operations (e.g. waiting for pods/daemonsets)")
+	cmd.Flags().StringP("output", "o", "", "specify the output file path for the support bundle (.tar.gz extension is added automatically)")
+	cmd.Flags().Bool("debug", false, "enable debug logging. This is equivalent to --v=0")
+	cmd.Flags().Bool("dry-run", false, "print support bundle spec without collecting anything")
+	cmd.Flags().Bool("auto-update", true, "enable automatic binary self-update check and install")
+	cmd.Flags().StringSlice("metadata", []string{}, "user-provided metadata key=value pairs to include in the bundle (can be specified multiple times)")
+
+	// Upload flags
+	cmd.Flags().Bool("auto-upload", false, "automatically upload resulting bundle to replicated.app")
+	cmd.Flags().String("license-id", "", "license ID for authentication when uploading (auto-detected from bundle if not provided)")
+	cmd.Flags().String("app-slug", "", "application slug when uploading (auto-detected from bundle if not provided)")
+	cmd.Flags().String("upload-domain", "", "custom domain for upload (default: replicated.app)")
+
+	// Auto-discovery flags
+	cmd.Flags().Bool("auto", false, "enable auto-discovery of foundational collectors. When used with YAML specs, adds foundational collectors to YAML collectors. When used alone, collects only foundational data")
+	cmd.Flags().Bool("include-images", false, "include container image metadata collection when using auto-discovery")
+	cmd.Flags().Bool("rbac-check", true, "enable RBAC permission checking for auto-discovered collectors")
+	cmd.Flags().String("discovery-profile", "standard", "auto-discovery profile: minimal, standard, comprehensive, or paranoid")
+	cmd.Flags().StringSlice("exclude-namespaces", []string{}, "namespaces to exclude from auto-discovery (supports glob patterns)")
+	cmd.Flags().StringSlice("include-namespaces", []string{}, "namespaces to include in auto-discovery (supports glob patterns). If specified, only these namespaces will be included")
+	cmd.Flags().Bool("include-system-namespaces", false, "include system namespaces (kube-system, etc.) in auto-discovery")
 
 	// hidden in favor of the `insecure-skip-tls-verify` flag
 	cmd.Flags().Bool("allow-insecure-connections", false, "when set, do not verify TLS certs when retrieving spec and reporting results")
 	cmd.Flags().MarkHidden("allow-insecure-connections")
 
-	viper.BindPFlags(cmd.Flags())
-
-	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+	// `no-uri` references the `followURI` functionality where we can use an upstream spec when creating a support bundle
+	// This flag makes sure we can also disable this and fall back to the default spec.
+	cmd.Flags().Bool("no-uri", false, "When this flag is used, Troubleshoot does not attempt to retrieve the spec referenced by the uri: field`")
 
 	k8sutil.AddFlags(cmd.Flags())
 
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
+	// CPU and memory profiling flags
+	util.AddProfilingFlags(cmd)
+
 	return cmd
 }
 
 func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
+	cmd := RootCmd()
+	if err := cmd.Execute(); err != nil {
+		var exitErr types.ExitError
+		if errors.As(err, &exitErr) {
+			if exitErr.ExitStatus() != constants.EXIT_CODE_FAIL && exitErr.ExitStatus() != constants.EXIT_CODE_WARN {
+				cmd.PrintErrln("Error:", err.Error())
+			}
+			os.Exit(exitErr.ExitStatus())
+		}
+		cmd.PrintErrln("Error:", err.Error())
 		os.Exit(1)
 	}
 }
@@ -66,24 +192,3 @@ func initConfig() {
 	viper.SetEnvPrefix("TROUBLESHOOT")
 	viper.AutomaticEnv()
 }
-
-func ensureCollectorInList(list []*troubleshootv1beta2.Collect, collector troubleshootv1beta2.Collect) []*troubleshootv1beta2.Collect {
-	for _, inList := range list {
-		if collector.ClusterResources != nil && inList.ClusterResources != nil {
-			return list
-		}
-		if collector.ClusterInfo != nil && inList.ClusterInfo != nil {
-			return list
-		}
-	}
-
-	return append(list, &collector)
-}
-
-func writeFile(filename string, contents []byte) error {
-	if err := ioutil.WriteFile(filename, contents, 0644); err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/troubleshoot/cli/run_test.go

@@ -0,0 +1,517 @@
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/replicatedhq/troubleshoot/internal/testutils"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/httputil"
+	"github.com/replicatedhq/troubleshoot/pkg/loader"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	testclient "k8s.io/client-go/kubernetes/fake"
+)
+
+func templSpec() string {
+	return `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-1
+spec:
+  uri: $MY_URI
+  collectors:
+    - configMap:
+        name: kube-root-ca.crt
+        namespace: default
+`
+}
+
+func Test_loadSupportBundleSpecsFromURIs(t *testing.T) {
+	// Run a webserver to serve the spec
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-2
+spec:
+  collectors:
+    - clusterInfo: {}`))
+	}))
+	defer srv.Close()
+
+	orig := strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL)
+
+	ctx := context.Background()
+	kinds, err := loader.LoadSpecs(ctx, loader.LoadOptions{RawSpec: orig})
+	require.NoError(t, err)
+	require.NotNil(t, kinds)
+
+	assert.Len(t, kinds.SupportBundlesV1Beta2, 1)
+	assert.NotNil(t, kinds.SupportBundlesV1Beta2[0].Spec.Collectors[0].ConfigMap)
+	err = loadSupportBundleSpecsFromURIs(ctx, kinds)
+	require.NoError(t, err)
+
+	require.Len(t, kinds.SupportBundlesV1Beta2, 1)
+	assert.NotNil(t, kinds.SupportBundlesV1Beta2[0].Spec.Collectors[0].ClusterInfo)
+}
+
+func Test_loadMultipleSupportBundleSpecsWithNoURIs(t *testing.T) {
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+	specs := []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-1
+spec:
+  collectors:
+    - clusterInfo:{}`), testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-2
+  spec:
+    collectors:
+      - clusterInfo: {}`)}
+
+	sb, _, err := loadSpecs(ctx, specs, client)
+	require.NoError(t, err)
+	require.Len(t, sb.Spec.Collectors, 2)
+}
+
+func Test_loadMultipleSupportBundleSpecsWithURIs(t *testing.T) {
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+
+	specFile := testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-file
+spec:
+  collectors:
+    - logs:
+        name: podlogs/kotsadm
+        selector:
+          - app=kotsadm
+`)
+
+	// Run a webserver to serve the spec
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-uri
+spec:
+  collectors:
+    - clusterInfo: {}`))
+	}))
+	defer srv.Close()
+
+	orig := strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL)
+	specUri := testutils.ServeFromFilePath(t, orig)
+	specs := []string{specFile, specUri}
+
+	sb, _, err := loadSpecs(ctx, specs, client)
+	require.NoError(t, err)
+	assert.NotNil(t, sb.Spec.Collectors[0].Logs)
+	assert.Nil(t, sb.Spec.Collectors[1].ConfigMap)      // original spec gone
+	assert.NotNil(t, sb.Spec.Collectors[1].ClusterInfo) // new spec from URI
+}
+
+func Test_loadSupportBundleSpecsFromURIs_TimeoutError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(2 * time.Second) // this will cause a timeout
+	}))
+	defer srv.Close()
+	ctx := context.Background()
+
+	kinds, err := loader.LoadSpecs(ctx, loader.LoadOptions{
+		RawSpec: strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL),
+	})
+	require.NoError(t, err)
+
+	// Set the timeout on the http client to 500ms
+	// The server sleeps for 2 seconds, so this should still timeout
+	// supportbundle.LoadSupportBundleSpec does not yet use the context
+	before := httputil.GetHttpClient().Timeout
+	httputil.GetHttpClient().Timeout = 500 * time.Millisecond
+	defer func() {
+		// Reinstate the original timeout. Its a global var so we need to reset it
+		httputil.GetHttpClient().Timeout = before
+	}()
+
+	beforeJSON, err := json.Marshal(kinds)
+	require.NoError(t, err)
+
+	err = loadSupportBundleSpecsFromURIs(ctx, kinds)
+	require.NoError(t, err)
+
+	afterJSON, err := json.Marshal(kinds)
+	require.NoError(t, err)
+
+	assert.JSONEq(t, string(beforeJSON), string(afterJSON))
+}
+
+func Test_loadSupportBundleSpecs(t *testing.T) {
+	tests := []struct {
+		name     string
+		args     []string
+		expected troubleshootv1beta2.SupportBundleSpec
+	}{
+		{
+			name: "empty collectors array in spec, default collectors added",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  collectors: []
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+			},
+		},
+		{
+			name: "no collectors defined in spec, default collectors added",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  analyzers: []
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+				Analyzers: []*troubleshootv1beta2.Analyze{},
+			},
+		},
+		{
+			name: "collectors present but defaults missing, default collectors added",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  collectors:
+  - logs: {}
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						Logs: &troubleshootv1beta2.Logs{},
+					},
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+			},
+		},
+		{
+			name: "empty support bundle spec adds default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+			},
+		},
+		{
+			name: "sb spec with host collectors does not add default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  hostCollectors:
+  - cpu: {}
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				HostCollectors: []*troubleshootv1beta2.HostCollect{
+					{
+						CPU: &troubleshootv1beta2.CPU{},
+					},
+				},
+			},
+		},
+		{
+			name: "host collector spec with collectors does not add default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+spec:
+  collectors:
+  - cpu: {}
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				HostCollectors: []*troubleshootv1beta2.HostCollect{
+					{
+						CPU: &troubleshootv1beta2.CPU{},
+					},
+				},
+			},
+		},
+		{
+			name: "sb spec with host and in-cluster collectors adds default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  hostCollectors:
+  - cpu: {}
+  collectors:
+  - logs: {}
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				HostCollectors: []*troubleshootv1beta2.HostCollect{
+					{
+						CPU: &troubleshootv1beta2.CPU{},
+					},
+				},
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						Logs: &troubleshootv1beta2.Logs{},
+					},
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+			},
+		},
+		{
+			name: "sb spec with host collectors and empty in-cluster collectors does not default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  hostCollectors:
+  - cpu: {}
+  collectors: []
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				HostCollectors: []*troubleshootv1beta2.HostCollect{
+					{
+						CPU: &troubleshootv1beta2.CPU{},
+					},
+				},
+				Collectors: []*troubleshootv1beta2.Collect{},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.Background()
+			client := testclient.NewSimpleClientset()
+
+			sb, _, err := loadSpecs(ctx, test.args, client)
+			require.NoError(t, err)
+
+			assert.Equal(t, test.expected, sb.Spec)
+		})
+	}
+}
+
+func Test_loadDuplicatedBundleSpecs(t *testing.T) {
+	spec := testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb
+spec:
+  collectors:
+  - helm: {}
+  analyzers:
+  - clusterVersion: {}
+  hostCollectors:
+  - cpu: {}
+  hostAnalyzers:
+  - cpu: {}
+`)
+	args := []string{spec, spec}
+
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+	sb, _, err := loadSpecs(ctx, args, client)
+	require.NoError(t, err)
+	assert.Len(t, sb.Spec.Collectors, 1+2) // default clusterInfo + clusterResources
+	assert.Len(t, sb.Spec.Analyzers, 1)
+	assert.Len(t, sb.Spec.HostCollectors, 1)
+	assert.Len(t, sb.Spec.HostAnalyzers, 1)
+}
+
+func Test_loadSpecsFromURL(t *testing.T) {
+	// Run a webserver to serve the URI spec
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-2
+spec:
+  collectors:
+    - logs:
+        name: podlogs/kotsadm
+        selector:
+          - app=kotsadm`))
+	}))
+	defer srv.Close()
+
+	// update URI spec with the server URL
+	orig := strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL)
+
+	// now create a webserver to serve the spec with URI
+	srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(orig))
+	}))
+	defer srv.Close()
+
+	fileSpec := testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb
+spec:
+  collectors:
+    - helm: {}`)
+
+	// test and ensure that URI spec is not loaded
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+	sb, _, err := loadSpecs(ctx, []string{fileSpec, srv.URL}, client)
+	require.NoError(t, err)
+	assert.Len(t, sb.Spec.Collectors, 2+2)            // default + clusterInfo + clusterResources
+	assert.NotNil(t, sb.Spec.Collectors[0].Helm)      // come from the file spec
+	assert.NotNil(t, sb.Spec.Collectors[1].ConfigMap) // come from the original spec
+	assert.Nil(t, sb.Spec.Collectors[1].Logs)         // come from the URI spec
+}
+
+func Test_loadInvalidURISpec(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`invalid spec`))
+	}))
+	defer srv.Close()
+
+	// update URI spec with the server URL
+	orig := strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL)
+	specFile := testutils.ServeFromFilePath(t, orig)
+
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+	sb, _, err := loadSpecs(ctx, []string{specFile}, client)
+	require.NoError(t, err)
+	assert.Len(t, sb.Spec.Collectors, 3)              // default + clusterInfo + clusterResources
+	assert.NotNil(t, sb.Spec.Collectors[0].ConfigMap) // come from the original spec
+}
+
+func TestCollectTimeoutFlag(t *testing.T) {
+	const defaultCollectTimeout = 30
+
+	// Parse flags and bind to viper without running the full command (avoids k8s connection).
+	// This verifies the flag is defined and viper receives the correct value.
+	bindFlagsFromArgs := func(t *testing.T, args []string) {
+		t.Helper()
+		cmd := RootCmd()
+		require.NoError(t, cmd.Flags().Parse(args))
+		if cmd.PersistentPreRun != nil {
+			cmd.PersistentPreRun(cmd, nil)
+		}
+	}
+
+	t.Run("default value when flag not set", func(t *testing.T) {
+		bindFlagsFromArgs(t, []string{})
+		actualTimeout := viper.GetInt("remote-host-collect-timeout")
+		assert.Equal(t, defaultCollectTimeout, actualTimeout, "remote-host-collect-timeout should default to 30 seconds")
+	})
+
+	t.Run("custom value when flag set", func(t *testing.T) {
+		bindFlagsFromArgs(t, []string{"--remote-host-collect-timeout=90"})
+		actualTimeout := viper.GetInt("remote-host-collect-timeout")
+		assert.Equal(t, 90, actualTimeout, "remote-host-collect-timeout should be 90 when --remote-host-collect-timeout=90 is passed")
+	})
+}
+
+func TestParseMetadataFlag(t *testing.T) {
+	tests := []struct {
+		name    string
+		values  []string
+		want    map[string]string
+		wantErr bool
+	}{
+		{
+			name:   "nil input",
+			values: nil,
+			want:   nil,
+		},
+		{
+			name:   "empty input",
+			values: []string{},
+			want:   nil,
+		},
+		{
+			name:   "single pair",
+			values: []string{"env=staging"},
+			want:   map[string]string{"env": "staging"},
+		},
+		{
+			name:   "multiple pairs",
+			values: []string{"env=staging", "version=1.2.3"},
+			want:   map[string]string{"env": "staging", "version": "1.2.3"},
+		},
+		{
+			name:   "value contains equals",
+			values: []string{"config=key=value"},
+			want:   map[string]string{"config": "key=value"},
+		},
+		{
+			name:    "missing equals",
+			values:  []string{"noequals"},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parseMetadataFlag(tt.values)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tt.want, got)
+			}
+		})
+	}
+}

cmd/troubleshoot/cli/schedule.go

@@ -0,0 +1,11 @@
+package cli
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/schedule"
+	"github.com/spf13/cobra"
+)
+
+// Schedule returns the schedule command for managing scheduled support bundle jobs
+func Schedule() *cobra.Command {
+	return schedule.CLI()
+}

cmd/troubleshoot/cli/upload.go

@@ -0,0 +1,61 @@
+package cli
+
+import (
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func UploadCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "upload [bundle-file]",
+		Args:  cobra.ExactArgs(1),
+		Short: "Upload a support bundle to replicated.app",
+		Long: `Upload a support bundle to replicated.app for analysis and troubleshooting.
+
+This command automatically extracts the license ID and app slug from the bundle if not provided.
+
+Examples:
+  # Auto-detect license and app from bundle
+  support-bundle upload bundle.tar.gz
+
+  # Specify license ID explicitly
+  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID
+
+  # Specify both license and app
+  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID --app-slug my-app
+
+  # Upload to a custom domain (e.g., development environment)
+  support-bundle upload bundle.tar.gz --upload-domain replicated-app-dev.example.com`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+			bundlePath := args[0]
+
+			// Check if bundle file exists
+			if _, err := os.Stat(bundlePath); os.IsNotExist(err) {
+				return errors.Errorf("bundle file does not exist: %s", bundlePath)
+			}
+
+			// Get upload parameters
+			licenseID := v.GetString("license-id")
+			appSlug := v.GetString("app-slug")
+			uploadDomain := v.GetString("upload-domain")
+
+			// Use auto-detection for uploads
+			if err := supportbundle.UploadBundleAutoDetect(bundlePath, licenseID, appSlug, uploadDomain); err != nil {
+				return errors.Wrap(err, "upload failed")
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Flags().String("license-id", "", "license ID for authentication (auto-detected from bundle if not provided)")
+	cmd.Flags().String("app-slug", "", "application slug (auto-detected from bundle if not provided)")
+	cmd.Flags().String("upload-domain", "", "custom domain for upload (default: replicated.app)")
+
+	return cmd
+}

cmd/troubleshoot/cli/util.go

@@ -1,24 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/pkg/errors"
-)
-
-func findFileName(basename, extension string) (string, error) {
-	n := 1
-	name := basename
-	for {
-		filename := name + "." + extension
-		if _, err := os.Stat(filename); os.IsNotExist(err) {
-			return filename, nil
-		} else if err != nil {
-			return "", errors.Wrap(err, "check file exists")
-		}
-
-		name = fmt.Sprintf("%s (%d)", basename, n)
-		n = n + 1
-	}
-}

cmd/troubleshoot/cli/version.go

@@ -1,51 +0,0 @@
-package cli
-
-import (
-	"fmt"
-
-	"io/ioutil"
-	"path/filepath"
-
-	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
-	"github.com/replicatedhq/troubleshoot/pkg/version"
-	"github.com/spf13/cobra"
-	"gopkg.in/yaml.v2"
-)
-
-func VersionCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "version",
-		Short: "Print the current version and exit",
-		Long:  `Print the current version and exit`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			fmt.Printf("Replicated Troubleshoot %s\n", version.Version())
-
-			return nil
-		},
-	}
-	return cmd
-}
-
-const VersionFilename = "version.yaml"
-
-func writeVersionFile(path string) error {
-	version := troubleshootv1beta2.SupportBundleVersion{
-		ApiVersion: "troubleshoot.sh/v1beta2",
-		Kind:       "SupportBundle",
-		Spec: troubleshootv1beta2.SupportBundleVersionSpec{
-			VersionNumber: version.Version(),
-		},
-	}
-	b, err := yaml.Marshal(version)
-	if err != nil {
-		return err
-	}
-
-	filename := filepath.Join(path, VersionFilename)
-	err = ioutil.WriteFile(filename, b, 0644)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/util/util.go

@@ -1,39 +0,0 @@
-package util
-
-import (
-	"net/url"
-	"os"
-	"strings"
-)
-
-func HomeDir() string {
-	if h := os.Getenv("HOME"); h != "" {
-		return h
-	}
-	return os.Getenv("USERPROFILE") // windows
-}
-
-func IsURL(str string) bool {
-	parsed, err := url.ParseRequestURI(str)
-	if err != nil {
-		return false
-	}
-
-	return parsed.Scheme != ""
-}
-
-func AppName(name string) string {
-	words := strings.Split(strings.Title(strings.Replace(name, "-", " ", -1)), " ")
-	casedWords := []string{}
-	for i, word := range words {
-		if strings.ToLower(word) == "ai" {
-			casedWords = append(casedWords, "AI")
-		} else if strings.ToLower(word) == "io" && i > 0 {
-			casedWords[i-1] += ".io"
-		} else {
-			casedWords = append(casedWords, word)
-		}
-	}
-
-	return strings.Join(casedWords, " ")
-}

config/crds/troubleshoot.replicated.com_collectors.yaml

@@ -1,11 +1,9 @@
-
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.3.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: collectors.troubleshoot.replicated.com
 spec:
   group: troubleshoot.replicated.com
@@ -15,373 +13,343 @@ spec:
     plural: collectors
     singular: collector
   scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      description: Collector is the Schema for the collectors API
-      properties:
-        apiVersion:
-          description: 'APIVersion defines the versioned schema of this representation
-            of an object. Servers should convert recognized schemas to the latest
-            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-          type: string
-        kind:
-          description: 'Kind is a string value representing the REST resource this
-            object represents. Servers may infer this from the endpoint the client
-            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-          type: string
-        metadata:
-          type: object
-        spec:
-          description: CollectorSpec defines the desired state of Collector
-          properties:
-            afterCollection:
-              items:
-                properties:
-                  callback:
-                    properties:
-                      method:
-                        type: string
-                      redactUri:
-                        type: string
-                      uri:
-                        type: string
-                    required:
-                    - method
-                    - redactUri
-                    - uri
-                    type: object
-                  uploadResultsTo:
-                    properties:
-                      method:
-                        type: string
-                      redactUri:
-                        type: string
-                      uri:
-                        type: string
-                    required:
-                    - method
-                    - redactUri
-                    - uri
-                    type: object
-                type: object
-              type: array
-            collectors:
-              items:
-                properties:
-                  clusterInfo:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                    type: object
-                  clusterResources:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                    type: object
-                  copy:
-                    properties:
-                      collectorName:
-                        type: string
-                      containerName:
-                        type: string
-                      containerPath:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                      selector:
-                        items:
-                          type: string
-                        type: array
-                    required:
-                    - containerPath
-                    - namespace
-                    - selector
-                    type: object
-                  data:
-                    properties:
-                      collectorName:
-                        type: string
-                      data:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      name:
-                        type: string
-                    required:
-                    - data
-                    type: object
-                  exec:
-                    properties:
-                      args:
-                        items:
-                          type: string
-                        type: array
-                      collectorName:
-                        type: string
-                      command:
-                        items:
-                          type: string
-                        type: array
-                      containerName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                      selector:
-                        items:
-                          type: string
-                        type: array
-                      timeout:
-                        type: string
-                    required:
-                    - namespace
-                    - selector
-                    type: object
-                  http:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      get:
-                        properties:
-                          headers:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          insecureSkipVerify:
-                            type: boolean
-                          url:
-                            type: string
-                        required:
-                        - url
-                        type: object
-                      name:
-                        type: string
-                      post:
-                        properties:
-                          body:
-                            type: string
-                          headers:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          insecureSkipVerify:
-                            type: boolean
-                          url:
-                            type: string
-                        required:
-                        - url
-                        type: object
-                      put:
-                        properties:
-                          body:
-                            type: string
-                          headers:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          insecureSkipVerify:
-                            type: boolean
-                          url:
-                            type: string
-                        required:
-                        - url
-                        type: object
-                    type: object
-                  logs:
-                    properties:
-                      collectorName:
-                        type: string
-                      containerNames:
-                        items:
-                          type: string
-                        type: array
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      limits:
-                        properties:
-                          maxAge:
-                            type: string
-                          maxLines:
-                            format: int64
-                            type: integer
-                        type: object
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                      selector:
-                        items:
-                          type: string
-                        type: array
-                    required:
-                    - selector
-                    type: object
-                  mysql:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      uri:
-                        type: string
-                    required:
-                    - uri
-                    type: object
-                  postgres:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      uri:
-                        type: string
-                    required:
-                    - uri
-                    type: object
-                  redis:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      uri:
-                        type: string
-                    required:
-                    - uri
-                    type: object
-                  run:
-                    properties:
-                      args:
-                        items:
-                          type: string
-                        type: array
-                      collectorName:
-                        type: string
-                      command:
-                        items:
-                          type: string
-                        type: array
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      image:
-                        type: string
-                      imagePullPolicy:
-                        type: string
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                      timeout:
-                        type: string
-                    required:
-                    - image
-                    - namespace
-                    type: object
-                  secret:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool
-                          or a string.  When used in JSON or YAML marshalling and
-                          unmarshalling, it produces or consumes the inner type.  This
-                          allows you to have, for example, a JSON field that can accept
-                          a booolean string or raw bool.
-                        type: BoolString
-                      includeValue:
-                        type: boolean
-                      key:
-                        type: string
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
-              type: array
-          type: object
-        status:
-          description: CollectorStatus defines the observed state of Collector
-          type: object
-      type: object
-  version: v1beta1
   versions:
   - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Collector is the Schema for the collectors API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: CollectorSpec defines the desired state of Collector
+            properties:
+              afterCollection:
+                items:
+                  properties:
+                    callback:
+                      properties:
+                        method:
+                          type: string
+                        redactUri:
+                          type: string
+                        uri:
+                          type: string
+                      required:
+                      - method
+                      - redactUri
+                      - uri
+                      type: object
+                    uploadResultsTo:
+                      properties:
+                        method:
+                          type: string
+                        redactUri:
+                          type: string
+                        uri:
+                          type: string
+                      required:
+                      - method
+                      - redactUri
+                      - uri
+                      type: object
+                  type: object
+                type: array
+              collectors:
+                items:
+                  properties:
+                    clusterInfo:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    clusterResources:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    copy:
+                      properties:
+                        collectorName:
+                          type: string
+                        containerName:
+                          type: string
+                        containerPath:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                        selector:
+                          items:
+                            type: string
+                          type: array
+                      required:
+                      - containerPath
+                      - namespace
+                      - selector
+                      type: object
+                    data:
+                      properties:
+                        collectorName:
+                          type: string
+                        data:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        name:
+                          type: string
+                      required:
+                      - data
+                      type: object
+                    exec:
+                      properties:
+                        args:
+                          items:
+                            type: string
+                          type: array
+                        collectorName:
+                          type: string
+                        command:
+                          items:
+                            type: string
+                          type: array
+                        containerName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                        selector:
+                          items:
+                            type: string
+                          type: array
+                        timeout:
+                          type: string
+                      required:
+                      - namespace
+                      - selector
+                      type: object
+                    http:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        get:
+                          properties:
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            timeout:
+                              description: |-
+                                A Duration represents the elapsed time between two instants
+                                as an int64 nanosecond count. The representation limits the
+                                largest representable duration to approximately 290 years.
+                              format: int64
+                              type: integer
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        name:
+                          type: string
+                        post:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            timeout:
+                              description: |-
+                                A Duration represents the elapsed time between two instants
+                                as an int64 nanosecond count. The representation limits the
+                                largest representable duration to approximately 290 years.
+                              format: int64
+                              type: integer
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        put:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            timeout:
+                              description: |-
+                                A Duration represents the elapsed time between two instants
+                                as an int64 nanosecond count. The representation limits the
+                                largest representable duration to approximately 290 years.
+                              format: int64
+                              type: integer
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                      type: object
+                    logs:
+                      properties:
+                        collectorName:
+                          type: string
+                        containerNames:
+                          items:
+                            type: string
+                          type: array
+                        exclude:
+                          type: BoolString
+                        limits:
+                          properties:
+                            maxAge:
+                              type: string
+                            maxLines:
+                              format: int64
+                              type: integer
+                          type: object
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                        selector:
+                          items:
+                            type: string
+                          type: array
+                      required:
+                      - selector
+                      type: object
+                    mysql:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        uri:
+                          type: string
+                      required:
+                      - uri
+                      type: object
+                    postgres:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        uri:
+                          type: string
+                      required:
+                      - uri
+                      type: object
+                    redis:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        uri:
+                          type: string
+                      required:
+                      - uri
+                      type: object
+                    run:
+                      properties:
+                        args:
+                          items:
+                            type: string
+                          type: array
+                        collectorName:
+                          type: string
+                        command:
+                          items:
+                            type: string
+                          type: array
+                        exclude:
+                          type: BoolString
+                        image:
+                          type: string
+                        imagePullPolicy:
+                          type: string
+                        imagePullSecret:
+                          properties:
+                            data:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            name:
+                              type: string
+                            type:
+                              type: string
+                          type: object
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                        timeout:
+                          type: string
+                      required:
+                      - image
+                      - namespace
+                      type: object
+                    secret:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        includeValue:
+                          type: boolean
+                        key:
+                          type: string
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                  type: object
+                type: array
+            type: object
+          status:
+            description: CollectorStatus defines the observed state of Collector
+            type: object
+        type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crds/troubleshoot.replicated.com_redactors.yaml

@@ -1,11 +1,9 @@
-
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.3.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: redactors.troubleshoot.replicated.com
 spec:
   group: troubleshoot.replicated.com
@@ -15,74 +13,72 @@ spec:
     plural: redactors
     singular: redactor
   scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      description: Redactor is the Schema for the redaction API
-      properties:
-        apiVersion:
-          description: 'APIVersion defines the versioned schema of this representation
-            of an object. Servers should convert recognized schemas to the latest
-            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-          type: string
-        kind:
-          description: 'Kind is a string value representing the REST resource this
-            object represents. Servers may infer this from the endpoint the client
-            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-          type: string
-        metadata:
-          type: object
-        spec:
-          description: RedactorSpec defines the desired state of Redactor
-          properties:
-            redactors:
-              items:
-                properties:
-                  fileSelector:
-                    properties:
-                      file:
-                        type: string
-                      files:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                  name:
-                    type: string
-                  removals:
-                    properties:
-                      regex:
-                        items:
-                          properties:
-                            redactor:
-                              type: string
-                            selector:
-                              type: string
-                          type: object
-                        type: array
-                      values:
-                        items:
-                          type: string
-                        type: array
-                      yamlPath:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                type: object
-              type: array
-          type: object
-        status:
-          description: RedactorStatus defines the observed state of Redactor
-          type: object
-      type: object
-  version: v1beta1
   versions:
   - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Redactor is the Schema for the redaction API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RedactorSpec defines the desired state of Redactor
+            properties:
+              redactors:
+                items:
+                  properties:
+                    fileSelector:
+                      properties:
+                        file:
+                          type: string
+                        files:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    name:
+                      type: string
+                    removals:
+                      properties:
+                        regex:
+                          items:
+                            properties:
+                              redactor:
+                                type: string
+                              selector:
+                                type: string
+                            type: object
+                          type: array
+                        values:
+                          items:
+                            type: string
+                          type: array
+                        yamlPath:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                  type: object
+                type: array
+            type: object
+          status:
+            description: RedactorStatus defines the observed state of Redactor
+            type: object
+        type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crds/troubleshoot.sh_redactors.yaml

@@ -1,11 +1,9 @@
-
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.3.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: redactors.troubleshoot.sh
 spec:
   group: troubleshoot.sh
@@ -15,74 +13,74 @@ spec:
     plural: redactors
     singular: redactor
   scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      description: Redactor is the Schema for the redaction API
-      properties:
-        apiVersion:
-          description: 'APIVersion defines the versioned schema of this representation
-            of an object. Servers should convert recognized schemas to the latest
-            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-          type: string
-        kind:
-          description: 'Kind is a string value representing the REST resource this
-            object represents. Servers may infer this from the endpoint the client
-            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-          type: string
-        metadata:
-          type: object
-        spec:
-          description: RedactorSpec defines the desired state of Redactor
-          properties:
-            redactors:
-              items:
-                properties:
-                  fileSelector:
-                    properties:
-                      file:
-                        type: string
-                      files:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                  name:
-                    type: string
-                  removals:
-                    properties:
-                      regex:
-                        items:
-                          properties:
-                            redactor:
-                              type: string
-                            selector:
-                              type: string
-                          type: object
-                        type: array
-                      values:
-                        items:
-                          type: string
-                        type: array
-                      yamlPath:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                type: object
-              type: array
-          type: object
-        status:
-          description: RedactorStatus defines the observed state of Redactor
-          type: object
-      type: object
-  version: v1beta2
   versions:
   - name: v1beta2
+    schema:
+      openAPIV3Schema:
+        description: Redactor is the Schema for the redaction API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RedactorSpec defines the desired state of Redactor
+            properties:
+              redactors:
+                items:
+                  properties:
+                    fileSelector:
+                      properties:
+                        file:
+                          type: string
+                        files:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    name:
+                      type: string
+                    removals:
+                      properties:
+                        regex:
+                          items:
+                            properties:
+                              redactor:
+                                type: string
+                              selector:
+                                type: string
+                            type: object
+                          type: array
+                        values:
+                          items:
+                            type: string
+                          type: array
+                        yamlPath:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                  type: object
+                type: array
+              uri:
+                type: string
+            type: object
+          status:
+            description: RedactorStatus defines the observed state of Redactor
+            type: object
+        type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []