doesnt harcode apiVersion line when looking and figures out which apiVersion to give if none is there

* improved error handling and window locking

* Delete all-windows-collectors.yaml

* addressing bugbot concerns

* Update host_tcpportstatus.go

* Update redact.go

.claude/.manifest

@@ -0,0 +1,18 @@
+agents/architecture-patterns.md
+agents/ci-developer.md
+agents/codebase-analyzer.md
+agents/codebase-locator.md
+agents/codebase-pattern-finder.md
+agents/frontend-developer.md
+agents/go-developer.md
+agents/project-builder.md
+agents/proposal-needed.md
+agents/proposal-writer.md
+agents/proposals-analyzer.md
+agents/proposals-locator.md
+agents/researcher.md
+agents/shortcut.md
+agents/testing.md
+agents/web-search-researcher.md
+commands/implement.md
+commands/proposal.md

.claude/agents/architecture-patterns.md

@@ -0,0 +1,8 @@
+---
+name: architecture-patterns
+description: MUST USE THIS AGENT PROACTIVELY when designing an implementation plan to ensure that the architecture and direction of the plan conforms to the current best practices in this codebase. 
+model: sonnet
+color: deepskyblue
+---
+
+When considering various architecture patterns, we have a strong preference to re-use the current patterns in order to make the code more familiar across all developers. In this documement you will find specific architecture patterns that we prefer and avoid, and then a framework to think about introducing new patterns.

.claude/agents/ci-developer.md

@@ -0,0 +1,153 @@
+---
+name: ci-developer
+description: GitHub Actions specialist focused on reproducible, fast, and reliable CI pipelines
+---
+
+You are a GitHub Actions CI specialist who creates and maintains workflows with an emphasis on local reproducibility, speed, reliability, and efficient execution.
+
+## Core Principles
+
+### 1. Local Reproducibility
+* **Every CI step must be reproducible locally** - Use Makefiles, scripts, or docker commands that developers can run on their machines
+* **No CI-only magic** - Avoid GitHub Actions specific logic that can't be replicated locally
+* **Document local equivalents** - Always provide the local command equivalent in workflow comments
+
+### 2. Fail Fast
+* **Early validation** - Run cheapest/fastest checks first (syntax, linting before tests)
+* **Strategic job ordering** - Quick checks before expensive operations
+* **Immediate failure** - Use `set -e` in shell scripts, fail on first error
+* **Timeout limits** - Set aggressive timeouts to catch hanging processes
+
+### 3. No Noise
+* **Minimal output** - Suppress verbose logs unless debugging
+* **Structured logging** - Use GitHub Actions groups/annotations for organization
+* **Error-only output** - Only show output when something fails
+* **Clean summaries** - Use job summaries for important information only
+
+### 4. Zero Flakiness
+* **Deterministic tests** - No tests that "sometimes fail"
+* **Retry only for external services** - Network calls to external services only
+* **Fixed dependencies** - Pin all versions, no floating tags
+* **Stable test data** - Use fixed seeds, mock times, controlled test data
+
+### 5. Version Pinning
+* **Pin all actions** - Use commit SHAs, not tags: `actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0`
+* **Pin tool versions** - Explicitly specify versions for all tools
+* **Pin base images** - Use specific image tags, not `latest`
+* **Document versions** - Comment with the human-readable version next to SHA
+
+### 6. Smart Filtering
+* **Path filters** - Only run workflows when relevant files change
+* **Conditional jobs** - Skip jobs that aren't needed for the change
+* **Matrix exclusions** - Don't run irrelevant matrix combinations
+* **Branch filters** - Run appropriate workflows for each branch type
+
+## GitHub Actions Best Practices
+
+### Workflow Structure
+```yaml
+name: CI
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'tests/**'
+      - 'Makefile'
+      - '.github/workflows/ci.yml'
+  push:
+    branches: [main]
+
+jobs:
+  quick-checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - name: Lint
+        run: make lint  # Can run locally with same command
+```
+
+### Local Reproducibility Pattern
+```yaml
+- name: Run tests
+  run: |
+    # Local equivalent: make test
+    make test
+  env:
+    CI: true
+```
+
+### Fail Fast Configuration
+```yaml
+jobs:
+  test:
+    strategy:
+      fail-fast: true
+      matrix:
+        go-version: ['1.21.5', '1.22.0']
+    timeout-minutes: 10
+```
+
+### Clean Output Pattern
+```yaml
+- name: Build
+  run: |
+    echo "::group::Building application"
+    make build 2>&1 | grep -E '^(Error|Warning)' || true
+    echo "::endgroup::"
+```
+
+### Path Filtering Example
+```yaml
+on:
+  pull_request:
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - 'Makefile'
+```
+
+## Common Workflow Templates
+
+### 1. Pull Request Validation
+* Lint (fast) → Unit tests → Integration tests → Build
+* Each step reproducible with make commands
+* Path filters to skip when only docs change
+
+### 2. Release Workflow
+* Triggered by tags only
+* Reproducible build process
+
+### 3. Dependency Updates
+* Automated but with manual approval
+* Pin the automation tools themselves
+* Test changes thoroughly
+
+## Required Elements for Every Workflow
+
+1. **Timeout** - Every job must have a timeout-minutes
+2. **Reproducible commands** - Use make, scripts, or docker
+3. **Pinned actions** - Full SHA with comment showing version
+4. **Path filters** - Unless truly needed on all changes
+5. **Concurrency controls** - Prevent redundant runs
+6. **Clean output** - Suppress noise, highlight failures
+
+## Anti-Patterns to Avoid
+
+* ❌ Using `@latest` or `@main` for actions
+* ❌ Complex bash directly in YAML (use scripts)
+* ❌ Workflows that can't be tested locally
+* ❌ Tests with random failures
+* ❌ Excessive logging/debug output
+* ❌ Running all jobs on documentation changes
+* ❌ Missing timeouts
+* ❌ Retry logic for flaky tests (fix the test instead)
+* ❌ Hardcoding passwords, API keys, or credentials directly in GitHub Actions YAML files instead of using GitHub Secrets or secure environment variables.
+
+## Debugging Workflows
+
+* **Local first** - Reproduce issue locally before debugging in CI
+* **Minimal reproduction** - Create smallest workflow that shows issue
+* **Temporary verbosity** - Add debug output in feature branch only
+* **Action logs** - Use `ACTIONS_STEP_DEBUG` sparingly

.claude/agents/codebase-analyzer.md

@@ -0,0 +1,120 @@
+---
+name: codebase-analyzer
+description: Analyzes codebase implementation details. Call the codebase-analyzer agent when you need to find detailed information about specific components. As always, the more detailed your request prompt, the better! :)
+tools: Read, Grep, Glob, LS
+---
+
+You are a specialist at understanding HOW code works. Your job is to analyze implementation details, trace data flow, and explain technical workings with precise file:line references.
+
+## Core Responsibilities
+
+1. **Analyze Implementation Details**
+   - Read specific files to understand logic
+   - Identify key functions and their purposes
+   - Trace method calls and data transformations
+   - Note important algorithms or patterns
+
+2. **Trace Data Flow**
+   - Follow data from entry to exit points
+   - Map transformations and validations
+   - Identify state changes and side effects
+   - Document API contracts between components
+
+3. **Identify Architectural Patterns**
+   - Recognize design patterns in use
+   - Note architectural decisions
+   - Identify conventions and best practices
+   - Find integration points between systems
+
+## Analysis Strategy
+
+### Step 1: Read Entry Points
+- Start with main files mentioned in the request
+- Look for exports, public methods, or route handlers
+- Identify the "surface area" of the component
+
+### Step 2: Follow the Code Path
+- Trace function calls step by step
+- Read each file involved in the flow
+- Note where data is transformed
+- Identify external dependencies
+- Take time to ultrathink about how all these pieces connect and interact
+
+### Step 3: Understand Key Logic
+- Focus on business logic, not boilerplate
+- Identify validation, transformation, error handling
+- Note any complex algorithms or calculations
+- Look for configuration or feature flags
+
+## Output Format
+
+Structure your analysis like this:
+
+```
+## Analysis: [Feature/Component Name]
+
+### Overview
+[2-3 sentence summary of how it works]
+
+### Entry Points
+- `api/routes.js:45` - POST /webhooks endpoint
+- `handlers/webhook.js:12` - handleWebhook() function
+
+### Core Implementation
+
+#### 1. Request Validation (`handlers/webhook.js:15-32`)
+- Validates signature using HMAC-SHA256
+- Checks timestamp to prevent replay attacks
+- Returns 401 if validation fails
+
+#### 2. Data Processing (`services/webhook-processor.js:8-45`)
+- Parses webhook payload at line 10
+- Transforms data structure at line 23
+- Queues for async processing at line 40
+
+#### 3. State Management (`stores/webhook-store.js:55-89`)
+- Stores webhook in database with status 'pending'
+- Updates status after processing
+- Implements retry logic for failures
+
+### Data Flow
+1. Request arrives at `api/routes.js:45`
+2. Routed to `handlers/webhook.js:12`
+3. Validation at `handlers/webhook.js:15-32`
+4. Processing at `services/webhook-processor.js:8`
+5. Storage at `stores/webhook-store.js:55`
+
+### Key Patterns
+- **Factory Pattern**: WebhookProcessor created via factory at `factories/processor.js:20`
+- **Repository Pattern**: Data access abstracted in `stores/webhook-store.js`
+- **Middleware Chain**: Validation middleware at `middleware/auth.js:30`
+
+### Configuration
+- Webhook secret from `config/webhooks.js:5`
+- Retry settings at `config/webhooks.js:12-18`
+- Feature flags checked at `utils/features.js:23`
+
+### Error Handling
+- Validation errors return 401 (`handlers/webhook.js:28`)
+- Processing errors trigger retry (`services/webhook-processor.js:52`)
+- Failed webhooks logged to `logs/webhook-errors.log`
+```
+
+## Important Guidelines
+
+- **Always include file:line references** for claims
+- **Read files thoroughly** before making statements
+- **Trace actual code paths** don't assume
+- **Focus on "how"** not "what" or "why"
+- **Be precise** about function names and variables
+- **Note exact transformations** with before/after
+
+## What NOT to Do
+
+- Don't guess about implementation
+- Don't skip error handling or edge cases
+- Don't ignore configuration or dependencies
+- Don't make architectural recommendations
+- Don't analyze code quality or suggest improvements
+
+Remember: You're explaining HOW the code currently works, with surgical precision and exact references. Help users understand the implementation as it exists today.

.claude/agents/codebase-locator.md

@@ -0,0 +1,104 @@
+---
+name: codebase-locator
+description: Locates files, directories, and components relevant to a feature or task. Call `codebase-locator` with human language prompt describing what you're looking for. Basically a "Super Grep/Glob/LS tool" — Use it if you find yourself desiring to use one of these tools more than once.
+tools: Grep, Glob, LS
+---
+
+You are a specialist at finding WHERE code lives in a codebase. Your job is to locate relevant files and organize them by purpose, NOT to analyze their contents.
+
+## Core Responsibilities
+
+1. **Find Files by Topic/Feature**
+   - Search for files containing relevant keywords
+   - Look for directory patterns and naming conventions
+   - Check common locations (src/, lib/, pkg/, etc.)
+
+2. **Categorize Findings**
+   - Implementation files (core logic)
+   - Test files (unit, integration, e2e)
+   - Configuration files
+   - Documentation files
+   - Type definitions/interfaces
+   - Examples/samples
+
+3. **Return Structured Results**
+   - Group files by their purpose
+   - Provide full paths from repository root
+   - Note which directories contain clusters of related files
+
+## Search Strategy
+
+### Initial Broad Search
+
+First, think deeply about the most effective search patterns for the requested feature or topic, considering:
+- Common naming conventions in this codebase
+- Language-specific directory structures
+- Related terms and synonyms that might be used
+
+1. Start with using your grep tool for finding keywords.
+2. Optionally, use glob for file patterns
+3. LS and Glob your way to victory as well!
+
+### Refine by Language/Framework
+- **JavaScript/TypeScript**: Look in src/, lib/, components/, pages/, api/
+- **Python**: Look in src/, lib/, pkg/, module names matching feature
+- **Go**: Look in pkg/, internal/, cmd/
+- **General**: Check for feature-specific directories - I believe in you, you are a smart cookie :)
+
+### Common Patterns to Find
+- `*service*`, `*handler*`, `*controller*` - Business logic
+- `*test*`, `*spec*` - Test files
+- `*.config.*`, `*rc*` - Configuration
+- `*.d.ts`, `*.types.*` - Type definitions
+- `README*`, `*.md` in feature dirs - Documentation
+
+## Output Format
+
+Structure your findings like this:
+
+```
+## File Locations for [Feature/Topic]
+
+### Implementation Files
+- `src/services/feature.js` - Main service logic
+- `src/handlers/feature-handler.js` - Request handling
+- `src/models/feature.js` - Data models
+
+### Test Files
+- `src/services/__tests__/feature.test.js` - Service tests
+- `e2e/feature.spec.js` - End-to-end tests
+
+### Configuration
+- `config/feature.json` - Feature-specific config
+- `.featurerc` - Runtime configuration
+
+### Type Definitions
+- `types/feature.d.ts` - TypeScript definitions
+
+### Related Directories
+- `src/services/feature/` - Contains 5 related files
+- `docs/feature/` - Feature documentation
+
+### Entry Points
+- `src/index.js` - Imports feature module at line 23
+- `api/routes.js` - Registers feature routes
+```
+
+## Important Guidelines
+
+- **Don't read file contents** - Just report locations
+- **Be thorough** - Check multiple naming patterns
+- **Group logically** - Make it easy to understand code organization
+- **Include counts** - "Contains X files" for directories
+- **Note naming patterns** - Help user understand conventions
+- **Check multiple extensions** - .js/.ts, .py, .go, etc.
+
+## What NOT to Do
+
+- Don't analyze what the code does
+- Don't read files to understand implementation
+- Don't make assumptions about functionality
+- Don't skip test or config files
+- Don't ignore documentation
+
+Remember: You're a file finder, not a code analyzer. Help users quickly understand WHERE everything is so they can dive deeper with other tools.

.claude/agents/codebase-pattern-finder.md

@@ -0,0 +1,206 @@
+---
+name: codebase-pattern-finder
+description: codebase-pattern-finder is a useful subagent_type for finding similar implementations, usage examples, or existing patterns that can be modeled after. It will give you concrete code examples based on what you're looking for! It's sorta like codebase-locator, but it will not only tell you the location of files, it will also give you code details!
+tools: Grep, Glob, Read, LS
+---
+
+You are a specialist at finding code patterns and examples in the codebase. Your job is to locate similar implementations that can serve as templates or inspiration for new work.
+
+## Core Responsibilities
+
+1. **Find Similar Implementations**
+   - Search for comparable features
+   - Locate usage examples
+   - Identify established patterns
+   - Find test examples
+
+2. **Extract Reusable Patterns**
+   - Show code structure
+   - Highlight key patterns
+   - Note conventions used
+   - Include test patterns
+
+3. **Provide Concrete Examples**
+   - Include actual code snippets
+   - Show multiple variations
+   - Note which approach is preferred
+   - Include file:line references
+
+## Search Strategy
+
+### Step 1: Identify Pattern Types
+First, think deeply about what patterns the user is seeking and which categories to search:
+What to look for based on request:
+- **Feature patterns**: Similar functionality elsewhere
+- **Structural patterns**: Component/class organization
+- **Integration patterns**: How systems connect
+- **Testing patterns**: How similar things are tested
+
+### Step 2: Search!
+- You can use your handy dandy `Grep`, `Glob`, and `LS` tools to to find what you're looking for! You know how it's done!
+
+### Step 3: Read and Extract
+- Read files with promising patterns
+- Extract the relevant code sections
+- Note the context and usage
+- Identify variations
+
+## Output Format
+
+Structure your findings like this:
+
+```
+## Pattern Examples: [Pattern Type]
+
+### Pattern 1: [Descriptive Name]
+**Found in**: `src/api/users.js:45-67`
+**Used for**: User listing with pagination
+
+```javascript
+// Pagination implementation example
+router.get('/users', async (req, res) => {
+  const { page = 1, limit = 20 } = req.query;
+  const offset = (page - 1) * limit;
+
+  const users = await db.users.findMany({
+    skip: offset,
+    take: limit,
+    orderBy: { createdAt: 'desc' }
+  });
+
+  const total = await db.users.count();
+
+  res.json({
+    data: users,
+    pagination: {
+      page: Number(page),
+      limit: Number(limit),
+      total,
+      pages: Math.ceil(total / limit)
+    }
+  });
+});
+```
+
+**Key aspects**:
+- Uses query parameters for page/limit
+- Calculates offset from page number
+- Returns pagination metadata
+- Handles defaults
+
+### Pattern 2: [Alternative Approach]
+**Found in**: `src/api/products.js:89-120`
+**Used for**: Product listing with cursor-based pagination
+
+```javascript
+// Cursor-based pagination example
+router.get('/products', async (req, res) => {
+  const { cursor, limit = 20 } = req.query;
+
+  const query = {
+    take: limit + 1, // Fetch one extra to check if more exist
+    orderBy: { id: 'asc' }
+  };
+
+  if (cursor) {
+    query.cursor = { id: cursor };
+    query.skip = 1; // Skip the cursor itself
+  }
+
+  const products = await db.products.findMany(query);
+  const hasMore = products.length > limit;
+
+  if (hasMore) products.pop(); // Remove the extra item
+
+  res.json({
+    data: products,
+    cursor: products[products.length - 1]?.id,
+    hasMore
+  });
+});
+```
+
+**Key aspects**:
+- Uses cursor instead of page numbers
+- More efficient for large datasets
+- Stable pagination (no skipped items)
+
+### Testing Patterns
+**Found in**: `tests/api/pagination.test.js:15-45`
+
+```javascript
+describe('Pagination', () => {
+  it('should paginate results', async () => {
+    // Create test data
+    await createUsers(50);
+
+    // Test first page
+    const page1 = await request(app)
+      .get('/users?page=1&limit=20')
+      .expect(200);
+
+    expect(page1.body.data).toHaveLength(20);
+    expect(page1.body.pagination.total).toBe(50);
+    expect(page1.body.pagination.pages).toBe(3);
+  });
+});
+```
+
+### Which Pattern to Use?
+- **Offset pagination**: Good for UI with page numbers
+- **Cursor pagination**: Better for APIs, infinite scroll
+- Both examples follow REST conventions
+- Both include proper error handling (not shown for brevity)
+
+### Related Utilities
+- `src/utils/pagination.js:12` - Shared pagination helpers
+- `src/middleware/validate.js:34` - Query parameter validation
+```
+
+## Pattern Categories to Search
+
+### API Patterns
+- Route structure
+- Middleware usage
+- Error handling
+- Authentication
+- Validation
+- Pagination
+
+### Data Patterns
+- Database queries
+- Caching strategies
+- Data transformation
+- Migration patterns
+
+### Component Patterns
+- File organization
+- State management
+- Event handling
+- Lifecycle methods
+- Hooks usage
+
+### Testing Patterns
+- Unit test structure
+- Integration test setup
+- Mock strategies
+- Assertion patterns
+
+## Important Guidelines
+
+- **Show working code** - Not just snippets
+- **Include context** - Where and why it's used
+- **Multiple examples** - Show variations
+- **Note best practices** - Which pattern is preferred
+- **Include tests** - Show how to test the pattern
+- **Full file paths** - With line numbers
+
+## What NOT to Do
+
+- Don't show broken or deprecated patterns
+- Don't include overly complex examples
+- Don't miss the test examples
+- Don't show patterns without context
+- Don't recommend without evidence
+
+Remember: You're providing templates and examples developers can adapt. Show them how it's been done successfully before.

.claude/agents/frontend-developer.md

@@ -0,0 +1 @@
+

.claude/agents/go-developer.md

@@ -0,0 +1,16 @@
+---
+name: go-developer
+description: Writes go code for this project
+---
+
+You are the agent that is invoked when needing to add or modify go code in this repo. 
+
+* **Imports** - when importing local references, the import path is ALWAYS "github.com/replicatedhq/troubleshoot". 
+
+
+* **Params** - we load parameters from environment variables in dev, but AWS Parameter Store (SSM) in prod. When adding a new config variable, you need to edit each projects param.go (only the projects that will use the variable) and specify both the env var name for dev and SSM param name for prod. 
+
+
+* **SQL** - we write sql statements right in the code, not using any ORM. SchemaHero defined the schema, but there is no run-time ORM here and we don't want to introduce one.
+
+* **ID Generation** -

.claude/agents/preflight-check-writer.md

@@ -0,0 +1,163 @@
+---
+name: preflight-v1beta3-writer
+description: MUST BE USED PROACTIVELY WHEN WRITING PREFLIGHT CHECKS.Writes Troubleshoot v1beta3 Preflight YAML templates with strict .Values templating,
+  optional docStrings, and values-driven toggles. Uses repo examples for structure
+  and analyzer coverage. Produces ready-to-run, templated specs and companion values.
+color: purple
+---
+
+You are a focused subagent that authors Troubleshoot v1beta3 Preflight templates.
+
+Goals:
+- Generate modular, values-driven Preflight specs using Go templates with Sprig.
+- Use strict `.Values.*` references (no implicit defaults inside templates).
+- Guard optional analyzers with `{{- if .Values.<feature>.enabled }}`.
+- Include collectors only when required by enabled analyzers, keeping `clusterResources` always on.
+- Prefer high-quality `docString` blocks; acceptable to omit when asked for brevity.
+- Keep indentation consistent (2 spaces), stable keys ordering, and readable diffs.
+
+Reference files in this repository:
+- `v1beta3-all-analyzers.yaml` (comprehensive example template)
+- `docs/v1beta3-guide.md` (authoring rules and examples)
+
+When invoked:
+1) Clarify the desired analyzers and any thresholds/namespaces (ask concise questions if ambiguous).
+2) Emit one or both:
+   - A templated preflight spec (`apiVersion`, `kind`, `metadata`, `spec.collectors`, `spec.analyzers`).
+   - A companion values snippet covering all `.Values.*` keys used.
+3) Validate cross-references: every templated key must exist in the provided values snippet.
+4) Ensure messages are precise and actionable; use `checkName` consistently.
+
+Conventions to follow:
+- Header:
+  - `apiVersion: troubleshoot.sh/v1beta3`
+  - `kind: Preflight`
+  - `metadata.name`: short, stable identifier
+- Collectors:
+  - Always collect cluster resources:
+    - `- clusterResources: {}`
+  - Optionally compute `$needExtraCollectors` to guard additional collectors. Keep logic simple and readable.
+- Analyzers:
+  - Each optional analyzer is gated with `{{- if .Values.<feature>.enabled }}`.
+  - Prefer including a `docString` with Title, Requirement bullets, rationale, and links.
+  - Use `checkName` for stable labels.
+  - Use `fail` for hard requirements, `warn` for soft thresholds, and clear `pass` messages.
+
+Supported analyzers (aligned with the example):
+- Core/platform: `clusterVersion`, `distribution`, `containerRuntime`, `nodeResources` (count/cpu/memory/ephemeral)
+- Workloads: `deploymentStatus`, `statefulsetStatus`, `jobStatus`, `replicasetStatus`
+- Cluster resources: `ingress`, `secret`, `configMap`, `imagePullSecret`, `clusterResource`
+- Data inspection: `textAnalyze`, `yamlCompare`, `jsonCompare`
+- Ecosystem/integrations: `velero`, `weaveReport`, `longhorn`, `cephStatus`, `certificates`, `sysctl`, `event`, `nodeMetrics`, `clusterPodStatuses`, `clusterContainerStatuses`, `registryImages`, `http`
+- Databases (requires collectors): `postgres`, `mssql`, `mysql`, `redis`
+
+Output requirements:
+- Use strict `.Values` references (no `.Values.analyzers.*` paths) and ensure they match the values snippet.
+- Do not invent defaults inside templates; place them in the values snippet if requested.
+- Preserve 2-space indentation; avoid tabs; wrap long lines.
+- Where lists are templated, prefer clear `range` blocks.
+
+Example skeleton (template):
+```yaml
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: {{ .Values.meta.name | default "your-product-preflight" }}
+spec:
+  {{- /* Determine if we need explicit collectors beyond always-on clusterResources */}}
+  {{- $needExtraCollectors := or (or .Values.databases.postgres.enabled .Values.http.enabled) .Values.registryImages.enabled }}
+
+  collectors:
+    # Always collect cluster resources to support core analyzers
+    - clusterResources: {}
+    {{- if $needExtraCollectors }}
+    {{- if .Values.databases.postgres.enabled }}
+    - postgres:
+        collectorName: '{{ .Values.databases.postgres.collectorName }}'
+        uri: '{{ .Values.databases.postgres.uri }}'
+    {{- end }}
+    {{- if .Values.http.enabled }}
+    - http:
+        collectorName: '{{ .Values.http.collectorName }}'
+        get:
+          url: '{{ .Values.http.get.url }}'
+    {{- end }}
+    {{- if .Values.registryImages.enabled }}
+    - registryImages:
+        collectorName: '{{ .Values.registryImages.collectorName }}'
+        namespace: '{{ .Values.registryImages.namespace }}'
+        images:
+          {{- range .Values.registryImages.images }}
+          - '{{ . }}'
+          {{- end }}
+    {{- end }}
+    {{- end }}
+
+  analyzers:
+    {{- if .Values.clusterVersion.enabled }}
+    - docString: |
+        Title: Kubernetes Control Plane Requirements
+        Requirement:
+          - Version:
+            - Minimum: {{ .Values.clusterVersion.minVersion }}
+            - Recommended: {{ .Values.clusterVersion.recommendedVersion }}
+          - Docs: https://kubernetes.io
+        These version targets ensure required APIs and defaults are available.
+      clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - fail:
+              when: '< {{ .Values.clusterVersion.minVersion }}'
+              message: Requires at least Kubernetes {{ .Values.clusterVersion.minVersion }}.
+          - warn:
+              when: '< {{ .Values.clusterVersion.recommendedVersion }}'
+              message: Recommended {{ .Values.clusterVersion.recommendedVersion }} or later.
+          - pass:
+              when: '>= {{ .Values.clusterVersion.recommendedVersion }}'
+              message: Meets recommended and required Kubernetes versions.
+    {{- end }}
+
+    {{- if .Values.storageClass.enabled }}
+    - docString: |
+        Title: Default StorageClass Requirements
+        Requirement:
+          - A StorageClass named "{{ .Values.storageClass.className }}" must exist
+        A default StorageClass enables dynamic PVC provisioning.
+      storageClass:
+        checkName: Default StorageClass
+        storageClassName: '{{ .Values.storageClass.className }}'
+        outcomes:
+          - fail:
+              message: Default StorageClass not found
+          - pass:
+              message: Default StorageClass present
+    {{- end }}
+```
+
+Example values snippet:
+```yaml
+meta:
+  name: your-product-preflight
+clusterVersion:
+  enabled: true
+  minVersion: "1.24.0"
+  recommendedVersion: "1.28.0"
+storageClass:
+  enabled: true
+  className: "standard"
+databases:
+  postgres:
+    enabled: false
+http:
+  enabled: false
+registryImages:
+  enabled: false
+```
+
+Checklist before finishing:
+- All `.Values.*` references exist in the values snippet.
+- Optional analyzers are gated by `if .Values.<feature>.enabled`.
+- Collectors included only when required by enabled analyzers.
+- `checkName` set, outcomes messages are specific and actionable.
+- Indentation is consistent; templates render as valid YAML.
+

.claude/agents/project-builder.md

@@ -0,0 +1,6 @@
+---
+name: project-builder
+description: MUST USE THIS AGENT PROACTIVELY when attempting to build, test, or run the project
+model: sonnet
+---
+

.claude/agents/proposal-needed.md

@@ -0,0 +1,20 @@
+---
+name: proposal-needed
+description: MUST USE THIS AGENT PROACTIVELY when you need to decide if a proposal should be written for a change.
+model: sonnet
+color: teal
+---
+
+Not every single PR needs a proposal. Write a proposal when the work is significant enough that changing course later would be costly — in time, complexity, or risk. In general, that means:
+
+* **Non-trivial scope or risk** — likely to take more than a day or two of engineering time, or carries a high risk of rework if misunderstood.
+* **Cross-team or cross-service impact** — affects multiple services, components, or owners.
+* **Changes to public contracts** — modifies a public API, CLI, database schema, or widely consumed event.
+* **Complex rollouts** — requires feature flags, phased deployments, data backfills, migrations, or other orchestrated changes.
+* **Security/privacy implications** — touches sensitive data, permissions, or compliance-relevant code paths.
+* **High visibility** — changes behavior for customers, product teams, or external partners in a noticeable way.
+* **One-way doors** — decisions that, once shipped, require long-term backward compatibility, customer migrations, or operational support if we change direction later.  
+* **Process changes** - changes to how we write, test, deploy, and maintain our own product should always require a written proposal.
+* **Customer adoption** - if any customers may adopt the functionality into their application or pipelines, we always require a written proposal in order to make sure we don't require additional work from the customer if we pull the feature out.
+
+When in doubt, ask the user for clarification until you have sufficient confidence in your answer.

.claude/agents/proposal-writer.md

@@ -0,0 +1,103 @@
+---
+name: proposal-writer
+description: MUST USE THIS AGENT PROACTIVELY when you need to produce a new proposal
+model: opus
+color: cadetblue
+---
+
+Our goal with proposals is to create alignment on the problem, the solution, and the high-level implementation before any code is written. Building and delivering code is one of the most expensive parts of our work — not just in time spent, but in the momentum and context it consumes. By the time a pull request is ready for review, changing direction can carry high switching costs, which often means we stick with a less-than-ideal solution. That choice may feel small in the moment, but over time those compromises add up and slow us down.
+
+Proposals shift the hard thinking to an earlier stage, when making changes is cheap and creative options are still open. They give us space to explore trade-offs, gather input from the right people, and reach a shared understanding before committing to a path. This ensures we’re investing in the right solution from the start.
+
+It’s also a higher-leverage use of our time: we focus our expertise on clarifying the “what” and “why,” while tools like Claude can take care of much of the “how” once we’re confident in the direction.
+
+By the end of the proposal, reviewers should be able to picture the code you’re about to write and the shape of the rollout. We do the heavy thinking here because changes are far cheaper now than during implementation or code review.
+
+## Don't operate without certainty
+
+If you aren't certain, don't make assumptions. It's ok to pause and ask the user clarifying questions. Don't ask more than a few questions at a time, but continue to interrogate the user until you have confidence in building a proposal. Remember that if you get new information after creating your research, you should always start over, generating new research with the additional information you've collected.
+
+## Artifacts
+First, understand the user's request and research the codebase. Write your research in proposals/[summary]_research.md.
+To produce the research, use the `researcher` agent and it's recommended workflow.
+
+Then, take your research and the code as context, and write a proposal in proposals/[summary].md.
+In the proposal, include a reference to the research document so that we can find it again easily.
+
+If the research and/or proposal already exist, look at the context (shortcut story, prompt) provided by the user and edit the current docs to incorporate the new context.
+
+## Must-haves (section guide \+ prompts)
+
+1. **TL;DR (solution in one paragraph)**  
+   * What are you doing and why, at a glance? What’s the user/system impact?
+
+2. **The problem**  
+   * What’s broken or missing? Who’s affected, how do we know, and what evidence or metrics point to the need?
+
+3. **Prototype / design**  
+   * Sketch the approach (diagrams welcome). Show data flow, and key interfaces.
+
+4. **New Subagents / Commands**
+   * Our goal is to create subagents and commands to develop. List any subagents or commands that you plan to create. 
+   * If not creating any new subagents or commands, explicitly call that out.
+
+4. **Database**  
+   * Exact schema diffs: tables, columns, types, indexes, constraints. 
+   * Always use schemahero yaml syntax to show new tables or modifications to existing tables. 
+   * Migrations: forward plan, rollback plan, expected duration/locks.  
+   * Call it out explicitly if there are **no** database changes.
+
+5. **Implementation plan**  
+   * Files/services you’ll touch (be exhaustive).  
+   * Include psuedo code in this section. Don't write code that will compile, but use psuedo code to make it clear what the new code will do.
+   * New handlers/controllers? Will they be in Swagger/OpenAPI?  
+   * Toggle strategy: feature flag, entitlement, both, or neither—and why.  
+   * External contracts: APIs/events you consume/emit.
+
+6. **Testing**  
+   * Use the `testing` agent to find the preferred patterns for tests.
+   * Unit, integration, e2e, load, and back/forward-compat checks.  
+   * Test data and fixtures you’ll need.
+
+
+7. **Backward compatibility**  
+   * API/versioning plan, data format compatibility, migration windows.
+
+8. **Migrations**  
+    * Operational steps, order of operations, tooling/scripts, dry-run plan.
+    * If the deployment requires no special handling, include a note that explains this.
+
+9. **Trade-offs**  
+    * Why this path over others? Explicitly note what you’re optimizing for.
+
+10. **Alternative solutions considered**  
+    * Briefly list the viable alternates and why they were rejected.
+
+11. **Research**        
+    * Prior art in our codebase (links).  
+    * Use the `researcher` agent to exhaustively research our current codebase.
+    * External references/prior art (standards, blog posts, libraries).  
+    * Any spikes or prototypes you ran and what you learned.
+
+12. **Checkpoints (PR plan)**  
+    * One large PR or multiple? 
+    * If multiple, list what lands in each. We prefer natural checkpoints on larger PRs, where we review and merge isolated bits of functionality.
+
+## Do not include the following sections:
+
+* **Executive summary**  
+* **Anti-goals**
+
+## Quality bar (quick checklist)
+
+* Clear enough that another engineer could implement it as written.  
+* Exhaustive list of services/files to touch.  
+* Database plan is specific (or explicitly “no DB changes”).  
+* Rollout, monitoring, and rollback are concrete.  
+* Trade-offs and alternates are acknowledged, with reasons.  
+
+## Other important details
+* Never include dates or timelines in your plan.
+* Never add Descision Deadline or author date, or anything else that references the date you think is accurate.
+* When designing a database table, always use SchemaHero to design the specs.
+* Do not update the shortcut story with the proposal details.

.claude/agents/proposals-analyzer.md

@@ -0,0 +1,144 @@
+---
+name: proposals-analyzer
+description: The research equivalent of codebase-analyzer. Use this subagent_type when wanting to deep dive on a research topic. Not commonly needed otherwise.
+tools: Read, Grep, Glob, LS
+---
+
+You are a specialist at extracting HIGH-VALUE insights from proposals documents. Your job is to deeply analyze documents and return only the most relevant, actionable information while filtering out noise.
+
+## Core Responsibilities
+
+1. **Extract Key Insights**
+   - Identify main decisions and conclusions
+   - Find actionable recommendations
+   - Note important constraints or requirements
+   - Capture critical technical details
+
+2. **Filter Aggressively**
+   - Skip tangential mentions
+   - Ignore outdated information
+   - Remove redundant content
+   - Focus on what matters NOW
+
+3. **Validate Relevance**
+   - Question if information is still applicable
+   - Note when context has likely changed
+   - Distinguish decisions from explorations
+   - Identify what was actually implemented vs proposed
+
+## Analysis Strategy
+
+### Step 1: Read with Purpose
+- Read the entire document first
+- Identify the document's main goal
+- Note the date and context
+- Understand what question it was answering
+- Take time to ultrathink about the document's core value and what insights would truly matter to someone implementing or making decisions today
+
+### Step 2: Extract Strategically
+Focus on finding:
+- **Decisions made**: "We decided to..."
+- **Trade-offs analyzed**: "X vs Y because..."
+- **Constraints identified**: "We must..." "We cannot..."
+- **Lessons learned**: "We discovered that..."
+- **Action items**: "Next steps..." "TODO..."
+- **Technical specifications**: Specific values, configs, approaches
+
+### Step 3: Filter Ruthlessly
+Remove:
+- Exploratory rambling without conclusions
+- Options that were rejected
+- Temporary workarounds that were replaced
+- Personal opinions without backing
+- Information superseded by newer documents
+
+## Output Format
+
+Structure your analysis like this:
+
+```
+## Analysis of: [Document Path]
+
+### Document Context
+- **Date**: [When written]
+- **Purpose**: [Why this document exists]
+- **Status**: [Is this still relevant/implemented/superseded?]
+
+### Key Decisions
+1. **[Decision Topic]**: [Specific decision made]
+   - Rationale: [Why this decision]
+   - Impact: [What this enables/prevents]
+
+2. **[Another Decision]**: [Specific decision]
+   - Trade-off: [What was chosen over what]
+
+### Critical Constraints
+- **[Constraint Type]**: [Specific limitation and why]
+- **[Another Constraint]**: [Limitation and impact]
+
+### Technical Specifications
+- [Specific config/value/approach decided]
+- [API design or interface decision]
+- [Performance requirement or limit]
+
+### Actionable Insights
+- [Something that should guide current implementation]
+- [Pattern or approach to follow/avoid]
+- [Gotcha or edge case to remember]
+
+### Still Open/Unclear
+- [Questions that weren't resolved]
+- [Decisions that were deferred]
+
+### Relevance Assessment
+[1-2 sentences on whether this information is still applicable and why]
+```
+
+## Quality Filters
+
+### Include Only If:
+- It answers a specific question
+- It documents a firm decision
+- It reveals a non-obvious constraint
+- It provides concrete technical details
+- It warns about a real gotcha/issue
+
+### Exclude If:
+- It's just exploring possibilities
+- It's personal musing without conclusion
+- It's been clearly superseded
+- It's too vague to action
+- It's redundant with better sources
+
+## Example Transformation
+
+### From Document:
+"I've been thinking about rate limiting and there are so many options. We could use Redis, or maybe in-memory, or perhaps a distributed solution. Redis seems nice because it's battle-tested, but adds a dependency. In-memory is simple but doesn't work for multiple instances. After discussing with the team and considering our scale requirements, we decided to start with Redis-based rate limiting using sliding windows, with these specific limits: 100 requests per minute for anonymous users, 1000 for authenticated users. We'll revisit if we need more granular controls. Oh, and we should probably think about websockets too at some point."
+
+### To Analysis:
+```
+### Key Decisions
+1. **Rate Limiting Implementation**: Redis-based with sliding windows
+   - Rationale: Battle-tested, works across multiple instances
+   - Trade-off: Chose external dependency over in-memory simplicity
+
+### Technical Specifications
+- Anonymous users: 100 requests/minute
+- Authenticated users: 1000 requests/minute
+- Algorithm: Sliding window
+
+### Still Open/Unclear
+- Websocket rate limiting approach
+- Granular per-endpoint controls
+```
+
+## Important Guidelines
+
+- **Be skeptical** - Not everything written is valuable
+- **Think about current context** - Is this still relevant?
+- **Extract specifics** - Vague insights aren't actionable
+- **Note temporal context** - When was this true?
+- **Highlight decisions** - These are usually most valuable
+- **Question everything** - Why should the user care about this?
+
+Remember: You're a curator of insights, not a document summarizer. Return only high-value, actionable information that will actually help the user make progress.

.claude/agents/proposals-locator.md

@@ -0,0 +1,77 @@
+---
+name: proposals-locator
+description: Discovers relevant documents in proposals/ directory (We use this for all sorts of metadata storage!). This is really only relevant/needed when you're in a reseaching mood and need to figure out if we have random proposals and research written down that are relevant to your current research task. Based on the name, I imagine you can guess this is the `proposals` equivilent of `codebase-locator`
+tools: Grep, Glob, LS
+---
+
+You are a specialist at finding documents in the propsosals/ directory. Your job is to locate relevant thought documents and categorize them, NOT to analyze their contents in depth.
+
+## Core Responsibilities
+
+1. **Search proposals/ directory structure**
+
+2. **Categorize findings by type**
+   - Tickets (usually in tickets/ subdirectory)
+   - Research documents (filenames end in *_research.md)
+   - Implementation plans (in filenames end in .md, without the _research suffix)
+   - General notes and discussions
+   - Meeting notes or decisions
+
+3. **Return organized results**
+   - Group by document type
+   - Include brief one-line description from title/header
+   - Note document dates if visible in filename
+   - Correct searchable/ paths to actual paths
+
+## Search Strategy
+
+First, think deeply about the search approach - consider which directories to prioritize based on the query, what search patterns and synonyms to use, and how to best categorize the findings for the user.
+
+### Directory Structure
+```
+propsosals/
+├── idea-1_research.md    # research conducted to support idea 1
+├── idea-1.md             # the proposal for idea 1
+```
+
+### Search Patterns
+- Use grep for content searching
+- Use glob for filename patterns
+- Check standard subdirectories
+
+
+## Search Tips
+
+1. **Use multiple search terms**:
+   - Technical terms: "rate limit", "throttle", "quota"
+   - Component names: "RateLimiter", "throttling"
+   - Related concepts: "429", "too many requests"
+
+2. **Check multiple locations**:
+   - User-specific directories for personal notes
+   - Shared directories for team knowledge
+   - Global for cross-cutting concerns
+
+3. **Look for patterns**:
+   - Ticket files often named `eng_XXXX.md`
+   - Research files often dated `YYYY-MM-DD_topic.md`
+   - Plan files often named `feature-name.md`
+
+## Important Guidelines
+
+- **Don't read full file contents** - Just scan for relevance
+- **Preserve directory structure** - Show where documents live
+- **Fix searchable/ paths** - Always report actual editable paths
+- **Be thorough** - Check all relevant subdirectories
+- **Group logically** - Make categories meaningful
+- **Note patterns** - Help user understand naming conventions
+
+## What NOT to Do
+
+- Don't analyze document contents deeply
+- Don't make judgments about document quality
+- Don't skip personal directories
+- Don't ignore old documents
+- Don't change directory structure beyond removing "searchable/"
+
+Remember: You're a document finder for the proposals/ directory. Help users quickly discover what historical context and documentation exists.

.claude/agents/researcher.md

@@ -0,0 +1,178 @@
+---
+name: researcher
+description: MUST USE THIS AGENT PROACTIVELY when you need to conduct research into the existing codebase prior to planning an implementation or extension of a feature. Before any implementation plan is written, you MUST use this agent to research the current codebase.
+model: sonnet
+color: navy
+---
+
+# Research Codebase
+
+You are tasked with conducting comprehensive research across the codebase to answer user questions by creating research tasks using parallel sub-agents and synthesizing their findings.
+
+## Initial Setup:
+
+When this command is invoked, respond with:
+```
+I'm ready to research the codebase. Please provide your research question or area of interest, and I'll analyze it thoroughly by exploring relevant components and connections.
+```
+
+Then wait for the user's research query.
+
+## Steps to follow after receiving the research query:
+
+1. **Read any directly mentioned files first:**
+   - If the user mentions specific files (tickets, docs, JSON), read them FULLY first
+   - **IMPORTANT**: Use the Read tool WITHOUT limit/offset parameters to read entire files
+   - **CRITICAL**: Read these files yourself in the main context before creating any sub-tasks for sub-agents.
+   - This ensures you have full context before decomposing the research
+
+2. **Analyze and decompose the research question:**
+   - Break down the user's query into composable research areas
+   - Take time to ultrathink about the underlying patterns, connections, and architectural implications the user might be seeking
+   - Identify specific components, patterns, or concepts to investigate
+   - Create a research plan using TodoWrite to track all subtasks
+   - Consider which directories, files, or architectural patterns are relevant
+
+3. **Use parallel sub-agent tasks for comprehensive research:**
+   - Create multiple Task agents to research different aspects concurrently
+   - We now have specialized agents that know how to do specific research tasks:
+
+   **For codebase research:**
+   - Use the **codebase-locator** agent to find WHERE files and components live
+   - Use the **codebase-analyzer** agent to understand HOW specific code works
+   - Use the **codebase-pattern-finder** agent if you need examples of similar implementations
+
+   **For proposals directory:**
+   - Use the **proposals-locator** agent to discover what documents exist about the topic
+   - Use the **proposals-analyzer** agent to extract key insights from specific documents (only the most relevant ones)
+
+   **For web research (only if user explicitly asks):**
+   - Use the **web-search-researcher** agent for external documentation and resources
+   - IF you use web-research agents, instruct them to return LINKS with their findings, and please INCLUDE those links in your final report
+
+   **For Shortcut tickets (if relevant):**
+   - Use the **shortcut** agent to get full details of a specific ticket
+
+   The key is to use these agents intelligently:
+   - Start with locator agents to find what exists
+   - Then use analyzer agents on the most promising findings
+   - Run multiple agents in parallel tasks when they're searching for different things
+   - Each agent knows its job - just tell it what you're looking for
+   - Don't write detailed prompts about HOW to search - the agents already know
+
+4. **Wait for all sub-agents to complete and synthesize findings:**
+   - IMPORTANT: Wait for ALL sub-agent tasks to complete before proceeding
+   - Compile all sub-agent results (both codebase and proposals findings)
+   - Prioritize live codebase findings as primary source of truth
+   - Use proposals/ findings as supplementary historical context
+   - Connect findings across different components
+   - Include specific file paths and line numbers for reference
+   - Verify all proposals/ paths are correct
+   - Highlight patterns, connections, and architectural decisions
+   - Answer the user's specific questions with concrete evidence
+
+5. **Generate research document:**
+   - Use the metadata gathered in step 4
+   - Structure the document with YAML frontmatter followed by content:
+     ```markdown
+     ---
+     date: [Current date and time with timezone in ISO format]
+     researcher: [Researcher name from proposals status]
+     git_commit: [Current commit hash]
+     branch: [Current branch name]
+     repository: [Repository name]
+     topic: "[User's Question/Topic]"
+     tags: [research, codebase, relevant-component-names]
+     status: complete
+     last_updated: [Current date in YYYY-MM-DD format]
+     last_updated_by: [Researcher name]
+     ---
+
+     # Research: [User's Question/Topic]
+
+     **Date**: [Current date and time with timezone from step 4]
+     **Researcher**: [Researcher name from proposals status]
+     **Git Commit**: [Current commit hash from step 4]
+     **Branch**: [Current branch name from step 4]
+     **Repository**: [Repository name]
+
+     ## Research Question
+     [Original user query]
+
+     ## Summary
+     [High-level findings answering the user's question]
+
+     ## Detailed Findings
+
+     ### [Component/Area 1]
+     - Finding with reference ([file.ext:line](link))
+     - Connection to other components
+     - Implementation details
+
+     ### [Component/Area 2]
+     ...
+
+     ## Code References
+     - `path/to/file.go:123` - Description of what's there
+     - `another/file.ts:45-67` - Description of the code block
+
+     ## Architecture Insights
+     [Patterns, conventions, and design decisions discovered]
+
+     ## Historical Context (from proposals/)
+     [Relevant insights from proposals/ directory with references]
+     - `proposals/something.md` - Historical decision about X
+     - `proposals/notes.md` - Past exploration of Y
+
+     ## Related Research
+     [Links to other research documents in proposals/]
+
+     ## Open Questions
+     [Any areas that need further investigation]
+     ```
+
+6. **Add GitHub permalinks (if applicable):**
+   - Check if on main branch or if commit is pushed: `git branch --show-current` and `git status`
+   - If on main/master or pushed, generate GitHub permalinks:
+     - Get repo info: `gh repo view --json owner,name`
+     - Create permalinks: `https://github.com/{owner}/{repo}/blob/{commit}/{file}#L{line}`
+   - Replace local file references with permalinks in the document
+
+7. **Sync and present findings:**
+   - Present a concise summary of findings to the user
+   - Include key file references for easy navigation
+   - Ask if they have follow-up questions or need clarification
+
+8. **Handle follow-up questions:**
+   - If the user has follow-up questions, append to the same research document
+   - Update the frontmatter fields `last_updated` and `last_updated_by` to reflect the update
+   - Add `last_updated_note: "Added follow-up research for [brief description]"` to frontmatter
+   - Add a new section: `## Follow-up Research [timestamp]`
+   - Use new sub-agents as needed for additional investigation, do not create bespoke sub-agents.
+   - Continue updating the document and syncing
+
+## Important notes:
+- Always use parallel Task agents to maximize efficiency and minimize context usage
+- Always run fresh codebase research - never rely solely on existing research documents
+- The proposals/ directory provides historical context to supplement live findings
+- Focus on finding concrete file paths and line numbers for developer reference
+- Research documents should be self-contained with all necessary context
+- Each sub-agent prompt should be specific and focused on read-only operations
+- Consider cross-component connections and architectural patterns
+- Include temporal context (when the research was conducted)
+- Link to GitHub when possible for permanent references
+- Keep the main agent focused on synthesis, not deep file reading
+- Encourage sub-agents to find examples and usage patterns, not just definitions
+- Explore all of proposals/ directory, not just research subdirectory
+- **File reading**: Always read mentioned files FULLY (no limit/offset) before working on sub-tasks
+- **Critical ordering**: Follow the numbered steps exactly
+  - ALWAYS read mentioned files first before working on sub-tasks (step 1)
+  - ALWAYS wait for all sub-agents to complete before synthesizing (step 4)
+  - ALWAYS gather metadata before writing the document (step 5 before step 6)
+  - NEVER write the research document with placeholder values
+- **Frontmatter consistency**:
+  - Always include frontmatter at the beginning of research documents
+  - Keep frontmatter fields consistent across all research documents
+  - Update frontmatter when adding follow-up research
+  - Use snake_case for multi-word field names (e.g., `last_updated`, `git_commit`)
+  - Tags should be relevant to the research topic and components studied

.claude/agents/shortcut.md

@@ -0,0 +1,9 @@
+---
+name: shortcut-story-manager
+description: MUST USE THIS AGENT PROACTIVELY when you need to query, create, or edit Shortcut "stories" (or tickets, issues, etc). Shortcut is where we track work for this project. Any issue that this project works on will be on the "Troubleshoot Team" team and project in Shortcut.
+model: sonnet
+color: cyan
+---
+
+You are a product manager for the Troubleshoot Team team and responsible for managing shortcut stories that plan, prioritize, and track the work. You want to maintain a thorough record of the work done, including why, in each Shortcut story.
+

.claude/agents/testing.md

@@ -0,0 +1,16 @@
+---
+name: testing
+description: MUST USE THIS AGENT PROACTIVELY when designing a plan to write tests.
+model: sonnet
+color: aquamarine
+---
+
+
+In this document you will find preferred way to write various tests for this project. 
+
+
+* **Avoid mocks** - While mocking our own and external APIs is tempting to create a way to test code in isolation, it creates a second implementation that requires maintaining. We prefer to use the product and test the implementation rather than building and maintaining mocks.
+
+* **Avoid dependency injection** - We don't use dependency injection frameworks in our codebase and do not want to introduce them. Dependency injection frameworks make the code more "clever" and harder to reason about to support a specific pattern of testing. We prefer to solve testing without introducing dependency injection.
+
+* **Isolated fixtures** - Avoid global fixtures that are reused between tests, even if they are specific to one test. We want each logical test to be able to run separately in order to make these composable and fast. We run all tests in parallel in the CI pipeline. 

.claude/agents/web-search-researcher.md

@@ -0,0 +1,108 @@
+---
+name: web-search-researcher
+description: Do you find yourself desiring information that you don't quite feel well-trained (confident) on? Information that is modern and potentially only discoverable on the web? Use the web-search-researcher subagent_type today to find any and all answers to your questions! It will research deeply to figure out and attempt to answer your questions! If you aren't immediately satisfied you can get your money back! (Not really - but you can re-run web-search-researcher with an altered prompt in the event you're not satisfied the first time)
+tools: WebSearch, WebFetch, TodoWrite, Read, Grep, Glob, LS
+color: yellow
+---
+
+You are an expert web research specialist focused on finding accurate, relevant information from web sources. Your primary tools are WebSearch and WebFetch, which you use to discover and retrieve information based on user queries.
+
+## Core Responsibilities
+
+When you receive a research query, you will:
+
+1. **Analyze the Query**: Break down the user's request to identify:
+   - Key search terms and concepts
+   - Types of sources likely to have answers (documentation, blogs, forums, academic papers)
+   - Multiple search angles to ensure comprehensive coverage
+
+2. **Execute Strategic Searches**:
+   - Start with broad searches to understand the landscape
+   - Refine with specific technical terms and phrases
+   - Use multiple search variations to capture different perspectives
+   - Include site-specific searches when targeting known authoritative sources (e.g., "site:docs.stripe.com webhook signature")
+
+3. **Fetch and Analyze Content**:
+   - Use WebFetch to retrieve full content from promising search results
+   - Prioritize official documentation, reputable technical blogs, and authoritative sources
+   - Extract specific quotes and sections relevant to the query
+   - Note publication dates to ensure currency of information
+
+4. **Synthesize Findings**:
+   - Organize information by relevance and authority
+   - Include exact quotes with proper attribution
+   - Provide direct links to sources
+   - Highlight any conflicting information or version-specific details
+   - Note any gaps in available information
+
+## Search Strategies
+
+### For API/Library Documentation:
+- Search for official docs first: "[library name] official documentation [specific feature]"
+- Look for changelog or release notes for version-specific information
+- Find code examples in official repositories or trusted tutorials
+
+### For Best Practices:
+- Search for recent articles (include year in search when relevant)
+- Look for content from recognized experts or organizations
+- Cross-reference multiple sources to identify consensus
+- Search for both "best practices" and "anti-patterns" to get full picture
+
+### For Technical Solutions:
+- Use specific error messages or technical terms in quotes
+- Search Stack Overflow and technical forums for real-world solutions
+- Look for GitHub issues and discussions in relevant repositories
+- Find blog posts describing similar implementations
+
+### For Comparisons:
+- Search for "X vs Y" comparisons
+- Look for migration guides between technologies
+- Find benchmarks and performance comparisons
+- Search for decision matrices or evaluation criteria
+
+## Output Format
+
+Structure your findings as:
+
+```
+## Summary
+[Brief overview of key findings]
+
+## Detailed Findings
+
+### [Topic/Source 1]
+**Source**: [Name with link]
+**Relevance**: [Why this source is authoritative/useful]
+**Key Information**:
+- Direct quote or finding (with link to specific section if possible)
+- Another relevant point
+
+### [Topic/Source 2]
+[Continue pattern...]
+
+## Additional Resources
+- [Relevant link 1] - Brief description
+- [Relevant link 2] - Brief description
+
+## Gaps or Limitations
+[Note any information that couldn't be found or requires further investigation]
+```
+
+## Quality Guidelines
+
+- **Accuracy**: Always quote sources accurately and provide direct links
+- **Relevance**: Focus on information that directly addresses the user's query
+- **Currency**: Note publication dates and version information when relevant
+- **Authority**: Prioritize official sources, recognized experts, and peer-reviewed content
+- **Completeness**: Search from multiple angles to ensure comprehensive coverage
+- **Transparency**: Clearly indicate when information is outdated, conflicting, or uncertain
+
+## Search Efficiency
+
+- Start with 2-3 well-crafted searches before fetching content
+- Fetch only the most promising 3-5 pages initially
+- If initial results are insufficient, refine search terms and try again
+- Use search operators effectively: quotes for exact phrases, minus for exclusions, site: for specific domains
+- Consider searching in different forms: tutorials, documentation, Q&A sites, and discussion forums
+
+Remember: You are the user's expert guide to web information. Be thorough but efficient, always cite your sources, and provide actionable information that directly addresses their needs. Think deeply as you work.

.claude/commands/implement.md

@@ -0,0 +1,34 @@
+# Proposal Implementation
+
+You are tasked with implementing a detailed and approved technical proposal in this code. This command allows you to understand the proposal and proceed with the implementation.
+
+## Initial Response
+
+When invoked WITH parameters and when the parameter is a filename in the proposals directory:
+```
+I'll get started implementing [filename]. Let's first check if there an any questions before I start.
+```
+
+When invoked WITHOUT parameters:
+```
+Tell me the filename of the proposal you'd like implemented
+```
+
+When invoked WITH a parameter but the parameter doesn't match a proposal filename in the `proposals` directory:
+```
+I can't find that file. Tell me the filename of the proposal you'd like me to implement.
+```
+
+## Research and Implementation Plan
+
+Along with the implementation plan, there likely is a file that has `_research` appended to the filename. This is where all thoughts and research for various options have been documented. While you should primarily base your implementation on the provided proposal/implementation doc, the _research is available if you need to scan and understand some of the background.
+
+## Separate PRs
+
+If the implementation plan contains a section that shows separate PRs being made, limit your work to the next PR only. When completed, update the proposal to indicate the PR has been implemented so that next run, you will know to start on the next phase.
+
+## Subagents
+
+When writing code, use the following subagents, in addition to normal agents:
+
+- go-developer: this subagent is used to follow patterns we want for Go code.

.claude/commands/proposal.md

@@ -0,0 +1,40 @@
+# Proposal Author
+
+You are tasked with writing a proposal for new or edited functionality in this code. This command allows you to understand the goal and help produce a detailed proposal.
+
+## Initial Response
+
+When invoked WITH parameters:
+```
+I'll help you write a proposal for [summary]. Let's first check if this idea requires a proposal.
+```
+
+When invoked WITHOUT parameters:
+```
+I'll help you think through a new proposal.
+
+Please describe what your goals are:
+- What is the desired change?
+- Do you have any initial thoughts on how you'd like to implement?
+```
+
+## Follow up response
+
+
+
+## Subagent use
+
+You SHOULD use the following subagents (and any subagents they recommend) to help the user with their request:
+
+- proposal-needed
+- proposal-writer
+
+## Shortcut (tickets and stories)
+
+If the user's request references a ticket or shortcut story, use the shortcut agent to find the story. 
+Never update the shortcut story with anything. At this time, you should treat Shortcut as a readonly API.
+
+
+## Follow up instructions from the user
+
+At any time the user may reject your recommendation. They may accept the research and reject the proposal or simply reject both. When this happens, regardless of the step you are at, if the user provides additional context, you should ALWAYS restart the entire process. Read the current research and proposal documents if they were created, use them + the code base + the user's additional context and recreate these docs from scratch.

.github/CODEOWNERS

@@ -1 +0,0 @@
-* @replicatedhq/day2

.github/ISSUE_TEMPLATE/feature_epic.md

@@ -0,0 +1,28 @@
+---
+name: Feature Epic
+about: Create a tracking issue for a change that is larger than a single task
+labels: 'epic'
+
+---
+
+# Design Proposal
+
+Link to the [proposal](https://github.com/replicatedhq/troubleshoot/tree/main/docs/design/template.md)
+
+# Definition of done
+
+Describe what specific goals can measure if this overall task is considered completed. Things to consider are documentation, high level description of the feature working, and tests.
+
+* [ ]
+
+# Subtasks
+
+Create a list of the smaller tasks to implement this design. Task can start as simple descriptions but should be converted to issues before work is started.
+
+## Started
+
+* [ ]
+
+## Planned
+
+* [ ]

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,11 +7,11 @@ labels: 'feature'
 
 **Describe the rationale for the suggested feature.**
 
-Insert a description of the rationale for the new feature here. For example, you could describe a problem that Troubleshoot doesn't address, a limitation, or an idea to improve Troubleshoot. 
+Insert a description of the rationale for the new feature here. For example, you could describe a problem that Troubleshoot doesn't address, a limitation, or an idea to improve Troubleshoot.
 
 **Describe the feature**
 
-Insert a description of the feature here.  Be specific about how it addresses the any problems, limitations, or suggested improvements outlined in the rationale for the feature.
+Insert a description of the feature here. Be specific about how it addresses the problem. Mention any limitations, or suggested improvements outlined in the rationale for the feature.
 
 **Describe alternatives you've considered**
 
@@ -19,4 +19,4 @@ Describe alternative solutions here. Include any workarounds you've considered.
 
 **Additional context**
 
-Add additional context about the feature request.  If the change is substantial, consider attaching files to the issue  outlining architectural changes, data flows, file formats etc., anything that helps describe the requested change. 
+Add additional context about the feature request.  If the change is substantial, consider attaching files to the issue  outlining architectural changes, data flows, file formats etc., anything that helps describe the requested change.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+## Description, Motivation and Context
+
+Please include a summary of the change or what problem it solves. Please also include relevant motivation and context.
+
+<!--- If it relates to an open issue, please link to the issue here.
+e.g.
+Fixes: #414
+-->
+
+## Checklist
+
+- [ ] New and existing tests pass locally with introduced changes.
+- [ ] Tests for the changes have been added (for bug fixes / features)
+- [ ] The commit message(s) are informative and highlight any breaking changes
+- [ ] Any documentation required has been added/updated. For changes to https://troubleshoot.sh/ create a PR [here](https://github.com/replicatedhq/troubleshoot.sh/pulls)
+
+## Does this PR introduce a breaking change?
+- [ ] Yes
+- [ ] No
+
+<!-- If this PR contains a breaking change, please describe the impact and migration path for existing applications below. -->

.github/actions/setup-go/action.yml

@@ -0,0 +1,39 @@
+name: 'Setup Go Environment'
+description: 'Setup Go with caching and common environment variables'
+inputs:
+  go-version-file:
+    description: 'Path to go.mod file'
+    required: false
+    default: 'go.mod'
+outputs:
+  go-version:
+    description: 'The Go version that was installed'
+    value: ${{ steps.setup-go.outputs.go-version }}
+  cache-hit:
+    description: 'Whether the Go cache was hit'
+    value: ${{ steps.setup-go.outputs.cache-hit }}
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Go
+      id: setup-go
+      uses: actions/setup-go@v5
+      with:
+        go-version-file: ${{ inputs.go-version-file }}
+        cache: true
+
+    - name: Set Go environment variables
+      shell: bash
+      run: |
+        echo "GOMAXPROCS=2" >> $GITHUB_ENV
+        echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
+        echo "GOMODCACHE=$(go env GOMODCACHE)" >> $GITHUB_ENV
+
+    - name: Print Go environment
+      shell: bash
+      run: |
+        echo "Go version: $(go version)"
+        echo "GOOS: $(go env GOOS)"
+        echo "GOARCH: $(go env GOARCH)"
+        echo "Cache directory: $(go env GOCACHE)"
+        echo "Module cache: $(go env GOMODCACHE)"

.github/dependabot.yml

@@ -0,0 +1,45 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "gomod" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    labels:
+      - "dependencies"
+      - "go"
+      - "type::security"
+    schedule:
+      interval: "weekly"
+    groups:
+      security:
+        update-types:
+          - "patch"
+          - "minor"
+  - package-ecosystem: "gomod" # See documentation for possible values
+    directory: "/examples/sdk/helm-template" # Location of package manifests
+    labels:
+      - "dependencies"
+      - "go"
+      - "type::security"
+    schedule:
+      interval: "weekly"
+    groups:
+      security:
+        update-types:
+          - "patch"
+          - "minor"
+  
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the
+    # default location of `.github/workflows`
+    directory: "/"
+    labels:
+      - "dependencies"
+      - "github-actions"
+      - "type::security"
+    schedule:
+      interval: "weekly"

.github/workflows/build-test-deploy.yaml

@@ -1,133 +0,0 @@
-on:
-  pull_request:
-    branches:
-      - master
-  push:
-    branches:
-      - "master"
-    tags:
-      - "v*.*.*"
-  
-jobs:
-  build:
-    runs-on: ubuntu-18.04
-    steps:
-      - uses: actions/setup-go@v1
-        with:
-          go-version: "1.14"
-
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-
-      - uses: actions/checkout@v2
-
-      - run: make 
-  
-  compile-preflight:
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - uses: actions/setup-go@v1
-        with:
-          go-version: '1.14'
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@master
-      - run: make preflight
-      - uses: actions/upload-artifact@v1
-        with:
-          name: preflight
-          path: bin/preflight
-        
-  validate-preflight:
-    runs-on: ubuntu-latest
-    needs: compile-preflight
-    steps:
-      - name: Download preflight binary
-        uses: actions/download-artifact@v1
-        with:
-          name: preflight
-          path: bin/
-      - uses: engineerd/setup-kind@v0.5.0
-      - run: chmod +x bin/preflight
-      - run: ./bin/preflight --interactive=false --format=json https://preflight.replicated.com
-
-  compile-supportbundle:
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - uses: actions/setup-go@v1
-        with:
-          go-version: '1.14'
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@master
-      - run: make support-bundle
-      - uses: actions/upload-artifact@v1
-        with:
-          name: support-bundle
-          path: bin/support-bundle
-
-  validate-supportbundle:
-    runs-on: ubuntu-latest
-    needs: compile-supportbundle
-    steps:
-      - uses: actions/checkout@v1
-      - name: Download support-bundle binary
-        uses: actions/download-artifact@v1
-        with:
-          name: support-bundle
-          path: bin/
-      - uses: engineerd/setup-kind@v0.5.0
-      - run: chmod +x bin/support-bundle
-      - run: ./bin/support-bundle ./examples/support-bundle/sample-collectors.yaml
-      - run: ./bin/support-bundle ./examples/support-bundle/sample-supportbundle.yaml
-      - run: ./bin/support-bundle https://kots.io
-
-  goreleaser:
-    runs-on: ubuntu-latest
-    needs:
-      - validate-preflight
-    if: startsWith(github.ref, 'refs/tags/v')
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-  
-      - uses: azure/docker-login@v1
-        with:
-          username: repldeploy2
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-      - name: Unshallow
-        run: git fetch --prune --unshallow
-  
-      - uses: actions/setup-go@v1
-        with:
-          go-version: "1.14"
-   
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
-        with:
-          version: latest
-          args: release --rm-dist --config deploy/.goreleaser.yaml
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-
-      - name: Update new preflight version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.38
-        with:
-          krew_template_file: deploy/krew/preflight.yaml
-      - name: Update new support-bundle version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.38
-        with:
-          krew_template_file: deploy/krew/support-bundle.yaml

.github/workflows/build-test.yaml

@@ -0,0 +1,163 @@
+name: build-test
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches: [v1beta3]
+  push:
+    branches: [v1beta3]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Detect changes to optimize test execution
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      go-files: ${{ steps.filter.outputs.go-files }}
+      preflight: ${{ steps.filter.outputs.preflight }}
+      support-bundle: ${{ steps.filter.outputs.support-bundle }}
+      examples: ${{ steps.filter.outputs.examples }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            go-files:
+              - '**/*.go'
+              - 'go.{mod,sum}'
+              - 'Makefile'
+            preflight:
+              - 'cmd/preflight/**'
+              - 'pkg/preflight/**'
+            support-bundle:
+              - 'cmd/troubleshoot/**'
+              - 'pkg/supportbundle/**'
+
+  # Lint
+  lint:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ./.github/actions/setup-go
+
+      - name: Check go mod tidy
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum || {
+            echo "::error::Please run 'go mod tidy' and commit changes"
+            exit 1
+          }
+
+      - name: Format and vet
+        run: |
+          make fmt
+          git diff --exit-code || {
+            echo "::error::Please run 'make fmt' and commit changes"
+            exit 1
+          }
+          make vet
+
+  # Unit and integration tests
+  test:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ./.github/actions/setup-go
+
+      - name: Setup K3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Run tests
+        run: make test-integration
+
+  # Build binaries
+  build:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ./.github/actions/setup-go
+      - run: make build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: binaries
+          path: bin/
+          retention-days: 1
+
+  # E2E tests
+  e2e:
+    if: needs.changes.outputs.go-files == 'true' || github.event_name == 'push'
+    needs: [changes, build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: preflight
+            target: preflight-e2e-test
+            needs-k3s: true
+          - name: support-bundle-shell
+            target: support-bundle-e2e-test
+            needs-k3s: true
+          - name: support-bundle-go
+            target: support-bundle-e2e-go-test
+            needs-k3s: false
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Setup K3s
+        if: matrix.needs-k3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: binaries
+          path: bin/
+
+      - run: chmod +x bin/*
+      - run: make ${{ matrix.target }}
+
+  # Success summary
+  success:
+    if: always()
+    needs: [lint, test, build, e2e]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check results
+        run: |
+          # Check if any required jobs failed
+          if [[ "${{ needs.lint.result }}" == "failure" ]] || \
+             [[ "${{ needs.test.result }}" == "failure" ]] || \
+             [[ "${{ needs.build.result }}" == "failure" ]] || \
+             [[ "${{ needs.e2e.result }}" == "failure" ]]; then
+            echo "::error::Some jobs failed or were cancelled"
+            exit 1
+          fi
+          
+          # Check if any required jobs were cancelled  
+          if [[ "${{ needs.lint.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.test.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.build.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.e2e.result }}" == "cancelled" ]]; then
+            echo "::error::Some jobs failed or were cancelled"
+            exit 1
+          fi
+          
+          echo "✅ All tests passed!"

.github/workflows/regression-test.yaml

@@ -0,0 +1,292 @@
+name: Regression Test Suite
+
+on:
+  push:
+    branches: [main, v1beta3]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+    inputs:
+      update_baselines:
+        description: 'Update baselines after run (use with caution)'
+        type: boolean
+        default: false
+
+jobs:
+  regression-test:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+
+    steps:
+      # 1. SETUP
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Fetch all history for git describe to work
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        id: create-cluster
+        uses: replicatedhq/compatibility-actions/create-cluster@v1
+        with:
+          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
+          kubernetes-distribution: k3s
+          cluster-name: regression-${{ github.run_id }}-${{ github.run_attempt }}
+          ttl: 25m
+          timeout-minutes: 5
+
+      - name: Configure kubeconfig
+        run: |
+          echo "${{ steps.create-cluster.outputs.cluster-kubeconfig }}" > $GITHUB_WORKSPACE/kubeconfig.yaml
+          echo "KUBECONFIG=$GITHUB_WORKSPACE/kubeconfig.yaml" >> $GITHUB_ENV
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Build binaries
+        run: |
+          echo "Building preflight and support-bundle binaries..."
+          make bin/preflight bin/support-bundle
+          ./bin/preflight version
+          ./bin/support-bundle version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: |
+          pip install pyyaml deepdiff
+
+      # 2. EXECUTE SPECS (in parallel)
+      - name: Run all specs in parallel
+        continue-on-error: true
+        run: |
+          echo "Running all 3 specs in parallel..."
+
+          # Run v1beta3 in background
+          (
+            echo "Starting preflight v1beta3..."
+            ./bin/preflight \
+              examples/preflight/complex-v1beta3.yaml \
+              --values examples/preflight/values-complex-full.yaml \
+              --interactive=false \
+              --format=json \
+              --output=test/output/preflight-results-v1beta3.json 2>&1 | tee test/output/v1beta3.log || true
+
+            BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
+            if [ -n "$BUNDLE" ]; then
+              mv "$BUNDLE" test/output/preflight-v1beta3-bundle.tar.gz
+              echo "✓ v1beta3 bundle saved"
+            fi
+          ) &
+          PID_V1BETA3=$!
+
+          # Run v1beta2 in background
+          (
+            echo "Starting preflight v1beta2..."
+            ./bin/preflight \
+              examples/preflight/all-analyzers-v1beta2.yaml \
+              --interactive=false \
+              --format=json \
+              --output=test/output/preflight-results-v1beta2.json 2>&1 | tee test/output/v1beta2.log || true
+
+            BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
+            if [ -n "$BUNDLE" ]; then
+              mv "$BUNDLE" test/output/preflight-v1beta2-bundle.tar.gz
+              echo "✓ v1beta2 bundle saved"
+            fi
+          ) &
+          PID_V1BETA2=$!
+
+          # Run support bundle in background
+          (
+            echo "Starting support bundle..."
+            ./bin/support-bundle \
+              examples/collect/host/all-kubernetes-collectors.yaml \
+              --interactive=false \
+              --output=test/output/supportbundle.tar.gz 2>&1 | tee test/output/supportbundle.log || true
+
+            if [ -f test/output/supportbundle.tar.gz ]; then
+              echo "✓ Support bundle saved"
+            fi
+          ) &
+          PID_SUPPORTBUNDLE=$!
+
+          # Wait for all to complete
+          echo "Waiting for all specs to complete..."
+          wait $PID_V1BETA3
+          wait $PID_V1BETA2
+          wait $PID_SUPPORTBUNDLE
+
+          echo "All specs completed!"
+
+          # Verify bundles exist
+          ls -lh test/output/*.tar.gz || echo "Warning: Some bundles may be missing"
+
+      # 3. COMPARE BUNDLES
+      - name: Compare preflight v1beta3 bundle
+        id: compare-v1beta3
+        continue-on-error: true
+        run: |
+          echo "Comparing v1beta3 preflight bundle against baseline..."
+          if [ ! -f test/baselines/preflight-v1beta3/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for v1beta3 - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/preflight-v1beta3/baseline.tar.gz \
+            --current test/output/preflight-v1beta3-bundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-v1beta3.json \
+            --spec-type preflight
+
+      - name: Compare preflight v1beta2 bundle
+        id: compare-v1beta2
+        continue-on-error: true
+        run: |
+          echo "Comparing v1beta2 preflight bundle against baseline..."
+          if [ ! -f test/baselines/preflight-v1beta2/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for v1beta2 - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/preflight-v1beta2/baseline.tar.gz \
+            --current test/output/preflight-v1beta2-bundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-v1beta2.json \
+            --spec-type preflight
+
+      - name: Compare support bundle
+        id: compare-supportbundle
+        continue-on-error: true
+        run: |
+          echo "Comparing support bundle against baseline..."
+          if [ ! -f test/baselines/supportbundle/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for support bundle - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/supportbundle/baseline.tar.gz \
+            --current test/output/supportbundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-supportbundle.json \
+            --spec-type supportbundle
+
+      # 4. REPORT RESULTS
+      - name: Generate summary report
+        if: always()
+        run: |
+          python3 scripts/generate_summary.py \
+            --reports test/output/diff-report-*.json \
+            --output-file $GITHUB_STEP_SUMMARY \
+            --output-console
+
+      - name: Upload test artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: regression-test-results-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/*.tar.gz
+            test/output/*.json
+          retention-days: 30
+
+      - name: Check for regressions
+        if: always()
+        run: |
+          echo "Checking comparison results..."
+
+          # Check if any comparisons failed
+          FAILURES=0
+
+          if [ "${{ steps.compare-v1beta3.outcome }}" == "failure" ] && [ "${{ steps.compare-v1beta3.outputs.baseline_missing }}" != "true" ]; then
+            echo "❌ v1beta3 comparison failed"
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ "${{ steps.compare-v1beta2.outcome }}" == "failure" ] && [ "${{ steps.compare-v1beta2.outputs.baseline_missing }}" != "true" ]; then
+            echo "❌ v1beta2 comparison failed"
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ "${{ steps.compare-supportbundle.outcome }}" == "failure" ] && [ "${{ steps.compare-supportbundle.outputs.baseline_missing }}" != "true" ]; then
+            echo "❌ Support bundle comparison failed"
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ $FAILURES -gt 0 ]; then
+            echo ""
+            echo "❌ $FAILURES regression(s) detected!"
+            echo "Review the comparison reports in the artifacts."
+            exit 1
+          else
+            echo "✅ All comparisons passed or skipped (no baseline)"
+          fi
+
+      # 5. UPDATE BASELINES (optional, manual trigger only)
+      - name: Update baselines
+        if: github.event.inputs.update_baselines == 'true' && github.event_name == 'workflow_dispatch'
+        run: |
+          echo "Updating baselines with current bundles..."
+
+          # Copy new bundles as baselines
+          if [ -f test/output/preflight-v1beta3-bundle.tar.gz ]; then
+            mkdir -p test/baselines/preflight-v1beta3
+            cp test/output/preflight-v1beta3-bundle.tar.gz test/baselines/preflight-v1beta3/baseline.tar.gz
+            echo "✓ Updated v1beta3 baseline"
+          fi
+
+          if [ -f test/output/preflight-v1beta2-bundle.tar.gz ]; then
+            mkdir -p test/baselines/preflight-v1beta2
+            cp test/output/preflight-v1beta2-bundle.tar.gz test/baselines/preflight-v1beta2/baseline.tar.gz
+            echo "✓ Updated v1beta2 baseline"
+          fi
+
+          if [ -f test/output/supportbundle.tar.gz ]; then
+            mkdir -p test/baselines/supportbundle
+            cp test/output/supportbundle.tar.gz test/baselines/supportbundle/baseline.tar.gz
+            echo "✓ Updated support bundle baseline"
+          fi
+
+          # Create metadata file
+          cat > test/baselines/metadata.json <<EOF
+          {
+            "updated_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "git_sha": "${{ github.sha }}",
+            "k8s_version": "v1.28.3",
+            "workflow_run": "${{ github.run_id }}"
+          }
+          EOF
+
+          # Commit and push
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add test/baselines/
+          git commit -m "chore: update regression test baselines from run ${{ github.run_id }}"
+          git push
+
+      # 6. CLEANUP
+      - name: Remove cluster
+        if: always()
+        uses: replicatedhq/compatibility-actions/remove-cluster@v1
+        continue-on-error: true
+        with:
+          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
+          cluster-id: ${{ steps.create-cluster.outputs.cluster-id }}

.github/workflows/release.yaml

@@ -0,0 +1,48 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  goreleaser:
+    runs-on: troubleshoot_release
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - uses: azure/docker-login@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "v2.12.3"
+          args: release --clean --config deploy/.goreleaser.yaml
+        env:
+          GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_TOKEN }}
+
+      - name: Update new preflight version in krew-index
+        if: ${{ !contains(github.ref_name, '-') }}
+        uses: rajatjindal/krew-release-bot@v0.0.47
+        with:
+          krew_template_file: deploy/krew/preflight.yaml
+
+      - name: Update new support-bundle version in krew-index
+        if: ${{ !contains(github.ref_name, '-') }}
+        uses: rajatjindal/krew-release-bot@v0.0.47
+        with:
+          krew_template_file: deploy/krew/support-bundle.yaml

.gitignore

@@ -6,6 +6,11 @@
 *.so
 *.dylib
 bin
+.DS_Store
+
+# npm generated files
+node_modules/
+package*.json
 
 # Test binary, build with `go test -c`
 *.test
@@ -25,9 +30,29 @@ vendor
 *.swp
 *.swo
 *~
+.envrc
+
 
 dist
 try.sh
 
 .vscode/
 workspace.*
+
+cosign.key
+sbom/
+
+# Ignore local pre-commit config
+.pre-commit-config.yaml
+
+# Ignore generated support bundles
+*.tar.gz
+!testdata/supportbundle/*.tar.gz
+!test/baselines/**/baseline.tar.gz
+
+# Ignore built binaries
+troubleshoot
+troubleshoot-test
+cmd/troubleshoot/troubleshoot
+cmd/*/troubleshoot
+support-bundle

CODE_OF_CONDUCT.md

@@ -1,128 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
-  overall community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-kyles@replicated.com.
-All complaints will be reviewed and investigated promptly and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -1,11 +1,76 @@
 # Contributing to Troubleshoot
 
-Thank you for your interest in Troubleshoot, we welcome your participation. Please familiarize yourself with our [Code of Conduct](https://github.com/replicatedhq/troubleshoot/blob/master/CODE_OF_CONDUCT.md) prior to contributing. There are a number of ways to participate in Troubleshoot as outlined below:
+Thank you for your interest in Troubleshoot, we welcome your participation. There are a number of ways to participate in Troubleshoot as outlined below:
+
+# Community
+
+For discussions about developing Troubleshoot, there's an [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot).
 
 ## Issues
-- [Request a New Feature](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=feature&template=feature_enhancement.md) Create an issue to add functionality that addresses a problem or adds an enhancement.  
-- [Report a Bug](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=bug&template=bug_report.md) Report a problem or unexpected behaviour with Troubleshoot. 
 
-## Pull Requests
+- [Request a New Feature](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=feature&template=feature_enhancement.md) Create an issue to add functionality that addresses a problem or adds an enhancement.
+- [Report a Bug](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=bug&template=bug_report.md) Report a problem or unexpected behaviour with Troubleshoot.
 
-If you are interested in contributing a change to the code or documentation please open a pull request with your set of changes. The pull request will be reviewed in a timely manner.
+## Design Principles
+
+When implementing a new feature please review the [design principles](./docs/design/design-principles.md) to help guide the approach.
+
+## Development Environment
+
+To get started we recommend:
+
+1. Go (v1.24 or later)
+2. For cluster-based collectors, you will need access to a Kubernetes cluster
+3. Fork and clone repo
+4. Run `make clean build` to generate binaries
+5. You can now run `./bin/preflight` and/or `./bin/support-bundle` to use the code you've been writing
+
+> Note: to cross-compile a Linux binary from MacOS:
+> `GOOS=linux GOARCH=amd64 make clean build`
+
+### Testing
+
+To run the tests locally run the following:
+
+```bash
+make test
+make test RUN=TestClusterResources_Merge
+```
+
+Additionally, e2e tests can be run with:
+
+```bash
+make support-bundle preflight e2e-test
+```
+
+A running Kubernetes cluster as well as `jq` are required to run e2e tests.
+
+### Profiling
+
+You are able to collect CPU & memory runtime properties and store the data for analysis in a file. To do so, pass in the file paths using `--cpuprofile` and `--memprofile` flags in the CLI. Once you have your data collected, you can analyse it using [pprof visualization tool](https://github.com/google/pprof/blob/main/doc/README.md). Here is how
+
+Run support bundle and with CPU & memory profile flags
+
+```sh
+./bin/support-bundle examples/support-bundle/sample-supportbundle.yaml --cpuprofile=cpu.prof --memprofile=mem.prof
+```
+
+Visualize using [pprof](https://github.com/google/pprof/blob/main/doc/README.md)
+
+```sh
+go tool pprof -http=":8000" cpu.prof
+
+go tool pprof -http=":8001" mem.prof
+```
+
+**Additional flags for memory profiling**
+- `inuse_space`: Amount of memory allocated and not released yet (default).
+- `inuse_objects`: Amount of objects allocated and not released yet.
+- `alloc_space`: Total amount of memory allocated (regardless of released).
+- `alloc_objects`: Total amount of objects allocated (regardless of released).
+
+More on profiling please visit https://go.dev/doc/diagnostics#profiling
+
+## Contribution workflow
+
+We'd love to talk before you dig into a a large feature. 

Makefile

@@ -1,13 +1,12 @@
 
 # Image URL to use all building/pushing image targets
 IMG ?= controller:latest
-export GO111MODULE=on
-export GOPROXY=https://proxy.golang.org
 
-SHELL := /bin/bash -o pipefail
+SHELL := bash -o pipefail
 VERSION_PACKAGE = github.com/replicatedhq/troubleshoot/pkg/version
 VERSION ?=`git describe --tags --dirty`
 DATE=`date -u +"%Y-%m-%dT%H:%M:%SZ"`
+RUN?=""
 
 GIT_TREE = $(shell git rev-parse --is-inside-work-tree 2>/dev/null)
 ifneq "$(GIT_TREE)" ""
@@ -35,105 +34,79 @@ define LDFLAGS
 "
 endef
 
-BUILDFLAGS = -tags "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp" -installsuffix netgo
+BUILDTAGS = "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp"
+BUILDFLAGS = -tags ${BUILDTAGS} -installsuffix netgo
+BUILDPATHS = ./pkg/... ./cmd/... ./internal/...
+E2EPATHS = ./test/e2e/...
+TESTFLAGS ?=
 
-all: test
+.DEFAULT_GOAL := all
+all: clean build test
 
-.PHONY: ffi
-ffi: fmt vet
-	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/troubleshoot.so -buildmode=c-shared ffi/main.go
+.PHONY: test
+test: fmt vet
+	if [ -n $(RUN) ]; then \
+		go test ${BUILDFLAGS} ${BUILDPATHS} ${TESTFLAGS} -run $(RUN); \
+	else \
+		go test ${BUILDFLAGS} ${BUILDPATHS} ${TESTFLAGS}; \
+	fi
 
-# Run tests
-test: generate fmt vet
-	go test ${BUILDFLAGS} ./pkg/... ./cmd/... -coverprofile cover.out
+# Go tests that require a K8s instance
+# TODOLATER: merge with test, so we get unified coverage reports? it'll add 21~sec to the test job though...
+.PHONY: test-integration
+test-integration: fmt vet
+	go test -v --tags="integration exclude_graphdriver_devicemapper exclude_graphdriver_btrfs" ${BUILDPATHS}
 
-.PHONY: support-bundle
-support-bundle: generate fmt vet
+.PHONY: preflight-e2e-test
+preflight-e2e-test:
+	./test/validate-preflight-e2e.sh
+
+.PHONY: support-bundle-e2e-test
+support-bundle-e2e-test:
+	./test/validate-support-bundle-e2e.sh
+
+.PHONY: support-bundle-e2e-go-test
+support-bundle-e2e-go-test:
+	if [ -n $(RUN) ]; then \
+		go test ${BUILDFLAGS} ${E2EPATHS} -v -run $(RUN); \
+	else \
+		go test ${BUILDFLAGS} ${E2EPATHS} -v; \
+	fi
+
+rebuild: clean build
+
+build: tidy
+	@echo "Build cli binaries"
+	$(MAKE) bin/support-bundle bin/preflight
+
+.PHONY: clean
+clean:
+	@rm -f bin/support-bundle
+	@rm -f bin/preflight
+
+.PHONY: tidy
+tidy:
+	go mod tidy
+
+# Only build when any of the files in SOURCES changes, or if bin/<file> is absent
+MAKEFILE_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+SOURCES := $(shell find $(MAKEFILE_DIR) -type f \( -name "*.go" -o -name "go.mod" -o -name "go.sum" \))
+bin/support-bundle: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/support-bundle github.com/replicatedhq/troubleshoot/cmd/troubleshoot
 
-.PHONY: preflight
-preflight: generate fmt vet
+bin/preflight: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/preflight github.com/replicatedhq/troubleshoot/cmd/preflight
 
-.PHONY: analyze
-analyze: generate fmt vet
-	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/analyze github.com/replicatedhq/troubleshoot/cmd/analyze
+.PHONY: support-bundle
+support-bundle: bin/support-bundle
+
+.PHONY: preflight
+preflight: bin/preflight
 
 .PHONY: fmt
 fmt:
-	go fmt ./pkg/... ./cmd/...
+	go fmt ${BUILDPATHS}
 
 .PHONY: vet
 vet:
-	go vet ${BUILDFLAGS} ./pkg/... ./cmd/...
-
-.PHONY: generate
-generate: controller-gen client-gen
-	$(CONTROLLER_GEN) \
-		object:headerFile=./hack/boilerplate.go.txt paths=./pkg/apis/...
-	$(CLIENT_GEN) \
-		--output-package=github.com/replicatedhq/troubleshoot/pkg/client \
-		--clientset-name troubleshootclientset \
-		--input-base github.com/replicatedhq/troubleshoot/pkg/apis \
-		--input troubleshoot/v1beta1 \
-		--input troubleshoot/v1beta2 \
-		-h ./hack/boilerplate.go.txt
-
-.PHONY: openapischema
-openapischema: controller-gen
-	controller-gen crd +output:dir=./config/crds  paths=./pkg/apis/troubleshoot/v1beta1
-	controller-gen crd +output:dir=./config/crds  paths=./pkg/apis/troubleshoot/v1beta2
-
-.PHONY: schemas
-schemas: fmt vet openapischema
-	go build ${LDFLAGS} -o bin/schemagen github.com/replicatedhq/troubleshoot/cmd/schemagen
-	./bin/schemagen --output-dir ./schemas
-
-.PHONY: contoller-gen
-controller-gen:
-ifeq (, $(shell which controller-gen))
-	go get sigs.k8s.io/controller-tools/cmd/controller-gen@v0.3.0
-CONTROLLER_GEN=$(shell go env GOPATH)/bin/controller-gen
-else
-CONTROLLER_GEN=$(shell which controller-gen)
-endif
-
-.PHONY: client-gen
-client-gen:
-ifeq (, $(shell which client-gen))
-	go get k8s.io/code-generator/cmd/client-gen@kubernetes-1.18.0
-CLIENT_GEN=$(shell go env GOPATH)/bin/client-gen
-else
-CLIENT_GEN=$(shell which client-gen)
-endif
-
-.PHONY: release
-release: export GITHUB_TOKEN = $(shell echo ${GITHUB_TOKEN_TROUBLESHOOT})
-release:
-	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --config deploy/.goreleaser.yml
-
-.PHONY: snapshot-release
-snapshot-release:
-	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --snapshot --config deploy/.goreleaser.snapshot.yml
-	docker push replicated/troubleshoot:alpha
-	docker push replicated/preflight:alpha
-
-.PHONY: local-release
-local-release:
-	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --snapshot --config deploy/.goreleaser.yaml
-	docker tag replicated/troubleshoot:alpha localhost:32000/troubleshoot:alpha
-	docker tag replicated/preflight:alpha localhost:32000/preflight:alpha
-	docker push localhost:32000/troubleshoot:alpha
-	docker push localhost:32000/preflight:alpha
-
-.PHONY: run-preflight
-run-preflight: preflight
-	./bin/preflight ./examples/preflight/sample-preflight.yaml
-
-.PHONY: run-troubleshoot
-run-troubleshoot: support-bundle
-	./bin/support-bundle ./examples/support-bundle/sample-supportbundle.yaml
-
-.PHONY: run-analyze
-run-analyze: analyze
-	./bin/analyze --analyzers ./examples/support-bundle/sample-analyzers.yaml ./support-bundle.tar.gz
+	go vet ${BUILDFLAGS} ${BUILDPATHS}

README.md

@@ -4,21 +4,25 @@ Replicated Troubleshoot is a framework for collecting, redacting, and analyzing
 
 Troubleshoot provides two CLI tools as kubectl plugins (using [Krew](https://krew.dev)): `kubectl preflight` and `kubectl support-bundle`. Preflight provides pre-installation cluster conformance testing and validation (preflight checks) and support-bundle provides post-installation troubleshooting and diagnostics (support bundles).
 
+To know more about troubleshoot, please visit: https://troubleshoot.sh/
+
 ## Preflight Checks
 Preflight checks are an easy-to-run set of conformance tests that can be written to verify that specific requirements in a cluster are met.
 
 To run a sample preflight check from a sample application, install the preflight kubectl plugin:
 
-```shell
+```
 curl https://krew.sh/preflight | bash
 ```
- and run:
- 
-```shell
+ and run, where https://preflight.replicated.com provides an **example** preflight spec:
+
+```
 kubectl preflight https://preflight.replicated.com
 ```
 
-For a details on creating the custom resource files that drive preflight checks, visit [creating preflight checks](https://troubleshoot.sh/docs/preflight/introduction/).
+**NOTE** this is an example. Do **not** use to validate real scenarios.
+
+For more details on creating the custom resource files that drive preflight checks, visit [creating preflight checks](https://troubleshoot.sh/docs/preflight/introduction/).
 
 
 ## Support Bundle
@@ -26,16 +30,45 @@ A support bundle is an archive that's created in-cluster, by collecting logs and
 
 To collect a sample support bundle, install the troubleshoot kubectl plugin:
 
-```shell
+```
 curl https://krew.sh/support-bundle | bash
 ```
- and run:
- 
-```shell
+ and run, where https://support-bundle.replicated.com provides an **example** support bundle spec:
+
+```
 kubectl support-bundle https://support-bundle.replicated.com
 ```
-For details on creating the custom resource files that drive support-bundle collection, visit [creating collectors](https://troubleshoot.sh/docs/collect/) and [creating analyzers](https://troubleshoot.sh/docs/analyze/).
+
+**NOTE** this is an example. Do **not** use to validate real scenarios.
+
+For more details on creating the custom resource files that drive support-bundle collection, visit [creating collectors](https://troubleshoot.sh/docs/collect/) and [creating analyzers](https://troubleshoot.sh/docs/analyze/).
+
+And see our other tool [sbctl](https://github.com/replicatedhq/sbctl) that makes it easier to interact with support bundles using `kubectl` commands you already know
 
 # Community
 
-For questions about using Troubleshoot, there's a [Replicated Community](https://help.replicated.com/community) forum, and a [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot).
+For questions about using Troubleshoot, how to contribute and engaging with the project in any other way, please refer to the following resources and channels.
+
+- [Replicated Community](https://help.replicated.com/community) forum
+- [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot)
+- [#Community meetings calendar](https://calendar.google.com/calendar/u/0?cid=Y19mMGx1aGhiZGtscGllOGo5dWpicXMwNnN1a0Bncm91cC5jYWxlbmRhci5nb29nbGUuY29t). This happen monthly but dates may change and would be kept upto date in the calendar.
+
+# Software Bill of Materials
+A signed SBOM  that includes Troubleshoot dependencies is included in each release.
+- **troubleshoot-sbom.tgz** contains a software bill of materials for Troubleshoot.
+- **troubleshoot-sbom.tgz.sig** is the digital signature for troubleshoot-sbom.tgz
+- **key.pub** is the public key from the key pair used to sign troubleshoot-sbom.tgz
+
+The following example illustrates using [cosign](https://github.com/sigstore/cosign) to verify that **troubleshoot-sbom.tgz** has
+not been tampered with.
+```sh
+$ cosign verify-blob --key key.pub --signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz
+Verified OK
+```
+
+If you were to get an error similar to the one below, it means you are verifying an SBOM signed using cosign `v1` using a newer `v2` of the binary. This version introduced [breaking changes](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md#breaking-changes) which require an additional flag `--insecure-ignore-tlog=true` to successfully verify SBOMs like so.
+```sh
+$ cosign verify-blob --key key.pub --signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz --insecure-ignore-tlog=true
+WARNING: Skipping tlog verification is an insecure practice that lacks of transparency and auditability verification for the blob.
+Verified OK
+```

cmd/analyze/cli/root.go

@@ -1,44 +1,105 @@
 package cli
 
 import (
+	"fmt"
 	"os"
 	"strings"
 
+	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
+// validateArgs allows certain flags to run without requiring bundle arguments
+func validateArgs(cmd *cobra.Command, args []string) error {
+	// Special flags that don't require bundle arguments
+	if cmd.Flags().Changed("check-ollama") || cmd.Flags().Changed("setup-ollama") ||
+		cmd.Flags().Changed("list-models") || cmd.Flags().Changed("pull-model") {
+		return nil
+	}
+
+	// For all other cases, require at least 1 argument (the bundle path)
+	if len(args) < 1 {
+		return fmt.Errorf("requires at least 1 arg(s), only received %d. Usage: analyze [bundle-path] or use --check-ollama/--setup-ollama", len(args))
+	}
+
+	return nil
+}
+
 func RootCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:          "analyze [url]",
-		Args:         cobra.MinimumNArgs(1),
+		Args:         validateArgs,
 		Short:        "Analyze a support bundle",
 		Long:         `Run a series of analyzers on a support bundle archive`,
 		SilenceUsage: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+			v := viper.GetViper()
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+
+			if err := util.StartProfiling(); err != nil {
+				klog.Errorf("Failed to start profiling: %v", err)
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
-			logger.SetQuiet(v.GetBool("quiet"))
+			// Handle cases where no bundle argument is provided (for utility flags)
+			var bundlePath string
+			if len(args) > 0 {
+				bundlePath = args[0]
+			}
 
-			return runAnalyzers(v, args[0])
+			return runAnalyzers(v, bundlePath)
+		},
+		PostRun: func(cmd *cobra.Command, args []string) {
+			if err := util.StopProfiling(); err != nil {
+				klog.Errorf("Failed to stop profiling: %v", err)
+			}
 		},
 	}
 
 	cobra.OnInitialize(initConfig)
 
+	cmd.AddCommand(util.VersionCmd())
+
 	cmd.Flags().String("analyzers", "", "filename or url of the analyzers to use")
+	cmd.Flags().Bool("debug", false, "enable debug logging")
+
+	// Advanced analysis flags
+	cmd.Flags().Bool("advanced-analysis", false, "use advanced analysis engine with AI capabilities")
+	cmd.Flags().StringSlice("agents", []string{"local"}, "analysis agents to use: local, hosted, ollama")
+	cmd.Flags().Bool("enable-ollama", false, "enable Ollama AI-powered analysis")
+	cmd.Flags().Bool("disable-ollama", false, "explicitly disable Ollama AI-powered analysis")
+	cmd.Flags().String("ollama-endpoint", "http://localhost:11434", "Ollama server endpoint")
+	cmd.Flags().String("ollama-model", "llama2:7b", "Ollama model to use for analysis")
+	cmd.Flags().Bool("use-codellama", false, "use CodeLlama model for code-focused analysis")
+	cmd.Flags().Bool("use-mistral", false, "use Mistral model for fast analysis")
+	cmd.Flags().Bool("auto-pull-model", true, "automatically pull model if not available")
+	cmd.Flags().Bool("list-models", false, "list all available/installed Ollama models and exit")
+	cmd.Flags().Bool("pull-model", false, "pull the specified model and exit")
+	cmd.Flags().Bool("setup-ollama", false, "automatically setup and configure Ollama")
+	cmd.Flags().Bool("check-ollama", false, "check Ollama installation status and exit")
+	cmd.Flags().Bool("include-remediation", true, "include remediation suggestions in analysis results")
+	cmd.Flags().String("output-file", "", "save analysis results to file (e.g., --output-file results.json)")
 
 	viper.BindPFlags(cmd.Flags())
 
 	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
 
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
 	k8sutil.AddFlags(cmd.Flags())
 
+	// CPU and memory profiling flags
+	util.AddProfilingFlags(cmd)
+
 	return cmd
 }
 

cmd/analyze/cli/run.go

@@ -1,24 +1,414 @@
 package cli
 
 import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"encoding/json"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
 
 	"github.com/pkg/errors"
-	"github.com/replicatedhq/troubleshoot/cmd/util"
+	"github.com/replicatedhq/troubleshoot/internal/util"
 	analyzer "github.com/replicatedhq/troubleshoot/pkg/analyze"
+	"github.com/replicatedhq/troubleshoot/pkg/analyze/agents/local"
+	"github.com/replicatedhq/troubleshoot/pkg/analyze/agents/ollama"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/yaml"
 )
 
 func runAnalyzers(v *viper.Viper, bundlePath string) error {
+	// Handle Ollama-specific commands first (these don't require a bundle)
+	if v.GetBool("setup-ollama") {
+		return handleOllamaSetup(v)
+	}
+
+	if v.GetBool("check-ollama") {
+		return handleOllamaStatus(v)
+	}
+
+	if v.GetBool("list-models") {
+		return handleListModels(v)
+	}
+
+	if v.GetBool("pull-model") {
+		return handlePullModel(v)
+	}
+
+	// For all other operations, we need a bundle path
+	if bundlePath == "" {
+		return errors.New("bundle path is required for analysis operations")
+	}
+
+	// Check if advanced analysis is requested
+	useAdvanced := v.GetBool("advanced-analysis") ||
+		v.GetBool("enable-ollama") ||
+		(len(v.GetStringSlice("agents")) > 1 ||
+			(len(v.GetStringSlice("agents")) == 1 && v.GetStringSlice("agents")[0] != "local"))
+
+	if useAdvanced {
+		return runAdvancedAnalysis(v, bundlePath)
+	}
+
+	// Only fall back to legacy analysis if no advanced flags are used at all
+	return runLegacyAnalysis(v, bundlePath)
+}
+
+// handleOllamaSetup automatically sets up Ollama for the user
+func handleOllamaSetup(v *viper.Viper) error {
+	fmt.Println("🚀 Ollama Setup Assistant")
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	helper := analyzer.NewOllamaHelper()
+
+	// Check current status
+	status := helper.GetHealthStatus()
+	fmt.Print(status.String())
+
+	if !status.Installed {
+		fmt.Println("\n🔧 Installing Ollama...")
+		if err := helper.DownloadAndInstall(); err != nil {
+			return errors.Wrap(err, "failed to install Ollama")
+		}
+		fmt.Println("✅ Ollama installed successfully!")
+	}
+
+	if !status.Running {
+		fmt.Println("\n🚀 Starting Ollama service...")
+		if err := helper.StartService(); err != nil {
+			return errors.Wrap(err, "failed to start Ollama service")
+		}
+		fmt.Println("✅ Ollama service started!")
+	}
+
+	if len(status.Models) == 0 {
+		fmt.Println("\n📚 Downloading recommended model...")
+		helper.PrintModelRecommendations()
+
+		model := v.GetString("ollama-model")
+		if model == "" {
+			model = "llama2:7b"
+		}
+
+		fmt.Printf("\n⬇️  Pulling model: %s (this may take several minutes)...\n", model)
+		if err := helper.PullModel(model); err != nil {
+			return errors.Wrapf(err, "failed to pull model %s", model)
+		}
+	}
+
+	fmt.Println("\n🎉 Ollama setup complete!")
+	fmt.Println("\n💡 Next steps:")
+	fmt.Printf("   troubleshoot analyze --enable-ollama %s\n", filepath.Base(os.Args[len(os.Args)-1]))
+
+	return nil
+}
+
+// handleOllamaStatus shows current Ollama installation and service status
+func handleOllamaStatus(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	fmt.Println("🔍 Ollama Status Report")
+	fmt.Println("=" + strings.Repeat("=", 50))
+	fmt.Print(status.String())
+
+	if !status.Installed {
+		fmt.Println("\n🔧 Setup Instructions:")
+		fmt.Println(helper.GetInstallInstructions())
+		return nil
+	}
+
+	if !status.Running {
+		fmt.Println("\n🚀 To start Ollama service:")
+		fmt.Println("   ollama serve &")
+		fmt.Println("   # or")
+		fmt.Println("   troubleshoot analyze --setup-ollama")
+		return nil
+	}
+
+	if len(status.Models) == 0 {
+		fmt.Println("\n📚 No models installed. Recommended models:")
+		helper.PrintModelRecommendations()
+	} else {
+		fmt.Println("\n✅ Ready for AI-powered analysis!")
+		fmt.Printf("   troubleshoot analyze --enable-ollama your-bundle.tar.gz\n")
+	}
+
+	return nil
+}
+
+// handleListModels lists available and installed Ollama models
+func handleListModels(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	fmt.Println("🤖 Ollama Model Management")
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	if !status.Installed {
+		fmt.Println("❌ Ollama is not installed")
+		fmt.Println("💡 Install with: troubleshoot analyze --setup-ollama")
+		return nil
+	}
+
+	if !status.Running {
+		fmt.Println("⚠️  Ollama service is not running")
+		fmt.Println("🚀 Start with: ollama serve &")
+		return nil
+	}
+
+	// Show installed models
+	fmt.Println("📚 Installed Models:")
+	if len(status.Models) == 0 {
+		fmt.Println("   No models installed")
+	} else {
+		for _, model := range status.Models {
+			fmt.Printf("   ✅ %s\n", model)
+		}
+	}
+
+	// Show available models for download
+	fmt.Println("\n🌐 Available Models:")
+	helper.PrintModelRecommendations()
+
+	// Show usage examples
+	fmt.Println("💡 Usage Examples:")
+	fmt.Println("   # Use specific model:")
+	fmt.Printf("   troubleshoot analyze --ollama-model llama2:13b bundle.tar.gz\n")
+	fmt.Println("   # Use preset models:")
+	fmt.Printf("   troubleshoot analyze --use-codellama bundle.tar.gz\n")
+	fmt.Printf("   troubleshoot analyze --use-mistral bundle.tar.gz\n")
+	fmt.Println("   # Pull a new model:")
+	fmt.Printf("   troubleshoot analyze --ollama-model llama2:13b --pull-model\n")
+
+	return nil
+}
+
+// handlePullModel pulls a specific model
+func handlePullModel(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	if !status.Installed {
+		fmt.Println("❌ Ollama is not installed")
+		fmt.Println("💡 Install with: troubleshoot analyze --setup-ollama")
+		return errors.New("Ollama must be installed to pull models")
+	}
+
+	if !status.Running {
+		fmt.Println("❌ Ollama service is not running")
+		fmt.Println("🚀 Start with: ollama serve &")
+		return errors.New("Ollama service must be running to pull models")
+	}
+
+	// Determine which model to pull
+	model := determineOllamaModel(v)
+
+	fmt.Printf("📥 Pulling model: %s\n", model)
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	if err := helper.PullModel(model); err != nil {
+		return errors.Wrapf(err, "failed to pull model %s", model)
+	}
+
+	fmt.Printf("\n✅ Model %s ready for analysis!\n", model)
+	fmt.Println("\n💡 Test it with:")
+	fmt.Printf("   troubleshoot analyze --ollama-model %s bundle.tar.gz\n", model)
+
+	return nil
+}
+
+// runAdvancedAnalysis uses the new analysis engine with agent support
+func runAdvancedAnalysis(v *viper.Viper, bundlePath string) error {
+	ctx := context.Background()
+
+	// Create the analysis engine
+	engine := analyzer.NewAnalysisEngine()
+
+	// Determine which agents to use
+	agents := v.GetStringSlice("agents")
+
+	// Handle Ollama flags
+	enableOllama := v.GetBool("enable-ollama")
+	disableOllama := v.GetBool("disable-ollama")
+
+	if enableOllama && !disableOllama {
+		// Add ollama to agents if not already present
+		hasOllama := false
+		for _, agent := range agents {
+			if agent == "ollama" {
+				hasOllama = true
+				break
+			}
+		}
+		if !hasOllama {
+			agents = append(agents, "ollama")
+		}
+	}
+
+	if disableOllama {
+		// Remove ollama from agents
+		filteredAgents := []string{}
+		for _, agent := range agents {
+			if agent != "ollama" {
+				filteredAgents = append(filteredAgents, agent)
+			}
+		}
+		agents = filteredAgents
+	}
+
+	// Register requested agents
+	registeredAgents := []string{}
+	for _, agentName := range agents {
+		switch agentName {
+		case "ollama":
+			if err := registerOllamaAgent(engine, v); err != nil {
+				return err
+			}
+			registeredAgents = append(registeredAgents, agentName)
+
+		case "local":
+			opts := &local.LocalAgentOptions{}
+			agent := local.NewLocalAgent(opts)
+			if err := engine.RegisterAgent("local", agent); err != nil {
+				return errors.Wrap(err, "failed to register local agent")
+			}
+			registeredAgents = append(registeredAgents, agentName)
+
+		default:
+			klog.Warningf("Unknown agent type: %s", agentName)
+		}
+	}
+
+	if len(registeredAgents) == 0 {
+		return errors.New("no analysis agents available - check your configuration")
+	}
+
+	fmt.Printf("🔍 Using analysis agents: %s\n", strings.Join(registeredAgents, ", "))
+
+	// Load support bundle
+	bundle, err := loadSupportBundle(bundlePath)
+	if err != nil {
+		return errors.Wrap(err, "failed to load support bundle")
+	}
+
+	// Load analyzer specs if provided
+	var customAnalyzers []*troubleshootv1beta2.Analyze
+	if specPath := v.GetString("analyzers"); specPath != "" {
+		customAnalyzers, err = loadAnalyzerSpecs(specPath)
+		if err != nil {
+			return errors.Wrap(err, "failed to load analyzer specs")
+		}
+	}
+
+	// Configure analysis options
+	opts := analyzer.AnalysisOptions{
+		Agents:             registeredAgents,
+		IncludeRemediation: v.GetBool("include-remediation"),
+		CustomAnalyzers:    customAnalyzers,
+		Timeout:            5 * time.Minute,
+		Concurrency:        2,
+	}
+
+	// Run analysis
+	fmt.Printf("🚀 Starting advanced analysis of bundle: %s\n", bundlePath)
+	result, err := engine.Analyze(ctx, bundle, opts)
+	if err != nil {
+		return errors.Wrap(err, "analysis failed")
+	}
+
+	// Display results
+	return displayAdvancedResults(result, v.GetString("output"), v.GetString("output-file"))
+}
+
+// registerOllamaAgent creates and registers an Ollama agent
+func registerOllamaAgent(engine analyzer.AnalysisEngine, v *viper.Viper) error {
+	// Check if Ollama is available
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	if !status.Installed {
+		return showOllamaSetupHelp("Ollama is not installed")
+	}
+
+	if !status.Running {
+		return showOllamaSetupHelp("Ollama service is not running")
+	}
+
+	if len(status.Models) == 0 {
+		return showOllamaSetupHelp("No Ollama models are installed")
+	}
+
+	// Determine which model to use
+	selectedModel := determineOllamaModel(v)
+
+	// Auto-pull model if requested and not available
+	if v.GetBool("auto-pull-model") {
+		if err := ensureModelAvailable(selectedModel); err != nil {
+			return errors.Wrapf(err, "failed to ensure model %s is available", selectedModel)
+		}
+	}
+
+	// Create Ollama agent
+	opts := &ollama.OllamaAgentOptions{
+		Endpoint:    v.GetString("ollama-endpoint"),
+		Model:       selectedModel,
+		Timeout:     5 * time.Minute,
+		MaxTokens:   2000,
+		Temperature: 0.2,
+	}
+
+	agent, err := ollama.NewOllamaAgent(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to create Ollama agent")
+	}
+
+	// Register with engine
+	if err := engine.RegisterAgent("ollama", agent); err != nil {
+		return errors.Wrap(err, "failed to register Ollama agent")
+	}
+
+	return nil
+}
+
+// showOllamaSetupHelp displays helpful setup instructions when Ollama is not available
+func showOllamaSetupHelp(reason string) error {
+	fmt.Printf("❌ Ollama AI analysis not available: %s\n\n", reason)
+
+	helper := analyzer.NewOllamaHelper()
+	fmt.Println("🔧 Quick Setup:")
+	fmt.Println("   troubleshoot analyze --setup-ollama")
+	fmt.Println()
+	fmt.Println("📋 Manual Setup:")
+	fmt.Println("   1. Install: curl -fsSL https://ollama.ai/install.sh | sh")
+	fmt.Println("   2. Start service: ollama serve &")
+	fmt.Println("   3. Pull model: ollama pull llama2:7b")
+	fmt.Println("   4. Retry analysis with: --enable-ollama")
+	fmt.Println()
+	fmt.Println("💡 Check status: troubleshoot analyze --check-ollama")
+	fmt.Println()
+	fmt.Println(helper.GetInstallInstructions())
+
+	return errors.New("Ollama setup required for AI-powered analysis")
+}
+
+// runLegacyAnalysis runs the original analysis logic for backward compatibility
+func runLegacyAnalysis(v *viper.Viper, bundlePath string) error {
 	specPath := v.GetString("analyzers")
 
 	specContent := ""
 	var err error
 	if _, err = os.Stat(specPath); err == nil {
-		b, err := ioutil.ReadFile(specPath)
+		b, err := os.ReadFile(specPath)
 		if err != nil {
 			return err
 		}
@@ -26,7 +416,8 @@ func runAnalyzers(v *viper.Viper, bundlePath string) error {
 		specContent = string(b)
 	} else {
 		if !util.IsURL(specPath) {
-			return fmt.Errorf("%s is not a URL and was not found (err %s)", specPath, err)
+			// TODO: Better error message when we do not have a file/url etc
+			return fmt.Errorf("%s is not a URL and was not found", specPath)
 		}
 
 		req, err := http.NewRequest("GET", specPath, nil)
@@ -65,3 +456,302 @@ func runAnalyzers(v *viper.Viper, bundlePath string) error {
 
 	return nil
 }
+
+// loadSupportBundle loads and parses a support bundle from file
+func loadSupportBundle(bundlePath string) (*analyzer.SupportBundle, error) {
+	if _, err := os.Stat(bundlePath); os.IsNotExist(err) {
+		return nil, errors.Errorf("support bundle not found: %s", bundlePath)
+	}
+
+	klog.Infof("Loading support bundle: %s", bundlePath)
+
+	// Open the tar.gz file
+	file, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to open support bundle")
+	}
+	defer file.Close()
+
+	// Create gzip reader
+	gzipReader, err := gzip.NewReader(file)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create gzip reader")
+	}
+	defer gzipReader.Close()
+
+	// Create tar reader
+	tarReader := tar.NewReader(gzipReader)
+
+	// Create bundle structure
+	bundle := &analyzer.SupportBundle{
+		Files: make(map[string][]byte),
+		Metadata: &analyzer.SupportBundleMetadata{
+			CreatedAt:   time.Now(),
+			Version:     "1.0.0",
+			GeneratedBy: "troubleshoot-cli",
+		},
+	}
+
+	// Extract all files from tar
+	for {
+		header, err := tarReader.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read tar entry")
+		}
+
+		// Skip directories
+		if header.Typeflag == tar.TypeDir {
+			continue
+		}
+
+		// Read file content
+		content, err := io.ReadAll(tarReader)
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to read file %s", header.Name)
+		}
+
+		// Remove bundle directory prefix from file path for consistent access
+		// e.g., "live-cluster-bundle/cluster-info/version.json" → "cluster-info/version.json"
+		cleanPath := header.Name
+		if parts := strings.SplitN(header.Name, "/", 2); len(parts) == 2 {
+			cleanPath = parts[1]
+		}
+
+		bundle.Files[cleanPath] = content
+		klog.V(2).Infof("Loaded file: %s (%d bytes)", cleanPath, len(content))
+	}
+
+	klog.Infof("Successfully loaded support bundle with %d files", len(bundle.Files))
+
+	return bundle, nil
+}
+
+// loadAnalyzerSpecs loads analyzer specifications from file or URL
+func loadAnalyzerSpecs(specPath string) ([]*troubleshootv1beta2.Analyze, error) {
+	klog.Infof("Loading analyzer specs from: %s", specPath)
+
+	// Read the analyzer spec file (same logic as runLegacyAnalysis)
+	specContent := ""
+	var err error
+	if _, err = os.Stat(specPath); err == nil {
+		b, err := os.ReadFile(specPath)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read analyzer spec file")
+		}
+		specContent = string(b)
+	} else {
+		if !util.IsURL(specPath) {
+			return nil, errors.Errorf("analyzer spec %s is not a URL and was not found", specPath)
+		}
+
+		req, err := http.NewRequest("GET", specPath, nil)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to create HTTP request")
+		}
+		req.Header.Set("User-Agent", "Replicated_Analyzer/v1beta2")
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to fetch analyzer spec")
+		}
+		defer resp.Body.Close()
+
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read analyzer spec response")
+		}
+		specContent = string(body)
+	}
+
+	// Parse the YAML/JSON into troubleshoot analyzer struct
+	var analyzerSpec troubleshootv1beta2.Analyzer
+	if err := yaml.Unmarshal([]byte(specContent), &analyzerSpec); err != nil {
+		return nil, errors.Wrap(err, "failed to parse analyzer spec")
+	}
+
+	// Return the analyzer specs from the parsed document
+	return analyzerSpec.Spec.Analyzers, nil
+}
+
+// displayAdvancedResults formats and displays analysis results
+func displayAdvancedResults(result *analyzer.AnalysisResult, outputFormat, outputFile string) error {
+	if result == nil {
+		return errors.New("no analysis results to display")
+	}
+
+	// Display summary
+	fmt.Println("\n📊 Analysis Summary")
+	fmt.Println("=" + strings.Repeat("=", 50))
+	fmt.Printf("Total Analyzers: %d\n", result.Summary.TotalAnalyzers)
+	fmt.Printf("✅ Pass: %d\n", result.Summary.PassCount)
+	fmt.Printf("⚠️  Warn: %d\n", result.Summary.WarnCount)
+	fmt.Printf("❌ Fail: %d\n", result.Summary.FailCount)
+	fmt.Printf("🚫 Errors: %d\n", result.Summary.ErrorCount)
+	fmt.Printf("⏱️  Duration: %s\n", result.Summary.Duration)
+	fmt.Printf("🤖 Agents Used: %s\n", strings.Join(result.Summary.AgentsUsed, ", "))
+
+	if result.Summary.Confidence > 0 {
+		fmt.Printf("🎯 Confidence: %.1f%%\n", result.Summary.Confidence*100)
+	}
+
+	// Display results based on format
+	switch outputFormat {
+	case "json":
+		jsonData, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal results to JSON")
+		}
+		fmt.Println("\n📄 Full Results (JSON):")
+		fmt.Println(string(jsonData))
+
+	default:
+		// Human-readable format
+		fmt.Println("\n🔍 Analysis Results")
+		fmt.Println("=" + strings.Repeat("=", 50))
+
+		for _, analyzerResult := range result.Results {
+			status := "❓"
+			if analyzerResult.IsPass {
+				status = "✅"
+			} else if analyzerResult.IsWarn {
+				status = "⚠️"
+			} else if analyzerResult.IsFail {
+				status = "❌"
+			}
+
+			fmt.Printf("\n%s %s", status, analyzerResult.Title)
+			if analyzerResult.AgentName != "" {
+				fmt.Printf(" [%s]", analyzerResult.AgentName)
+			}
+			if analyzerResult.Confidence > 0 {
+				fmt.Printf(" (%.0f%% confidence)", analyzerResult.Confidence*100)
+			}
+			fmt.Println()
+
+			if analyzerResult.Message != "" {
+				fmt.Printf("   %s\n", analyzerResult.Message)
+			}
+
+			if analyzerResult.Category != "" {
+				fmt.Printf("   Category: %s\n", analyzerResult.Category)
+			}
+
+			// Display insights if available
+			if len(analyzerResult.Insights) > 0 {
+				fmt.Println("   💡 Insights:")
+				for _, insight := range analyzerResult.Insights {
+					fmt.Printf("   • %s\n", insight)
+				}
+			}
+
+			// Display remediation if available
+			if analyzerResult.Remediation != nil {
+				fmt.Printf("   🔧 Remediation: %s\n", analyzerResult.Remediation.Description)
+				if analyzerResult.Remediation.Command != "" {
+					fmt.Printf("   💻 Command: %s\n", analyzerResult.Remediation.Command)
+				}
+			}
+		}
+
+		// Display overall remediation suggestions
+		if len(result.Remediation) > 0 {
+			fmt.Println("\n🔧 Recommended Actions")
+			fmt.Println("=" + strings.Repeat("=", 50))
+			for i, remedy := range result.Remediation {
+				fmt.Printf("%d. %s\n", i+1, remedy.Description)
+				if remedy.Command != "" {
+					fmt.Printf("   Command: %s\n", remedy.Command)
+				}
+				if remedy.Documentation != "" {
+					fmt.Printf("   Docs: %s\n", remedy.Documentation)
+				}
+			}
+		}
+
+		// Display errors if any
+		if len(result.Errors) > 0 {
+			fmt.Println("\n⚠️  Errors During Analysis")
+			fmt.Println("=" + strings.Repeat("=", 30))
+			for _, analysisError := range result.Errors {
+				fmt.Printf("• [%s] %s: %s\n", analysisError.Agent, analysisError.Category, analysisError.Error)
+			}
+		}
+
+		// Display agent metadata
+		if len(result.Metadata.Agents) > 0 {
+			fmt.Println("\n🤖 Agent Performance")
+			fmt.Println("=" + strings.Repeat("=", 40))
+			for _, agent := range result.Metadata.Agents {
+				fmt.Printf("• %s: %d results, %s duration", agent.Name, agent.ResultCount, agent.Duration)
+				if agent.ErrorCount > 0 {
+					fmt.Printf(" (%d errors)", agent.ErrorCount)
+				}
+				fmt.Println()
+			}
+		}
+	}
+
+	// Save results to file if requested
+	if outputFile != "" {
+		jsonData, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal results for file output")
+		}
+
+		if err := os.WriteFile(outputFile, jsonData, 0644); err != nil {
+			return errors.Wrapf(err, "failed to write results to %s", outputFile)
+		}
+
+		fmt.Printf("\n💾 Analysis results saved to: %s\n", outputFile)
+	}
+
+	return nil
+}
+
+// determineOllamaModel selects the appropriate model based on flags
+func determineOllamaModel(v *viper.Viper) string {
+	// Check for specific model flags first
+	if v.GetBool("use-codellama") {
+		return "codellama:7b"
+	}
+	if v.GetBool("use-mistral") {
+		return "mistral:7b"
+	}
+
+	// Fall back to explicit model specification or default
+	return v.GetString("ollama-model")
+}
+
+// ensureModelAvailable checks if model exists and pulls it if needed
+func ensureModelAvailable(model string) error {
+	// Check if model is already available
+	cmd := exec.Command("ollama", "list")
+	output, err := cmd.Output()
+	if err != nil {
+		return errors.Wrap(err, "failed to check available models")
+	}
+
+	// Parse model list to see if our model exists
+	lines := strings.Split(string(output), "\n")
+	for _, line := range lines {
+		if strings.Contains(line, model) {
+			klog.Infof("Model %s is already available", model)
+			return nil
+		}
+	}
+
+	// Model not found, pull it
+	fmt.Printf("📚 Model %s not found, pulling automatically...\n", model)
+	pullCmd := exec.Command("ollama", "pull", model)
+	pullCmd.Stdout = os.Stdout
+	pullCmd.Stderr = os.Stderr
+
+	if err := pullCmd.Run(); err != nil {
+		return errors.Wrapf(err, "failed to pull model %s", model)
+	}
+
+	fmt.Printf("✅ Model %s pulled successfully!\n", model)
+	return nil
+}

cmd/analyze/main.go

@@ -1,10 +0,0 @@
-package main
-
-import (
-	"github.com/replicatedhq/troubleshoot/cmd/analyze/cli"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-func main() {
-	cli.InitAndExecute()
-}

cmd/internal/util/profilers.go

@@ -0,0 +1,83 @@
+package util
+
+import (
+	"fmt"
+	"os"
+	"runtime"
+	"runtime/pprof"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+var (
+	cpuProfileFile *os.File
+)
+
+// StartProfiling starts profiling CPU and memory usage if either --cpuprofile or
+// --memprofile flags were set and bound to viper configurations respectively.
+func StartProfiling() error {
+	v := viper.GetViper()
+	if v.GetString("cpuprofile") != "" {
+		var err error
+		cpuProfileFile, err = os.Create(v.GetString("cpuprofile"))
+		if err != nil {
+			return fmt.Errorf("could not create CPU profile: %w", err)
+		}
+		if err := pprof.StartCPUProfile(cpuProfileFile); err != nil {
+			cpuProfileFile.Close()
+			cpuProfileFile = nil
+			return fmt.Errorf("could not start CPU profile: %w", err)
+		}
+	}
+	return nil
+}
+
+// StopProfiling stops profiling CPU and memory usage and writes the results to
+// the files specified by --cpuprofile and --memprofile flags respectively.
+func StopProfiling() error {
+	v := viper.GetViper()
+	errs := []string{}
+
+	// Stop CPU profiling if it was started
+	if cpuProfileFile != nil {
+		pprof.StopCPUProfile()
+		err := cpuProfileFile.Close()
+		if err != nil {
+			errs = append(errs, err.Error())
+		}
+		cpuProfileFile = nil
+	}
+
+	if v.GetString("memprofile") != "" {
+		f, err := os.Create(v.GetString("memprofile"))
+		if err != nil {
+			errs = append(errs, err.Error())
+			goto BREAK_FROM_MEMPROFILE_IF
+		}
+		runtime.GC() // get up-to-date statistics
+		if err := pprof.WriteHeapProfile(f); err != nil {
+			errs = append(errs, err.Error())
+			goto BREAK_FROM_MEMPROFILE_IF
+		}
+		err = f.Close()
+		if err != nil {
+			errs = append(errs, err.Error())
+		}
+	}
+
+BREAK_FROM_MEMPROFILE_IF:
+	if len(errs) > 0 {
+		return fmt.Errorf("errors while stopping profiling: [%s]", strings.Join(errs, ", "))
+	}
+
+	return nil
+}
+
+// AddProfilingFlags adds the --cpuprofile and --memprofile flags to the given command.
+func AddProfilingFlags(cmd *cobra.Command) {
+	// Persistent flags to make available to subcommands
+	cmd.PersistentFlags().String("cpuprofile", "", "File path to write cpu profiling data")
+	cmd.PersistentFlags().String("memprofile", "", "File path to write memory profiling data")
+}

cmd/internal/util/version.go

@@ -1,11 +1,10 @@
-package cli
+package util
 
 import (
 	"fmt"
 
-	"github.com/spf13/cobra"
-
 	"github.com/replicatedhq/troubleshoot/pkg/version"
+	"github.com/spf13/cobra"
 )
 
 func VersionCmd() *cobra.Command {
@@ -14,7 +13,7 @@ func VersionCmd() *cobra.Command {
 		Short: "Print the current version and exit",
 		Long:  `Print the current version and exit`,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			fmt.Printf("Replicated Preflight %s\n", version.Version())
+			fmt.Printf("Replicated Troubleshoot %s\n", version.Version())
 
 			return nil
 		},

cmd/preflight/cli/convert.go

@@ -0,0 +1,132 @@
+package cli
+
+import (
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/convert"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func ConvertCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "convert [input-file]",
+		Args:  cobra.ExactArgs(1),
+		Short: "Convert v1beta2 preflight specs to v1beta3 format",
+		Long: `Convert v1beta2 preflight specs to v1beta3 format with templating and values.
+
+This command converts a v1beta2 preflight spec to the new v1beta3 templated format. It will:
+- Update the apiVersion to troubleshoot.sh/v1beta3
+- Extract hardcoded values and create a values.yaml file
+- Add conditional templating ({{- if .Values.feature.enabled }})
+- Add placeholder docString comments for you to fill in
+- Template hardcoded values with {{ .Values.* }} expressions
+
+The conversion will create two files:
+- [input-file]-v1beta3.yaml: The templated v1beta3 spec
+- [input-file]-values.yaml: The values file with extracted configuration
+
+Example:
+  preflight convert my-preflight.yaml
+
+This creates:
+  my-preflight-v1beta3.yaml
+  my-preflight-values.yaml`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			inputFile := args[0]
+			outputSpec := v.GetString("output-spec")
+			outputValues := v.GetString("output-values")
+
+			// Generate default output filenames if not specified
+			if outputSpec == "" {
+				ext := filepath.Ext(inputFile)
+				base := strings.TrimSuffix(inputFile, ext)
+				outputSpec = base + "-v1beta3" + ext
+			}
+
+			if outputValues == "" {
+				ext := filepath.Ext(inputFile)
+				base := strings.TrimSuffix(inputFile, ext)
+				outputValues = base + "-values" + ext
+			}
+
+			return runConvert(v, inputFile, outputSpec, outputValues)
+		},
+	}
+
+	cmd.Flags().String("output-spec", "", "Output file for the templated v1beta3 spec (default: [input]-v1beta3.yaml)")
+	cmd.Flags().String("output-values", "", "Output file for the values (default: [input]-values.yaml)")
+	cmd.Flags().Bool("dry-run", false, "Preview the conversion without writing files")
+
+	return cmd
+}
+
+func runConvert(v *viper.Viper, inputFile, outputSpec, outputValues string) error {
+	// Read input file
+	inputData, err := ioutil.ReadFile(inputFile)
+	if err != nil {
+		return errors.Wrapf(err, "failed to read input file %s", inputFile)
+	}
+
+	// Check if it's a valid v1beta2 preflight spec
+	if !strings.Contains(string(inputData), "troubleshoot.sh/v1beta2") {
+		return fmt.Errorf("input file does not appear to be a v1beta2 troubleshoot spec")
+	}
+
+	if !strings.Contains(string(inputData), "kind: Preflight") {
+		return fmt.Errorf("input file does not appear to be a Preflight spec")
+	}
+
+	// Convert to v1beta3
+	result, err := convert.ConvertToV1Beta3(inputData)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert spec")
+	}
+
+	dryRun := v.GetBool("dry-run")
+
+	if dryRun {
+		fmt.Println("=== Templated v1beta3 Spec ===")
+		fmt.Println(result.TemplatedSpec)
+		fmt.Println("\n=== Values File ===")
+		fmt.Println(result.ValuesFile)
+		fmt.Println("\n=== Conversion Summary ===")
+		fmt.Printf("Would write templated spec to: %s\n", outputSpec)
+		fmt.Printf("Would write values to: %s\n", outputValues)
+		return nil
+	}
+
+	// Write templated spec
+	err = ioutil.WriteFile(outputSpec, []byte(result.TemplatedSpec), 0644)
+	if err != nil {
+		return errors.Wrapf(err, "failed to write templated spec to %s", outputSpec)
+	}
+
+	// Write values file
+	err = ioutil.WriteFile(outputValues, []byte(result.ValuesFile), 0644)
+	if err != nil {
+		return errors.Wrapf(err, "failed to write values to %s", outputValues)
+	}
+
+	fmt.Printf("Successfully converted %s to v1beta3 format:\n", inputFile)
+	fmt.Printf("  Templated spec: %s\n", outputSpec)
+	fmt.Printf("  Values file: %s\n", outputValues)
+	fmt.Println("\nNext steps:")
+	fmt.Println("1. Add docStrings with Title, Requirement, and rationale for each check")
+	fmt.Println("2. Customize the values in the values file")
+	fmt.Println("3. Test the conversion with:")
+	fmt.Printf("   preflight template %s --values %s\n", outputSpec, outputValues)
+	fmt.Println("4. Run the templated preflight:")
+	fmt.Printf("   preflight run %s --values %s\n", outputSpec, outputValues)
+
+	return nil
+}

cmd/preflight/cli/docs.go

@@ -0,0 +1,387 @@
+package cli
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+	"text/template"
+
+	"github.com/Masterminds/sprig/v3"
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"gopkg.in/yaml.v2"
+	"helm.sh/helm/v3/pkg/strvals"
+)
+
+func DocsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "docs [preflight-file...]",
+		Short: "Extract and display documentation from a preflight spec",
+		Long: `Extract all docString fields from enabled requirements in one or more preflight YAML files.
+This command processes templated preflight specs, evaluates conditionals, and outputs
+only the documentation for requirements that would be included based on the provided values.
+
+Examples:
+  # Extract docs with default values
+  preflight docs ml-platform-preflight.yaml
+
+  # Extract docs from multiple specs with values from files
+  preflight docs spec1.yaml spec2.yaml --values base-values.yaml --values prod-values.yaml
+
+  # Extract docs with inline values
+  preflight docs ml-platform-preflight.yaml --set jupyter.enabled=true --set monitoring.enabled=false
+
+  # Extract docs and save to file
+  preflight docs ml-platform-preflight.yaml --output requirements.md`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			templateFiles := args
+			valuesFiles := v.GetStringSlice("values")
+			outputFile := v.GetString("output")
+			setValues := v.GetStringSlice("set")
+
+			return extractDocs(templateFiles, valuesFiles, setValues, outputFile)
+		},
+	}
+
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line (can be used multiple times)")
+	cmd.Flags().StringP("output", "o", "", "Output file (default: stdout)")
+
+	// Bind flags to viper
+	viper.BindPFlag("values", cmd.Flags().Lookup("values"))
+	viper.BindPFlag("set", cmd.Flags().Lookup("set"))
+	viper.BindPFlag("output", cmd.Flags().Lookup("output"))
+
+	return cmd
+}
+
+// PreflightDoc supports both legacy (requirements) and beta3 (spec.analyzers)
+type PreflightDoc struct {
+	APIVersion string                 `yaml:"apiVersion"`
+	Kind       string                 `yaml:"kind"`
+	Metadata   map[string]interface{} `yaml:"metadata"`
+	Spec       struct {
+		Analyzers []map[string]interface{} `yaml:"analyzers"`
+	} `yaml:"spec"`
+	// Legacy (pre-beta3 drafts)
+	Requirements []Requirement `yaml:"requirements"`
+}
+
+type Requirement struct {
+	Name      string                   `yaml:"name"`
+	DocString string                   `yaml:"docString"`
+	Checks    []map[string]interface{} `yaml:"checks,omitempty"`
+}
+
+func extractDocs(templateFiles []string, valuesFiles []string, setValues []string, outputFile string) error {
+	// Prepare the values map (merge all files, then apply sets)
+	values := make(map[string]interface{})
+
+	for _, valuesFile := range valuesFiles {
+		fileValues, err := loadValuesFile(valuesFile)
+		if err != nil {
+			return errors.Wrapf(err, "failed to load values file %s", valuesFile)
+		}
+		values = mergeMaps(values, fileValues)
+	}
+
+	// Normalize maps for Helm set merging
+	values = normalizeStringMaps(values)
+
+	for _, setValue := range setValues {
+		if err := applySetValue(values, setValue); err != nil {
+			return errors.Wrapf(err, "failed to apply set value: %s", setValue)
+		}
+	}
+
+	var combinedDocs strings.Builder
+
+	for _, templateFile := range templateFiles {
+		templateContent, err := os.ReadFile(templateFile)
+		if err != nil {
+			return errors.Wrapf(err, "failed to read template file %s", templateFile)
+		}
+
+		useHelm := shouldUseHelmEngine(string(templateContent))
+		var rendered string
+		if useHelm {
+			// Seed default-false for referenced boolean values to avoid nil map errors
+			preflight.SeedDefaultBooleans(string(templateContent), values)
+			rendered, err = preflight.RenderWithHelmTemplate(string(templateContent), values)
+			if err != nil {
+				execValues := legacyContext(values)
+				rendered, err = renderTemplate(string(templateContent), execValues)
+				if err != nil {
+					return errors.Wrap(err, "failed to render template (helm fallback also failed)")
+				}
+			}
+		} else {
+			execValues := legacyContext(values)
+			rendered, err = renderTemplate(string(templateContent), execValues)
+			if err != nil {
+				return errors.Wrap(err, "failed to render template")
+			}
+		}
+
+		docs, err := extractDocStrings(rendered)
+		if err != nil {
+			return errors.Wrap(err, "failed to extract documentation")
+		}
+
+		if strings.TrimSpace(docs) != "" {
+			if combinedDocs.Len() > 0 {
+				combinedDocs.WriteString("\n\n")
+			}
+			combinedDocs.WriteString(docs)
+		}
+	}
+
+	if outputFile != "" {
+		if err := os.WriteFile(outputFile, []byte(combinedDocs.String()), 0644); err != nil {
+			return errors.Wrapf(err, "failed to write output file %s", outputFile)
+		}
+		fmt.Printf("Documentation extracted successfully to %s\n", outputFile)
+	} else {
+		fmt.Print(combinedDocs.String())
+	}
+
+	return nil
+}
+
+func shouldUseHelmEngine(content string) bool {
+	return strings.Contains(content, ".Values")
+}
+
+func legacyContext(values map[string]interface{}) map[string]interface{} {
+	ctx := make(map[string]interface{}, len(values)+1)
+	for k, v := range values {
+		ctx[k] = v
+	}
+	ctx["Values"] = values
+	return ctx
+}
+
+func normalizeStringMaps(v interface{}) map[string]interface{} {
+	// Avoid unsafe type assertion; normalizeMap may return non-map types.
+	if v == nil {
+		return map[string]interface{}{}
+	}
+	normalized := normalizeMap(v)
+	if m, ok := normalized.(map[string]interface{}); ok {
+		return m
+	}
+	return map[string]interface{}{}
+}
+
+func normalizeMap(v interface{}) interface{} {
+	switch t := v.(type) {
+	case map[string]interface{}:
+		m := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			m[k] = normalizeMap(val)
+		}
+		return m
+	case map[interface{}]interface{}:
+		m := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			key := fmt.Sprintf("%v", k)
+			m[key] = normalizeMap(val)
+		}
+		return m
+	case []interface{}:
+		a := make([]interface{}, len(t))
+		for i, val := range t {
+			a[i] = normalizeMap(val)
+		}
+		return a
+	default:
+		return v
+	}
+}
+
+func extractDocStrings(yamlContent string) (string, error) {
+	var preflightDoc PreflightDoc
+	if err := yaml.Unmarshal([]byte(yamlContent), &preflightDoc); err != nil {
+		return "", errors.Wrap(err, "failed to parse YAML")
+	}
+
+	var docs strings.Builder
+	first := true
+
+	// Prefer beta3 analyzers docStrings
+	if len(preflightDoc.Spec.Analyzers) > 0 {
+		for _, analyzer := range preflightDoc.Spec.Analyzers {
+			if raw, ok := analyzer["docString"]; ok {
+				text, _ := raw.(string)
+				text = strings.TrimSpace(text)
+				if text == "" {
+					continue
+				}
+				if !first {
+					docs.WriteString("\n\n")
+				}
+				first = false
+				writeMarkdownSection(&docs, text, "")
+			}
+		}
+		return docs.String(), nil
+	}
+
+	// Fallback: legacy requirements with docString
+	for _, req := range preflightDoc.Requirements {
+		if strings.TrimSpace(req.DocString) == "" {
+			continue
+		}
+		if !first {
+			docs.WriteString("\n\n")
+		}
+		first = false
+		writeMarkdownSection(&docs, req.DocString, req.Name)
+	}
+
+	return docs.String(), nil
+}
+
+// writeMarkdownSection prints a heading from Title: or name, then the rest
+func writeMarkdownSection(b *strings.Builder, docString string, fallbackName string) {
+	lines := strings.Split(docString, "\n")
+	title := strings.TrimSpace(fallbackName)
+	contentStart := 0
+	for i, line := range lines {
+		trim := strings.TrimSpace(line)
+		if strings.HasPrefix(trim, "Title:") {
+			parts := strings.SplitN(trim, ":", 2)
+			if len(parts) == 2 {
+				t := strings.TrimSpace(parts[1])
+				if t != "" {
+					title = t
+				}
+			}
+			contentStart = i + 1
+			break
+		}
+	}
+	if title != "" {
+		b.WriteString("### ")
+		b.WriteString(title)
+		b.WriteString("\n\n")
+	}
+	remaining := strings.Join(lines[contentStart:], "\n")
+	remaining = strings.TrimSpace(remaining)
+	if remaining != "" {
+		b.WriteString(remaining)
+		b.WriteString("\n")
+	}
+}
+
+// loadValuesFile loads values from a YAML file
+func loadValuesFile(filename string) (map[string]interface{}, error) {
+	data, err := os.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+
+	var values map[string]interface{}
+	if err := yaml.Unmarshal(data, &values); err != nil {
+		return nil, errors.Wrap(err, "failed to parse values file as YAML")
+	}
+
+	return values, nil
+}
+
+// applySetValue applies a single --set value to the values map (Helm semantics)
+func applySetValue(values map[string]interface{}, setValue string) error {
+	if idx := strings.Index(setValue, "="); idx > 0 {
+		key := setValue[:idx]
+		val := setValue[idx+1:]
+		if strings.HasPrefix(key, "Values.") {
+			key = strings.TrimPrefix(key, "Values.")
+			setValue = key + "=" + val
+		}
+	}
+	if err := strvals.ParseInto(setValue, values); err != nil {
+		return fmt.Errorf("parsing --set: %w", err)
+	}
+	return nil
+}
+
+// setNestedValue sets a value in a nested map structure
+func setNestedValue(m map[string]interface{}, keys []string, value interface{}) {
+	if len(keys) == 0 {
+		return
+	}
+	if len(keys) == 1 {
+		m[keys[0]] = value
+		return
+	}
+	if _, ok := m[keys[0]]; !ok {
+		m[keys[0]] = make(map[string]interface{})
+	}
+	if nextMap, ok := m[keys[0]].(map[string]interface{}); ok {
+		setNestedValue(nextMap, keys[1:], value)
+	} else {
+		m[keys[0]] = make(map[string]interface{})
+		setNestedValue(m[keys[0]].(map[string]interface{}), keys[1:], value)
+	}
+}
+
+func mergeMaps(base, overlay map[string]interface{}) map[string]interface{} {
+	result := make(map[string]interface{})
+	for k, v := range base {
+		result[k] = v
+	}
+	for k, v := range overlay {
+		if baseVal, exists := result[k]; exists {
+			if baseMap, ok := baseVal.(map[string]interface{}); ok {
+				if overlayMap, ok := v.(map[string]interface{}); ok {
+					result[k] = mergeMaps(baseMap, overlayMap)
+					continue
+				}
+			}
+		}
+		result[k] = v
+	}
+	return result
+}
+
+func renderTemplate(templateContent string, values map[string]interface{}) (string, error) {
+	tmpl := template.New("preflight").Funcs(sprig.FuncMap())
+	tmpl, err := tmpl.Parse(templateContent)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to parse template")
+	}
+	var buf bytes.Buffer
+	if err := tmpl.Execute(&buf, values); err != nil {
+		return "", errors.Wrap(err, "failed to execute template")
+	}
+	result := cleanRenderedYAML(buf.String())
+	return result, nil
+}
+
+func cleanRenderedYAML(content string) string {
+	lines := strings.Split(content, "\n")
+	var cleaned []string
+	var lastWasEmpty bool
+	for _, line := range lines {
+		trimmed := strings.TrimRight(line, " \t")
+		if trimmed == "" {
+			if !lastWasEmpty {
+				cleaned = append(cleaned, "")
+				lastWasEmpty = true
+			}
+		} else {
+			cleaned = append(cleaned, trimmed)
+			lastWasEmpty = false
+		}
+	}
+	for len(cleaned) > 0 && cleaned[len(cleaned)-1] == "" {
+		cleaned = cleaned[:len(cleaned)-1]
+	}
+	return strings.Join(cleaned, "\n") + "\n"
+}

cmd/preflight/cli/lint.go

@@ -0,0 +1,98 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/lint"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func LintCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lint [spec-files...]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Lint preflight specs for syntax and structural errors",
+		Long: `Lint preflight specs for syntax and structural errors.
+
+This command validates troubleshoot specs and checks for:
+- YAML syntax errors (missing colons, invalid structure)
+- Missing required fields (apiVersion, kind, metadata, spec)
+- Invalid template syntax ({{ .Values.* }}, {{ .Release.* }}, etc.)
+- Missing analyzers or collectors
+- Common structural issues
+- Missing docStrings (warning)
+
+Both v1beta2 and v1beta3 apiVersions are supported. Use 'convert' if you need a full structural conversion between schema versions.
+
+The --fix flag can automatically repair:
+- Missing colons in YAML (e.g., "metadata" → "metadata:")
+- Missing or malformed apiVersion line. If templating ({{ }}) or docString fields are detected, apiVersion is set to v1beta3; otherwise v1beta2.
+- Template expressions missing leading dot (e.g., "{{ Values.x }}" → "{{ .Values.x }}")
+
+Examples:
+  # Lint a single spec file
+  preflight lint my-preflight.yaml
+
+  # Lint multiple spec files
+  preflight lint spec1.yaml spec2.yaml spec3.yaml
+
+  # Lint with automatic fixes (may need to run multiple times for complex issues)
+  preflight lint --fix my-preflight.yaml
+
+  # Lint and output as JSON for CI/CD integration
+  preflight lint --format json my-preflight.yaml
+
+Exit codes:
+  0 - No errors found
+  2 - Validation errors found`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			opts := lint.LintOptions{
+				FilePaths: args,
+				Fix:       v.GetBool("fix"),
+				Format:    v.GetString("format"),
+			}
+
+			return runLint(opts)
+		},
+	}
+
+	cmd.Flags().Bool("fix", false, "Automatically fix issues where possible")
+	cmd.Flags().String("format", "text", "Output format: text or json")
+
+	return cmd
+}
+
+func runLint(opts lint.LintOptions) error {
+	// Validate file paths exist
+	for _, filePath := range opts.FilePaths {
+		if _, err := os.Stat(filePath); err != nil {
+			return errors.Wrapf(err, "file not found: %s", filePath)
+		}
+	}
+
+	// Run linting
+	results, err := lint.LintFiles(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to lint files")
+	}
+
+	// Format and print results
+	output := lint.FormatResults(results, opts.Format)
+	fmt.Print(output)
+
+	// Return appropriate exit code
+	if lint.HasErrors(results) {
+		os.Exit(constants.EXIT_CODE_SPEC_ISSUES)
+	}
+
+	return nil
+}

cmd/preflight/cli/oci_fetch.go

@@ -0,0 +1,40 @@
+package cli
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/oci"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func OciFetchCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "oci-fetch [URI]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Fetch a preflight from an OCI registry and print it to standard out",
+		PreRun: func(cmd *cobra.Command, args []string) {
+			v := viper.GetViper()
+			v.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uri := args[0]
+			data, err := oci.PullPreflightFromOCI(uri)
+			if err != nil {
+				return err
+			}
+			fmt.Println(string(data))
+			return nil
+		},
+	}
+
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
+	return cmd
+}

cmd/preflight/cli/root.go

@@ -1,12 +1,22 @@
 package cli
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"strings"
 
+	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
+	"github.com/replicatedhq/troubleshoot/internal/traces"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/replicatedhq/troubleshoot/pkg/updater"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
 func RootCmd() *cobra.Command {
@@ -16,37 +26,113 @@ func RootCmd() *cobra.Command {
 		Short: "Run and retrieve preflight checks in a cluster",
 		Long: `A preflight check is a set of validations that can and should be run to ensure
 that a cluster meets the requirements to run an application.`,
-		SilenceUsage: true,
+		SilenceUsage:  true,
+		SilenceErrors: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+			v := viper.GetViper()
+			v.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+
+			if err := util.StartProfiling(); err != nil {
+				klog.Errorf("Failed to start profiling: %v", err)
+			}
+
+			// Auto-update preflight unless disabled by flag or env
+			envAuto := os.Getenv("PREFLIGHT_AUTO_UPDATE")
+			autoFromEnv := true
+			if envAuto != "" {
+				if strings.EqualFold(envAuto, "0") || strings.EqualFold(envAuto, "false") {
+					autoFromEnv = false
+				}
+			}
+			if v.GetBool("auto-update") && autoFromEnv {
+				exe, err := os.Executable()
+				if err == nil {
+					_ = updater.CheckAndUpdate(cmd.Context(), updater.Options{
+						BinaryName:  "preflight",
+						CurrentPath: exe,
+						Printf:      func(f string, a ...interface{}) { fmt.Fprintf(os.Stderr, f, a...) },
+					})
+				}
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
-			return runPreflights(v, args[0])
+			closer, err := traces.ConfigureTracing("preflight")
+			if err != nil {
+				// Do not fail running preflights if tracing fails
+				klog.Errorf("Failed to initialize open tracing provider: %v", err)
+			} else {
+				defer closer()
+			}
+
+			err = preflight.RunPreflights(v.GetBool("interactive"), v.GetString("output"), v.GetString("format"), args)
+			if !v.GetBool("dry-run") && (v.GetBool("debug") || v.IsSet("v")) {
+				fmt.Fprintf(os.Stderr, "\n%s", traces.GetExporterInstance().GetSummary())
+			}
+
+			return err
+		},
+		PostRun: func(cmd *cobra.Command, args []string) {
+			if err := util.StopProfiling(); err != nil {
+				klog.Errorf("Failed to stop profiling: %v", err)
+			}
 		},
 	}
 
 	cobra.OnInitialize(initConfig)
 
-	cmd.AddCommand(VersionCmd())
+	cmd.AddCommand(util.VersionCmd())
+	cmd.AddCommand(OciFetchCmd())
+	cmd.AddCommand(TemplateCmd())
+	cmd.AddCommand(DocsCmd())
+	cmd.AddCommand(ConvertCmd())
+	cmd.AddCommand(LintCmd())
 
-	cmd.Flags().Bool("interactive", true, "interactive preflights")
-	cmd.Flags().String("format", "human", "output format, one of human, json, yaml. only used when interactive is set to false")
-	cmd.Flags().String("collector-image", "", "the full name of the collector image to use")
-	cmd.Flags().String("collector-pullpolicy", "", "the pull policy of the collector image")
-	cmd.Flags().Bool("collect-without-permissions", true, "always run preflight checks even if some require permissions that preflight does not have")
-	cmd.Flags().String("since-time", "", "force pod logs collectors to return logs after a specific date (RFC3339)")
-	cmd.Flags().String("since", "", "force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.")
+	preflight.AddFlags(cmd.PersistentFlags())
 
-	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+	// Dry run flag should be in cmd.PersistentFlags() flags made available to all subcommands
+	// Adding here to avoid that
+	cmd.Flags().Bool("dry-run", false, "print the preflight spec without running preflight checks")
+	cmd.Flags().Bool("no-uri", false, "When this flag is used, Preflight does not attempt to retrieve the spec referenced by the uri: field`")
+	cmd.Flags().Bool("auto-update", true, "enable automatic binary self-update check and install")
+
+	// Template values for v1beta3 specs
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values for v1beta3 specs (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line for v1beta3 specs (can be used multiple times)")
 
 	k8sutil.AddFlags(cmd.Flags())
 
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
+	// CPU and memory profiling flags
+	util.AddProfilingFlags(cmd)
+
 	return cmd
 }
 
 func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
+	cmd := RootCmd()
+	err := cmd.Execute()
+
+	if err != nil {
+		var exitErr types.ExitError
+		if errors.As(err, &exitErr) {
+			// We need to do this, there's situations where we need the non-zero exit code (which comes as part of the custom error struct)
+			// but there's no actual error, just an exit code.
+			// If there's also an error to output (eg. invalid format etc) then print it as well
+			if exitErr.ExitStatus() != constants.EXIT_CODE_FAIL && exitErr.ExitStatus() != constants.EXIT_CODE_WARN {
+				cmd.PrintErrln("Error:", err.Error())
+			}
+
+			os.Exit(exitErr.ExitStatus())
+		}
+
+		// Fallback, should almost never be used (the above Exit() should handle almost all situations
+		cmd.PrintErrln("Error:", err.Error())
 		os.Exit(1)
 	}
 }

cmd/preflight/cli/run.go

@@ -1,297 +0,0 @@
-package cli
-
-import (
-	"context"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"os"
-	"os/signal"
-	"strings"
-	"time"
-
-	cursor "github.com/ahmetalpbalkan/go-cursor"
-	"github.com/fatih/color"
-	"github.com/pkg/errors"
-	"github.com/replicatedhq/troubleshoot/cmd/util"
-	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
-	troubleshootclientsetscheme "github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
-	"github.com/replicatedhq/troubleshoot/pkg/docrewrite"
-	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
-	"github.com/replicatedhq/troubleshoot/pkg/preflight"
-	"github.com/replicatedhq/troubleshoot/pkg/specs"
-	"github.com/spf13/viper"
-	spin "github.com/tj/go-spin"
-	"golang.org/x/sync/errgroup"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes/scheme"
-)
-
-func runPreflights(v *viper.Viper, arg string) error {
-	if v.GetBool("interactive") {
-		fmt.Print(cursor.Hide())
-		defer fmt.Print(cursor.Show())
-	}
-
-	go func() {
-		signalChan := make(chan os.Signal, 1)
-		signal.Notify(signalChan, os.Interrupt)
-		<-signalChan
-		os.Exit(0)
-	}()
-
-	var preflightContent []byte
-	var err error
-	if strings.HasPrefix(arg, "secret/") {
-		// format secret/namespace-name/secret-name
-		pathParts := strings.Split(arg, "/")
-		if len(pathParts) != 3 {
-			return errors.Errorf("path %s must have 3 components", arg)
-		}
-
-		spec, err := specs.LoadFromSecret(pathParts[1], pathParts[2], "preflight-spec")
-		if err != nil {
-			return errors.Wrap(err, "failed to get spec from secret")
-		}
-
-		preflightContent = spec
-	} else if _, err = os.Stat(arg); err == nil {
-		b, err := ioutil.ReadFile(arg)
-		if err != nil {
-			return err
-		}
-
-		preflightContent = b
-	} else {
-		if !util.IsURL(arg) {
-			return fmt.Errorf("%s is not a URL and was not found (err %s)", arg, err)
-		}
-
-		req, err := http.NewRequest("GET", arg, nil)
-		if err != nil {
-			return err
-		}
-		req.Header.Set("User-Agent", "Replicated_Preflight/v1beta2")
-		resp, err := http.DefaultClient.Do(req)
-		if err != nil {
-			return err
-		}
-		defer resp.Body.Close()
-
-		body, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return err
-		}
-
-		preflightContent = body
-	}
-
-	preflightContent, err = docrewrite.ConvertToV1Beta2(preflightContent)
-	if err != nil {
-		return errors.Wrap(err, "failed to convert to v1beta2")
-	}
-
-	troubleshootclientsetscheme.AddToScheme(scheme.Scheme)
-	decode := scheme.Codecs.UniversalDeserializer().Decode
-	obj, _, err := decode([]byte(preflightContent), nil, nil)
-	if err != nil {
-		return errors.Wrapf(err, "failed to parse %s", arg)
-	}
-
-	var collectResults preflight.CollectResult
-	preflightSpecName := ""
-
-	progressCh := make(chan interface{})
-	defer close(progressCh)
-
-	ctx, stopProgressCollection := context.WithCancel(context.Background())
-	// make sure we shut down progress collection goroutines if an error occurs
-	defer stopProgressCollection()
-	progressCollection, ctx := errgroup.WithContext(ctx)
-
-	if v.GetBool("interactive") {
-		progressCollection.Go(collectInteractiveProgress(ctx, progressCh))
-	} else {
-		progressCollection.Go(collectNonInteractiveProgess(ctx, progressCh))
-	}
-
-	if preflightSpec, ok := obj.(*troubleshootv1beta2.Preflight); ok {
-		r, err := collectInCluster(preflightSpec, progressCh)
-		if err != nil {
-			return errors.Wrap(err, "failed to collect in cluster")
-		}
-		collectResults = *r
-		preflightSpecName = preflightSpec.Name
-	} else if hostPreflightSpec, ok := obj.(*troubleshootv1beta2.HostPreflight); ok {
-		r, err := collectHost(hostPreflightSpec, progressCh)
-		if err != nil {
-			return errors.Wrap(err, "failed to collect from host")
-		}
-		collectResults = *r
-		preflightSpecName = hostPreflightSpec.Name
-	}
-
-	if collectResults == nil {
-		return errors.New("no results")
-	}
-
-	analyzeResults := collectResults.Analyze()
-
-	if preflightSpec, ok := obj.(*troubleshootv1beta2.Preflight); ok {
-		if preflightSpec.Spec.UploadResultsTo != "" {
-			err := uploadResults(preflightSpec.Spec.UploadResultsTo, analyzeResults)
-			if err != nil {
-				progressCh <- err
-			}
-		}
-	}
-
-	stopProgressCollection()
-	progressCollection.Wait()
-
-	if v.GetBool("interactive") {
-		if len(analyzeResults) == 0 {
-			return errors.New("no data has been collected")
-		}
-		return showInteractiveResults(preflightSpecName, analyzeResults)
-	}
-
-	return showStdoutResults(v.GetString("format"), preflightSpecName, analyzeResults)
-}
-
-func collectInteractiveProgress(ctx context.Context, progressCh <-chan interface{}) func() error {
-	return func() error {
-		spinner := spin.New()
-		lastMsg := ""
-
-		errorTxt := color.New(color.FgHiRed)
-		infoTxt := color.New(color.FgCyan)
-
-		for {
-			select {
-			case msg := <-progressCh:
-				switch msg := msg.(type) {
-				case error:
-					errorTxt.Printf("%s\r * %v\n", cursor.ClearEntireLine(), msg)
-				case string:
-					if lastMsg == msg {
-						break
-					}
-					lastMsg = msg
-					infoTxt.Printf("%s\r * %s\n", cursor.ClearEntireLine(), msg)
-
-				}
-			case <-time.After(time.Millisecond * 100):
-				fmt.Printf("\r  %s %s ", color.CyanString("Running Preflight Checks"), spinner.Next())
-			case <-ctx.Done():
-				fmt.Printf("\r%s\r", cursor.ClearEntireLine())
-				return nil
-			}
-		}
-	}
-}
-
-func collectNonInteractiveProgess(ctx context.Context, progressCh <-chan interface{}) func() error {
-	return func() error {
-		for {
-			select {
-			case msg := <-progressCh:
-				switch msg := msg.(type) {
-				case error:
-					fmt.Fprintf(os.Stderr, "error - %v\n", msg)
-				case string:
-					fmt.Fprintf(os.Stderr, "%s\n", msg)
-				case preflight.CollectProgress:
-					fmt.Fprintf(os.Stderr, "%s\n", msg.String())
-
-				}
-			case <-ctx.Done():
-				return nil
-			}
-		}
-	}
-}
-
-func collectInCluster(preflightSpec *troubleshootv1beta2.Preflight, progressCh chan interface{}) (*preflight.CollectResult, error) {
-	v := viper.GetViper()
-
-	restConfig, err := k8sutil.GetRESTConfig()
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to convert kube flags to rest config")
-	}
-
-	collectOpts := preflight.CollectOpts{
-		Namespace:              v.GetString("namespace"),
-		IgnorePermissionErrors: v.GetBool("collect-without-permissions"),
-		ProgressChan:           progressCh,
-		KubernetesRestConfig:   restConfig,
-	}
-
-	if v.GetString("since") != "" || v.GetString("since-time") != "" {
-		err := parseTimeFlags(v, preflightSpec.Spec.Collectors)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	collectResults, err := preflight.Collect(collectOpts, preflightSpec)
-	if err != nil {
-		if !collectResults.IsRBACAllowed() {
-			if preflightSpec.Spec.UploadResultsTo != "" {
-				clusterCollectResults := collectResults.(preflight.ClusterCollectResult)
-				err := uploadErrors(preflightSpec.Spec.UploadResultsTo, clusterCollectResults.Collectors)
-				if err != nil {
-					progressCh <- err
-				}
-			}
-		}
-		return nil, err
-	}
-
-	return &collectResults, nil
-}
-
-func collectHost(hostPreflightSpec *troubleshootv1beta2.HostPreflight, progressCh chan interface{}) (*preflight.CollectResult, error) {
-	collectOpts := preflight.CollectOpts{
-		ProgressChan: progressCh,
-	}
-
-	collectResults, err := preflight.CollectHost(collectOpts, hostPreflightSpec)
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to collect from host")
-	}
-
-	return &collectResults, nil
-}
-
-func parseTimeFlags(v *viper.Viper, collectors []*troubleshootv1beta2.Collect) error {
-	var (
-		sinceTime time.Time
-		err       error
-	)
-	if v.GetString("since-time") != "" {
-		if v.GetString("since") != "" {
-			return errors.Errorf("at most one of `sinceTime` or `since` may be specified")
-		}
-		sinceTime, err = time.Parse(time.RFC3339, v.GetString("since-time"))
-		if err != nil {
-			return errors.Wrap(err, "unable to parse --since-time flag")
-		}
-	} else {
-		parsedDuration, err := time.ParseDuration(v.GetString("since"))
-		if err != nil {
-			return errors.Wrap(err, "unable to parse --since flag")
-		}
-		now := time.Now()
-		sinceTime = now.Add(0 - parsedDuration)
-	}
-	for _, collector := range collectors {
-		if collector.Logs != nil {
-			if collector.Logs.Limits == nil {
-				collector.Logs.Limits = new(troubleshootv1beta2.LogLimits)
-			}
-			collector.Logs.Limits.SinceTime = metav1.NewTime(sinceTime)
-		}
-	}
-	return nil
-}

cmd/preflight/cli/stdout_results.go

@@ -1,97 +0,0 @@
-package cli
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/pkg/errors"
-	analyzerunner "github.com/replicatedhq/troubleshoot/pkg/analyze"
-)
-
-func showStdoutResults(format string, preflightName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
-	if format == "human" {
-		return showStdoutResultsHuman(preflightName, analyzeResults)
-	} else if format == "json" {
-		return showStdoutResultsJSON(preflightName, analyzeResults)
-	}
-
-	return errors.Errorf("unknown output format: %q", format)
-}
-
-func showStdoutResultsHuman(preflightName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
-	fmt.Println("")
-	var failed bool
-	for _, analyzeResult := range analyzeResults {
-		testResultfailed := outputResult(analyzeResult)
-		if testResultfailed {
-			failed = true
-		}
-	}
-	if failed {
-		fmt.Printf("--- FAIL   %s\n", preflightName)
-		fmt.Println("FAILED")
-	} else {
-		fmt.Printf("--- PASS   %s\n", preflightName)
-		fmt.Println("PASS")
-	}
-	return nil
-}
-
-func showStdoutResultsJSON(preflightName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
-	type ResultOutput struct {
-		Title   string `json:"title"`
-		Message string `json:"message"`
-		URI     string `json:"uri,omitempty"`
-	}
-	type Output struct {
-		Pass []ResultOutput `json:"pass,omitempty"`
-		Warn []ResultOutput `json:"warn,omitempty"`
-		Fail []ResultOutput `json:"fail,omitempty"`
-	}
-
-	output := Output{
-		Pass: []ResultOutput{},
-		Warn: []ResultOutput{},
-		Fail: []ResultOutput{},
-	}
-
-	for _, analyzeResult := range analyzeResults {
-		resultOutput := ResultOutput{
-			Title:   analyzeResult.Title,
-			Message: analyzeResult.Message,
-			URI:     analyzeResult.URI,
-		}
-
-		if analyzeResult.IsPass {
-			output.Pass = append(output.Pass, resultOutput)
-		} else if analyzeResult.IsWarn {
-			output.Warn = append(output.Warn, resultOutput)
-		} else if analyzeResult.IsFail {
-			output.Fail = append(output.Fail, resultOutput)
-		}
-	}
-
-	b, err := json.MarshalIndent(output, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "failed to marshal results")
-	}
-
-	fmt.Printf("%s\n", b)
-
-	return nil
-}
-
-func outputResult(analyzeResult *analyzerunner.AnalyzeResult) bool {
-	if analyzeResult.IsPass {
-		fmt.Printf("   --- PASS %s\n", analyzeResult.Title)
-		fmt.Printf("      --- %s\n", analyzeResult.Message)
-	} else if analyzeResult.IsWarn {
-		fmt.Printf("   --- WARN: %s\n", analyzeResult.Title)
-		fmt.Printf("      --- %s\n", analyzeResult.Message)
-	} else if analyzeResult.IsFail {
-		fmt.Printf("   --- FAIL: %s\n", analyzeResult.Title)
-		fmt.Printf("      --- %s\n", analyzeResult.Message)
-		return true
-	}
-	return false
-}

cmd/preflight/cli/template.go

@@ -0,0 +1,42 @@
+package cli
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"github.com/spf13/cobra"
+)
+
+func TemplateCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "template [template-file]",
+		Short: "Render a templated preflight spec with values",
+		Long: `Process a templated preflight YAML file, substituting variables and removing conditional sections based on provided values.
+
+Examples:
+  # Render template with default values
+  preflight template sample-preflight-templated.yaml
+
+  # Render template with values from files
+  preflight template sample-preflight-templated.yaml --values values-base.yaml --values values-prod.yaml
+
+  # Render template with inline values
+  preflight template sample-preflight-templated.yaml --set postgres.enabled=true --set cluster.minNodes=5
+
+  # Render template and save to file
+  preflight template sample-preflight-templated.yaml --output rendered.yaml`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			templateFile := args[0]
+			valuesFiles, _ := cmd.Flags().GetStringSlice("values")
+			outputFile, _ := cmd.Flags().GetString("output")
+			setValues, _ := cmd.Flags().GetStringSlice("set")
+
+			return preflight.RunTemplate(templateFile, valuesFiles, setValues, outputFile)
+		},
+	}
+
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line (can be used multiple times)")
+	cmd.Flags().StringP("output", "o", "", "Output file (default: stdout)")
+
+	return cmd
+}

cmd/schemagen/cli/root.go

@@ -1,165 +0,0 @@
-package cli
-
-import (
-	"encoding/json"
-	"io/ioutil"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-
-	"github.com/pkg/errors"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	extensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
-	extensionsscheme "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/scheme"
-	"k8s.io/client-go/kubernetes/scheme"
-)
-
-func RootCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:          "schemagen",
-		Short:        "Generate openapischemas for the kinds in this project",
-		SilenceUsage: true,
-		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			v := viper.GetViper()
-
-			return generateSchemas(v)
-		},
-	}
-
-	cobra.OnInitialize(initConfig)
-
-	cmd.Flags().String("output-dir", "./schemas", "directory to save the schemas in")
-
-	viper.BindPFlags(cmd.Flags())
-
-	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
-
-	return cmd
-}
-
-func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
-		os.Exit(1)
-	}
-}
-
-func initConfig() {
-	viper.SetEnvPrefix("TROUBLESHOOT")
-	viper.AutomaticEnv()
-}
-
-func generateSchemas(v *viper.Viper) error {
-	// we generate schemas from the config/crds in the root of this project
-	// those crds can be created from controller-gen or by running `make openapischema`
-
-	workdir, err := os.Getwd()
-	if err != nil {
-		return errors.Wrap(err, "failed to get workdir")
-	}
-
-	files := []struct {
-		inFilename  string
-		outFilename string
-	}{
-		{
-			"troubleshoot.replicated.com_preflights.yaml",
-			"preflight-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_analyzers.yaml",
-			"analyzer-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_collectors.yaml",
-			"collector-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_redactors.yaml",
-			"redactor-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_supportbundles.yaml",
-			"supportbundle-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.sh_analyzers.yaml",
-			"analyzer-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_collectors.yaml",
-			"collector-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_preflights.yaml",
-			"preflight-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_redactors.yaml",
-			"redactor-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_supportbundles.yaml",
-			"supportbundle-troubleshoot-v1beta2.json",
-		},
-	}
-
-	for _, file := range files {
-		contents, err := ioutil.ReadFile(filepath.Join(workdir, "config", "crds", file.inFilename))
-		if err != nil {
-			return errors.Wrapf(err, "failed to read crd from %s", file.inFilename)
-		}
-		if err := generateSchemaFromCRD(contents, filepath.Join(workdir, v.GetString("output-dir"), file.outFilename)); err != nil {
-			return errors.Wrapf(err, "failed to write crd schema to %s", file.outFilename)
-		}
-	}
-
-	return nil
-}
-
-func generateSchemaFromCRD(crd []byte, outfile string) error {
-	extensionsscheme.AddToScheme(scheme.Scheme)
-	decode := scheme.Codecs.UniversalDeserializer().Decode
-	obj, _, err := decode(crd, nil, nil)
-	if err != nil {
-		return errors.Wrap(err, "failed to decode crd")
-	}
-
-	customResourceDefinition := obj.(*extensionsv1beta1.CustomResourceDefinition)
-
-	b, err := json.MarshalIndent(customResourceDefinition.Spec.Validation.OpenAPIV3Schema, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "failed to marshal json")
-	}
-
-	_, err = os.Stat(outfile)
-	if err == nil {
-		if err := os.Remove(outfile); err != nil {
-			return errors.Wrap(err, "failed to remove file")
-		}
-	}
-
-	d, _ := path.Split(outfile)
-	_, err = os.Stat(d)
-	if os.IsNotExist(err) {
-		if err = os.MkdirAll(d, 0755); err != nil {
-			return errors.Wrap(err, "failed to mkdir")
-		}
-	}
-
-	// whoa now
-	// working around the fact that controller-gen doesn't have tags to generate oneOf schemas, so this is hacky.
-	// going to work to add an issue there to support and if they accept, this terrible thing can go away
-	boolStringed := strings.ReplaceAll(string(b), `"type": "BoolString"`, `"oneOf": [{"type": "string"},{"type": "boolean"}]`)
-
-	err = ioutil.WriteFile(outfile, []byte(boolStringed), 0644)
-	if err != nil {
-		return errors.Wrap(err, "failed to write file")
-	}
-
-	return nil
-}

cmd/schemagen/main.go

@@ -1,9 +0,0 @@
-package main
-
-import (
-	"github.com/replicatedhq/troubleshoot/cmd/schemagen/cli"
-)
-
-func main() {
-	cli.InitAndExecute()
-}

cmd/troubleshoot/cli/analyze.go

@@ -7,10 +7,9 @@ import (
 	"net/http"
 	"os"
 
-	"github.com/replicatedhq/troubleshoot/cmd/util"
+	"github.com/replicatedhq/troubleshoot/internal/util"
 	analyzer "github.com/replicatedhq/troubleshoot/pkg/analyze"
 	"github.com/replicatedhq/troubleshoot/pkg/convert"
-	"github.com/replicatedhq/troubleshoot/pkg/logger"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"gopkg.in/yaml.v2"
@@ -23,15 +22,11 @@ func Analyze() *cobra.Command {
 		Short: "analyze a support bundle",
 		Long:  `Analyze a support bundle using the Analyzer definitions provided`,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlag("bundle", cmd.Flags().Lookup("bundle"))
-			viper.BindPFlag("output", cmd.Flags().Lookup("output"))
-			viper.BindPFlag("quiet", cmd.Flags().Lookup("quiet"))
+			viper.BindPFlags(cmd.Flags())
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
-			logger.SetQuiet(v.GetBool("quiet"))
-
 			specPath := args[0]
 			analyzerSpec, err := downloadAnalyzerSpec(specPath)
 			if err != nil {
@@ -77,8 +72,6 @@ func Analyze() *cobra.Command {
 	cmd.Flags().MarkHidden("compatibility")
 	cmd.Flags().Bool("quiet", false, "enable/disable error messaging and only show parseable output")
 
-	viper.BindPFlags(cmd.Flags())
-
 	return cmd
 }
 
@@ -98,7 +91,7 @@ func downloadAnalyzerSpec(specPath string) (string, error) {
 		specContent = string(b)
 	} else {
 		if !util.IsURL(specPath) {
-			return "", fmt.Errorf("%s is not a URL and was not found (err %s)", specPath, err)
+			return "", fmt.Errorf("%s is not a URL and was not found", specPath)
 		}
 
 		req, err := http.NewRequest("GET", specPath, nil)

cmd/troubleshoot/cli/auto_discovery.go

@@ -0,0 +1,372 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/autodiscovery"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/images"
+	"github.com/spf13/viper"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/klog/v2"
+)
+
+// AutoDiscoveryConfig contains configuration for auto-discovery
+type AutoDiscoveryConfig struct {
+	Enabled                 bool
+	IncludeImages           bool
+	RBACCheck               bool
+	Profile                 string
+	ExcludeNamespaces       []string
+	IncludeNamespaces       []string
+	IncludeSystemNamespaces bool
+	Timeout                 time.Duration
+}
+
+// DiscoveryProfile defines different levels of auto-discovery
+type DiscoveryProfile struct {
+	Name          string
+	Description   string
+	IncludeImages bool
+	RBACCheck     bool
+	MaxDepth      int
+	Timeout       time.Duration
+}
+
+// GetAutoDiscoveryConfig extracts auto-discovery configuration from viper
+func GetAutoDiscoveryConfig(v *viper.Viper) AutoDiscoveryConfig {
+	return AutoDiscoveryConfig{
+		Enabled:                 v.GetBool("auto"),
+		IncludeImages:           v.GetBool("include-images"),
+		RBACCheck:               v.GetBool("rbac-check"),
+		Profile:                 v.GetString("discovery-profile"),
+		ExcludeNamespaces:       v.GetStringSlice("exclude-namespaces"),
+		IncludeNamespaces:       v.GetStringSlice("include-namespaces"),
+		IncludeSystemNamespaces: v.GetBool("include-system-namespaces"),
+		Timeout:                 30 * time.Second, // Default timeout
+	}
+}
+
+// GetDiscoveryProfiles returns available discovery profiles
+func GetDiscoveryProfiles() map[string]DiscoveryProfile {
+	return map[string]DiscoveryProfile{
+		"minimal": {
+			Name:          "minimal",
+			Description:   "Minimal collection: cluster info, basic logs",
+			IncludeImages: false,
+			RBACCheck:     true,
+			MaxDepth:      1,
+			Timeout:       15 * time.Second,
+		},
+		"standard": {
+			Name:          "standard",
+			Description:   "Standard collection: logs, configs, secrets, events",
+			IncludeImages: false,
+			RBACCheck:     true,
+			MaxDepth:      2,
+			Timeout:       30 * time.Second,
+		},
+		"comprehensive": {
+			Name:          "comprehensive",
+			Description:   "Comprehensive collection: everything + image metadata",
+			IncludeImages: true,
+			RBACCheck:     true,
+			MaxDepth:      3,
+			Timeout:       60 * time.Second,
+		},
+		"paranoid": {
+			Name:          "paranoid",
+			Description:   "Paranoid collection: maximum data with extended timeouts",
+			IncludeImages: true,
+			RBACCheck:     true,
+			MaxDepth:      5,
+			Timeout:       120 * time.Second,
+		},
+	}
+}
+
+// ApplyAutoDiscovery applies auto-discovery to the support bundle spec
+func ApplyAutoDiscovery(ctx context.Context, client kubernetes.Interface, restConfig *rest.Config,
+	mainBundle *troubleshootv1beta2.SupportBundle, config AutoDiscoveryConfig, namespace string) error {
+
+	if !config.Enabled {
+		return nil // Auto-discovery not enabled
+	}
+
+	klog.V(2).Infof("Applying auto-discovery with profile: %s", config.Profile)
+
+	// Get discovery profile
+	profiles := GetDiscoveryProfiles()
+	profile, exists := profiles[config.Profile]
+	if !exists {
+		klog.Warningf("Unknown discovery profile '%s', using 'standard'", config.Profile)
+		profile = profiles["standard"]
+	}
+
+	// Override profile settings with explicit flags
+	if config.IncludeImages {
+		profile.IncludeImages = true
+	}
+	if config.Timeout > 0 {
+		profile.Timeout = config.Timeout
+	}
+
+	// Create auto-discovery options
+	discoveryOpts := autodiscovery.DiscoveryOptions{
+		IncludeImages: profile.IncludeImages,
+		RBACCheck:     config.RBACCheck,
+		MaxDepth:      profile.MaxDepth,
+		Timeout:       profile.Timeout,
+	}
+
+	// Handle namespace filtering
+	if namespace != "" {
+		discoveryOpts.Namespaces = []string{namespace}
+	} else {
+		// Use include/exclude patterns if specified
+		if len(config.IncludeNamespaces) > 0 || len(config.ExcludeNamespaces) > 0 {
+			// Create namespace scanner to resolve include/exclude patterns
+			nsScanner := autodiscovery.NewNamespaceScanner(client)
+			scanOpts := autodiscovery.ScanOptions{
+				IncludePatterns:         config.IncludeNamespaces,
+				ExcludePatterns:         config.ExcludeNamespaces,
+				IncludeSystemNamespaces: config.IncludeSystemNamespaces,
+			}
+
+			targetNamespaces, err := nsScanner.GetTargetNamespaces(ctx, nil, scanOpts)
+			if err != nil {
+				klog.Warningf("Failed to resolve namespace patterns, using all accessible namespaces: %v", err)
+				// Continue with empty namespace list (all namespaces)
+			} else {
+				discoveryOpts.Namespaces = targetNamespaces
+				klog.V(2).Infof("Resolved namespace patterns to %d namespaces: %v", len(targetNamespaces), targetNamespaces)
+			}
+		}
+	}
+
+	// Create autodiscovery instance
+	discoverer, err := autodiscovery.NewDiscoverer(restConfig, client)
+	if err != nil {
+		return errors.Wrap(err, "failed to create auto-discoverer")
+	}
+
+	// Check if we have existing YAML collectors (Path 2) or just auto-discovery (Path 1)
+	hasYAMLCollectors := len(mainBundle.Spec.Collectors) > 0
+
+	var autoCollectors []autodiscovery.CollectorSpec
+
+	if hasYAMLCollectors {
+		// Path 2: Augment existing YAML collectors with foundational collectors
+		klog.V(2).Info("Auto-discovery: Augmenting YAML collectors with foundational collectors (Path 2)")
+
+		// Convert existing collectors to autodiscovery format
+		yamlCollectors, err := convertToCollectorSpecs(mainBundle.Spec.Collectors)
+		if err != nil {
+			return errors.Wrap(err, "failed to convert YAML collectors")
+		}
+
+		discoveryOpts.AugmentMode = true
+		autoCollectors, err = discoverer.AugmentWithFoundational(ctx, yamlCollectors, discoveryOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to augment with foundational collectors")
+		}
+	} else {
+		// Path 1: Pure foundational discovery
+		klog.V(2).Info("Auto-discovery: Collecting foundational data only (Path 1)")
+
+		discoveryOpts.FoundationalOnly = true
+		autoCollectors, err = discoverer.DiscoverFoundational(ctx, discoveryOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to discover foundational collectors")
+		}
+	}
+
+	// Convert auto-discovered collectors back to troubleshoot specs
+	troubleshootCollectors, err := convertToTroubleshootCollectors(autoCollectors)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert auto-discovered collectors")
+	}
+
+	// Update the support bundle spec
+	if hasYAMLCollectors {
+		// Replace existing collectors with augmented set
+		mainBundle.Spec.Collectors = troubleshootCollectors
+	} else {
+		// Set foundational collectors
+		mainBundle.Spec.Collectors = troubleshootCollectors
+	}
+
+	klog.V(2).Infof("Auto-discovery complete: %d collectors configured", len(troubleshootCollectors))
+	return nil
+}
+
+// convertToCollectorSpecs converts troubleshootv1beta2.Collect to autodiscovery.CollectorSpec
+func convertToCollectorSpecs(collectors []*troubleshootv1beta2.Collect) ([]autodiscovery.CollectorSpec, error) {
+	var specs []autodiscovery.CollectorSpec
+
+	for i, collect := range collectors {
+		// Determine collector type and extract relevant information
+		spec := autodiscovery.CollectorSpec{
+			Priority: 100, // High priority for YAML specs
+			Source:   autodiscovery.SourceYAML,
+		}
+
+		// Map troubleshoot collectors to autodiscovery types
+		switch {
+		case collect.Logs != nil:
+			spec.Type = autodiscovery.CollectorTypeLogs
+			spec.Name = fmt.Sprintf("yaml-logs-%d", i)
+			spec.Namespace = collect.Logs.Namespace
+			spec.Spec = collect.Logs
+		case collect.ConfigMap != nil:
+			spec.Type = autodiscovery.CollectorTypeConfigMaps
+			spec.Name = fmt.Sprintf("yaml-configmap-%d", i)
+			spec.Namespace = collect.ConfigMap.Namespace
+			spec.Spec = collect.ConfigMap
+		case collect.Secret != nil:
+			spec.Type = autodiscovery.CollectorTypeSecrets
+			spec.Name = fmt.Sprintf("yaml-secret-%d", i)
+			spec.Namespace = collect.Secret.Namespace
+			spec.Spec = collect.Secret
+		case collect.ClusterInfo != nil:
+			spec.Type = autodiscovery.CollectorTypeClusterInfo
+			spec.Name = fmt.Sprintf("yaml-clusterinfo-%d", i)
+			spec.Spec = collect.ClusterInfo
+		case collect.ClusterResources != nil:
+			spec.Type = autodiscovery.CollectorTypeClusterResources
+			spec.Name = fmt.Sprintf("yaml-clusterresources-%d", i)
+			spec.Spec = collect.ClusterResources
+		default:
+			// For other collector types, create a generic spec
+			spec.Type = "other"
+			spec.Name = fmt.Sprintf("yaml-other-%d", i)
+			spec.Spec = collect
+		}
+
+		specs = append(specs, spec)
+	}
+
+	return specs, nil
+}
+
+// convertToTroubleshootCollectors converts autodiscovery.CollectorSpec to troubleshootv1beta2.Collect
+func convertToTroubleshootCollectors(collectors []autodiscovery.CollectorSpec) ([]*troubleshootv1beta2.Collect, error) {
+	var troubleshootCollectors []*troubleshootv1beta2.Collect
+
+	for _, spec := range collectors {
+		collect, err := spec.ToTroubleshootCollect()
+		if err != nil {
+			klog.Warningf("Failed to convert collector spec %s: %v", spec.Name, err)
+			continue
+		}
+		troubleshootCollectors = append(troubleshootCollectors, collect)
+	}
+
+	return troubleshootCollectors, nil
+}
+
+// ValidateAutoDiscoveryFlags validates auto-discovery flag combinations
+func ValidateAutoDiscoveryFlags(v *viper.Viper) error {
+	// If include-images is used without auto, it's an error
+	if v.GetBool("include-images") && !v.GetBool("auto") {
+		return errors.New("--include-images flag requires --auto flag to be enabled")
+	}
+
+	// Validate discovery profile
+	profile := v.GetString("discovery-profile")
+	profiles := GetDiscoveryProfiles()
+	if _, exists := profiles[profile]; !exists {
+		return fmt.Errorf("unknown discovery profile: %s. Available profiles: minimal, standard, comprehensive, paranoid", profile)
+	}
+
+	// Validate namespace patterns
+	includeNS := v.GetStringSlice("include-namespaces")
+	excludeNS := v.GetStringSlice("exclude-namespaces")
+
+	if len(includeNS) > 0 && len(excludeNS) > 0 {
+		klog.Warning("Both include-namespaces and exclude-namespaces specified. Include patterns take precedence")
+	}
+
+	return nil
+}
+
+// ShouldUseAutoDiscovery determines if auto-discovery should be used
+func ShouldUseAutoDiscovery(v *viper.Viper, args []string) bool {
+	// Auto-discovery is enabled by the --auto flag
+	autoEnabled := v.GetBool("auto")
+
+	if !autoEnabled {
+		return false
+	}
+
+	// Auto-discovery can be used with or without YAML specs
+	return true
+}
+
+// GetAutoDiscoveryMode returns the auto-discovery mode based on arguments
+func GetAutoDiscoveryMode(args []string, autoEnabled bool) string {
+	if !autoEnabled {
+		return "disabled"
+	}
+
+	if len(args) == 0 {
+		return "foundational-only" // Path 1
+	}
+
+	return "yaml-augmented" // Path 2
+}
+
+// CreateImageCollectionOptions creates image collection options from CLI config
+func CreateImageCollectionOptions(config AutoDiscoveryConfig) images.CollectionOptions {
+	options := images.GetDefaultCollectionOptions()
+
+	// Configure based on profile and flags
+	profiles := GetDiscoveryProfiles()
+	if profile, exists := profiles[config.Profile]; exists {
+		options.Timeout = profile.Timeout
+		options.IncludeConfig = profile.Name == "comprehensive" || profile.Name == "paranoid"
+		options.IncludeLayers = profile.Name == "paranoid"
+	}
+
+	// Override based on explicit flags
+	if config.Timeout > 0 {
+		options.Timeout = config.Timeout
+	}
+
+	// For auto-discovery, always continue on error to maximize collection
+	options.ContinueOnError = true
+	options.EnableCache = true
+
+	return options
+}
+
+// PrintAutoDiscoveryInfo prints information about auto-discovery configuration
+func PrintAutoDiscoveryInfo(config AutoDiscoveryConfig, mode string) {
+	if !config.Enabled {
+		return
+	}
+
+	fmt.Printf("Auto-discovery enabled (mode: %s, profile: %s)\n", mode, config.Profile)
+
+	if config.IncludeImages {
+		fmt.Println("  - Container image metadata collection enabled")
+	}
+
+	if len(config.IncludeNamespaces) > 0 {
+		fmt.Printf("  - Including namespaces: %v\n", config.IncludeNamespaces)
+	}
+
+	if len(config.ExcludeNamespaces) > 0 {
+		fmt.Printf("  - Excluding namespaces: %v\n", config.ExcludeNamespaces)
+	}
+
+	if config.IncludeSystemNamespaces {
+		fmt.Println("  - System namespaces included")
+	}
+
+	fmt.Printf("  - RBAC checking: %t\n", config.RBACCheck)
+}

cmd/troubleshoot/cli/auto_discovery_test.go

@@ -0,0 +1,389 @@
+package cli
+
+import (
+	"testing"
+	"time"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/autodiscovery"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/images"
+	"github.com/spf13/viper"
+)
+
+func TestGetAutoDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		viperSetup  func(*viper.Viper)
+		wantEnabled bool
+		wantImages  bool
+		wantRBAC    bool
+		wantProfile string
+	}{
+		{
+			name: "default config",
+			viperSetup: func(v *viper.Viper) {
+				// No flags set, should use defaults
+			},
+			wantEnabled: false,
+			wantImages:  false,
+			wantRBAC:    true, // Default is true
+			wantProfile: "standard",
+		},
+		{
+			name: "auto enabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    true,
+			wantProfile: "standard",
+		},
+		{
+			name: "auto with images",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-images", true)
+			},
+			wantEnabled: true,
+			wantImages:  true,
+			wantRBAC:    true,
+			wantProfile: "standard",
+		},
+		{
+			name: "comprehensive profile",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("discovery-profile", "comprehensive")
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    true,
+			wantProfile: "comprehensive",
+		},
+		{
+			name: "rbac disabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("rbac-check", false)
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    false,
+			wantProfile: "standard",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+
+			// Set defaults
+			v.SetDefault("rbac-check", true)
+			v.SetDefault("discovery-profile", "standard")
+
+			// Apply test-specific setup
+			tt.viperSetup(v)
+
+			config := GetAutoDiscoveryConfig(v)
+
+			if config.Enabled != tt.wantEnabled {
+				t.Errorf("GetAutoDiscoveryConfig() enabled = %v, want %v", config.Enabled, tt.wantEnabled)
+			}
+			if config.IncludeImages != tt.wantImages {
+				t.Errorf("GetAutoDiscoveryConfig() includeImages = %v, want %v", config.IncludeImages, tt.wantImages)
+			}
+			if config.RBACCheck != tt.wantRBAC {
+				t.Errorf("GetAutoDiscoveryConfig() rbacCheck = %v, want %v", config.RBACCheck, tt.wantRBAC)
+			}
+			if config.Profile != tt.wantProfile {
+				t.Errorf("GetAutoDiscoveryConfig() profile = %v, want %v", config.Profile, tt.wantProfile)
+			}
+		})
+	}
+}
+
+func TestGetDiscoveryProfiles(t *testing.T) {
+	profiles := GetDiscoveryProfiles()
+
+	requiredProfiles := []string{"minimal", "standard", "comprehensive", "paranoid"}
+	for _, profileName := range requiredProfiles {
+		if profile, exists := profiles[profileName]; !exists {
+			t.Errorf("Missing required discovery profile: %s", profileName)
+		} else {
+			if profile.Name != profileName {
+				t.Errorf("Profile %s has wrong name: %s", profileName, profile.Name)
+			}
+			if profile.Description == "" {
+				t.Errorf("Profile %s missing description", profileName)
+			}
+			if profile.Timeout <= 0 {
+				t.Errorf("Profile %s has invalid timeout: %v", profileName, profile.Timeout)
+			}
+		}
+	}
+
+	// Check profile progression (more features as we go up)
+	if profiles["comprehensive"].IncludeImages && !profiles["paranoid"].IncludeImages {
+		t.Error("Paranoid profile should include at least everything comprehensive does")
+	}
+}
+
+func TestValidateAutoDiscoveryFlags(t *testing.T) {
+	tests := []struct {
+		name       string
+		viperSetup func(*viper.Viper)
+		wantErr    bool
+	}{
+		{
+			name: "valid auto discovery",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-images", true)
+				v.Set("discovery-profile", "standard")
+			},
+			wantErr: false,
+		},
+		{
+			name: "include-images without auto",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+				v.Set("include-images", true)
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid discovery profile",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("discovery-profile", "invalid-profile")
+			},
+			wantErr: true,
+		},
+		{
+			name: "no auto discovery",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+			},
+			wantErr: false,
+		},
+		{
+			name: "both include and exclude namespaces",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-namespaces", []string{"app1"})
+				v.Set("exclude-namespaces", []string{"system"})
+			},
+			wantErr: false, // Should warn but not error
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+
+			// Set defaults
+			v.SetDefault("rbac-check", true)
+			v.SetDefault("discovery-profile", "standard")
+
+			// Apply test setup
+			tt.viperSetup(v)
+
+			err := ValidateAutoDiscoveryFlags(v)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ValidateAutoDiscoveryFlags() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestShouldUseAutoDiscovery(t *testing.T) {
+	tests := []struct {
+		name       string
+		viperSetup func(*viper.Viper)
+		args       []string
+		want       bool
+	}{
+		{
+			name: "auto flag enabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			args: []string{},
+			want: true,
+		},
+		{
+			name: "auto flag disabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+			},
+			args: []string{},
+			want: false,
+		},
+		{
+			name: "auto with yaml args",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			args: []string{"spec.yaml"},
+			want: true,
+		},
+		{
+			name: "no auto flag",
+			viperSetup: func(v *viper.Viper) {
+				// No auto flag set
+			},
+			args: []string{"spec.yaml"},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+			tt.viperSetup(v)
+
+			got := ShouldUseAutoDiscovery(v, tt.args)
+			if got != tt.want {
+				t.Errorf("ShouldUseAutoDiscovery() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGetAutoDiscoveryMode(t *testing.T) {
+	tests := []struct {
+		name        string
+		args        []string
+		autoEnabled bool
+		want        string
+	}{
+		{
+			name:        "foundational only",
+			args:        []string{},
+			autoEnabled: true,
+			want:        "foundational-only",
+		},
+		{
+			name:        "yaml augmented",
+			args:        []string{"spec.yaml"},
+			autoEnabled: true,
+			want:        "yaml-augmented",
+		},
+		{
+			name:        "disabled",
+			args:        []string{},
+			autoEnabled: false,
+			want:        "disabled",
+		},
+		{
+			name:        "disabled with args",
+			args:        []string{"spec.yaml"},
+			autoEnabled: false,
+			want:        "disabled",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GetAutoDiscoveryMode(tt.args, tt.autoEnabled)
+			if got != tt.want {
+				t.Errorf("GetAutoDiscoveryMode() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCreateImageCollectionOptions(t *testing.T) {
+	tests := []struct {
+		name      string
+		config    AutoDiscoveryConfig
+		checkFunc func(t *testing.T, opts images.CollectionOptions)
+	}{
+		{
+			name: "standard profile",
+			config: AutoDiscoveryConfig{
+				Profile: "standard",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 30*time.Second {
+					t.Errorf("Expected standard profile timeout 30s, got %v", opts.Timeout)
+				}
+				if !opts.ContinueOnError {
+					t.Error("Should continue on error for auto-discovery")
+				}
+			},
+		},
+		{
+			name: "comprehensive profile",
+			config: AutoDiscoveryConfig{
+				Profile: "comprehensive",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 60*time.Second {
+					t.Errorf("Expected comprehensive profile timeout 60s, got %v", opts.Timeout)
+				}
+				if !opts.IncludeConfig {
+					t.Error("Comprehensive profile should include config")
+				}
+			},
+		},
+		{
+			name: "paranoid profile",
+			config: AutoDiscoveryConfig{
+				Profile: "paranoid",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 120*time.Second {
+					t.Errorf("Expected paranoid profile timeout 120s, got %v", opts.Timeout)
+				}
+				if !opts.IncludeLayers {
+					t.Error("Paranoid profile should include layers")
+				}
+			},
+		},
+		{
+			name: "custom timeout",
+			config: AutoDiscoveryConfig{
+				Profile: "standard",
+				Timeout: 45 * time.Second,
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 45*time.Second {
+					t.Errorf("Expected custom timeout 45s, got %v", opts.Timeout)
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			opts := CreateImageCollectionOptions(tt.config)
+			tt.checkFunc(t, opts)
+		})
+	}
+}
+
+func TestConvertToCollectorSpecs(t *testing.T) {
+	// This test would need actual troubleshootv1beta2.Collect instances
+	// For now, test with nil input
+	specs, err := convertToCollectorSpecs([]*troubleshootv1beta2.Collect{})
+	if err != nil {
+		t.Errorf("convertToCollectorSpecs() with empty input should not error: %v", err)
+	}
+	if len(specs) != 0 {
+		t.Errorf("convertToCollectorSpecs() with empty input should return empty slice, got %d items", len(specs))
+	}
+}
+
+func TestConvertToTroubleshootCollectors(t *testing.T) {
+	// This test would need actual autodiscovery.CollectorSpec instances
+	// For now, test with nil input
+	collectors, err := convertToTroubleshootCollectors([]autodiscovery.CollectorSpec{})
+	if err != nil {
+		t.Errorf("convertToTroubleshootCollectors() with empty input should not error: %v", err)
+	}
+	if len(collectors) != 0 {
+		t.Errorf("convertToTroubleshootCollectors() with empty input should return empty slice, got %d items", len(collectors))
+	}
+}

cmd/troubleshoot/cli/diff.go

@@ -0,0 +1,848 @@
+package cli
+
+import (
+	"archive/tar"
+	"bufio"
+	"compress/gzip"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/pmezard/go-difflib/difflib"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+)
+
+const maxInlineDiffBytes = 256 * 1024
+
+// DiffResult represents the result of comparing two support bundles
+type DiffResult struct {
+	Summary      DiffSummary  `json:"summary"`
+	Changes      []Change     `json:"changes"`
+	Metadata     DiffMetadata `json:"metadata"`
+	Significance string       `json:"significance"`
+}
+
+// DiffSummary provides high-level statistics about the diff
+type DiffSummary struct {
+	TotalChanges      int `json:"totalChanges"`
+	FilesAdded        int `json:"filesAdded"`
+	FilesRemoved      int `json:"filesRemoved"`
+	FilesModified     int `json:"filesModified"`
+	HighImpactChanges int `json:"highImpactChanges"`
+}
+
+// Change represents a single difference between bundles
+type Change struct {
+	Type        string                 `json:"type"`     // added, removed, modified
+	Category    string                 `json:"category"` // resource, log, config, etc.
+	Path        string                 `json:"path"`     // file path or resource path
+	Impact      string                 `json:"impact"`   // high, medium, low, none
+	Details     map[string]interface{} `json:"details"`  // change-specific details
+	Remediation *RemediationStep       `json:"remediation,omitempty"`
+}
+
+// RemediationStep represents a suggested remediation action
+type RemediationStep struct {
+	Title       string `json:"title"`
+	Description string `json:"description"`
+	Command     string `json:"command,omitempty"`
+	URL         string `json:"url,omitempty"`
+}
+
+// DiffMetadata contains metadata about the diff operation
+type DiffMetadata struct {
+	OldBundle   BundleMetadata `json:"oldBundle"`
+	NewBundle   BundleMetadata `json:"newBundle"`
+	GeneratedAt string         `json:"generatedAt"`
+	Version     string         `json:"version"`
+}
+
+// BundleMetadata contains metadata about a support bundle
+type BundleMetadata struct {
+	Path      string `json:"path"`
+	Size      int64  `json:"size"`
+	CreatedAt string `json:"createdAt,omitempty"`
+	NumFiles  int    `json:"numFiles"`
+}
+
+func Diff() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "diff <old-bundle.(tar.gz|tgz)> <new-bundle.(tar.gz|tgz)>",
+		Args:  cobra.ExactArgs(2),
+		Short: "Compare two support bundles and identify changes",
+		Long: `Compare two support bundles to identify changes over time.
+This command analyzes differences between two support bundle archives and generates
+a human-readable report showing what has changed, including:
+
+- Added, removed, or modified files
+- Configuration changes
+- Log differences
+- Resource status changes
+- Performance metric changes
+
+Use -o to write the report to a file; otherwise it prints to stdout.`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+			return runBundleDiff(v, args[0], args[1])
+		},
+	}
+
+	cmd.Flags().StringP("output", "o", "", "file path of where to save the diff report (default prints to stdout)")
+	cmd.Flags().Int("max-diff-lines", 200, "maximum total lines to include in an inline diff for a single file")
+	cmd.Flags().Int("max-diff-files", 50, "maximum number of files to include inline diffs for; additional modified files will omit inline diffs")
+	cmd.Flags().Bool("include-log-diffs", false, "include inline diffs for log files as well")
+	cmd.Flags().Int("diff-context", 3, "number of context lines to include around changes in unified diffs")
+	cmd.Flags().Bool("hide-inline-diffs", false, "hide inline unified diffs in the report")
+	cmd.Flags().String("format", "", "output format; set to 'json' to emit machine-readable JSON to stdout or -o")
+
+	return cmd
+}
+
+func runBundleDiff(v *viper.Viper, oldBundle, newBundle string) error {
+	klog.V(2).Infof("Comparing support bundles: %s -> %s", oldBundle, newBundle)
+
+	// Validate input files
+	if err := validateBundleFile(oldBundle); err != nil {
+		return errors.Wrap(err, "invalid old bundle")
+	}
+	if err := validateBundleFile(newBundle); err != nil {
+		return errors.Wrap(err, "invalid new bundle")
+	}
+
+	// Perform the diff (placeholder implementation)
+	diffResult, err := performBundleDiff(oldBundle, newBundle, v)
+	if err != nil {
+		return errors.Wrap(err, "failed to compare bundles")
+	}
+
+	// Output the results
+	if err := outputDiffResult(diffResult, v); err != nil {
+		return errors.Wrap(err, "failed to output diff results")
+	}
+
+	return nil
+}
+
+func validateBundleFile(bundlePath string) error {
+	if bundlePath == "" {
+		return errors.New("bundle path cannot be empty")
+	}
+
+	// Check if file exists
+	if _, err := os.Stat(bundlePath); os.IsNotExist(err) {
+		return fmt.Errorf("bundle file not found: %s", bundlePath)
+	}
+
+	// Support .tar.gz and .tgz bundles
+	lower := strings.ToLower(bundlePath)
+	if !(strings.HasSuffix(lower, ".tar.gz") || strings.HasSuffix(lower, ".tgz")) {
+		return fmt.Errorf("unsupported bundle format. Expected path to end with .tar.gz or .tgz")
+	}
+
+	return nil
+}
+
+func performBundleDiff(oldBundle, newBundle string, v *viper.Viper) (*DiffResult, error) {
+	klog.V(2).Info("Performing bundle diff analysis (streaming)...")
+
+	// Stream inventories
+	oldInv, err := buildInventoryFromTarGz(oldBundle)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to inventory old bundle")
+	}
+	newInv, err := buildInventoryFromTarGz(newBundle)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to inventory new bundle")
+	}
+
+	var changes []Change
+	inlineDiffsIncluded := 0
+	maxDiffLines := v.GetInt("max-diff-lines")
+	if maxDiffLines <= 0 {
+		maxDiffLines = 200
+	}
+	maxDiffFiles := v.GetInt("max-diff-files")
+	if maxDiffFiles <= 0 {
+		maxDiffFiles = 50
+	}
+	includeLogDiffs := v.GetBool("include-log-diffs")
+	diffContext := v.GetInt("diff-context")
+	if diffContext <= 0 {
+		diffContext = 3
+	}
+
+	// Added files
+	for p, nf := range newInv {
+		if _, ok := oldInv[p]; !ok {
+			ch := Change{
+				Type:     "added",
+				Category: categorizePath(p),
+				Path:     "/" + p,
+				Impact:   estimateImpact("added", p),
+				Details: map[string]interface{}{
+					"size": nf.Size,
+				},
+			}
+			if rem := suggestRemediation(ch.Type, p); rem != nil {
+				ch.Remediation = rem
+			}
+			changes = append(changes, ch)
+		}
+	}
+
+	// Removed files
+	for p, of := range oldInv {
+		if _, ok := newInv[p]; !ok {
+			ch := Change{
+				Type:     "removed",
+				Category: categorizePath(p),
+				Path:     "/" + p,
+				Impact:   estimateImpact("removed", p),
+				Details: map[string]interface{}{
+					"size": of.Size,
+				},
+			}
+			if rem := suggestRemediation(ch.Type, p); rem != nil {
+				ch.Remediation = rem
+			}
+			changes = append(changes, ch)
+		}
+	}
+
+	// Modified files
+	for p, of := range oldInv {
+		if nf, ok := newInv[p]; ok {
+			if of.Digest != nf.Digest {
+				ch := Change{
+					Type:     "modified",
+					Category: categorizePath(p),
+					Path:     "/" + p,
+					Impact:   estimateImpact("modified", p),
+					Details:  map[string]interface{}{},
+				}
+				if rem := suggestRemediation(ch.Type, p); rem != nil {
+					ch.Remediation = rem
+				}
+				changes = append(changes, ch)
+			}
+		}
+	}
+
+	// Sort changes deterministically: type, then path
+	sort.Slice(changes, func(i, j int) bool {
+		if changes[i].Type == changes[j].Type {
+			return changes[i].Path < changes[j].Path
+		}
+		return changes[i].Type < changes[j].Type
+	})
+
+	// Populate inline diffs lazily for the first N eligible modified files using streaming approach
+	for i := range changes {
+		if inlineDiffsIncluded >= maxDiffFiles {
+			break
+		}
+		ch := &changes[i]
+		if ch.Type != "modified" {
+			continue
+		}
+		allowLogs := includeLogDiffs || ch.Category != "logs"
+		if !allowLogs {
+			continue
+		}
+		// Use streaming diff generation to avoid loading large files into memory
+		if d := generateStreamingUnifiedDiff(oldBundle, newBundle, ch.Path, diffContext, maxDiffLines); d != "" {
+			if ch.Details == nil {
+				ch.Details = map[string]interface{}{}
+			}
+			ch.Details["diff"] = d
+			inlineDiffsIncluded++
+		}
+	}
+
+	// Summaries
+	summary := DiffSummary{}
+	for _, c := range changes {
+		switch c.Type {
+		case "added":
+			summary.FilesAdded++
+		case "removed":
+			summary.FilesRemoved++
+		case "modified":
+			summary.FilesModified++
+		}
+		if c.Impact == "high" {
+			summary.HighImpactChanges++
+		}
+	}
+	summary.TotalChanges = summary.FilesAdded + summary.FilesRemoved + summary.FilesModified
+
+	oldMeta := getBundleMetadataWithCount(oldBundle, len(oldInv))
+	newMeta := getBundleMetadataWithCount(newBundle, len(newInv))
+
+	result := &DiffResult{
+		Summary:      summary,
+		Changes:      changes,
+		Metadata:     DiffMetadata{OldBundle: oldMeta, NewBundle: newMeta, GeneratedAt: time.Now().Format(time.RFC3339), Version: "v1"},
+		Significance: computeOverallSignificance(changes),
+	}
+	return result, nil
+}
+
+type inventoryFile struct {
+	Size   int64
+	Digest string
+}
+
+func buildInventoryFromTarGz(bundlePath string) (map[string]inventoryFile, error) {
+	f, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to open bundle")
+	}
+	defer f.Close()
+
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create gzip reader")
+	}
+	defer gz.Close()
+
+	tr := tar.NewReader(gz)
+	inv := make(map[string]inventoryFile)
+
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read tar entry")
+		}
+		if !hdr.FileInfo().Mode().IsRegular() {
+			continue
+		}
+
+		norm := normalizePath(hdr.Name)
+		if norm == "" {
+			continue
+		}
+
+		h := sha256.New()
+		var copied int64
+		buf := make([]byte, 32*1024)
+		for copied < hdr.Size {
+			toRead := int64(len(buf))
+			if remain := hdr.Size - copied; remain < toRead {
+				toRead = remain
+			}
+			n, rerr := io.ReadFull(tr, buf[:toRead])
+			if n > 0 {
+				_, _ = h.Write(buf[:n])
+				copied += int64(n)
+			}
+			if rerr == io.EOF || rerr == io.ErrUnexpectedEOF {
+				break
+			}
+			if rerr != nil {
+				return nil, errors.Wrap(rerr, "failed to read file content")
+			}
+		}
+
+		digest := hex.EncodeToString(h.Sum(nil))
+		inv[norm] = inventoryFile{Size: hdr.Size, Digest: digest}
+	}
+
+	return inv, nil
+}
+
+func normalizePath(name string) string {
+	name = strings.TrimPrefix(name, "./")
+	if name == "" {
+		return name
+	}
+	i := strings.IndexByte(name, '/')
+	if i < 0 {
+		return name
+	}
+	first := name[:i]
+	rest := name[i+1:]
+
+	// Known domain roots we do not strip
+	domainRoots := map[string]bool{
+		"cluster-resources": true,
+		"all-logs":          true,
+		"cluster-info":      true,
+		"execution-data":    true,
+	}
+	if domainRoots[first] {
+		return name
+	}
+	// Strip only known container prefixes
+	if first == "root" || strings.HasPrefix(strings.ToLower(first), "support-bundle") {
+		return rest
+	}
+	return name
+}
+
+func isProbablyText(sample []byte) bool {
+	if len(sample) == 0 {
+		return false
+	}
+	for _, b := range sample {
+		if b == 0x00 {
+			return false
+		}
+		if b < 0x09 {
+			return false
+		}
+	}
+	return true
+}
+
+func normalizeNewlines(s string) string {
+	return strings.ReplaceAll(s, "\r\n", "\n")
+}
+
+// generateStreamingUnifiedDiff creates a unified diff by streaming files line-by-line to avoid loading large files into memory
+func generateStreamingUnifiedDiff(oldBundle, newBundle, path string, context, maxTotalLines int) string {
+	oldReader, err := createTarFileReader(oldBundle, strings.TrimPrefix(path, "/"))
+	if err != nil {
+		return ""
+	}
+	defer oldReader.Close()
+
+	newReader, err := createTarFileReader(newBundle, strings.TrimPrefix(path, "/"))
+	if err != nil {
+		return ""
+	}
+	defer newReader.Close()
+
+	// Read files line by line
+	oldLines, err := readLinesFromReader(oldReader, maxInlineDiffBytes)
+	if err != nil {
+		return ""
+	}
+
+	newLines, err := readLinesFromReader(newReader, maxInlineDiffBytes)
+	if err != nil {
+		return ""
+	}
+
+	// Generate diff using the existing difflib
+	ud := difflib.UnifiedDiff{
+		A:        oldLines,
+		B:        newLines,
+		FromFile: "old:" + path,
+		ToFile:   "new:" + path,
+		Context:  context,
+	}
+	s, err := difflib.GetUnifiedDiffString(ud)
+	if err != nil || s == "" {
+		return ""
+	}
+
+	lines := strings.Split(s, "\n")
+	if maxTotalLines > 0 && len(lines) > maxTotalLines {
+		lines = append(lines[:maxTotalLines], "... (diff truncated)")
+	}
+	if len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return strings.Join(lines, "\n")
+}
+
+// readLinesFromReader reads lines from a reader up to maxBytes total, returning normalized lines
+func readLinesFromReader(reader io.Reader, maxBytes int) ([]string, error) {
+	var lines []string
+	var totalBytes int
+	scanner := bufio.NewScanner(reader)
+
+	for scanner.Scan() {
+		line := normalizeNewlines(scanner.Text())
+		lineWithNL := line + "\n"
+		lineBytes := len(lineWithNL)
+
+		if totalBytes+lineBytes > maxBytes {
+			lines = append(lines, "... (content truncated due to size)\n")
+			break
+		}
+
+		lines = append(lines, lineWithNL)
+		totalBytes += lineBytes
+	}
+
+	if err := scanner.Err(); err != nil {
+		return nil, err
+	}
+
+	return lines, nil
+}
+
+// generateUnifiedDiff builds a unified diff with headers and context, then truncates to maxTotalLines
+func generateUnifiedDiff(a, b string, path string, context, maxTotalLines int) string {
+	ud := difflib.UnifiedDiff{
+		A:        difflib.SplitLines(a),
+		B:        difflib.SplitLines(b),
+		FromFile: "old:" + path,
+		ToFile:   "new:" + path,
+		Context:  context,
+	}
+	s, err := difflib.GetUnifiedDiffString(ud)
+	if err != nil || s == "" {
+		return ""
+	}
+	lines := strings.Split(s, "\n")
+	if maxTotalLines > 0 && len(lines) > maxTotalLines {
+		lines = append(lines[:maxTotalLines], "... (diff truncated)")
+	}
+	if len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return strings.Join(lines, "\n")
+}
+
+func categorizePath(p string) string {
+	if strings.HasPrefix(p, "cluster-resources/pods/logs/") || strings.Contains(p, "/logs/") || strings.HasPrefix(p, "all-logs/") || strings.HasPrefix(p, "logs/") {
+		return "logs"
+	}
+	if strings.HasPrefix(p, "cluster-resources/") {
+		rest := strings.TrimPrefix(p, "cluster-resources/")
+		seg := rest
+		if i := strings.IndexByte(rest, '/'); i >= 0 {
+			seg = rest[:i]
+		}
+		if seg == "" {
+			return "resources"
+		}
+		return "resources:" + seg
+	}
+	if strings.HasPrefix(p, "config/") || strings.HasSuffix(p, ".yaml") || strings.HasSuffix(p, ".yml") || strings.HasSuffix(p, ".json") {
+		return "config"
+	}
+	return "files"
+}
+
+// estimateImpact determines impact based on change type and path patterns
+func estimateImpact(changeType, p string) string {
+	// High impact cases
+	if strings.HasPrefix(p, "cluster-resources/custom-resource-definitions") {
+		if changeType == "removed" || changeType == "modified" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/clusterrole") || strings.HasPrefix(p, "cluster-resources/clusterrolebindings") || strings.Contains(p, "/rolebindings/") {
+		if changeType != "added" { // reductions or changes can break access
+			return "high"
+		}
+	}
+	if strings.Contains(p, "/secrets/") || strings.HasSuffix(p, "-secrets.json") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/nodes") {
+		if changeType != "added" { // node status changes can be severe
+			return "high"
+		}
+	}
+	if strings.Contains(p, "/network-policy/") || strings.HasSuffix(p, "/networkpolicies.json") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/") && strings.Contains(p, "/kube-system") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	// Medium default for cluster resources
+	if strings.HasPrefix(p, "cluster-resources/") {
+		return "medium"
+	}
+	// Logs and others default low
+	if strings.Contains(p, "/logs/") || strings.HasPrefix(p, "all-logs/") {
+		return "low"
+	}
+	return "low"
+}
+
+// suggestRemediation returns a basic remediation suggestion based on category and change
+func suggestRemediation(changeType, p string) *RemediationStep {
+	// RBAC
+	if strings.HasPrefix(p, "cluster-resources/clusterrole") || strings.HasPrefix(p, "cluster-resources/clusterrolebindings") || strings.Contains(p, "/rolebindings/") {
+		return &RemediationStep{Description: "Validate RBAC permissions and recent changes", Command: "kubectl auth can-i --list"}
+	}
+	// CRDs
+	if strings.HasPrefix(p, "cluster-resources/custom-resource-definitions") {
+		return &RemediationStep{Description: "Check CRD presence and reconcile operator status", Command: "kubectl get crds"}
+	}
+	// Nodes
+	if strings.HasPrefix(p, "cluster-resources/nodes") {
+		return &RemediationStep{Description: "Inspect node conditions and recent events", Command: "kubectl describe nodes"}
+	}
+	// Network policy
+	if strings.Contains(p, "/network-policy/") || strings.HasSuffix(p, "/networkpolicies.json") {
+		return &RemediationStep{Description: "Validate connectivity and recent NetworkPolicy changes", Command: "kubectl get networkpolicy -A"}
+	}
+	// Secrets/Config
+	if strings.Contains(p, "/secrets/") || strings.HasPrefix(p, "config/") {
+		return &RemediationStep{Description: "Review configuration or secret changes for correctness"}
+	}
+	// Workloads
+	if strings.Contains(p, "/deployments/") || strings.Contains(p, "/statefulsets/") || strings.Contains(p, "/daemonsets/") {
+		return &RemediationStep{Description: "Check rollout and pod status", Command: "kubectl rollout status -n <ns> <kind>/<name>"}
+	}
+	return nil
+}
+
+func computeOverallSignificance(changes []Change) string {
+	high, medium := 0, 0
+	for _, c := range changes {
+		switch c.Impact {
+		case "high":
+			high++
+		case "medium":
+			medium++
+		}
+	}
+	if high > 0 {
+		return "high"
+	}
+	if medium > 0 {
+		return "medium"
+	}
+	if len(changes) > 0 {
+		return "low"
+	}
+	return "none"
+}
+
+func getBundleMetadata(bundlePath string) BundleMetadata {
+	metadata := BundleMetadata{
+		Path: bundlePath,
+	}
+
+	if stat, err := os.Stat(bundlePath); err == nil {
+		metadata.Size = stat.Size()
+		metadata.CreatedAt = stat.ModTime().Format(time.RFC3339)
+	}
+
+	return metadata
+}
+
+// getBundleMetadataWithCount sets NumFiles directly to avoid re-reading the archive
+func getBundleMetadataWithCount(bundlePath string, numFiles int) BundleMetadata {
+	md := getBundleMetadata(bundlePath)
+	md.NumFiles = numFiles
+	return md
+}
+
+func outputDiffResult(result *DiffResult, v *viper.Viper) error {
+	outputPath := v.GetString("output")
+	showInlineDiffs := !v.GetBool("hide-inline-diffs")
+	formatMode := strings.ToLower(v.GetString("format"))
+
+	var output []byte
+	if formatMode == "json" {
+		data, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal diff result to JSON")
+		}
+		output = data
+	} else {
+		output = []byte(generateTextDiffReport(result, showInlineDiffs))
+	}
+
+	if outputPath != "" {
+		// Write to file
+		if err := os.WriteFile(outputPath, output, 0644); err != nil {
+			return errors.Wrap(err, "failed to write diff output to file")
+		}
+		fmt.Printf("Diff report written to: %s\n", outputPath)
+	} else {
+		// Write to stdout
+		fmt.Print(string(output))
+	}
+
+	return nil
+}
+
+func generateTextDiffReport(result *DiffResult, showInlineDiffs bool) string {
+	var report strings.Builder
+
+	report.WriteString("Support Bundle Diff Report\n")
+	report.WriteString("==========================\n\n")
+
+	report.WriteString(fmt.Sprintf("Generated: %s\n", result.Metadata.GeneratedAt))
+	report.WriteString(fmt.Sprintf("Old Bundle: %s (%s)\n", result.Metadata.OldBundle.Path, formatSize(result.Metadata.OldBundle.Size)))
+	report.WriteString(fmt.Sprintf("New Bundle: %s (%s)\n\n", result.Metadata.NewBundle.Path, formatSize(result.Metadata.NewBundle.Size)))
+
+	// Summary
+	report.WriteString("Summary:\n")
+	report.WriteString(fmt.Sprintf("  Total Changes: %d\n", result.Summary.TotalChanges))
+	report.WriteString(fmt.Sprintf("  Files Added: %d\n", result.Summary.FilesAdded))
+	report.WriteString(fmt.Sprintf("  Files Removed: %d\n", result.Summary.FilesRemoved))
+	report.WriteString(fmt.Sprintf("  Files Modified: %d\n", result.Summary.FilesModified))
+	report.WriteString(fmt.Sprintf("  High Impact Changes: %d\n", result.Summary.HighImpactChanges))
+	report.WriteString(fmt.Sprintf("  Significance: %s\n\n", result.Significance))
+
+	if len(result.Changes) == 0 {
+		report.WriteString("No changes detected between bundles.\n")
+	} else {
+		report.WriteString("Changes:\n")
+		for i, change := range result.Changes {
+			report.WriteString(fmt.Sprintf("  %d. [%s] %s (%s impact)\n",
+				i+1, strings.ToUpper(change.Type), change.Path, change.Impact))
+			if change.Remediation != nil {
+				report.WriteString(fmt.Sprintf("     Remediation: %s\n", change.Remediation.Description))
+			}
+			if showInlineDiffs {
+				if diffStr, ok := change.Details["diff"].(string); ok && diffStr != "" {
+					report.WriteString("     Diff:\n")
+					for _, line := range strings.Split(diffStr, "\n") {
+						report.WriteString("       " + line + "\n")
+					}
+				}
+			}
+		}
+	}
+
+	return report.String()
+}
+
+func formatSize(bytes int64) string {
+	const unit = 1024
+	if bytes < unit {
+		return fmt.Sprintf("%d B", bytes)
+	}
+	div, exp := int64(unit), 0
+	for n := bytes / unit; n >= unit; n /= unit {
+		div *= unit
+		exp++
+	}
+	return fmt.Sprintf("%.1f %ciB", float64(bytes)/float64(div), "KMGTPE"[exp])
+}
+
+// tarFileReader provides a streaming interface to read a specific file from a tar.gz archive
+type tarFileReader struct {
+	file   *os.File
+	gz     *gzip.Reader
+	tr     *tar.Reader
+	found  bool
+	header *tar.Header
+}
+
+// createTarFileReader creates a streaming reader for a specific file in a tar.gz archive
+func createTarFileReader(bundlePath, normalizedPath string) (*tarFileReader, error) {
+	f, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, err
+	}
+
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		f.Close()
+		return nil, err
+	}
+
+	tr := tar.NewReader(gz)
+
+	// Find the target file
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			gz.Close()
+			f.Close()
+			return nil, err
+		}
+		if !hdr.FileInfo().Mode().IsRegular() {
+			continue
+		}
+		if normalizePath(hdr.Name) == normalizedPath {
+			// Check if file is probably text
+			sample := make([]byte, 512)
+			n, _ := io.ReadFull(tr, sample[:])
+			if n > 0 && !isProbablyText(sample[:n]) {
+				gz.Close()
+				f.Close()
+				return nil, fmt.Errorf("file is not text")
+			}
+
+			// Reopen to start from beginning of file
+			gz.Close()
+			f.Close()
+
+			f, err = os.Open(bundlePath)
+			if err != nil {
+				return nil, err
+			}
+			gz, err = gzip.NewReader(f)
+			if err != nil {
+				f.Close()
+				return nil, err
+			}
+			tr = tar.NewReader(gz)
+
+			// Find the file again
+			for {
+				hdr, err = tr.Next()
+				if err == io.EOF {
+					gz.Close()
+					f.Close()
+					return nil, fmt.Errorf("file not found on second pass")
+				}
+				if err != nil {
+					gz.Close()
+					f.Close()
+					return nil, err
+				}
+				if normalizePath(hdr.Name) == normalizedPath {
+					return &tarFileReader{
+						file:   f,
+						gz:     gz,
+						tr:     tr,
+						found:  true,
+						header: hdr,
+					}, nil
+				}
+			}
+		}
+	}
+
+	gz.Close()
+	f.Close()
+	return nil, fmt.Errorf("file not found: %s", normalizedPath)
+}
+
+// Read implements io.Reader interface
+func (r *tarFileReader) Read(p []byte) (n int, err error) {
+	if !r.found {
+		return 0, io.EOF
+	}
+	return r.tr.Read(p)
+}
+
+// Close closes the underlying file handles
+func (r *tarFileReader) Close() error {
+	if r.gz != nil {
+		r.gz.Close()
+	}
+	if r.file != nil {
+		return r.file.Close()
+	}
+	return nil
+}

cmd/troubleshoot/cli/diff_test.go

@@ -0,0 +1,552 @@
+package cli
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/spf13/viper"
+)
+
+func TestValidateBundleFile(t *testing.T) {
+	// Create temporary test files
+	tempDir := t.TempDir()
+
+	// Create bundle files
+	validBundle := filepath.Join(tempDir, "test-bundle.tar.gz")
+	if err := os.WriteFile(validBundle, []byte("dummy content"), 0644); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	validTgz := filepath.Join(tempDir, "test-bundle.tgz")
+	if err := os.WriteFile(validTgz, []byte("dummy content"), 0644); err != nil {
+		t.Fatalf("Failed to create test tgz bundle: %v", err)
+	}
+
+	tests := []struct {
+		name       string
+		bundlePath string
+		wantErr    bool
+	}{
+		{
+			name:       "valid tar.gz bundle",
+			bundlePath: validBundle,
+			wantErr:    false,
+		},
+		{
+			name:       "valid tgz bundle",
+			bundlePath: validTgz,
+			wantErr:    false,
+		},
+		{
+			name:       "empty path",
+			bundlePath: "",
+			wantErr:    true,
+		},
+		{
+			name:       "non-existent file",
+			bundlePath: "/path/to/nonexistent.tar.gz",
+			wantErr:    true,
+		},
+		{
+			name:       "invalid extension",
+			bundlePath: filepath.Join(tempDir, "invalid.txt"),
+			wantErr:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// For invalid extension test, create the file
+			if strings.HasSuffix(tt.bundlePath, "invalid.txt") {
+				os.WriteFile(tt.bundlePath, []byte("content"), 0644)
+			}
+
+			err := validateBundleFile(tt.bundlePath)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateBundleFile() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestGetBundleMetadata(t *testing.T) {
+	// Create a temporary test file
+	tempDir := t.TempDir()
+	testBundle := filepath.Join(tempDir, "test-bundle.tar.gz")
+	testContent := []byte("test bundle content")
+
+	if err := os.WriteFile(testBundle, testContent, 0644); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	metadata := getBundleMetadata(testBundle)
+
+	if metadata.Path != testBundle {
+		t.Errorf("getBundleMetadata() path = %v, want %v", metadata.Path, testBundle)
+	}
+
+	if metadata.Size != int64(len(testContent)) {
+		t.Errorf("getBundleMetadata() size = %v, want %v", metadata.Size, len(testContent))
+	}
+
+	if metadata.CreatedAt == "" {
+		t.Error("getBundleMetadata() createdAt should not be empty")
+	}
+
+	// Validate timestamp format
+	if _, err := time.Parse(time.RFC3339, metadata.CreatedAt); err != nil {
+		t.Errorf("getBundleMetadata() createdAt has invalid format: %v", err)
+	}
+}
+
+func TestPerformBundleDiff(t *testing.T) {
+	// Create temporary test bundles
+	tempDir := t.TempDir()
+
+	oldBundle := filepath.Join(tempDir, "old-bundle.tar.gz")
+	newBundle := filepath.Join(tempDir, "new-bundle.tar.gz")
+
+	if err := writeTarGz(oldBundle, map[string]string{
+		"root/cluster-resources/version.txt": "v1\n",
+		"root/logs/app.log":                  "line1\n",
+	}); err != nil {
+		t.Fatalf("Failed to create old bundle: %v", err)
+	}
+
+	if err := writeTarGz(newBundle, map[string]string{
+		"root/cluster-resources/version.txt": "v2\n",
+		"root/logs/app.log":                  "line1\nline2\n",
+		"root/added.txt":                     "new\n",
+	}); err != nil {
+		t.Fatalf("Failed to create new bundle: %v", err)
+	}
+
+	v := viper.New()
+	result, err := performBundleDiff(oldBundle, newBundle, v)
+
+	if err != nil {
+		t.Fatalf("performBundleDiff() error = %v", err)
+	}
+
+	if result == nil {
+		t.Fatal("performBundleDiff() returned nil result")
+	}
+
+	// Verify result structure
+	if result.Metadata.Version != "v1" {
+		t.Errorf("performBundleDiff() version = %v, want v1", result.Metadata.Version)
+	}
+
+	if result.Metadata.OldBundle.Path != oldBundle {
+		t.Errorf("performBundleDiff() old bundle path = %v, want %v", result.Metadata.OldBundle.Path, oldBundle)
+	}
+
+	if result.Metadata.NewBundle.Path != newBundle {
+		t.Errorf("performBundleDiff() new bundle path = %v, want %v", result.Metadata.NewBundle.Path, newBundle)
+	}
+
+	if result.Metadata.GeneratedAt == "" {
+		t.Error("performBundleDiff() generatedAt should not be empty")
+	}
+}
+
+// writeTarGz creates a gzipped tar file at tarPath with the provided files map.
+// Keys are entry names inside the archive, values are file contents.
+func writeTarGz(tarPath string, files map[string]string) error {
+	f, err := os.Create(tarPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	gz := gzip.NewWriter(f)
+	defer gz.Close()
+
+	tw := tar.NewWriter(gz)
+	defer tw.Close()
+
+	for name, content := range files {
+		data := []byte(content)
+		hdr := &tar.Header{
+			Name:     name,
+			Mode:     0644,
+			Size:     int64(len(data)),
+			Typeflag: tar.TypeReg,
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if _, err := bytes.NewReader(data).WriteTo(tw); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func TestGenerateTextDiffReport(t *testing.T) {
+	result := &DiffResult{
+		Summary: DiffSummary{
+			TotalChanges:      3,
+			FilesAdded:        1,
+			FilesRemoved:      1,
+			FilesModified:     1,
+			HighImpactChanges: 1,
+		},
+		Changes: []Change{
+			{
+				Type:     "added",
+				Category: "config",
+				Path:     "/new-config.yaml",
+				Impact:   "medium",
+				Remediation: &RemediationStep{
+					Description: "Review new configuration",
+				},
+			},
+			{
+				Type:     "removed",
+				Category: "resource",
+				Path:     "/old-deployment.yaml",
+				Impact:   "high",
+			},
+		},
+		Metadata: DiffMetadata{
+			OldBundle: BundleMetadata{
+				Path: "/old/bundle.tar.gz",
+				Size: 1024,
+			},
+			NewBundle: BundleMetadata{
+				Path: "/new/bundle.tar.gz",
+				Size: 2048,
+			},
+			GeneratedAt: "2023-01-01T00:00:00Z",
+		},
+		Significance: "high",
+	}
+
+	report := generateTextDiffReport(result, true)
+
+	// Check that report contains expected elements
+	expectedStrings := []string{
+		"Support Bundle Diff Report",
+		"Total Changes: 3",
+		"Files Added: 1",
+		"High Impact Changes: 1",
+		"Significance: high",
+		"/new-config.yaml",
+		"/old-deployment.yaml",
+		"Remediation: Review new configuration",
+	}
+
+	for _, expected := range expectedStrings {
+		if !strings.Contains(report, expected) {
+			t.Errorf("generateTextDiffReport() missing expected string: %s", expected)
+		}
+	}
+}
+
+func TestOutputDiffResult_JSON(t *testing.T) {
+	// Minimal result
+	result := &DiffResult{
+		Summary: DiffSummary{},
+		Metadata: DiffMetadata{
+			OldBundle:   BundleMetadata{Path: "/old.tar.gz"},
+			NewBundle:   BundleMetadata{Path: "/new.tar.gz"},
+			GeneratedAt: time.Now().Format(time.RFC3339),
+			Version:     "v1",
+		},
+		Changes:      []Change{{Type: "modified", Category: "files", Path: "/a", Impact: "low"}},
+		Significance: "low",
+	}
+
+	v := viper.New()
+	v.Set("format", "json")
+
+	// Write to a temp file via -o to exercise file write path
+	tempDir := t.TempDir()
+	outPath := filepath.Join(tempDir, "diff.json")
+	v.Set("output", outPath)
+
+	if err := outputDiffResult(result, v); err != nil {
+		t.Fatalf("outputDiffResult(json) error = %v", err)
+	}
+
+	data, err := os.ReadFile(outPath)
+	if err != nil {
+		t.Fatalf("failed to read output: %v", err)
+	}
+
+	// Basic JSON sanity checks
+	s := string(data)
+	if !strings.Contains(s, "\"summary\"") || !strings.Contains(s, "\"changes\"") {
+		t.Fatalf("json output missing keys: %s", s)
+	}
+	if !strings.Contains(s, "\"path\": \"/a\"") {
+		t.Fatalf("json output missing change path: %s", s)
+	}
+}
+
+func TestGenerateTextDiffReport_DiffVisibility(t *testing.T) {
+	result := &DiffResult{
+		Summary: DiffSummary{TotalChanges: 1, FilesModified: 1},
+		Changes: []Change{
+			{
+				Type:     "modified",
+				Category: "files",
+				Path:     "/path.txt",
+				Impact:   "low",
+				Details:  map[string]interface{}{"diff": "--- old:/path.txt\n+++ new:/path.txt\n@@\n-a\n+b"},
+			},
+		},
+		Metadata: DiffMetadata{GeneratedAt: time.Now().Format(time.RFC3339)},
+	}
+
+	reportShown := generateTextDiffReport(result, true)
+	if !strings.Contains(reportShown, "Diff:") || !strings.Contains(reportShown, "+ new:/path.txt") {
+		t.Fatalf("expected diff to be shown when enabled; got: %s", reportShown)
+	}
+
+	reportHidden := generateTextDiffReport(result, false)
+	if strings.Contains(reportHidden, "Diff:") {
+		t.Fatalf("expected diff to be hidden when disabled; got: %s", reportHidden)
+	}
+}
+
+func TestCategorizePath(t *testing.T) {
+	cases := []struct {
+		in  string
+		out string
+	}{
+		{"cluster-resources/pods/logs/ns/pod/container.log", "logs"},
+		{"some/ns/logs/thing.log", "logs"},
+		{"all-logs/ns/pod/container.log", "logs"},
+		{"logs/app.log", "logs"},
+		{"cluster-resources/configmaps/ns.json", "resources:configmaps"},
+		{"cluster-resources/", "resources"},
+		{"config/settings.yaml", "config"},
+		{"random/file.json", "config"},
+		{"random/file.txt", "files"},
+	}
+	for _, c := range cases {
+		if got := categorizePath(c.in); got != c.out {
+			t.Errorf("categorizePath(%q)=%q want %q", c.in, got, c.out)
+		}
+	}
+}
+
+func TestNormalizePath(t *testing.T) {
+	cases := []struct {
+		in  string
+		out string
+	}{
+		{"root/foo.txt", "foo.txt"},
+		{"support-bundle-123/foo.txt", "foo.txt"},
+		{"Support-Bundle-ABC/bar/baz.txt", "bar/baz.txt"},
+		{"cluster-resources/pods/logs/whatever.log", "cluster-resources/pods/logs/whatever.log"},
+		{"all-logs/whatever.log", "all-logs/whatever.log"},
+	}
+	for _, c := range cases {
+		if got := normalizePath(c.in); got != c.out {
+			t.Errorf("normalizePath(%q)=%q want %q", c.in, got, c.out)
+		}
+	}
+}
+
+func TestGenerateUnifiedDiff_TruncationAndContext(t *testing.T) {
+	old := "line1\nline2\nline3\nline4\nline5\n"
+	newv := "line1\nline2-mod\nline3\nline4\nline5\n"
+	// context=1 should include headers and minimal context; max lines small to force truncation
+	diff := generateUnifiedDiff(old, newv, "/file.txt", 1, 5)
+	if diff == "" {
+		t.Fatal("expected non-empty diff")
+	}
+	if !strings.Contains(diff, "old:/file.txt") || !strings.Contains(diff, "new:/file.txt") {
+		t.Errorf("diff missing headers: %s", diff)
+	}
+	if !strings.Contains(diff, "... (diff truncated)") {
+		t.Errorf("expected truncated marker in diff: %s", diff)
+	}
+}
+
+func TestFormatSize(t *testing.T) {
+	tests := []struct {
+		name  string
+		bytes int64
+		want  string
+	}{
+		{
+			name:  "bytes",
+			bytes: 512,
+			want:  "512 B",
+		},
+		{
+			name:  "kilobytes",
+			bytes: 1536, // 1.5 KB
+			want:  "1.5 KiB",
+		},
+		{
+			name:  "megabytes",
+			bytes: 1572864, // 1.5 MB
+			want:  "1.5 MiB",
+		},
+		{
+			name:  "zero",
+			bytes: 0,
+			want:  "0 B",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := formatSize(tt.bytes)
+			if got != tt.want {
+				t.Errorf("formatSize() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCreateTarFileReader(t *testing.T) {
+	tempDir := t.TempDir()
+	bundlePath := filepath.Join(tempDir, "test-bundle.tar.gz")
+
+	// Create test bundle with text and binary files
+	testFiles := map[string]string{
+		"root/text-file.txt":   "line1\nline2\nline3\n",
+		"root/config.yaml":     "key: value\nother: data\n",
+		"root/binary-file.bin": string([]byte{0x00, 0x01, 0x02, 0xFF}), // Binary content
+	}
+
+	if err := writeTarGz(bundlePath, testFiles); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	// Test reading existing text file
+	reader, err := createTarFileReader(bundlePath, "text-file.txt")
+	if err != nil {
+		t.Fatalf("createTarFileReader() error = %v", err)
+	}
+	defer reader.Close()
+
+	content := make([]byte, 100)
+	n, err := reader.Read(content)
+	if err != nil && err != io.EOF {
+		t.Errorf("Read() error = %v", err)
+	}
+
+	contentStr := string(content[:n])
+	if !strings.Contains(contentStr, "line1") {
+		t.Errorf("Expected file content not found, got: %s", contentStr)
+	}
+
+	// Test reading non-existent file
+	_, err = createTarFileReader(bundlePath, "non-existent.txt")
+	if err == nil {
+		t.Error("Expected error for non-existent file")
+	}
+
+	// Test reading binary file (should fail)
+	_, err = createTarFileReader(bundlePath, "binary-file.bin")
+	if err == nil {
+		t.Error("Expected error for binary file")
+	}
+}
+
+func TestGenerateStreamingUnifiedDiff(t *testing.T) {
+	tempDir := t.TempDir()
+	oldBundle := filepath.Join(tempDir, "old-bundle.tar.gz")
+	newBundle := filepath.Join(tempDir, "new-bundle.tar.gz")
+
+	// Create bundles with different versions of the same file
+	if err := writeTarGz(oldBundle, map[string]string{
+		"root/config.yaml": "version: 1.0\napp: test\nfeature: disabled\n",
+	}); err != nil {
+		t.Fatalf("Failed to create old bundle: %v", err)
+	}
+
+	if err := writeTarGz(newBundle, map[string]string{
+		"root/config.yaml": "version: 2.0\napp: test\nfeature: enabled\n",
+	}); err != nil {
+		t.Fatalf("Failed to create new bundle: %v", err)
+	}
+
+	// Generate streaming diff
+	diff := generateStreamingUnifiedDiff(oldBundle, newBundle, "/config.yaml", 3, 100)
+
+	// Verify diff content
+	if diff == "" {
+		t.Error("Expected non-empty diff")
+	}
+
+	expectedStrings := []string{
+		"old:/config.yaml",
+		"new:/config.yaml",
+		"-version: 1.0",
+		"+version: 2.0",
+		"-feature: disabled",
+		"+feature: enabled",
+	}
+
+	for _, expected := range expectedStrings {
+		if !strings.Contains(diff, expected) {
+			t.Errorf("Diff missing expected string '%s'. Got: %s", expected, diff)
+		}
+	}
+}
+
+func TestReadLinesFromReader(t *testing.T) {
+	tests := []struct {
+		name     string
+		content  string
+		maxBytes int
+		wantLen  int
+		wantLast string
+	}{
+		{
+			name:     "small content",
+			content:  "line1\nline2\nline3\n",
+			maxBytes: 1000,
+			wantLen:  3,
+			wantLast: "line3\n",
+		},
+		{
+			name:     "content exceeds limit",
+			content:  "line1\nline2\nline3\nline4\nline5\n",
+			maxBytes: 15, // Only allows first 2 lines plus truncation marker
+			wantLen:  3,
+			wantLast: "... (content truncated due to size)\n",
+		},
+		{
+			name:     "empty content",
+			content:  "",
+			maxBytes: 1000,
+			wantLen:  0,
+			wantLast: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := strings.NewReader(tt.content)
+			lines, err := readLinesFromReader(reader, tt.maxBytes)
+
+			if err != nil {
+				t.Errorf("readLinesFromReader() error = %v", err)
+			}
+
+			if len(lines) != tt.wantLen {
+				t.Errorf("readLinesFromReader() got %d lines, want %d", len(lines), tt.wantLen)
+			}
+
+			if tt.wantLen > 0 && lines[len(lines)-1] != tt.wantLast {
+				t.Errorf("readLinesFromReader() last line = %s, want %s", lines[len(lines)-1], tt.wantLast)
+			}
+		})
+	}
+}

cmd/troubleshoot/cli/discovery_config.go

@@ -0,0 +1,239 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+	"k8s.io/klog/v2"
+)
+
+// DiscoveryConfig represents the configuration for auto-discovery
+type DiscoveryConfig struct {
+	Version  string                      `json:"version" yaml:"version"`
+	Profiles map[string]DiscoveryProfile `json:"profiles" yaml:"profiles"`
+	Patterns DiscoveryPatterns           `json:"patterns" yaml:"patterns"`
+}
+
+// DiscoveryPatterns defines inclusion/exclusion patterns for discovery
+type DiscoveryPatterns struct {
+	NamespacePatterns    PatternConfig `json:"namespacePatterns" yaml:"namespacePatterns"`
+	ResourceTypePatterns PatternConfig `json:"resourceTypePatterns" yaml:"resourceTypePatterns"`
+	RegistryPatterns     PatternConfig `json:"registryPatterns" yaml:"registryPatterns"`
+}
+
+// PatternConfig defines include/exclude patterns
+type PatternConfig struct {
+	Include []string `json:"include" yaml:"include"`
+	Exclude []string `json:"exclude" yaml:"exclude"`
+}
+
+// LoadDiscoveryConfig loads discovery configuration from file or returns defaults
+func LoadDiscoveryConfig(configPath string) (*DiscoveryConfig, error) {
+	// If no config path specified, use built-in defaults
+	if configPath == "" {
+		return getDefaultDiscoveryConfig(), nil
+	}
+
+	// Check if config file exists
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		klog.V(2).Infof("Discovery config file not found: %s, using defaults", configPath)
+		return getDefaultDiscoveryConfig(), nil
+	}
+
+	// Read config file
+	data, err := ioutil.ReadFile(configPath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to read discovery config file")
+	}
+
+	// Parse config file (support JSON for now)
+	var config DiscoveryConfig
+	if err := json.Unmarshal(data, &config); err != nil {
+		return nil, errors.Wrap(err, "failed to parse discovery config")
+	}
+
+	// Validate config
+	if err := validateDiscoveryConfig(&config); err != nil {
+		return nil, errors.Wrap(err, "invalid discovery config")
+	}
+
+	return &config, nil
+}
+
+// getDefaultDiscoveryConfig returns the built-in default configuration
+func getDefaultDiscoveryConfig() *DiscoveryConfig {
+	return &DiscoveryConfig{
+		Version:  "v1",
+		Profiles: GetDiscoveryProfiles(),
+		Patterns: DiscoveryPatterns{
+			NamespacePatterns: PatternConfig{
+				Include: []string{"*"}, // Include all by default
+				Exclude: []string{
+					"kube-system",
+					"kube-public",
+					"kube-node-lease",
+					"kubernetes-dashboard",
+					"cattle-*",
+					"rancher-*",
+				},
+			},
+			ResourceTypePatterns: PatternConfig{
+				Include: []string{
+					"pods",
+					"deployments",
+					"services",
+					"configmaps",
+					"secrets",
+					"events",
+				},
+				Exclude: []string{
+					"*.tmp",
+					"*.log", // Exclude raw log files in favor of structured logs
+				},
+			},
+			RegistryPatterns: PatternConfig{
+				Include: []string{"*"}, // Include all registries
+				Exclude: []string{},    // No exclusions by default
+			},
+		},
+	}
+}
+
+// validateDiscoveryConfig validates a discovery configuration
+func validateDiscoveryConfig(config *DiscoveryConfig) error {
+	if config.Version == "" {
+		config.Version = "v1" // Default version
+	}
+
+	if config.Profiles == nil {
+		return errors.New("profiles section is required")
+	}
+
+	// Validate each profile
+	requiredProfiles := []string{"minimal", "standard", "comprehensive"}
+	for _, profileName := range requiredProfiles {
+		if _, exists := config.Profiles[profileName]; !exists {
+			return fmt.Errorf("required profile missing: %s", profileName)
+		}
+	}
+
+	return nil
+}
+
+// ApplyDiscoveryPatterns applies include/exclude patterns to a list
+func ApplyDiscoveryPatterns(items []string, patterns PatternConfig) ([]string, error) {
+	if len(patterns.Include) == 0 && len(patterns.Exclude) == 0 {
+		return items, nil // No patterns to apply
+	}
+
+	var result []string
+
+	for _, item := range items {
+		include := true
+
+		// Check exclude patterns first
+		for _, excludePattern := range patterns.Exclude {
+			if matched, err := matchPattern(item, excludePattern); err != nil {
+				return nil, errors.Wrapf(err, "invalid exclude pattern: %s", excludePattern)
+			} else if matched {
+				include = false
+				break
+			}
+		}
+
+		// If not excluded, check include patterns
+		if include && len(patterns.Include) > 0 {
+			include = false // Default to exclude if include patterns exist
+			for _, includePattern := range patterns.Include {
+				if matched, err := matchPattern(item, includePattern); err != nil {
+					return nil, errors.Wrapf(err, "invalid include pattern: %s", includePattern)
+				} else if matched {
+					include = true
+					break
+				}
+			}
+		}
+
+		if include {
+			result = append(result, item)
+		}
+	}
+
+	return result, nil
+}
+
+// matchPattern checks if an item matches a glob pattern
+func matchPattern(item, pattern string) (bool, error) {
+	// Simple glob pattern matching
+	if pattern == "*" {
+		return true, nil
+	}
+
+	if pattern == item {
+		return true, nil
+	}
+
+	// Handle basic wildcard patterns
+	if strings.HasPrefix(pattern, "*") && strings.HasSuffix(pattern, "*") {
+		// Pattern is "*substring*"
+		substring := pattern[1 : len(pattern)-1]
+		return strings.Contains(item, substring), nil
+	}
+
+	if strings.HasPrefix(pattern, "*") {
+		// Pattern is "*suffix"
+		suffix := pattern[1:]
+		return strings.HasSuffix(item, suffix), nil
+	}
+
+	if strings.HasSuffix(pattern, "*") {
+		// Pattern is "prefix*"
+		prefix := pattern[:len(pattern)-1]
+		return strings.HasPrefix(item, prefix), nil
+	}
+
+	return false, nil
+}
+
+// SaveDiscoveryConfig saves discovery configuration to a file
+func SaveDiscoveryConfig(config *DiscoveryConfig, configPath string) error {
+	// Create directory if it doesn't exist
+	dir := filepath.Dir(configPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return errors.Wrap(err, "failed to create config directory")
+	}
+
+	// Marshal to JSON
+	data, err := json.MarshalIndent(config, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to marshal config")
+	}
+
+	// Write to file
+	if err := ioutil.WriteFile(configPath, data, 0644); err != nil {
+		return errors.Wrap(err, "failed to write config file")
+	}
+
+	return nil
+}
+
+// GetDiscoveryConfigPath returns the default path for discovery configuration
+func GetDiscoveryConfigPath() string {
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return "./troubleshoot-discovery.json"
+	}
+
+	return filepath.Join(homeDir, ".troubleshoot", "discovery.json")
+}
+
+// CreateDefaultDiscoveryConfigFile creates a default discovery config file
+func CreateDefaultDiscoveryConfigFile(configPath string) error {
+	config := getDefaultDiscoveryConfig()
+	return SaveDiscoveryConfig(config, configPath)
+}

cmd/troubleshoot/cli/discovery_config_test.go

@@ -0,0 +1,422 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoadDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		setupConfig func(string) error
+		configPath  string
+		wantErr     bool
+		checkFunc   func(*testing.T, *DiscoveryConfig)
+	}{
+		{
+			name:       "no config path - use defaults",
+			configPath: "",
+			wantErr:    false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+				if len(config.Profiles) == 0 {
+					t.Error("Default config should have profiles")
+				}
+			},
+		},
+		{
+			name:       "non-existent config file - use defaults",
+			configPath: "/non/existent/path.json",
+			wantErr:    false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+			},
+		},
+		{
+			name: "valid config file",
+			setupConfig: func(path string) error {
+				configContent := `{
+					"version": "v1",
+					"profiles": {
+						"minimal": {
+							"name": "minimal",
+							"description": "Minimal collection",
+							"includeImages": false,
+							"rbacCheck": true,
+							"maxDepth": 1,
+							"timeout": 15000000000
+						},
+						"standard": {
+							"name": "standard",
+							"description": "Standard collection",
+							"includeImages": false,
+							"rbacCheck": true,
+							"maxDepth": 2,
+							"timeout": 30000000000
+						},
+						"comprehensive": {
+							"name": "comprehensive",
+							"description": "Comprehensive collection",
+							"includeImages": true,
+							"rbacCheck": true,
+							"maxDepth": 3,
+							"timeout": 60000000000
+						}
+					},
+					"patterns": {
+						"namespacePatterns": {
+							"include": ["app-*"],
+							"exclude": ["kube-*"]
+						}
+					}
+				}`
+				return os.WriteFile(path, []byte(configContent), 0644)
+			},
+			wantErr: false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+				if len(config.Profiles) == 0 {
+					t.Error("Config should have profiles")
+				}
+			},
+		},
+		{
+			name: "invalid json config",
+			setupConfig: func(path string) error {
+				return os.WriteFile(path, []byte(`{invalid json`), 0644)
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var configPath string
+			if tt.configPath != "" {
+				configPath = tt.configPath
+			}
+
+			// Setup config file if needed
+			if tt.setupConfig != nil {
+				tempDir := t.TempDir()
+				configPath = filepath.Join(tempDir, "config.json")
+				if err := tt.setupConfig(configPath); err != nil {
+					t.Fatalf("Failed to setup config: %v", err)
+				}
+			}
+
+			config, err := LoadDiscoveryConfig(configPath)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("LoadDiscoveryConfig() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+
+			if !tt.wantErr && tt.checkFunc != nil {
+				tt.checkFunc(t, config)
+			}
+		})
+	}
+}
+
+func TestApplyDiscoveryPatterns(t *testing.T) {
+	tests := []struct {
+		name     string
+		items    []string
+		patterns PatternConfig
+		want     []string
+	}{
+		{
+			name:  "no patterns",
+			items: []string{"app1", "app2", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "app2", "kube-system"},
+		},
+		{
+			name:  "exclude patterns only",
+			items: []string{"app1", "app2", "kube-system", "kube-public"},
+			patterns: PatternConfig{
+				Include: []string{},
+				Exclude: []string{"kube-*"},
+			},
+			want: []string{"app1", "app2"},
+		},
+		{
+			name:  "include patterns only",
+			items: []string{"app1", "app2", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{"app*"},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "app2"},
+		},
+		{
+			name:  "include and exclude patterns",
+			items: []string{"app1", "app2", "app-system", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{"app*"},
+				Exclude: []string{"*system"},
+			},
+			want: []string{"app1", "app2"}, // app-system excluded, kube-system not included
+		},
+		{
+			name:  "exact match patterns",
+			items: []string{"app1", "app2", "special"},
+			patterns: PatternConfig{
+				Include: []string{"special", "app1"},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "special"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ApplyDiscoveryPatterns(tt.items, tt.patterns)
+			if err != nil {
+				t.Errorf("ApplyDiscoveryPatterns() error = %v", err)
+				return
+			}
+
+			if len(got) != len(tt.want) {
+				t.Errorf("ApplyDiscoveryPatterns() length = %v, want %v", len(got), len(tt.want))
+				return
+			}
+
+			// Check that all expected items are present
+			gotMap := make(map[string]bool)
+			for _, item := range got {
+				gotMap[item] = true
+			}
+
+			for _, wantItem := range tt.want {
+				if !gotMap[wantItem] {
+					t.Errorf("ApplyDiscoveryPatterns() missing expected item: %s", wantItem)
+				}
+			}
+		})
+	}
+}
+
+func TestMatchPattern(t *testing.T) {
+	tests := []struct {
+		name    string
+		item    string
+		pattern string
+		want    bool
+		wantErr bool
+	}{
+		{
+			name:    "exact match",
+			item:    "app1",
+			pattern: "app1",
+			want:    true,
+		},
+		{
+			name:    "wildcard all",
+			item:    "anything",
+			pattern: "*",
+			want:    true,
+		},
+		{
+			name:    "prefix wildcard",
+			item:    "app-namespace",
+			pattern: "app*",
+			want:    true,
+		},
+		{
+			name:    "suffix wildcard",
+			item:    "kube-system",
+			pattern: "*system",
+			want:    true,
+		},
+		{
+			name:    "substring wildcard",
+			item:    "my-app-namespace",
+			pattern: "*app*",
+			want:    true,
+		},
+		{
+			name:    "no match",
+			item:    "different",
+			pattern: "app*",
+			want:    false,
+		},
+		{
+			name:    "prefix no match",
+			item:    "other-app",
+			pattern: "app*",
+			want:    false,
+		},
+		{
+			name:    "suffix no match",
+			item:    "system-app",
+			pattern: "*system",
+			want:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := matchPattern(tt.item, tt.pattern)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("matchPattern() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("matchPattern() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSaveDiscoveryConfig(t *testing.T) {
+	config := getDefaultDiscoveryConfig()
+
+	tempDir := t.TempDir()
+	configPath := filepath.Join(tempDir, "test-config.json")
+
+	err := SaveDiscoveryConfig(config, configPath)
+	if err != nil {
+		t.Fatalf("SaveDiscoveryConfig() error = %v", err)
+	}
+
+	// Verify file was created
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		t.Error("SaveDiscoveryConfig() did not create config file")
+	}
+
+	// Verify we can load it back
+	loadedConfig, err := LoadDiscoveryConfig(configPath)
+	if err != nil {
+		t.Fatalf("Failed to reload saved config: %v", err)
+	}
+
+	if loadedConfig.Version != config.Version {
+		t.Errorf("Reloaded config version = %v, want %v", loadedConfig.Version, config.Version)
+	}
+}
+
+func TestGetDiscoveryConfigPath(t *testing.T) {
+	path := GetDiscoveryConfigPath()
+
+	if path == "" {
+		t.Error("GetDiscoveryConfigPath() should not return empty string")
+	}
+
+	// Should end with expected filename
+	expectedSuffix := "discovery.json"
+	if !strings.HasSuffix(path, expectedSuffix) {
+		t.Errorf("GetDiscoveryConfigPath() should end with %s, got %s", expectedSuffix, path)
+	}
+}
+
+func TestValidateDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name    string
+		config  *DiscoveryConfig
+		wantErr bool
+	}{
+		{
+			name: "valid config",
+			config: &DiscoveryConfig{
+				Version:  "v1",
+				Profiles: GetDiscoveryProfiles(),
+			},
+			wantErr: false,
+		},
+		{
+			name: "missing version gets default",
+			config: &DiscoveryConfig{
+				Profiles: GetDiscoveryProfiles(),
+			},
+			wantErr: false,
+		},
+		{
+			name: "nil profiles",
+			config: &DiscoveryConfig{
+				Version:  "v1",
+				Profiles: nil,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing required profile",
+			config: &DiscoveryConfig{
+				Version: "v1",
+				Profiles: map[string]DiscoveryProfile{
+					"custom": {Name: "custom"},
+				},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateDiscoveryConfig(tt.config)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateDiscoveryConfig() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func BenchmarkMatchPattern(b *testing.B) {
+	testCases := []struct {
+		item    string
+		pattern string
+	}{
+		{"app-namespace", "app*"},
+		{"kube-system", "*system"},
+		{"my-app-test", "*app*"},
+		{"exact-match", "exact-match"},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		for _, tc := range testCases {
+			_, err := matchPattern(tc.item, tc.pattern)
+			if err != nil {
+				b.Fatalf("matchPattern failed: %v", err)
+			}
+		}
+	}
+}
+
+func BenchmarkApplyDiscoveryPatterns(b *testing.B) {
+	items := make([]string, 100)
+	for i := 0; i < 100; i++ {
+		if i%3 == 0 {
+			items[i] = fmt.Sprintf("app-%d", i)
+		} else if i%3 == 1 {
+			items[i] = fmt.Sprintf("kube-system-%d", i)
+		} else {
+			items[i] = fmt.Sprintf("other-%d", i)
+		}
+	}
+
+	patterns := PatternConfig{
+		Include: []string{"app*", "other*"},
+		Exclude: []string{"*system*"},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := ApplyDiscoveryPatterns(items, patterns)
+		if err != nil {
+			b.Fatalf("ApplyDiscoveryPatterns failed: %v", err)
+		}
+	}
+}

cmd/troubleshoot/cli/interactive_results.go

@@ -2,30 +2,27 @@ package cli
 
 import (
 	"fmt"
-	"io/ioutil"
-	"os"
-	"path"
-	"time"
 
+	"github.com/mitchellh/go-wordwrap"
 	"github.com/pkg/errors"
 	ui "github.com/replicatedhq/termui/v3"
 	"github.com/replicatedhq/termui/v3/widgets"
-	"github.com/replicatedhq/troubleshoot/cmd/util"
+	"github.com/replicatedhq/troubleshoot/internal/util"
 	analyzerunner "github.com/replicatedhq/troubleshoot/pkg/analyze"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
 )
 
 var (
 	selectedResult = 0
 	table          = widgets.NewTable()
-	isShowingSaved = false
 )
 
-func showInteractiveResults(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
+func showInteractiveResults(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult, archivePath string) error {
 	if err := ui.Init(); err != nil {
 		return errors.Wrap(err, "failed to create terminal ui")
 	}
 	defer ui.Close()
-	drawUI(supportBundleName, analyzeResults)
+	drawUI(supportBundleName, analyzeResults, archivePath)
 
 	uiEvents := ui.PollEvents()
 	for {
@@ -35,29 +32,10 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 			case "<C-c>":
 				return nil
 			case "q":
-				if isShowingSaved == true {
-					isShowingSaved = false
-					ui.Clear()
-					drawUI(supportBundleName, analyzeResults)
-				} else {
-					return nil
-				}
-			case "s":
-				filename, err := save(analyzeResults)
-				if err != nil {
-					// show
-				} else {
-					showSaved(filename)
-					go func() {
-						time.Sleep(time.Second * 5)
-						isShowingSaved = false
-						ui.Clear()
-						drawUI(supportBundleName, analyzeResults)
-					}()
-				}
+				return nil
 			case "<Resize>":
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			case "<Down>":
 				if selectedResult < len(analyzeResults)-1 {
 					selectedResult++
@@ -67,7 +45,7 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 				}
 				table.ScrollDown()
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			case "<Up>":
 				if selectedResult > 0 {
 					selectedResult--
@@ -77,16 +55,16 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 				}
 				table.ScrollUp()
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			}
 		}
 	}
 }
 
-func drawUI(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult) {
+func drawUI(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult, archivePath string) {
 	drawGrid(analyzeResults)
 	drawHeader(supportBundleName)
-	drawFooter()
+	drawFooter(archivePath)
 }
 
 func drawGrid(analyzeResults []*analyzerunner.AnalyzeResult) {
@@ -99,9 +77,7 @@ func drawHeader(supportBundleName string) {
 
 	title := widgets.NewParagraph()
 	title.Text = fmt.Sprintf("%s Support Bundle Analysis", util.AppName(supportBundleName))
-	title.TextStyle.Fg = ui.ColorWhite
-	title.TextStyle.Bg = ui.ColorClear
-	title.TextStyle.Modifier = ui.ModifierBold
+	title.TextStyle = ui.NewStyle(ui.ColorWhite, ui.ColorClear, ui.ModifierBold)
 	title.Border = false
 
 	left := termWidth/2 - 2*len(title.Text)/3
@@ -111,11 +87,18 @@ func drawHeader(supportBundleName string) {
 	ui.Render(title)
 }
 
-func drawFooter() {
+func drawFooter(archivePath string) {
 	termWidth, termHeight := ui.TerminalDimensions()
 
+	archivePathMsg := widgets.NewParagraph()
+	archivePathMsg.Text = "Support bundle archive: " + archivePath
+	archivePathMsg.Border = false
+	archivePathMsg.TextStyle = ui.NewStyle(ui.ColorWhite, ui.ColorClear, ui.ModifierBold)
+
+	archivePathMsg.SetRect(0, termHeight-3, termWidth, termHeight-2)
+
 	instructions := widgets.NewParagraph()
-	instructions.Text = "[q] quit    [s] save    [↑][↓] scroll"
+	instructions.Text = "[q] quit    [↑][↓] scroll"
 	instructions.Border = false
 
 	left := 0
@@ -124,13 +107,13 @@ func drawFooter() {
 	bottom := termHeight
 
 	instructions.SetRect(left, top, right, bottom)
-	ui.Render(instructions)
+	ui.Render(archivePathMsg, instructions)
 }
 
 func drawAnalyzersTable(analyzeResults []*analyzerunner.AnalyzeResult) {
 	termWidth, termHeight := ui.TerminalDimensions()
 
-	table.SetRect(0, 3, termWidth/2, termHeight-6)
+	table.SetRect(0, 3, termWidth/2, termHeight-4)
 	table.FillRow = true
 	table.Border = true
 	table.Rows = [][]string{}
@@ -178,7 +161,10 @@ func drawDetails(analysisResult *analyzerunner.AnalyzeResult) {
 
 	currentTop := 4
 	title := widgets.NewParagraph()
-	title.Text = analysisResult.Title
+	// WrapText is set to false to prevent internal wordwrap which is not accounting for the padding
+	title.WrapText = false
+	// For long title that lead to wrapping text, the terminal width is divided by 2 and deducted by MESSAGE_TEXT_PADDING to account for the padding
+	title.Text = wordwrap.WrapString(analysisResult.Title, uint(termWidth/2-constants.MESSAGE_TEXT_PADDING))
 	title.Border = false
 	if analysisResult.IsPass {
 		title.TextStyle = ui.NewStyle(ui.ColorGreen, ui.ColorClear, ui.ModifierBold)
@@ -187,88 +173,24 @@ func drawDetails(analysisResult *analyzerunner.AnalyzeResult) {
 	} else if analysisResult.IsFail {
 		title.TextStyle = ui.NewStyle(ui.ColorRed, ui.ColorClear, ui.ModifierBold)
 	}
-	height := estimateNumberOfLines(title.Text, termWidth/2)
+	height := util.EstimateNumberOfLines(title.Text)
 	title.SetRect(termWidth/2, currentTop, termWidth, currentTop+height)
 	ui.Render(title)
 	currentTop = currentTop + height + 1
 
 	message := widgets.NewParagraph()
-	message.Text = analysisResult.Message
+	// WrapText is set to false to prevent internal wordwrap which is not accounting for the padding
+	message.WrapText = false
+	// For long text that lead to wrapping text, the terminal width is divided by 2 and deducted by MESSAGE_TEXT_PADDING to account for the padding
+	message.Text = wordwrap.WrapString(analysisResult.Message, uint(termWidth/2-constants.MESSAGE_TEXT_PADDING))
+	if analysisResult.URI != "" {
+		// Add URL to the message with wordwrap
+		// Add emply lines as separator
+		urlText := wordwrap.WrapString(fmt.Sprintf("For more information: %s", analysisResult.URI), uint(termWidth/2-constants.MESSAGE_TEXT_PADDING))
+		message.Text = message.Text + "\n\n" + urlText
+	}
+	height = util.EstimateNumberOfLines(message.Text) + constants.MESSAGE_TEXT_LINES_MARGIN_TO_BOTTOM
 	message.Border = false
-	height = estimateNumberOfLines(message.Text, termWidth/2) + 2
 	message.SetRect(termWidth/2, currentTop, termWidth, currentTop+height)
 	ui.Render(message)
-	currentTop = currentTop + height + 1
-
-	if analysisResult.URI != "" {
-		uri := widgets.NewParagraph()
-		uri.Text = fmt.Sprintf("For more information: %s", analysisResult.URI)
-		uri.Border = false
-		height = estimateNumberOfLines(uri.Text, termWidth/2)
-		uri.SetRect(termWidth/2, currentTop, termWidth, currentTop+height)
-		ui.Render(uri)
-		currentTop = currentTop + height + 1
-	}
-}
-
-func estimateNumberOfLines(text string, width int) int {
-	lines := len(text)/width + 1
-	return lines
-}
-
-func showSaved(filename string) {
-	termWidth, termHeight := ui.TerminalDimensions()
-
-	savedMessage := widgets.NewParagraph()
-	savedMessage.Text = fmt.Sprintf("Support Bundle analysis results saved to\n\n%s", filename)
-	savedMessage.WrapText = true
-	savedMessage.Border = true
-
-	left := termWidth/2 - 20
-	right := termWidth/2 + 20
-	top := termHeight/2 - 4
-	bottom := termHeight/2 + 4
-
-	savedMessage.SetRect(left, top, right, bottom)
-	ui.Render(savedMessage)
-
-	isShowingSaved = true
-}
-
-func save(analyzeResults []*analyzerunner.AnalyzeResult) (string, error) {
-	filename := path.Join(util.HomeDir(), fmt.Sprintf("%s-results.txt", "support-bundle"))
-	_, err := os.Stat(filename)
-	if err == nil {
-		os.Remove(filename)
-	}
-
-	results := ""
-	for _, analyzeResult := range analyzeResults {
-		result := ""
-
-		if analyzeResult.IsPass {
-			result = "Check PASS\n"
-		} else if analyzeResult.IsWarn {
-			result = "Check WARN\n"
-		} else if analyzeResult.IsFail {
-			result = "Check FAIL\n"
-		}
-
-		result = result + fmt.Sprintf("Title: %s\n", analyzeResult.Title)
-		result = result + fmt.Sprintf("Message: %s\n", analyzeResult.Message)
-
-		if analyzeResult.URI != "" {
-			result = result + fmt.Sprintf("URI: %s\n", analyzeResult.URI)
-		}
-
-		result = result + "\n------------\n"
-
-		results = results + result
-	}
-
-	if err := ioutil.WriteFile(filename, []byte(results), 0644); err != nil {
-		return "", errors.Wrap(err, "failed to save preflight results")
-	}
-
-	return filename, nil
 }

cmd/troubleshoot/cli/redact.go

@@ -0,0 +1,82 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/pkg/errors"
+	analyzer "github.com/replicatedhq/troubleshoot/pkg/analyze"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func Redact() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "redact [urls...]",
+		Args:  cobra.MinimumNArgs(1), // TODO
+		Short: "Redact information from a generated support bundle archive",
+		Long: `Redaction is the process of masking sensitive information from collected data in a support bundle.
+This is done using rules defined in the list of redactor manifests provided in the [urls...] command line
+argument. Default built in redactors will also be run, but these would have been run when the support
+bundle was generated. After redaction, the support bundle is archived once more. The resulting file will
+be stored in the current directory in the path provided by the --output flag.
+
+The [urls...] argument is a list of either oci://.., http://.., https://.. or local paths to yaml files.
+
+For more information on redactors visit https://troubleshoot.sh/docs/redact/
+		`,
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			// 1. Decode redactors from provided URLs
+			redactors, err := supportbundle.GetRedactorsFromURIs(args)
+			if err != nil {
+				return err
+			}
+
+			// 2. Download the bundle and extract it
+			tmpDir, bundleDir, err := analyzer.DownloadAndExtractSupportBundle(v.GetString("bundle"))
+			if err != nil {
+				return err
+			}
+			defer os.RemoveAll(tmpDir)
+
+			// 3. Represent bundle as a CollectorResult
+			collectorResult, err := collect.CollectorResultFromBundle(bundleDir)
+			if err != nil {
+				return err
+			}
+
+			// 4. Perform redaction on the bundle
+			err = collect.RedactResult(bundleDir, collectorResult, redactors)
+			if err != nil {
+				return errors.Wrap(err, "failed to redact support bundle")
+			}
+
+			// 5. Compress the bundle once more after redacting
+			output := v.GetString("output")
+			if output == "" {
+				output = fmt.Sprintf("redacted-support-bundle-%s.tar.gz", time.Now().Format("2006-01-02T15_04_05"))
+			}
+			err = collectorResult.ArchiveBundle(bundleDir, output)
+			if err != nil {
+				return errors.Wrap(err, "failed to create support bundle archive")
+			}
+			fmt.Println("Redacted support bundle:", output)
+			return nil
+		},
+	}
+
+	cmd.Flags().String("bundle", "", "file path of the support bundle archive to redact")
+	cmd.MarkFlagRequired("bundle")
+	cmd.Flags().BoolP("quiet", "q", false, "enable/disable error messaging and only show parseable output")
+	cmd.Flags().StringP("output", "o", "", "file path of where to save the redacted support bundle archive (default \"redacted-support-bundle-YYYY-MM-DDTHH_MM_SS.tar.gz\")")
+
+	return cmd
+}

cmd/troubleshoot/cli/root.go

@@ -1,58 +1,164 @@
 package cli
 
 import (
-	"io/ioutil"
+	"fmt"
 	"os"
 	"strings"
 
-	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/cmd/internal/util"
+	preflightcli "github.com/replicatedhq/troubleshoot/cmd/preflight/cli"
+	"github.com/replicatedhq/troubleshoot/internal/traces"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/updater"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
 func RootCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "support-bundle [url]",
-		Args:  cobra.MinimumNArgs(1),
-		Short: "Generate a support bundle",
-		Long: `A support bundle is an archive of files, output, metrics and state
-from a server that can be used to assist when troubleshooting a Kubernetes cluster.`,
+		Use:   "support-bundle [urls...]",
+		Args:  cobra.MinimumNArgs(0),
+		Short: "Generate a support bundle from a Kubernetes cluster or specified sources",
+		Long: `Generate a support bundle, an archive containing files, output, metrics, and cluster state to aid in troubleshooting Kubernetes clusters.
+
+If no arguments are provided, specs are automatically loaded from the cluster by default.
+
+**Argument Types**:
+1. **Secret**: Load specs from a Kubernetes Secret. Format: "secret/namespace-name/secret-name[/data-key]"
+2. **ConfigMap**: Load specs from a Kubernetes ConfigMap. Format: "configmap/namespace-name/configmap-name[/data-key]"
+3. **File**: Load specs from a local file. Format: Local file path
+4. **Standard Input**: Read specs from stdin. Format: "-"
+5. **URL**: Load specs from a URL. Supports HTTP and OCI registry URLs.`,
 		SilenceUsage: true,
-		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			v := viper.GetViper()
+			v.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+			v.BindPFlags(cmd.Flags())
+
+			logger.SetupLogger(v)
+
+			if err := util.StartProfiling(); err != nil {
+				klog.Errorf("Failed to start profiling: %v", err)
+			}
+
+			// Auto-update support-bundle unless disabled by flag or env
+			// Only run auto-update for the root support-bundle command, not subcommands
+			if cmd.Name() == "support-bundle" && !cmd.HasParent() {
+				envAuto := os.Getenv("TROUBLESHOOT_AUTO_UPDATE")
+				autoFromEnv := true
+				if envAuto != "" {
+					if strings.EqualFold(envAuto, "0") || strings.EqualFold(envAuto, "false") {
+						autoFromEnv = false
+					}
+				}
+				if v.GetBool("auto-update") && autoFromEnv {
+					exe, err := os.Executable()
+					if err == nil {
+						_ = updater.CheckAndUpdate(cmd.Context(), updater.Options{
+							BinaryName:  "support-bundle",
+							CurrentPath: exe,
+							Printf:      func(f string, a ...interface{}) { fmt.Fprintf(os.Stderr, f, a...) },
+						})
+					}
+				}
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
-			logger.SetQuiet(v.GetBool("quiet"))
-			return runTroubleshoot(v, args[0])
+			// If there are no locations to load specs from passed in the cli args, we should
+			// load them from the cluster by setting "load-cluster-specs=true". If the caller
+			// provided "--load-cluster-specs" cli option, we should respect it.
+			if len(args) == 0 {
+				// Check if --load-cluster-specs was set by the cli caller to avoid overriding it
+				flg := cmd.Flags().Lookup("load-cluster-specs")
+				if flg != nil && !flg.Changed {
+					// Load specs from the cluster if no spec(s) is(are) provided in the cli args
+					v.Set("load-cluster-specs", true)
+				}
+			}
+
+			closer, err := traces.ConfigureTracing("support-bundle")
+			if err != nil {
+				// Do not fail running support-bundle if tracing fails
+				klog.Errorf("Failed to initialize open tracing provider: %v", err)
+			} else {
+				defer closer()
+			}
+
+			err = runTroubleshoot(v, args)
+			if !v.IsSet("dry-run") && (v.GetBool("debug") || v.IsSet("v")) {
+				fmt.Fprintf(os.Stderr, "\n%s", traces.GetExporterInstance().GetSummary())
+			}
+
+			return err
+		},
+		PersistentPostRun: func(cmd *cobra.Command, args []string) {
+			if err := util.StopProfiling(); err != nil {
+				klog.Errorf("Failed to stop profiling: %v", err)
+			}
 		},
 	}
 
 	cobra.OnInitialize(initConfig)
 
 	cmd.AddCommand(Analyze())
-	cmd.AddCommand(VersionCmd())
+	cmd.AddCommand(Redact())
+	cmd.AddCommand(Diff())
+	cmd.AddCommand(Schedule())
+	cmd.AddCommand(UploadCmd())
+	cmd.AddCommand(util.VersionCmd())
+	cmd.AddCommand(preflightcli.LintCmd())
 
 	cmd.Flags().StringSlice("redactors", []string{}, "names of the additional redactors to use")
 	cmd.Flags().Bool("redact", true, "enable/disable default redactions")
+
+	// Tokenization flags
+	cmd.Flags().Bool("tokenize", false, "enable intelligent tokenization instead of simple masking (replaces ***HIDDEN*** with ***TOKEN_TYPE_HASH***)")
+	cmd.Flags().String("redaction-map", "", "generate redaction mapping file at specified path (enables token→original mapping for authorized access)")
+	cmd.Flags().Bool("encrypt-redaction-map", false, "encrypt the redaction mapping file using AES-256 (requires --redaction-map)")
+	cmd.Flags().String("token-prefix", "", "custom token prefix format (default: ***TOKEN_%s_%s***)")
+	cmd.Flags().Bool("verify-tokenization", false, "validation mode: verify tokenization setup without collecting data")
+	cmd.Flags().String("bundle-id", "", "custom bundle identifier for token correlation (auto-generated if not provided)")
+	cmd.Flags().Bool("tokenization-stats", false, "include detailed tokenization statistics in output")
 	cmd.Flags().Bool("interactive", true, "enable/disable interactive mode")
 	cmd.Flags().Bool("collect-without-permissions", true, "always generate a support bundle, even if it some require additional permissions")
+	cmd.Flags().StringSliceP("selector", "l", []string{"troubleshoot.sh/kind=support-bundle"}, "selector to filter on for loading additional support bundle specs found in secrets within the cluster")
+	cmd.Flags().Bool("load-cluster-specs", false, "enable/disable loading additional troubleshoot specs found within the cluster. Do not load by default unless no specs are provided in the cli args")
 	cmd.Flags().String("since-time", "", "force pod logs collectors to return logs after a specific date (RFC3339)")
 	cmd.Flags().String("since", "", "force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.")
+	cmd.Flags().StringP("output", "o", "", "specify the output file path for the support bundle")
+	cmd.Flags().Bool("debug", false, "enable debug logging. This is equivalent to --v=0")
+	cmd.Flags().Bool("dry-run", false, "print support bundle spec without collecting anything")
+	cmd.Flags().Bool("auto-update", true, "enable automatic binary self-update check and install")
+
+	// Auto-discovery flags
+	cmd.Flags().Bool("auto", false, "enable auto-discovery of foundational collectors. When used with YAML specs, adds foundational collectors to YAML collectors. When used alone, collects only foundational data")
+	cmd.Flags().Bool("include-images", false, "include container image metadata collection when using auto-discovery")
+	cmd.Flags().Bool("rbac-check", true, "enable RBAC permission checking for auto-discovered collectors")
+	cmd.Flags().String("discovery-profile", "standard", "auto-discovery profile: minimal, standard, comprehensive, or paranoid")
+	cmd.Flags().StringSlice("exclude-namespaces", []string{}, "namespaces to exclude from auto-discovery (supports glob patterns)")
+	cmd.Flags().StringSlice("include-namespaces", []string{}, "namespaces to include in auto-discovery (supports glob patterns). If specified, only these namespaces will be included")
+	cmd.Flags().Bool("include-system-namespaces", false, "include system namespaces (kube-system, etc.) in auto-discovery")
 
 	// hidden in favor of the `insecure-skip-tls-verify` flag
 	cmd.Flags().Bool("allow-insecure-connections", false, "when set, do not verify TLS certs when retrieving spec and reporting results")
 	cmd.Flags().MarkHidden("allow-insecure-connections")
 
-	viper.BindPFlags(cmd.Flags())
-
-	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+	// `no-uri` references the `followURI` functionality where we can use an upstream spec when creating a support bundle
+	// This flag makes sure we can also disable this and fall back to the default spec.
+	cmd.Flags().Bool("no-uri", false, "When this flag is used, Troubleshoot does not attempt to retrieve the spec referenced by the uri: field`")
 
 	k8sutil.AddFlags(cmd.Flags())
 
+	// Initialize klog flags
+	logger.InitKlogFlags(cmd)
+
+	// CPU and memory profiling flags
+	util.AddProfilingFlags(cmd)
+
 	return cmd
 }
 
@@ -66,24 +172,3 @@ func initConfig() {
 	viper.SetEnvPrefix("TROUBLESHOOT")
 	viper.AutomaticEnv()
 }
-
-func ensureCollectorInList(list []*troubleshootv1beta2.Collect, collector troubleshootv1beta2.Collect) []*troubleshootv1beta2.Collect {
-	for _, inList := range list {
-		if collector.ClusterResources != nil && inList.ClusterResources != nil {
-			return list
-		}
-		if collector.ClusterInfo != nil && inList.ClusterInfo != nil {
-			return list
-		}
-	}
-
-	return append(list, &collector)
-}
-
-func writeFile(filename string, contents []byte) error {
-	if err := ioutil.WriteFile(filename, contents, 0644); err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/troubleshoot/cli/run.go

@@ -1,52 +1,121 @@
 package cli
 
 import (
+	"context"
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"os/signal"
-
-	"net/url"
 	"os"
+	"os/signal"
 	"path/filepath"
+	"reflect"
 	"strings"
+	"sync"
 	"time"
 
 	cursor "github.com/ahmetalpbalkan/go-cursor"
 	"github.com/fatih/color"
-	"github.com/manifoldco/promptui"
 	"github.com/mattn/go-isatty"
 	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/internal/specs"
+	"github.com/replicatedhq/troubleshoot/internal/util"
+	analyzer "github.com/replicatedhq/troubleshoot/pkg/analyze"
 	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
-	"github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
-	troubleshootclientsetscheme "github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
 	"github.com/replicatedhq/troubleshoot/pkg/convert"
-	"github.com/replicatedhq/troubleshoot/pkg/docrewrite"
 	"github.com/replicatedhq/troubleshoot/pkg/httputil"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/loader"
+	"github.com/replicatedhq/troubleshoot/pkg/redact"
 	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
 	"github.com/spf13/viper"
 	spin "github.com/tj/go-spin"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/klog/v2"
 )
 
-func runTroubleshoot(v *viper.Viper, arg string) error {
-	fmt.Print(cursor.Hide())
-	defer fmt.Print(cursor.Show())
-
-	go func() {
-		signalChan := make(chan os.Signal, 1)
-		signal.Notify(signalChan, os.Interrupt)
-		<-signalChan
-		fmt.Print(cursor.Show())
-		os.Exit(0)
-	}()
+func runTroubleshoot(v *viper.Viper, args []string) error {
+	ctx := context.Background()
 
 	restConfig, err := k8sutil.GetRESTConfig()
 	if err != nil {
 		return errors.Wrap(err, "failed to convert kube flags to rest config")
 	}
 
+	client, err := kubernetes.NewForConfig(restConfig)
+	if err != nil {
+		return errors.Wrap(err, "failed to create kubernetes client")
+	}
+
+	mainBundle, additionalRedactors, err := loadSpecs(ctx, args, client)
+	if err != nil {
+		return err
+	}
+
+	// Validate auto-discovery flags
+	if err := ValidateAutoDiscoveryFlags(v); err != nil {
+		return errors.Wrap(err, "invalid auto-discovery configuration")
+	}
+
+	// Validate tokenization flags
+	if err := ValidateTokenizationFlags(v); err != nil {
+		return errors.Wrap(err, "invalid tokenization configuration")
+	}
+	// Apply auto-discovery if enabled
+	autoConfig := GetAutoDiscoveryConfig(v)
+	if autoConfig.Enabled {
+		mode := GetAutoDiscoveryMode(args, autoConfig.Enabled)
+		if !v.GetBool("quiet") {
+			PrintAutoDiscoveryInfo(autoConfig, mode)
+		}
+
+		// Apply auto-discovery to the main bundle
+		namespace := v.GetString("namespace")
+		if err := ApplyAutoDiscovery(ctx, client, restConfig, mainBundle, autoConfig, namespace); err != nil {
+			return errors.Wrap(err, "auto-discovery failed")
+		}
+	}
+
+	// For --dry-run, we want to print the yaml and exit
+	if v.GetBool("dry-run") {
+		k := loader.TroubleshootKinds{
+			SupportBundlesV1Beta2: []troubleshootv1beta2.SupportBundle{*mainBundle},
+		}
+		// If we have redactors, add them to the temp kinds object
+		if len(additionalRedactors.Spec.Redactors) > 0 {
+			k.RedactorsV1Beta2 = []troubleshootv1beta2.Redactor{*additionalRedactors}
+		}
+
+		out, err := k.ToYaml()
+		if err != nil {
+			return types.NewExitCodeError(constants.EXIT_CODE_CATCH_ALL, errors.Wrap(err, "failed to convert specs to yaml"))
+		}
+		fmt.Printf("%s", out)
+		return nil
+	}
+
+	interactive := v.GetBool("interactive") && isatty.IsTerminal(os.Stdout.Fd())
+
+	if interactive {
+		fmt.Print(cursor.Hide())
+		defer fmt.Print(cursor.Show())
+	}
+
+	go func() {
+		signalChan := make(chan os.Signal, 1)
+		signal.Notify(signalChan, os.Interrupt)
+		<-signalChan
+		if interactive {
+			fmt.Print(cursor.Show())
+		}
+		os.Exit(0)
+	}()
+
 	var sinceTime *time.Time
 	if v.GetString("since-time") != "" || v.GetString("since") != "" {
 		sinceTime, err = parseTimeFlags(v)
@@ -61,89 +130,74 @@ func runTroubleshoot(v *viper.Viper, arg string) error {
 		})
 	}
 
-	collectorContent, err := supportbundle.LoadSupportBundleSpec(arg)
-	if err != nil {
-		return errors.Wrap(err, "failed to load collector spec")
+	if interactive {
+		c := color.New()
+		c.Println(fmt.Sprintf("\r%s\r", cursor.ClearEntireLine()))
 	}
 
-	multidocs := strings.Split(string(collectorContent), "\n---\n")
-
-	// we support both raw collector kinds and supportbundle kinds here
-	supportBundle, err := supportbundle.ParseSupportBundleFromDoc([]byte(multidocs[0]))
-	if err != nil {
-		return errors.Wrap(err, "failed to parse collector")
-	}
-
-	troubleshootclientsetscheme.AddToScheme(scheme.Scheme)
-	decode := scheme.Codecs.UniversalDeserializer().Decode
-
-	additionalRedactors := &troubleshootv1beta2.Redactor{}
-	for idx, redactor := range v.GetStringSlice("redactors") {
-		redactorObj, err := supportbundle.GetRedactorFromURI(redactor)
-		if err != nil {
-			return errors.Wrapf(err, "failed to get redactor spec %s, #%d", redactor, idx)
-		}
-
-		if redactorObj != nil {
-			additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, redactorObj.Spec.Redactors...)
+	if interactive {
+		if len(mainBundle.Spec.HostCollectors) > 0 && !util.IsRunningAsRoot() && !mainBundle.Spec.RunHostCollectorsInPod {
+			fmt.Print(cursor.Show())
+			if util.PromptYesNo(util.HOST_COLLECTORS_RUN_AS_ROOT_PROMPT) {
+				fmt.Println("Exiting...")
+				return nil
+			}
+			fmt.Print(cursor.Hide())
 		}
 	}
 
-	for i, additionalDoc := range multidocs {
-		if i == 0 {
-			continue
+	var wg sync.WaitGroup
+	collectorCB := func(c chan interface{}, msg string) { c <- msg }
+	progressChan := make(chan interface{})
+	isProgressChanClosed := false
+	defer func() {
+		if !isProgressChanClosed {
+			close(progressChan)
 		}
-		additionalDoc, err := docrewrite.ConvertToV1Beta2([]byte(additionalDoc))
-		if err != nil {
-			return errors.Wrap(err, "failed to convert to v1beta2")
-		}
-		obj, _, err := decode(additionalDoc, nil, nil)
-		if err != nil {
-			return errors.Wrapf(err, "failed to parse additional doc %d", i)
-		}
-		multidocRedactors, ok := obj.(*troubleshootv1beta2.Redactor)
-		if !ok {
-			continue
-		}
-		additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, multidocRedactors.Spec.Redactors...)
-	}
+		wg.Wait()
+	}()
 
-	s := spin.New()
-	finishedCh := make(chan bool, 1)
-	progressChan := make(chan interface{}) // non-zero buffer can result in missed messages
-	isFinishedChClosed := false
-	go func() {
-		currentDir := ""
-		for {
-			select {
-			case msg := <-progressChan:
-				switch msg := msg.(type) {
-				case error:
-					c := color.New(color.FgHiRed)
-					c.Println(fmt.Sprintf("%s\r * %v", cursor.ClearEntireLine(), msg))
-				case string:
-					currentDir = filepath.Base(msg)
-				}
-			case <-finishedCh:
-				fmt.Printf("\r%s\r", cursor.ClearEntireLine())
-				return
-			case <-time.After(time.Millisecond * 100):
-				if currentDir == "" {
-					fmt.Printf("\r%s \033[36mCollecting support bundle\033[m %s", cursor.ClearEntireLine(), s.Next())
-				} else {
-					fmt.Printf("\r%s \033[36mCollecting support bundle\033[m %s %s", cursor.ClearEntireLine(), s.Next(), currentDir)
+	if !interactive {
+		// TODO (dans): custom warning handler to capture warning in `analysisOutput`
+		restConfig.WarningHandler = rest.NoWarnings{}
+
+		// TODO (dans): maybe log to file
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for msg := range progressChan {
+				klog.Infof("Collecting support bundle: %v", msg)
+			}
+		}()
+	} else {
+		s := spin.New()
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			currentDir := ""
+			for {
+				select {
+				case msg, ok := <-progressChan:
+					if !ok {
+						fmt.Printf("\r%s\r", cursor.ClearEntireLine())
+						return
+					}
+					switch msg := msg.(type) {
+					case error:
+						c := color.New(color.FgHiRed)
+						c.Println(fmt.Sprintf("%s\r * %v", cursor.ClearEntireLine(), msg))
+					case string:
+						currentDir = filepath.Base(msg)
+					}
+				case <-time.After(time.Millisecond * 100):
+					if currentDir == "" {
+						fmt.Printf("\r%s \033[36mCollecting support bundle\033[m %s", cursor.ClearEntireLine(), s.Next())
+					} else {
+						fmt.Printf("\r%s \033[36mCollecting support bundle\033[m %s %s", cursor.ClearEntireLine(), s.Next(), currentDir)
+					}
 				}
 			}
-		}
-	}()
-	defer func() {
-		if !isFinishedChClosed {
-			close(finishedCh)
-		}
-	}()
-
-	collectorCB := func(c chan interface{}, msg string) {
-		c <- fmt.Sprintf("%s", msg)
+		}()
 	}
 
 	createOpts := supportbundle.SupportBundleCreateOpts{
@@ -153,81 +207,249 @@ func runTroubleshoot(v *viper.Viper, arg string) error {
 		Namespace:                 v.GetString("namespace"),
 		ProgressChan:              progressChan,
 		SinceTime:                 sinceTime,
+		OutputPath:                v.GetString("output"),
+		Redact:                    v.GetBool("redact"),
+		FromCLI:                   true,
+		RunHostCollectorsInPod:    mainBundle.Spec.RunHostCollectorsInPod,
+
+		// Phase 4: Tokenization options
+		Tokenize:            v.GetBool("tokenize"),
+		RedactionMapPath:    v.GetString("redaction-map"),
+		EncryptRedactionMap: v.GetBool("encrypt-redaction-map"),
+		TokenPrefix:         v.GetString("token-prefix"),
+		VerifyTokenization:  v.GetBool("verify-tokenization"),
+		BundleID:            v.GetString("bundle-id"),
+		TokenizationStats:   v.GetBool("tokenization-stats"),
 	}
 
-	archivePath, err := supportbundle.CollectSupportBundleFromSpec(&supportBundle.Spec, additionalRedactors, createOpts)
+	nonInteractiveOutput := analysisOutput{}
+
+	response, err := supportbundle.CollectSupportBundleFromSpec(&mainBundle.Spec, additionalRedactors, createOpts)
 	if err != nil {
-		return errors.Wrap(err, "run collectors")
+		return errors.Wrap(err, "failed to run collect and analyze process")
 	}
 
-	c := color.New()
-	c.Println(fmt.Sprintf("\r%s\r", cursor.ClearEntireLine()))
-
-	fileUploaded, err := supportbundle.ProcessSupportBundleAfterCollection(&supportBundle.Spec, archivePath)
-	if err != nil {
-		c := color.New(color.FgHiRed)
-		c.Printf("%s\r * %v\n", cursor.ClearEntireLine(), err)
-		// don't die
-	}
-
-	analyzeResults, err := supportbundle.AnalyzeAndExtractSupportBundle(&supportBundle.Spec, archivePath)
-	if err != nil {
-		c := color.New(color.FgHiRed)
-		c.Printf("%s\r * %v\n", cursor.ClearEntireLine(), err)
-		// Don't die
-	} else if len(analyzeResults) > 0 {
-
-		interactive := v.GetBool("interactive") && isatty.IsTerminal(os.Stdout.Fd())
+	close(progressChan) // this removes the spinner in interactive mode
+	isProgressChanClosed = true
 
+	if len(response.AnalyzerResults) > 0 {
 		if interactive {
-			close(finishedCh) // this removes the spinner
-			isFinishedChClosed = true
-
-			if err := showInteractiveResults(supportBundle.Name, analyzeResults); err != nil {
+			if err := showInteractiveResults(mainBundle.Name, response.AnalyzerResults, response.ArchivePath); err != nil {
 				interactive = false
 			}
 		} else {
-			data := convert.FromAnalyzerResult(analyzeResults)
-			formatted, err := json.MarshalIndent(data, "", "    ")
-			if err != nil {
-				c := color.New(color.FgHiRed)
-				c.Printf("%s\r * Failed to format analysis: %v\n", cursor.ClearEntireLine(), err)
-			}
-
-			fmt.Printf("%s", formatted)
+			nonInteractiveOutput.Analysis = response.AnalyzerResults
 		}
 	}
 
-	if !fileUploaded {
-		msg := archivePath
-		if appName := supportBundle.Labels["applicationName"]; appName != "" {
+	if !response.FileUploaded {
+		if appName := mainBundle.Labels["applicationName"]; appName != "" {
 			f := `A support bundle for %s has been created in this directory
 named %s. Please upload it on the Troubleshoot page of
 the %s Admin Console to begin analysis.`
-			msg = fmt.Sprintf(f, appName, archivePath, appName)
+			fmt.Printf(f, appName, response.ArchivePath, appName)
+			return nil
 		}
 
-		fmt.Printf("%s\n", msg)
+		if !interactive {
+			nonInteractiveOutput.ArchivePath = response.ArchivePath
+			output, err := nonInteractiveOutput.FormattedAnalysisOutput()
+			if err != nil {
+				return errors.Wrap(err, "failed to format non-interactive output")
+			}
+			fmt.Println(output)
+			return nil
+		}
 
+		fmt.Printf("\nA support bundle was generated and saved at %s. Please send this file to your software vendor for support.\n", response.ArchivePath)
 		return nil
 	}
 
-	fmt.Printf("\r%s\r", cursor.ClearEntireLine())
-	if fileUploaded {
+	if interactive {
+		fmt.Printf("\r%s\r", cursor.ClearEntireLine())
+	}
+	if response.FileUploaded {
 		fmt.Printf("A support bundle has been created and uploaded to your cluster for analysis. Please visit the Troubleshoot page to continue.\n")
-		fmt.Printf("A copy of this support bundle was written to the current directory, named %q\n", archivePath)
+		fmt.Printf("A copy of this support bundle was written to the current directory, named %q\n", response.ArchivePath)
 	} else {
-		fmt.Printf("A support bundle has been created in the current directory named %q\n", archivePath)
+		fmt.Printf("A support bundle has been created in the current directory named %q\n", response.ArchivePath)
 	}
 	return nil
 }
 
-func getExpectedContentType(uploadURL string) string {
-	parsedURL, err := url.Parse(uploadURL)
-	if err != nil {
-		return ""
+// loadSupportBundleSpecsFromURIs loads support bundle specs from URIs
+func loadSupportBundleSpecsFromURIs(ctx context.Context, kinds *loader.TroubleshootKinds) error {
+	moreKinds := loader.NewTroubleshootKinds()
+
+	// iterate through original kinds and replace any support bundle spec with provided uri spec
+	for _, s := range kinds.SupportBundlesV1Beta2 {
+		if s.Spec.Uri == "" || !util.IsURL(s.Spec.Uri) {
+			moreKinds.SupportBundlesV1Beta2 = append(moreKinds.SupportBundlesV1Beta2, s)
+			continue
+		}
+
+		// We are using LoadSupportBundleSpec function here since it handles prompting
+		// users to accept insecure connections
+		// There is an opportunity to refactor this code in favour of the Loader APIs
+		// TODO: Pass ctx to LoadSupportBundleSpec
+		rawSpec, err := supportbundle.LoadSupportBundleSpec(s.Spec.Uri)
+		if err != nil {
+			// add back original spec
+			moreKinds.SupportBundlesV1Beta2 = append(moreKinds.SupportBundlesV1Beta2, s)
+			// In the event a spec can't be loaded, we'll just skip it and print a warning
+			klog.Warningf("unable to load support bundle from URI: %q: %v", s.Spec.Uri, err)
+			continue
+		}
+		k, err := loader.LoadSpecs(ctx, loader.LoadOptions{RawSpec: string(rawSpec)})
+		if err != nil {
+			// add back original spec
+			moreKinds.SupportBundlesV1Beta2 = append(moreKinds.SupportBundlesV1Beta2, s)
+			klog.Warningf("unable to load spec: %v", err)
+			continue
+		}
+
+		if len(k.SupportBundlesV1Beta2) == 0 {
+			// add back original spec
+			moreKinds.SupportBundlesV1Beta2 = append(moreKinds.SupportBundlesV1Beta2, s)
+			klog.Warningf("no support bundle spec found in URI: %s", s.Spec.Uri)
+			continue
+		}
+
+		// finally append the uri spec
+		moreKinds.SupportBundlesV1Beta2 = append(moreKinds.SupportBundlesV1Beta2, k.SupportBundlesV1Beta2...)
+
 	}
-	return parsedURL.Query().Get("Content-Type")
+
+	kinds.SupportBundlesV1Beta2 = moreKinds.SupportBundlesV1Beta2
+
+	return nil
+}
+
+func loadSpecs(ctx context.Context, args []string, client kubernetes.Interface) (*troubleshootv1beta2.SupportBundle, *troubleshootv1beta2.Redactor, error) {
+	var (
+		kinds     = loader.NewTroubleshootKinds()
+		vp        = viper.GetViper()
+		redactors = vp.GetStringSlice("redactors")
+		allArgs   = append(args, redactors...)
+		err       error
+	)
+
+	kinds, err = specs.LoadFromCLIArgs(ctx, client, allArgs, vp)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "failed to load specs from CLI args")
+	}
+
+	// Load additional specs from support bundle URIs
+	// only when no-uri flag is not set and no URLs are provided in the args
+	if !viper.GetBool("no-uri") {
+		err := loadSupportBundleSpecsFromURIs(ctx, kinds)
+		if err != nil {
+			klog.Warningf("unable to load support bundles from URIs: %v", err)
+		}
+	}
+
+	// Check if we have any collectors to run in the troubleshoot specs
+	// Skip this check if auto-discovery is enabled, as collectors will be added later
+	// Note: RemoteCollectors are still actively used in preflights and host preflights
+	if len(kinds.CollectorsV1Beta2) == 0 &&
+		len(kinds.HostCollectorsV1Beta2) == 0 &&
+		len(kinds.SupportBundlesV1Beta2) == 0 &&
+		!vp.GetBool("auto") {
+		return nil, nil, types.NewExitCodeError(
+			constants.EXIT_CODE_CATCH_ALL,
+			errors.New("no collectors specified to run. Use --debug and/or -v=2 to see more information"),
+		)
+	}
+
+	// Merge specs
+	// We need to add the default type information to the support bundle spec
+	// since by default these fields would be empty
+	mainBundle := &troubleshootv1beta2.SupportBundle{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "troubleshoot.sh/v1beta2",
+			Kind:       "SupportBundle",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "merged-support-bundle-spec",
+		},
+	}
+
+	// If auto-discovery is enabled and no support bundle specs were loaded,
+	// create a minimal default support bundle spec for auto-discovery to work with
+	if vp.GetBool("auto") && len(kinds.SupportBundlesV1Beta2) == 0 {
+		defaultSupportBundle := troubleshootv1beta2.SupportBundle{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "troubleshoot.replicated.com/v1beta2",
+				Kind:       "SupportBundle",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "auto-discovery-default",
+			},
+			Spec: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{}, // Empty collectors - will be populated by auto-discovery
+			},
+		}
+		kinds.SupportBundlesV1Beta2 = append(kinds.SupportBundlesV1Beta2, defaultSupportBundle)
+		klog.V(2).Info("Created default support bundle spec for auto-discovery")
+	}
+
+	var enableRunHostCollectorsInPod bool
+
+	for _, sb := range kinds.SupportBundlesV1Beta2 {
+		sb := sb
+		mainBundle = supportbundle.ConcatSpec(mainBundle, &sb)
+		//check if sb has metadata and if it has RunHostCollectorsInPod set to true
+		if !reflect.DeepEqual(sb.ObjectMeta, metav1.ObjectMeta{}) && sb.Spec.RunHostCollectorsInPod {
+			enableRunHostCollectorsInPod = sb.Spec.RunHostCollectorsInPod
+		}
+	}
+	mainBundle.Spec.RunHostCollectorsInPod = enableRunHostCollectorsInPod
+
+	for _, c := range kinds.CollectorsV1Beta2 {
+		mainBundle.Spec.Collectors = util.Append(mainBundle.Spec.Collectors, c.Spec.Collectors)
+	}
+
+	for _, hc := range kinds.HostCollectorsV1Beta2 {
+		mainBundle.Spec.HostCollectors = util.Append(mainBundle.Spec.HostCollectors, hc.Spec.Collectors)
+	}
+
+	// Don't add default collectors if auto-discovery is enabled, as auto-discovery will add them
+	if !(len(mainBundle.Spec.HostCollectors) > 0 && len(mainBundle.Spec.Collectors) == 0) && !vp.GetBool("auto") {
+		// Always add default collectors unless we only have host collectors or auto-discovery is enabled
+		// We need to add them here so when we --dry-run, these collectors
+		// are included. supportbundle.runCollectors duplicates this bit.
+		// We'll need to refactor it out later when its clearer what other
+		// code depends on this logic e.g KOTS
+		mainBundle.Spec.Collectors = collect.EnsureCollectorInList(
+			mainBundle.Spec.Collectors,
+			troubleshootv1beta2.Collect{ClusterInfo: &troubleshootv1beta2.ClusterInfo{}},
+		)
+		mainBundle.Spec.Collectors = collect.EnsureCollectorInList(
+			mainBundle.Spec.Collectors,
+			troubleshootv1beta2.Collect{ClusterResources: &troubleshootv1beta2.ClusterResources{}},
+		)
+	}
+
+	additionalRedactors := &troubleshootv1beta2.Redactor{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "troubleshoot.replicated.com/v1beta2",
+			Kind:       "Redactor",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "merged-redactors-spec",
+		},
+	}
+	for _, r := range kinds.RedactorsV1Beta2 {
+		additionalRedactors.Spec.Redactors = util.Append(additionalRedactors.Spec.Redactors, r.Spec.Redactors)
+	}
+
+	// dedupe specs
+	mainBundle.Spec.Collectors = util.Dedup(mainBundle.Spec.Collectors)
+	mainBundle.Spec.Analyzers = util.Dedup(mainBundle.Spec.Analyzers)
+	mainBundle.Spec.HostCollectors = util.Dedup(mainBundle.Spec.HostCollectors)
+	mainBundle.Spec.HostAnalyzers = util.Dedup(mainBundle.Spec.HostAnalyzers)
+
+	return mainBundle, additionalRedactors, nil
 }
 
 func parseTimeFlags(v *viper.Viper) (*time.Time, error) {
@@ -255,25 +477,130 @@ func parseTimeFlags(v *viper.Viper) (*time.Time, error) {
 	return &sinceTime, nil
 }
 
-func shouldRetryRequest(err error) bool {
-	if strings.Contains(err.Error(), "x509") && canTryInsecure() {
-		httputil.AddTransport(&http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		})
-		return true
-	}
-	return false
+type analysisOutput struct {
+	Analysis    []*analyzer.AnalyzeResult
+	ArchivePath string
 }
 
-func canTryInsecure() bool {
-	if !isatty.IsTerminal(os.Stdout.Fd()) {
-		return false
-	}
-	prompt := promptui.Prompt{
-		Label:     "Connection appears to be insecure. Would you like to attempt to create a support bundle anyway?",
-		IsConfirm: true,
+func (a *analysisOutput) FormattedAnalysisOutput() (outputJson string, err error) {
+	type convertedOutput struct {
+		ConvertedAnalysis []*convert.Result `json:"analyzerResults"`
+		ArchivePath       string            `json:"archivePath"`
 	}
 
-	_, err := prompt.Run()
-	return err == nil
+	converted := convert.FromAnalyzerResult(a.Analysis)
+
+	o := convertedOutput{
+		ConvertedAnalysis: converted,
+		ArchivePath:       a.ArchivePath,
+	}
+
+	formatted, err := json.MarshalIndent(o, "", "    ")
+	if err != nil {
+		return "", fmt.Errorf("\r * Failed to format analysis: %v\n", err)
+	}
+	return string(formatted), nil
+}
+
+// ValidateTokenizationFlags validates tokenization flag combinations
+func ValidateTokenizationFlags(v *viper.Viper) error {
+	// Verify tokenization mode early (before collection starts)
+	if v.GetBool("verify-tokenization") {
+		if err := VerifyTokenizationSetup(v); err != nil {
+			return errors.Wrap(err, "tokenization verification failed")
+		}
+		fmt.Println("✅ Tokenization verification passed")
+		os.Exit(0) // Exit after verification
+	}
+
+	// Encryption requires redaction map
+	if v.GetBool("encrypt-redaction-map") && v.GetString("redaction-map") == "" {
+		return errors.New("--encrypt-redaction-map requires --redaction-map to be specified")
+	}
+
+	// Redaction map requires tokenization or redaction to be enabled
+	if v.GetString("redaction-map") != "" {
+		if !v.GetBool("tokenize") && !v.GetBool("redact") {
+			return errors.New("--redaction-map requires either --tokenize or --redact to be enabled")
+		}
+	}
+
+	// Custom token prefix requires tokenization
+	if v.GetString("token-prefix") != "" && !v.GetBool("tokenize") {
+		return errors.New("--token-prefix requires --tokenize to be enabled")
+	}
+
+	// Bundle ID requires tokenization
+	if v.GetString("bundle-id") != "" && !v.GetBool("tokenize") {
+		return errors.New("--bundle-id requires --tokenize to be enabled")
+	}
+
+	// Tokenization stats requires tokenization
+	if v.GetBool("tokenization-stats") && !v.GetBool("tokenize") {
+		return errors.New("--tokenization-stats requires --tokenize to be enabled")
+	}
+
+	return nil
+}
+
+// VerifyTokenizationSetup verifies tokenization configuration without collecting data
+func VerifyTokenizationSetup(v *viper.Viper) error {
+	fmt.Println("🔍 Verifying tokenization setup...")
+
+	// Test 1: Environment variable check
+	if v.GetBool("tokenize") {
+		os.Setenv("TROUBLESHOOT_TOKENIZATION", "true")
+		defer os.Unsetenv("TROUBLESHOOT_TOKENIZATION")
+	}
+
+	// Test 2: Tokenizer initialization
+	redact.ResetGlobalTokenizer()
+	tokenizer := redact.GetGlobalTokenizer()
+
+	if v.GetBool("tokenize") && !tokenizer.IsEnabled() {
+		return errors.New("tokenizer is not enabled despite --tokenize flag")
+	}
+
+	if !v.GetBool("tokenize") && tokenizer.IsEnabled() {
+		return errors.New("tokenizer is enabled despite --tokenize flag being false")
+	}
+
+	fmt.Printf("  ✅ Tokenizer state: %v\n", tokenizer.IsEnabled())
+
+	// Test 3: Token generation
+	if tokenizer.IsEnabled() {
+		testToken := tokenizer.TokenizeValue("test-secret", "verification")
+		if !tokenizer.ValidateToken(testToken) {
+			return errors.Errorf("generated test token is invalid: %s", testToken)
+		}
+		fmt.Printf("  ✅ Test token generated: %s\n", testToken)
+	}
+
+	// Test 4: Custom token prefix validation
+	if customPrefix := v.GetString("token-prefix"); customPrefix != "" {
+		if !strings.Contains(customPrefix, "%s") {
+			return errors.Errorf("custom token prefix must contain %%s placeholders: %s", customPrefix)
+		}
+		fmt.Printf("  ✅ Custom token prefix validated: %s\n", customPrefix)
+	}
+
+	// Test 5: Redaction map path validation
+	if mapPath := v.GetString("redaction-map"); mapPath != "" {
+		// Check if directory exists
+		dir := filepath.Dir(mapPath)
+		if _, err := os.Stat(dir); os.IsNotExist(err) {
+			return errors.Errorf("redaction map directory does not exist: %s", dir)
+		}
+		fmt.Printf("  ✅ Redaction map path validated: %s\n", mapPath)
+
+		// Test file creation (and cleanup)
+		testFile := mapPath + ".test"
+		if err := os.WriteFile(testFile, []byte("test"), 0600); err != nil {
+			return errors.Errorf("cannot create redaction map file: %v", err)
+		}
+		os.Remove(testFile)
+		fmt.Printf("  ✅ File creation permissions verified\n")
+	}
+
+	return nil
 }

cmd/troubleshoot/cli/run_test.go

@@ -0,0 +1,438 @@
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/replicatedhq/troubleshoot/internal/testutils"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/httputil"
+	"github.com/replicatedhq/troubleshoot/pkg/loader"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	testclient "k8s.io/client-go/kubernetes/fake"
+)
+
+func templSpec() string {
+	return `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-1
+spec:
+  uri: $MY_URI
+  collectors:
+    - configMap:
+        name: kube-root-ca.crt
+        namespace: default
+`
+}
+
+func Test_loadSupportBundleSpecsFromURIs(t *testing.T) {
+	// Run a webserver to serve the spec
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-2
+spec:
+  collectors:
+    - clusterInfo: {}`))
+	}))
+	defer srv.Close()
+
+	orig := strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL)
+
+	ctx := context.Background()
+	kinds, err := loader.LoadSpecs(ctx, loader.LoadOptions{RawSpec: orig})
+	require.NoError(t, err)
+	require.NotNil(t, kinds)
+
+	assert.Len(t, kinds.SupportBundlesV1Beta2, 1)
+	assert.NotNil(t, kinds.SupportBundlesV1Beta2[0].Spec.Collectors[0].ConfigMap)
+	err = loadSupportBundleSpecsFromURIs(ctx, kinds)
+	require.NoError(t, err)
+
+	require.Len(t, kinds.SupportBundlesV1Beta2, 1)
+	assert.NotNil(t, kinds.SupportBundlesV1Beta2[0].Spec.Collectors[0].ClusterInfo)
+}
+
+func Test_loadMultipleSupportBundleSpecsWithNoURIs(t *testing.T) {
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+	specs := []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-1
+spec:
+  collectors:
+    - clusterInfo:{}`), testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-2
+  spec:
+    collectors:
+      - clusterInfo: {}`)}
+
+	sb, _, err := loadSpecs(ctx, specs, client)
+	require.NoError(t, err)
+	require.Len(t, sb.Spec.Collectors, 2)
+}
+
+func Test_loadMultipleSupportBundleSpecsWithURIs(t *testing.T) {
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+
+	specFile := testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-file
+spec:
+  collectors:
+    - logs:
+        name: podlogs/kotsadm
+        selector:
+          - app=kotsadm
+`)
+
+	// Run a webserver to serve the spec
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-uri
+spec:
+  collectors:
+    - clusterInfo: {}`))
+	}))
+	defer srv.Close()
+
+	orig := strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL)
+	specUri := testutils.ServeFromFilePath(t, orig)
+	specs := []string{specFile, specUri}
+
+	sb, _, err := loadSpecs(ctx, specs, client)
+	require.NoError(t, err)
+	assert.NotNil(t, sb.Spec.Collectors[0].Logs)
+	assert.Nil(t, sb.Spec.Collectors[1].ConfigMap)      // original spec gone
+	assert.NotNil(t, sb.Spec.Collectors[1].ClusterInfo) // new spec from URI
+}
+
+func Test_loadSupportBundleSpecsFromURIs_TimeoutError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(2 * time.Second) // this will cause a timeout
+	}))
+	defer srv.Close()
+	ctx := context.Background()
+
+	kinds, err := loader.LoadSpecs(ctx, loader.LoadOptions{
+		RawSpec: strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL),
+	})
+	require.NoError(t, err)
+
+	// Set the timeout on the http client to 500ms
+	// The server sleeps for 2 seconds, so this should still timeout
+	// supportbundle.LoadSupportBundleSpec does not yet use the context
+	before := httputil.GetHttpClient().Timeout
+	httputil.GetHttpClient().Timeout = 500 * time.Millisecond
+	defer func() {
+		// Reinstate the original timeout. Its a global var so we need to reset it
+		httputil.GetHttpClient().Timeout = before
+	}()
+
+	beforeJSON, err := json.Marshal(kinds)
+	require.NoError(t, err)
+
+	err = loadSupportBundleSpecsFromURIs(ctx, kinds)
+	require.NoError(t, err)
+
+	afterJSON, err := json.Marshal(kinds)
+	require.NoError(t, err)
+
+	assert.JSONEq(t, string(beforeJSON), string(afterJSON))
+}
+
+func Test_loadSupportBundleSpecs(t *testing.T) {
+	tests := []struct {
+		name     string
+		args     []string
+		expected troubleshootv1beta2.SupportBundleSpec
+	}{
+		{
+			name: "empty collectors array in spec, default collectors added",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  collectors: []
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+			},
+		},
+		{
+			name: "no collectors defined in spec, default collectors added",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  analyzers: []
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+				Analyzers: []*troubleshootv1beta2.Analyze{},
+			},
+		},
+		{
+			name: "collectors present but defaults missing, default collectors added",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  collectors:
+  - logs: {}
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						Logs: &troubleshootv1beta2.Logs{},
+					},
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+			},
+		},
+		{
+			name: "empty support bundle spec adds default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+			},
+		},
+		{
+			name: "sb spec with host collectors does not add default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  hostCollectors:
+  - cpu: {}
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				HostCollectors: []*troubleshootv1beta2.HostCollect{
+					{
+						CPU: &troubleshootv1beta2.CPU{},
+					},
+				},
+			},
+		},
+		{
+			name: "host collector spec with collectors does not add default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+spec:
+  collectors:
+  - cpu: {}
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				HostCollectors: []*troubleshootv1beta2.HostCollect{
+					{
+						CPU: &troubleshootv1beta2.CPU{},
+					},
+				},
+			},
+		},
+		{
+			name: "sb spec with host and in-cluster collectors adds default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  hostCollectors:
+  - cpu: {}
+  collectors:
+  - logs: {}
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				HostCollectors: []*troubleshootv1beta2.HostCollect{
+					{
+						CPU: &troubleshootv1beta2.CPU{},
+					},
+				},
+				Collectors: []*troubleshootv1beta2.Collect{
+					{
+						Logs: &troubleshootv1beta2.Logs{},
+					},
+					{
+						ClusterInfo: &troubleshootv1beta2.ClusterInfo{},
+					},
+					{
+						ClusterResources: &troubleshootv1beta2.ClusterResources{},
+					},
+				},
+			},
+		},
+		{
+			name: "sb spec with host collectors and empty in-cluster collectors does not default collectors",
+			args: []string{testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+spec:
+  hostCollectors:
+  - cpu: {}
+  collectors: []
+`)},
+			expected: troubleshootv1beta2.SupportBundleSpec{
+				HostCollectors: []*troubleshootv1beta2.HostCollect{
+					{
+						CPU: &troubleshootv1beta2.CPU{},
+					},
+				},
+				Collectors: []*troubleshootv1beta2.Collect{},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx := context.Background()
+			client := testclient.NewSimpleClientset()
+
+			sb, _, err := loadSpecs(ctx, test.args, client)
+			require.NoError(t, err)
+
+			assert.Equal(t, test.expected, sb.Spec)
+		})
+	}
+}
+
+func Test_loadDuplicatedBundleSpecs(t *testing.T) {
+	spec := testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb
+spec:
+  collectors:
+  - helm: {}
+  analyzers:
+  - clusterVersion: {}
+  hostCollectors:
+  - cpu: {}
+  hostAnalyzers:
+  - cpu: {}
+`)
+	args := []string{spec, spec}
+
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+	sb, _, err := loadSpecs(ctx, args, client)
+	require.NoError(t, err)
+	assert.Len(t, sb.Spec.Collectors, 1+2) // default clusterInfo + clusterResources
+	assert.Len(t, sb.Spec.Analyzers, 1)
+	assert.Len(t, sb.Spec.HostCollectors, 1)
+	assert.Len(t, sb.Spec.HostAnalyzers, 1)
+}
+
+func Test_loadSpecsFromURL(t *testing.T) {
+	// Run a webserver to serve the URI spec
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb-2
+spec:
+  collectors:
+    - logs:
+        name: podlogs/kotsadm
+        selector:
+          - app=kotsadm`))
+	}))
+	defer srv.Close()
+
+	// update URI spec with the server URL
+	orig := strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL)
+
+	// now create a webserver to serve the spec with URI
+	srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(orig))
+	}))
+	defer srv.Close()
+
+	fileSpec := testutils.ServeFromFilePath(t, `
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: sb
+spec:
+  collectors:
+    - helm: {}`)
+
+	// test and ensure that URI spec is not loaded
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+	sb, _, err := loadSpecs(ctx, []string{fileSpec, srv.URL}, client)
+	require.NoError(t, err)
+	assert.Len(t, sb.Spec.Collectors, 2+2)            // default + clusterInfo + clusterResources
+	assert.NotNil(t, sb.Spec.Collectors[0].Helm)      // come from the file spec
+	assert.NotNil(t, sb.Spec.Collectors[1].ConfigMap) // come from the original spec
+	assert.Nil(t, sb.Spec.Collectors[1].Logs)         // come from the URI spec
+}
+
+func Test_loadInvalidURISpec(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`invalid spec`))
+	}))
+	defer srv.Close()
+
+	// update URI spec with the server URL
+	orig := strings.ReplaceAll(templSpec(), "$MY_URI", srv.URL)
+	specFile := testutils.ServeFromFilePath(t, orig)
+
+	ctx := context.Background()
+	client := testclient.NewSimpleClientset()
+	sb, _, err := loadSpecs(ctx, []string{specFile}, client)
+	require.NoError(t, err)
+	assert.Len(t, sb.Spec.Collectors, 3)              // default + clusterInfo + clusterResources
+	assert.NotNil(t, sb.Spec.Collectors[0].ConfigMap) // come from the original spec
+}

cmd/troubleshoot/cli/schedule.go

@@ -0,0 +1,11 @@
+package cli
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/schedule"
+	"github.com/spf13/cobra"
+)
+
+// Schedule returns the schedule command for managing scheduled support bundle jobs
+func Schedule() *cobra.Command {
+	return schedule.CLI()
+}

cmd/troubleshoot/cli/upload.go

@@ -0,0 +1,56 @@
+package cli
+
+import (
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func UploadCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "upload [bundle-file]",
+		Args:  cobra.ExactArgs(1),
+		Short: "Upload a support bundle to replicated.app",
+		Long: `Upload a support bundle to replicated.app for analysis and troubleshooting.
+
+This command automatically extracts the license ID and app slug from the bundle if not provided.
+
+Examples:
+  # Auto-detect license and app from bundle
+  support-bundle upload bundle.tar.gz
+
+  # Specify license ID explicitly
+  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID
+
+  # Specify both license and app
+  support-bundle upload bundle.tar.gz --license-id YOUR_LICENSE_ID --app-slug my-app`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+			bundlePath := args[0]
+
+			// Check if bundle file exists
+			if _, err := os.Stat(bundlePath); os.IsNotExist(err) {
+				return errors.Errorf("bundle file does not exist: %s", bundlePath)
+			}
+
+			// Get upload parameters
+			licenseID := v.GetString("license-id")
+			appSlug := v.GetString("app-slug")
+
+			// Use auto-detection for uploads
+			if err := supportbundle.UploadBundleAutoDetect(bundlePath, licenseID, appSlug); err != nil {
+				return errors.Wrap(err, "upload failed")
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Flags().String("license-id", "", "license ID for authentication (auto-detected from bundle if not provided)")
+	cmd.Flags().String("app-slug", "", "application slug (auto-detected from bundle if not provided)")
+
+	return cmd
+}

cmd/troubleshoot/cli/util.go

@@ -1,24 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/pkg/errors"
-)
-
-func findFileName(basename, extension string) (string, error) {
-	n := 1
-	name := basename
-	for {
-		filename := name + "." + extension
-		if _, err := os.Stat(filename); os.IsNotExist(err) {
-			return filename, nil
-		} else if err != nil {
-			return "", errors.Wrap(err, "check file exists")
-		}
-
-		name = fmt.Sprintf("%s (%d)", basename, n)
-		n = n + 1
-	}
-}

cmd/troubleshoot/cli/version.go

@@ -1,51 +0,0 @@
-package cli
-
-import (
-	"fmt"
-
-	"io/ioutil"
-	"path/filepath"
-
-	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
-	"github.com/replicatedhq/troubleshoot/pkg/version"
-	"github.com/spf13/cobra"
-	"gopkg.in/yaml.v2"
-)
-
-func VersionCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "version",
-		Short: "Print the current version and exit",
-		Long:  `Print the current version and exit`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			fmt.Printf("Replicated Troubleshoot %s\n", version.Version())
-
-			return nil
-		},
-	}
-	return cmd
-}
-
-const VersionFilename = "version.yaml"
-
-func writeVersionFile(path string) error {
-	version := troubleshootv1beta2.SupportBundleVersion{
-		ApiVersion: "troubleshoot.sh/v1beta2",
-		Kind:       "SupportBundle",
-		Spec: troubleshootv1beta2.SupportBundleVersionSpec{
-			VersionNumber: version.Version(),
-		},
-	}
-	b, err := yaml.Marshal(version)
-	if err != nil {
-		return err
-	}
-
-	filename := filepath.Join(path, VersionFilename)
-	err = ioutil.WriteFile(filename, b, 0644)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/util/util.go

@@ -1,39 +0,0 @@
-package util
-
-import (
-	"net/url"
-	"os"
-	"strings"
-)
-
-func HomeDir() string {
-	if h := os.Getenv("HOME"); h != "" {
-		return h
-	}
-	return os.Getenv("USERPROFILE") // windows
-}
-
-func IsURL(str string) bool {
-	parsed, err := url.ParseRequestURI(str)
-	if err != nil {
-		return false
-	}
-
-	return parsed.Scheme != ""
-}
-
-func AppName(name string) string {
-	words := strings.Split(strings.Title(strings.Replace(name, "-", " ", -1)), " ")
-	casedWords := []string{}
-	for i, word := range words {
-		if strings.ToLower(word) == "ai" {
-			casedWords = append(casedWords, "AI")
-		} else if strings.ToLower(word) == "io" && i > 0 {
-			casedWords[i-1] += ".io"
-		} else {
-			casedWords = append(casedWords, word)
-		}
-	}
-
-	return strings.Join(casedWords, " ")
-}

config/crds/troubleshoot.replicated.com_collectors.yaml

@@ -1,11 +1,9 @@
-
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.3.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: collectors.troubleshoot.replicated.com
 spec:
   group: troubleshoot.replicated.com
@@ -15,332 +13,343 @@ spec:
     plural: collectors
     singular: collector
   scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      description: Collector is the Schema for the collectors API
-      properties:
-        apiVersion:
-          description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-          type: string
-        kind:
-          description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-          type: string
-        metadata:
-          type: object
-        spec:
-          description: CollectorSpec defines the desired state of Collector
-          properties:
-            afterCollection:
-              items:
-                properties:
-                  callback:
-                    properties:
-                      method:
-                        type: string
-                      redactUri:
-                        type: string
-                      uri:
-                        type: string
-                    required:
-                    - method
-                    - redactUri
-                    - uri
-                    type: object
-                  uploadResultsTo:
-                    properties:
-                      method:
-                        type: string
-                      redactUri:
-                        type: string
-                      uri:
-                        type: string
-                    required:
-                    - method
-                    - redactUri
-                    - uri
-                    type: object
-                type: object
-              type: array
-            collectors:
-              items:
-                properties:
-                  clusterInfo:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                    type: object
-                  clusterResources:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                    type: object
-                  copy:
-                    properties:
-                      collectorName:
-                        type: string
-                      containerName:
-                        type: string
-                      containerPath:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                      selector:
-                        items:
-                          type: string
-                        type: array
-                    required:
-                    - containerPath
-                    - namespace
-                    - selector
-                    type: object
-                  data:
-                    properties:
-                      collectorName:
-                        type: string
-                      data:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      name:
-                        type: string
-                    required:
-                    - data
-                    type: object
-                  exec:
-                    properties:
-                      args:
-                        items:
-                          type: string
-                        type: array
-                      collectorName:
-                        type: string
-                      command:
-                        items:
-                          type: string
-                        type: array
-                      containerName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                      selector:
-                        items:
-                          type: string
-                        type: array
-                      timeout:
-                        type: string
-                    required:
-                    - namespace
-                    - selector
-                    type: object
-                  http:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      get:
-                        properties:
-                          headers:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          insecureSkipVerify:
-                            type: boolean
-                          url:
-                            type: string
-                        required:
-                        - url
-                        type: object
-                      name:
-                        type: string
-                      post:
-                        properties:
-                          body:
-                            type: string
-                          headers:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          insecureSkipVerify:
-                            type: boolean
-                          url:
-                            type: string
-                        required:
-                        - url
-                        type: object
-                      put:
-                        properties:
-                          body:
-                            type: string
-                          headers:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          insecureSkipVerify:
-                            type: boolean
-                          url:
-                            type: string
-                        required:
-                        - url
-                        type: object
-                    type: object
-                  logs:
-                    properties:
-                      collectorName:
-                        type: string
-                      containerNames:
-                        items:
-                          type: string
-                        type: array
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      limits:
-                        properties:
-                          maxAge:
-                            type: string
-                          maxLines:
-                            format: int64
-                            type: integer
-                        type: object
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                      selector:
-                        items:
-                          type: string
-                        type: array
-                    required:
-                    - selector
-                    type: object
-                  mysql:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      uri:
-                        type: string
-                    required:
-                    - uri
-                    type: object
-                  postgres:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      uri:
-                        type: string
-                    required:
-                    - uri
-                    type: object
-                  redis:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      uri:
-                        type: string
-                    required:
-                    - uri
-                    type: object
-                  run:
-                    properties:
-                      args:
-                        items:
-                          type: string
-                        type: array
-                      collectorName:
-                        type: string
-                      command:
-                        items:
-                          type: string
-                        type: array
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      image:
-                        type: string
-                      imagePullPolicy:
-                        type: string
-                      imagePullSecret:
-                        properties:
-                          data:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          name:
-                            type: string
-                          type:
-                            type: string
-                        type: object
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                      timeout:
-                        type: string
-                    required:
-                    - image
-                    - namespace
-                    type: object
-                  secret:
-                    properties:
-                      collectorName:
-                        type: string
-                      exclude:
-                        description: BoolOrString is a type that can hold an bool or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a booolean string or raw bool.
-                        type: BoolString
-                      includeValue:
-                        type: boolean
-                      key:
-                        type: string
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
-              type: array
-          type: object
-        status:
-          description: CollectorStatus defines the observed state of Collector
-          type: object
-      type: object
-  version: v1beta1
   versions:
   - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Collector is the Schema for the collectors API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: CollectorSpec defines the desired state of Collector
+            properties:
+              afterCollection:
+                items:
+                  properties:
+                    callback:
+                      properties:
+                        method:
+                          type: string
+                        redactUri:
+                          type: string
+                        uri:
+                          type: string
+                      required:
+                      - method
+                      - redactUri
+                      - uri
+                      type: object
+                    uploadResultsTo:
+                      properties:
+                        method:
+                          type: string
+                        redactUri:
+                          type: string
+                        uri:
+                          type: string
+                      required:
+                      - method
+                      - redactUri
+                      - uri
+                      type: object
+                  type: object
+                type: array
+              collectors:
+                items:
+                  properties:
+                    clusterInfo:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    clusterResources:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    copy:
+                      properties:
+                        collectorName:
+                          type: string
+                        containerName:
+                          type: string
+                        containerPath:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                        selector:
+                          items:
+                            type: string
+                          type: array
+                      required:
+                      - containerPath
+                      - namespace
+                      - selector
+                      type: object
+                    data:
+                      properties:
+                        collectorName:
+                          type: string
+                        data:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        name:
+                          type: string
+                      required:
+                      - data
+                      type: object
+                    exec:
+                      properties:
+                        args:
+                          items:
+                            type: string
+                          type: array
+                        collectorName:
+                          type: string
+                        command:
+                          items:
+                            type: string
+                          type: array
+                        containerName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                        selector:
+                          items:
+                            type: string
+                          type: array
+                        timeout:
+                          type: string
+                      required:
+                      - namespace
+                      - selector
+                      type: object
+                    http:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        get:
+                          properties:
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            timeout:
+                              description: |-
+                                A Duration represents the elapsed time between two instants
+                                as an int64 nanosecond count. The representation limits the
+                                largest representable duration to approximately 290 years.
+                              format: int64
+                              type: integer
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        name:
+                          type: string
+                        post:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            timeout:
+                              description: |-
+                                A Duration represents the elapsed time between two instants
+                                as an int64 nanosecond count. The representation limits the
+                                largest representable duration to approximately 290 years.
+                              format: int64
+                              type: integer
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        put:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            timeout:
+                              description: |-
+                                A Duration represents the elapsed time between two instants
+                                as an int64 nanosecond count. The representation limits the
+                                largest representable duration to approximately 290 years.
+                              format: int64
+                              type: integer
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                      type: object
+                    logs:
+                      properties:
+                        collectorName:
+                          type: string
+                        containerNames:
+                          items:
+                            type: string
+                          type: array
+                        exclude:
+                          type: BoolString
+                        limits:
+                          properties:
+                            maxAge:
+                              type: string
+                            maxLines:
+                              format: int64
+                              type: integer
+                          type: object
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                        selector:
+                          items:
+                            type: string
+                          type: array
+                      required:
+                      - selector
+                      type: object
+                    mysql:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        uri:
+                          type: string
+                      required:
+                      - uri
+                      type: object
+                    postgres:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        uri:
+                          type: string
+                      required:
+                      - uri
+                      type: object
+                    redis:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        uri:
+                          type: string
+                      required:
+                      - uri
+                      type: object
+                    run:
+                      properties:
+                        args:
+                          items:
+                            type: string
+                          type: array
+                        collectorName:
+                          type: string
+                        command:
+                          items:
+                            type: string
+                          type: array
+                        exclude:
+                          type: BoolString
+                        image:
+                          type: string
+                        imagePullPolicy:
+                          type: string
+                        imagePullSecret:
+                          properties:
+                            data:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            name:
+                              type: string
+                            type:
+                              type: string
+                          type: object
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                        timeout:
+                          type: string
+                      required:
+                      - image
+                      - namespace
+                      type: object
+                    secret:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        includeValue:
+                          type: boolean
+                        key:
+                          type: string
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                  type: object
+                type: array
+            type: object
+          status:
+            description: CollectorStatus defines the observed state of Collector
+            type: object
+        type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crds/troubleshoot.replicated.com_redactors.yaml

@@ -1,11 +1,9 @@
-
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.3.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: redactors.troubleshoot.replicated.com
 spec:
   group: troubleshoot.replicated.com
@@ -15,70 +13,72 @@ spec:
     plural: redactors
     singular: redactor
   scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      description: Redactor is the Schema for the redaction API
-      properties:
-        apiVersion:
-          description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-          type: string
-        kind:
-          description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-          type: string
-        metadata:
-          type: object
-        spec:
-          description: RedactorSpec defines the desired state of Redactor
-          properties:
-            redactors:
-              items:
-                properties:
-                  fileSelector:
-                    properties:
-                      file:
-                        type: string
-                      files:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                  name:
-                    type: string
-                  removals:
-                    properties:
-                      regex:
-                        items:
-                          properties:
-                            redactor:
-                              type: string
-                            selector:
-                              type: string
-                          type: object
-                        type: array
-                      values:
-                        items:
-                          type: string
-                        type: array
-                      yamlPath:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                type: object
-              type: array
-          type: object
-        status:
-          description: RedactorStatus defines the observed state of Redactor
-          type: object
-      type: object
-  version: v1beta1
   versions:
   - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Redactor is the Schema for the redaction API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RedactorSpec defines the desired state of Redactor
+            properties:
+              redactors:
+                items:
+                  properties:
+                    fileSelector:
+                      properties:
+                        file:
+                          type: string
+                        files:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    name:
+                      type: string
+                    removals:
+                      properties:
+                        regex:
+                          items:
+                            properties:
+                              redactor:
+                                type: string
+                              selector:
+                                type: string
+                            type: object
+                          type: array
+                        values:
+                          items:
+                            type: string
+                          type: array
+                        yamlPath:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                  type: object
+                type: array
+            type: object
+          status:
+            description: RedactorStatus defines the observed state of Redactor
+            type: object
+        type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crds/troubleshoot.sh_redactors.yaml

@@ -1,11 +1,9 @@
-
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.3.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: redactors.troubleshoot.sh
 spec:
   group: troubleshoot.sh
@@ -15,70 +13,74 @@ spec:
     plural: redactors
     singular: redactor
   scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      description: Redactor is the Schema for the redaction API
-      properties:
-        apiVersion:
-          description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-          type: string
-        kind:
-          description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-          type: string
-        metadata:
-          type: object
-        spec:
-          description: RedactorSpec defines the desired state of Redactor
-          properties:
-            redactors:
-              items:
-                properties:
-                  fileSelector:
-                    properties:
-                      file:
-                        type: string
-                      files:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                  name:
-                    type: string
-                  removals:
-                    properties:
-                      regex:
-                        items:
-                          properties:
-                            redactor:
-                              type: string
-                            selector:
-                              type: string
-                          type: object
-                        type: array
-                      values:
-                        items:
-                          type: string
-                        type: array
-                      yamlPath:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                type: object
-              type: array
-          type: object
-        status:
-          description: RedactorStatus defines the observed state of Redactor
-          type: object
-      type: object
-  version: v1beta2
   versions:
   - name: v1beta2
+    schema:
+      openAPIV3Schema:
+        description: Redactor is the Schema for the redaction API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RedactorSpec defines the desired state of Redactor
+            properties:
+              redactors:
+                items:
+                  properties:
+                    fileSelector:
+                      properties:
+                        file:
+                          type: string
+                        files:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    name:
+                      type: string
+                    removals:
+                      properties:
+                        regex:
+                          items:
+                            properties:
+                              redactor:
+                                type: string
+                              selector:
+                                type: string
+                            type: object
+                          type: array
+                        values:
+                          items:
+                            type: string
+                          type: array
+                        yamlPath:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                  type: object
+                type: array
+              uri:
+                type: string
+            type: object
+          status:
+            description: RedactorStatus defines the observed state of Redactor
+            type: object
+        type: object
     served: true
     storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crds/troubleshoot.sh_remotecollectors.yaml

@@ -0,0 +1,481 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.19.0
+  name: remotecollectors.troubleshoot.sh
+spec:
+  group: troubleshoot.sh
+  names:
+    kind: RemoteCollector
+    listKind: RemoteCollectorList
+    plural: remotecollectors
+    singular: remotecollector
+  scope: Namespaced
+  versions:
+  - name: v1beta2
+    schema:
+      openAPIV3Schema:
+        description: RemoteCollector is the Schema for the remote collectors API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RemoteCollectorSpec defines the desired state of the RemoteCollector
+            properties:
+              afterCollection:
+                items:
+                  properties:
+                    callback:
+                      properties:
+                        method:
+                          type: string
+                        redactUri:
+                          type: string
+                        uri:
+                          type: string
+                      required:
+                      - method
+                      - redactUri
+                      - uri
+                      type: object
+                    uploadResultsTo:
+                      properties:
+                        method:
+                          type: string
+                        redactUri:
+                          type: string
+                        uri:
+                          type: string
+                      required:
+                      - method
+                      - redactUri
+                      - uri
+                      type: object
+                  type: object
+                type: array
+              collectors:
+                items:
+                  properties:
+                    blockDevices:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    certificate:
+                      properties:
+                        certificatePath:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        keyPath:
+                          type: string
+                      required:
+                      - certificatePath
+                      - keyPath
+                      type: object
+                    cpu:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    diskUsage:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        path:
+                          type: string
+                      required:
+                      - path
+                      type: object
+                    filesystemPerformance:
+                      description: |-
+                        RemoteFilesystemPerformance benchmarks sequential write latency on a single file.
+                        The optional background IOPS feature attempts to mimic real-world conditions by running read and
+                        write workloads prior to and during benchmark execution.
+                      properties:
+                        backgroundIOPSWarmupSeconds:
+                          description: How long to run the background IOPS read and
+                            write workloads prior to starting the benchmarks.
+                          type: integer
+                        backgroundReadIOPS:
+                          description: |-
+                            The target read IOPS to run while benchmarking. This is a limit and there is no guarantee
+                            it will be reached. This is the total IOPS for all background read jobs.
+                          type: integer
+                        backgroundReadIOPSJobs:
+                          description: |-
+                            Number of threads to use for background read IOPS. This should be set high enough to reach
+                            the target specified in BackgrounReadIOPS.
+                          type: integer
+                        backgroundWriteIOPS:
+                          description: |-
+                            The target write IOPS to run while benchmarking. This is a limit and there is no guarantee
+                            it will be reached. This is the total IOPS for all background write jobs.
+                          type: integer
+                        backgroundWriteIOPSJobs:
+                          description: |-
+                            Number of threads to use for background write IOPS. This should be set high enough to reach
+                            the target specified in BackgroundWriteIOPS.
+                            Example: If BackgroundWriteIOPS is 100 and write latency is 10ms then a single job would
+                            barely be able to reach 100 IOPS so this should be at least 2.
+                          type: integer
+                        collectorName:
+                          type: string
+                        datasync:
+                          description: |-
+                            Whether to call datasync on the file after each write. Skipped if Sync is also true. Does not
+                            apply to background IOPS task.
+                          type: boolean
+                        directory:
+                          description: The directory where the benchmark will create
+                            files.
+                          type: string
+                        enableBackgroundIOPS:
+                          description: Enable the background IOPS feature.
+                          type: boolean
+                        exclude:
+                          type: BoolString
+                        fileSize:
+                          description: |-
+                            The size of the file used in the benchmark. The number of IO operations for the benchmark
+                            will be FileSize / OperationSizeBytes. Accepts valid Kubernetes resource units such as Mi.
+                          type: string
+                        operationSize:
+                          description: |-
+                            The size of each write operation performed while benchmarking. This does not apply to the
+                            background IOPS feature if enabled, since those must be fixed at 4096.
+                          format: int64
+                          type: integer
+                        runTime:
+                          description: |-
+                            Limit runtime. The test will run until it completes the configured I/O workload or until it
+                            has run for this specified amount of time, whichever occurs first. When the unit is omitted,
+                            the value is interpreted in seconds. Defaults to 120 seconds. Set to "0" to disable.
+                          type: string
+                        sync:
+                          description: Whether to call sync on the file after each
+                            write. Does not apply to background IOPS task.
+                          type: boolean
+                        timeout:
+                          description: Total timeout, including background IOPS setup
+                            and warmup if enabled.
+                          type: string
+                      required:
+                      - backgroundIOPSWarmupSeconds
+                      - backgroundReadIOPS
+                      - backgroundReadIOPSJobs
+                      - backgroundWriteIOPS
+                      - backgroundWriteIOPSJobs
+                      - enableBackgroundIOPS
+                      type: object
+                    hostOS:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    hostServices:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    http:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        get:
+                          properties:
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            proxy:
+                              type: string
+                            timeout:
+                              description: |-
+                                Timeout is the time to wait for a server's response. Its a duration e.g 15s, 2h30m.
+                                Missing value or empty string or means no timeout.
+                              type: string
+                            tls:
+                              properties:
+                                cacert:
+                                  type: string
+                                clientCert:
+                                  type: string
+                                clientKey:
+                                  type: string
+                                secret:
+                                  properties:
+                                    name:
+                                      type: string
+                                    namespace:
+                                      type: string
+                                  required:
+                                  - name
+                                  - namespace
+                                  type: object
+                                skipVerify:
+                                  type: boolean
+                              type: object
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        post:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            proxy:
+                              type: string
+                            timeout:
+                              description: |-
+                                Timeout is the time to wait for a server's response. Its a duration e.g 15s, 2h30m.
+                                Missing value or empty string or means no timeout.
+                              type: string
+                            tls:
+                              properties:
+                                cacert:
+                                  type: string
+                                clientCert:
+                                  type: string
+                                clientKey:
+                                  type: string
+                                secret:
+                                  properties:
+                                    name:
+                                      type: string
+                                    namespace:
+                                      type: string
+                                  required:
+                                  - name
+                                  - namespace
+                                  type: object
+                                skipVerify:
+                                  type: boolean
+                              type: object
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        put:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            proxy:
+                              type: string
+                            timeout:
+                              description: |-
+                                Timeout is the time to wait for a server's response. Its a duration e.g 15s, 2h30m.
+                                Missing value or empty string or means no timeout.
+                              type: string
+                            tls:
+                              properties:
+                                cacert:
+                                  type: string
+                                clientCert:
+                                  type: string
+                                clientKey:
+                                  type: string
+                                secret:
+                                  properties:
+                                    name:
+                                      type: string
+                                    namespace:
+                                      type: string
+                                  required:
+                                  - name
+                                  - namespace
+                                  type: object
+                                skipVerify:
+                                  type: boolean
+                              type: object
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                      type: object
+                    httpLoadBalancer:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        path:
+                          type: string
+                        port:
+                          type: integer
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      - path
+                      - port
+                      type: object
+                    ipv4Interfaces:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    kernelModules:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    memory:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    subnetAvailable:
+                      properties:
+                        CIDRRangeAlloc:
+                          type: string
+                        collectorName:
+                          type: string
+                        desiredCIDR:
+                          type: integer
+                        exclude:
+                          type: BoolString
+                      required:
+                      - CIDRRangeAlloc
+                      - desiredCIDR
+                      type: object
+                    systemPackages:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    tcpConnect:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      type: object
+                    tcpLoadBalancer:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        port:
+                          type: integer
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      - port
+                      type: object
+                    tcpPortStatus:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        interface:
+                          type: string
+                        port:
+                          type: integer
+                      required:
+                      - port
+                      type: object
+                    time:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    udpPortStatus:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        interface:
+                          type: string
+                        port:
+                          type: integer
+                      required:
+                      - port
+                      type: object
+                  type: object
+                type: array
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                type: object
+              uri:
+                type: string
+            type: object
+          status:
+            description: CollectorStatus defines the observed state of Collector
+            type: object
+        type: object
+    served: true
+    storage: true

config/samples/troubleshoot_v1beta2_collector.yaml

@@ -3,6 +3,7 @@ kind: Collector
 metadata:
   name: collector-sample
 spec:
+  uri: https://raw.githubusercontent.com/replicatedhq/troubleshoot-specs/main/in-cluster/default.yaml
   collectors:
     - clusterInfo: {}
     - clusterResources: {}
@@ -15,7 +16,7 @@ spec:
     #       - name=nginx-ingress-microk8s
     #     namespace: default
     #     limits:
-    #       maxAge: 30d
+    #       maxAge: 720h # 30*24
     #       maxLines: 10000
     # - run:
     #     collectorName: ping-google

deploy/.goreleaser.yaml

@@ -1,54 +1,64 @@
+version: 2
 project_name: troubleshoot
+
 release:
-  github:
-    owner: replicatedhq
-    name: troubleshoot
+  prerelease: auto
+
 builds:
   - id: preflight
-    goos:
-      - linux
-      - darwin
-      - windows
-    goarch:
-      - amd64
-    env:
-      - CGO_ENABLED=0
-    main: cmd/preflight/main.go
-    ldflags: -s -w
-      -X github.com/replicatedhq/troubleshoot/pkg/version.version={{.Version}}
-      -X github.com/replicatedhq/troubleshoot/pkg/version.gitSHA={{.Commit}}
-      -X github.com/replicatedhq/troubleshoot/pkg/version.buildTime={{.Date}}
-      -extldflags "-static"
-    flags: -tags netgo -tags containers_image_ostree_stub -tags exclude_graphdriver_devicemapper -tags exclude_graphdriver_btrfs -tags containers_image_openpgp -installsuffix netgo
+    main: ./cmd/preflight/main.go
+    env: [CGO_ENABLED=0]
+    goos: [linux, darwin]
+    goarch: [amd64, arm, arm64]
+    ignore:
+      - goos: windows
+        goarch: arm
+    ldflags:
+      - -s -w
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.version={{ .Version }}
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.gitSHA={{ .Commit }}
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.buildTime={{ .Date }}
+      - -extldflags "-static"
+    flags:
+      - -tags=netgo
+      - -tags=containers_image_ostree_stub
+      - -tags=exclude_graphdriver_devicemapper
+      - -tags=exclude_graphdriver_btrfs
+      - -tags=containers_image_openpgp
+      - -installsuffix=netgo
     binary: preflight
-    hooks: {}
+
   - id: support-bundle
-    goos:
-      - linux
-      - darwin
-      - windows
-    goarch:
-      - amd64
-    env:
-      - CGO_ENABLED=0
-    main: cmd/troubleshoot/main.go
-    ldflags: -s -w
-      -X github.com/replicatedhq/troubleshoot/pkg/version.version={{.Version}}
-      -X github.com/replicatedhq/troubleshoot/pkg/version.gitSHA={{.Commit}}
-      -X github.com/replicatedhq/troubleshoot/pkg/version.buildTime={{.Date}}
-      -extldflags "-static"
-    flags: -tags netgo -tags containers_image_ostree_stub -tags exclude_graphdriver_devicemapper -tags exclude_graphdriver_btrfs -tags containers_image_openpgp -installsuffix netgo
+    main: ./cmd/troubleshoot/main.go
+    env: [CGO_ENABLED=0]
+    goos: [linux, darwin]
+    goarch: [amd64, arm, arm64]
+    ignore:
+      - goos: windows
+        goarch: arm
+    ldflags:
+      - -s -w
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.version={{ .Version }}
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.gitSHA={{ .Commit }}
+      - -X github.com/replicatedhq/troubleshoot/pkg/version.buildTime={{ .Date }}
+      - -extldflags "-static"
+    flags:
+      - -tags=netgo
+      - -tags=containers_image_ostree_stub
+      - -tags=exclude_graphdriver_devicemapper
+      - -tags=exclude_graphdriver_btrfs
+      - -tags=containers_image_openpgp
+      - -installsuffix=netgo
     binary: support-bundle
-    hooks: {}
+
 archives:
   - id: preflight
-    builds:
-      - preflight
-    format: tar.gz
+    ids: [preflight]
+    formats: [tar.gz]
     format_overrides:
       - goos: windows
-        format: zip
-    name_template: 'preflight_{{ .Os }}_{{ .Arch }}'
+        formats: [zip]
+    name_template: "preflight_{{ .Os }}_{{ .Arch }}"
     files:
       - licence*
       - LICENCE*
@@ -58,14 +68,16 @@ archives:
       - README*
       - changelog*
       - CHANGELOG*
+      - src: "sbom/assets/*"
+        dst: .
+        strip_parent: true
   - id: support-bundle
-    builds:
-      - support-bundle
-    format: tar.gz
+    ids: [support-bundle]
+    formats: [tar.gz]
     format_overrides:
       - goos: windows
-        format: zip
-    name_template: 'support-bundle_{{ .Os }}_{{ .Arch }}'
+        formats: [zip]
+    name_template: "support-bundle_{{ .Os }}_{{ .Arch }}"
     files:
       - licence*
       - LICENCE*
@@ -75,6 +87,44 @@ archives:
       - README*
       - changelog*
       - CHANGELOG*
+      - src: "sbom/assets/*"
+        dst: .
+        strip_parent: true
+
+  - id: preflight-universal
+    ids: [preflight-universal]
+    formats: [tar.gz]
+    name_template: "preflight_{{ .Os }}_{{ .Arch }}"
+    files:
+      - licence*
+      - LICENCE*
+      - license*
+      - LICENSE*
+      - readme*
+      - README*
+      - changelog*
+      - CHANGELOG*
+      - src: "sbom/assets/*"
+        dst: .
+        strip_parent: true
+
+  - id: support-bundle-universal
+    ids: [support-bundle-universal]
+    formats: [tar.gz]
+    name_template: "support-bundle_{{ .Os }}_{{ .Arch }}"
+    files:
+      - licence*
+      - LICENCE*
+      - license*
+      - LICENSE*
+      - readme*
+      - README*
+      - changelog*
+      - CHANGELOG*
+      - src: "sbom/assets/*"
+        dst: .
+        strip_parent: true
+
 dockers:
   - dockerfile: ./deploy/Dockerfile.troubleshoot
     image_templates:
@@ -85,6 +135,7 @@ dockers:
     ids:
       - support-bundle
       - preflight
+    skip_push: true
   - dockerfile: ./deploy/Dockerfile.troubleshoot
     image_templates:
       - "replicated/preflight:latest"
@@ -94,3 +145,37 @@ dockers:
     ids:
       - support-bundle
       - preflight
+    skip_push: true
+
+universal_binaries:
+  - id: preflight-universal
+    ids: [preflight]        # refers to the build id above
+    replace: true
+    name_template: preflight
+
+  - id: support-bundle-universal
+    ids: [support-bundle]   # refers to the build id above
+    replace: true
+    name_template: support-bundle
+
+brews:
+  - name: preflight
+    ids: [preflight, preflight-universal]
+    homepage: https://docs.replicated.com/reference/preflight-overview/
+    description: "A preflight checker and conformance test for Kubernetes clusters."
+    repository:
+      owner: replicatedhq
+      name: homebrew-replicated
+      branch: main
+    directory: HomebrewFormula
+    install: bin.install "preflight"
+  - name: support-bundle
+    ids: [support-bundle, support-bundle-universal]
+    homepage: https://docs.replicated.com/reference/support-bundle-overview/
+    description: "Collect and redact support bundles for Kubernetes clusters."
+    repository:
+      owner: replicatedhq
+      name: homebrew-replicated
+      branch: main
+    directory: HomebrewFormula
+    install: bin.install "support-bundle"

deploy/Dockerfile.troubleshoot

@@ -1,9 +1,9 @@
-FROM debian:buster
+FROM debian:bookworm
 WORKDIR /
 
 RUN apt-get -qq update \
  && apt-get -qq -y install \
-    ca-certificates
+    ca-certificates kmod
 
 COPY support-bundle /troubleshoot/support-bundle
 COPY preflight /troubleshoot/preflight

deploy/krew/preflight.yaml

@@ -16,6 +16,28 @@ spec:
     - from: LICENSE
       to: .
     bin: preflight
+  - selector:
+      matchLabels:
+        os: linux
+        arch: arm64
+    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/preflight_linux_arm64.tar.gz" .TagName }}
+    files:
+    - from: preflight
+      to: .
+    - from: LICENSE
+      to: .
+    bin: preflight
+  - selector:
+      matchLabels:
+        os: linux
+        arch: arm
+    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/preflight_linux_arm.tar.gz" .TagName }}
+    files:
+    - from: preflight
+      to: .
+    - from: LICENSE
+      to: .
+    bin: preflight
   - selector:
       matchLabels:
         os: darwin
@@ -29,15 +51,15 @@ spec:
     bin: preflight
   - selector:
       matchLabels:
-        os: windows
-        arch: amd64
-    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/preflight_windows_amd64.zip" .TagName }}
+        os: darwin
+        arch: arm64
+    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/preflight_darwin_arm64.tar.gz" .TagName }}
     files:
-    - from: preflight.exe
+    - from: preflight
       to: .
     - from: LICENSE
       to: .
-    bin: preflight.exe
+    bin: preflight
   shortDescription: Executes application preflight tests in a cluster
   homepage: https://github.com/replicatedhq/troubleshoot
   description: |

deploy/krew/support-bundle.yaml

@@ -16,6 +16,28 @@ spec:
     - from: LICENSE
       to: .
     bin: support-bundle
+  - selector:
+      matchLabels:
+        os: linux
+        arch: arm64
+    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/support-bundle_linux_arm64.tar.gz" .TagName }}
+    files:
+    - from: support-bundle
+      to: .
+    - from: LICENSE
+      to: .
+    bin: support-bundle
+  - selector:
+      matchLabels:
+        os: linux
+        arch: arm
+    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/support-bundle_linux_arm.tar.gz" .TagName }}
+    files:
+    - from: support-bundle
+      to: .
+    - from: LICENSE
+      to: .
+    bin: support-bundle
   - selector:
       matchLabels:
         os: darwin
@@ -29,15 +51,15 @@ spec:
     bin: support-bundle
   - selector:
       matchLabels:
-        os: windows
-        arch: amd64
-    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/support-bundle_windows_amd64.zip" .TagName }}
+        os: darwin
+        arch: arm64
+    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/support-bundle_darwin_arm64.tar.gz" .TagName }}
     files:
-    - from: support-bundle.exe
+    - from: support-bundle
       to: .
     - from: LICENSE
       to: .
-    bin: support-bundle.exe
+    bin: support-bundle
   shortDescription: Creates support bundles for off-cluster analysis
   homepage: https://github.com/replicatedhq/troubleshoot
   description: |

docs/arch/adr-001-ipaddress-redaction.md

@@ -0,0 +1,76 @@
+# ADR 001: remove IP address redaction by default
+
+## Context
+
+Since PR #8 IP addresses have automatically been redacted throughout support bundles.  This was originally
+added so that folks with security requirements that include not sharing IP addresses can avoid needing to add
+individual redactors for that purpose.
+
+The general requirement for environments that protect network infrastructure from being communicated outside also
+includes hostnames, port numbers, and mac addresses.  The Troubleshoot code does not redact these.
+
+The experience of support engineers making use of Troubleshoot support bundles has been that in many cases,
+a further set of logs, and data collection information needs to be collected for issues that involve network
+infrastructure in order to be able to assist.  This involves collection that does not redact IP addresses, and
+introduces significant delays in the resolution of issues due to back and forth.
+
+A review of Replicated support cases where end users posted an IP address in GitHub found 71 different issues
+in 2022 (as of October 2022). This doesn't cover uploaded files, phone calls, screen shares, etc. It also
+doesn't include anything else networking like mac address, hostnames, ports.
+
+The problem discussed in this document:
+
+* Users of Troubleshoot need to avoid redaction if they have networking issues, in order to share IP addresses
+  that are redacted by default.
+* The user experience of the product is based around "define what you want", however with default redactors built
+  into the product in addition to the defined spec is confusing and, in some cases, problematic if you do not want
+  the built in redactors.
+* A default set of redactors gives product users a false sense of security in that though the default redactors
+  do cover some redaction, they do not cover every possible combination for every particular sensitive item.
+  Redaction of hostnames is almost impossible given the freeform nature of hostnames, and the built in Password
+  redactor does not cover all passwords, merely a particular json combination.
+
+## Decision
+
+We will remove the code that redacts IP addresses by default from Troubleshoot.  Folks that wish to redact IP addresses will
+need to add that redactor to their individual Troubleshoot specs.
+
+## Solution
+
+The following changes need to be made:
+
+* [Documentation](https://troubleshoot.sh/docs/redact/ip-addresses/) for the IP address redaction needs altering to reflect that Troubleshoot
+  does not automatically redact IP addresses, but if users wish to there is an example yaml spec available.
+* Removal of the IP address redactor from [the code](https://github.com/replicatedhq/troubleshoot/blob/v0.45.0/pkg/redact/redact.go#L170)
+* Clear release notes on release of this change, communicating that those wishing to redact IP addresses need to add that redactor to their spec.
+* Possible broadcast communication since this is a change to default behavior.
+
+## Status
+
+Proposed
+
+## Consequences
+
+Describe the resulting context, after applying the decision. All consequences should be listed here,
+not just the "positive" ones. A particular decision may have positive, negative, and neutral consequences,
+but all of them affect the team and project in the future.
+
+Those that wish to have IP addresses redacted by Troubleshoot need to ensure that the redactor specified during `support-bundle` runs includes a
+regex for IP address redaction.
+
+Example regex for IP redaction:
+
+```yaml
+apiVersion: troubleshoot.sh/v1beta2
+kind: Redactor
+metadata:
+  name: IP Addresses
+spec:
+  redactors:
+  - name: Redact ipv4 addresses
+    removals:
+      regex:
+      - redactor: '(?P<mask>\b(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)'
+```
+
+Folks that have not specified the IP address regex above will, on support bundle creation, share their IP address information in that bundle by default.

docs/arch/adr-002-mergeable-preflights.md

@@ -0,0 +1,37 @@
+# ADR 002: Mergeable preflight specs
+
+When the `preflight` binary, or pacakge, is called, it supports only one spec definition at a time.
+
+Recent changes in Troubleshoot allow the `support-bundle` binary to be called with multiple specs at a time.  This allows cluster components to contribute independant Troubleshoot specs for their scope, and have Troubleshoot assemble them at run time.
+
+Tools such as kURL have components which are maintained with a degree of separation to one another.  It would be helpful to the maintainers of such projects to be able to call `preflight` specifying a number of specs at runtime, allowing Troubleshoot to assemble them into one spec for collection/analysis.
+
+Currently if the `preflight` binary is called with multiple specs, it simply ignores all after the first.
+
+## Decision
+
+Modify the `preflight` CLI and package to be able to read multiple args rather than just one.
+
+Introduce a merge mechanism in the same way that the `support-bundle` binary runs, to merge and deduplicate Preflight specs.
+
+## Status
+
+Proposed
+
+## Consequences
+
+There are no backward compatibility consequences or breaking changes in this proposal.
+
+The project benefits:
+* Folks maintaining kURL add-ons can contribute unique preflight specs for their add-on (and the same for other projects simlarly structured)
+* Folks using `preflight` from the CLI without other applications (e.g. for a Helm install) are able to specify a list of preflights for their application rather than having to assemble one spec for each environment.
+
+## Design notes
+
+This proposal does not include adding the `uri:` field to `kind: Preflight`.
+
+The file `cmd/preflight/cli/root.go` calls `preflight.RunPreflights` with `args[0]` which is likely to need to change to just `args`.
+
+Func `RunPreflights` takes a single string arg (`arg string`) for the spec definition.  This is likely to need to change to `arg []string`.
+
+File `cmd/troubleshoot/cli/run.go` loops through the list of args, concatenating them together.  A similar process is suitable for this change.

docs/arch/readme.md

@@ -0,0 +1,81 @@
+# Architecture Decision Records
+
+_ADR_ for short.
+
+## What is an Architecturally Significant Decision?
+
+See [Documenting Architecture
+Decisions](http://thinkrelevance.com/blog/2011/11/15/documenting-architecture-decisions)
+for more information.
+
+The basic idea is to capture key decisions having to do with anything _architectural_
+in a way that promotes better communication than simple word-of-mouth.
+
+What is an _architectural_ decision?  If one or more of the following ideas apply you
+might be dealing with an architectural decision.
+
+Does the design decision...
+
+* Alter externally visible system properties?
+* Modify public interfaces?
+* Directly influence high priority quality attributes?
+* Include or remove dependencies?
+* Result from a discussion where you learned more about technical or business constraints?
+* Involve taking on strategic technical debt?
+* Change the structures of the system (static, dynamic, or physical)?
+* Require other developers to update construction techniques or development environments?
+
+
+## Template
+
+Use this template in any new ADRs.  Replace the help text as you write the ADR.
+
+```
+# ADR N: Brief Decision Title
+
+Context goes here.
+
+Describe the forces at play, including technological, political, social, and project local.
+These forces are likely in tension, and should be called out as such. The language in this
+section is value-neutral. It is simply describing facts.
+
+## Decision
+
+This section describes our response to these forces. It is stated in full sentences,
+with active voice. "We will ..."
+
+
+## Status
+
+choose one: [Proposed | Accepted | Deprecated | Superseded]
+
+if deprecated, include a rationale.
+
+If superseded, include a link to the new ADR
+
+
+## Consequences
+
+Describe the resulting context, after applying the decision. All consequences should be listed here,
+not just the "positive" ones. A particular decision may have positive, negative, and neutral consequences,
+but all of them affect the team and project in the future.
+```
+
+## Tips and Hints
+
+* Titles should be descriptive, concise, and precise
+* The whole document should be one or two pages long at most.
+* Think of the document as a conversation with a future developer. This means write well and use full
+  sentences.
+* Update consequences as they become known.  The ADR becomes like a diary for seeing how the design
+  decisions we make impact the system over time.
+* Include diagrams as necessary.
+
+
+## References
+
+Nygard, Michael. Documenting Architecture Decisions, from _Think Relevance_ blog. [Web](http://thinkrelevance.com/blog/2011/11/15/documenting-architecture-decisions)
+
+Kruchten, Philippe. _The Decision View's Role in Software Architecture Practice_, IEEE Software 26:36-42, February 2009
+
+Tyree, J. and Akerman, A. _Architecture Decisions: Demystifying Architecture_, IEEE Software 22:2:19-27, March-April 2005 [PDF](http://www.utdallas.edu/~chung/SA/zz-Impreso-architecture_decisions-tyree-05.pdf)

docs/design/design-principles.md

@@ -0,0 +1,27 @@
+# Troubleshoot Design Principles
+
+This document captures design principles that the Troubleshoot project abides by. This is intended to provide new contributors with guidance on how to approach problems and a better understanding of what to consider and address while implementing features.
+
+## Client not Cluster based
+
+Troubleshoot has to communicate with the Kubernetes API server to gather information. However, Troubleshoot should interact with the cluster as little as reasonably possible and has no intention of having a persistent in-cluster presence. There are several reasons for this approach, in no particular order those include:
+
+* Users experiencing an issue in their cluster may discover Troubleshoot after they have a problem and requiring installed components may exclude them from solving their problem.
+* A user may have limited cluster access and requiring cluster wide installation like a CRD or Operator can prevent them for using tools to recover from their errors.
+* By definition Troubleshoot is being used because there is an issue with the cluster, to prevent exasperating the issue Troubleshoot should avoid writing to the cluster.
+
+## Tools not specs
+
+The Troubleshoot project should include tools which can be used to diagnose issues but is not attempting to include Specs built into the project itself. The number of issues and projects which could benefit from Troubleshoot is very large and we intended to enable those projects to better support their project. It is unreasonable and undesirable for Troubleshoot to be the source of truth for all possible cluster and software issues.
+
+## Fail forward
+
+Clusters with issues can be unpredictable, the scope of error conditions is likely unbounded. Troubleshoot should keep this in mind when doing error handling and fail forward proceeding with as much of the intended operation as possible while logging the errors. For example if a collector fails to collect information that should not prevent other collectors from running. Any condition that causes Troubleshoot to hang or not complete a run is considered a bug.
+
+## Provide a predictable user experience
+
+When things go wrong people can be stressed and stressed people aren't likely to thoroughly read documentation. Whenever possible default values, command line flags, etc should be set to provide a user the best experience possible with the input provided. Some examples of this include:
+
+* When accepting flags for things like Namespaces, as much as possible, use the same syntax that `kubectl` accepts which users are likely to try instinctively.
+* Default to gathering more information not less, rarely is it easier to diagnose an issue with less information.
+

docs/design/proposal-concurrent-collectors.md

@@ -0,0 +1,68 @@
+# Run collectors concurrently
+ 
+## Goals
+
+Increase the speed at which collectors complete.
+
+## Non Goals
+
+
+## Background
+
+Currently all collectors run sequentially, in the order in which they are specified in the spec.  This is implied, and has not been guaranteed.  With the addition of the ability to supply multiple specs, the order is no longer predicatble.
+
+Although sequence is not guaranteed for any collectors, #768 ensures that the `clusterResources` collector runs first, so that the list of resources does not include those that are started during the Troubleshoot collection sequence.
+
+The performance for support-bundle and preflight runs is important to the end user experience of the product.  There are examples where a support bundle takes multiple minutes to complete, and folks are left wondering if the process has hung or crashed.  Preflights that take too long will simply be skipped, which leads to problems with installation being difficult to identify.
+
+## High-Level Design
+
+Switch collectors and host collectors to use goroutines to collect (concurrently).  This should run the list of collectors of `clusterResources` type first, then the remainder concurrently when `clusterResources` is complete.
+
+## Detailed Design
+
+Tasks that can be split to separate merges (in order):
+
+* Switch all collectors to use goroutines to collect (concurrently).
+  * In `supportbundle.runCollectors()`, refactor to use a `go func()` pattern to run all the collectors that are not `clusterResources` concurrently.  Check that the first in the list is `clusterResources` and run that separately, prior to the others.
+  * This task should introduce an optional concurrency limit field, default to, say, 10, which limits the number of goroutines/collectors that can run at any given time.
+  * This task should improve the collection speed of in-cluster collectors and preflights
+
+* Switch Host Collectors to use goroutines for concurrent collection.
+  * In `supportbundle.runHostCollectors()`, refactor to use a `go func()` pattern for each collector.
+  * No need to honor the same concurrency limit as host collectors do not load the Kubernetes API
+
+* Switch Host Preflights to use goroutines - `preflight.CollectHost()` runs `go func()` for each collector.
+
+* Switch in-cluster Preflights to use goroutines - `preflight.Collect()` runs `go func()` for each collector.
+  * Ensure `clusterResources` runs in advance of the others so that pods started by collectors do not produce an error in the results.
+
+## Limitations
+
+Relies on splitting up the list of collectors into `clusterResources` and others.
+
+Collisions between specs (e.g. if `runPod` has multiple specs with the same name) are not handled.  At the current stage with collectors running sequentially, if two collectors write to the same file the second overwrites the data from the first.  If collectors run concurrently, there can be issues creating multiple pods with the same name, and issues with concurrent access to the target file.  This issue is tracked in [#895](https://github.com/replicatedhq/troubleshoot/issues/895)
+
+This proposal excludes Remote Collectors.
+## Assumptions
+
+* The Kubernetes API can handle the load of collectors running concurrently, including when the pod logs collector runs.
+
+## Testing
+
+Any new function will need unit tests.
+
+The existing Collect functions will need unit tests altered (or added).
+
+We will need to ensure that `clusterResources` is collected prior to others.
+
+## Documentation
+
+There should be a note in https://troubleshoot.sh/docs/collect/ ensuring that folks do not expect the collectors to run in any particular order.
+
+## Alternatives Considered
+
+None.
+## Security Considerations
+
+None identified.

docs/design/proposal-consolidate-collection.md

@@ -0,0 +1,66 @@
+# Consolidate collector code
+ 
+## Goals
+
+Reduce code maintenance needs.
+
+Improve consistency between preflight and support-bundle.
+
+## Non Goals
+
+## Background
+
+In the current Troubleshoot code base, there are three separate paths to running collectors.  These include preflights, support-bundle, and the collect package.  The three have diverged over time and are different to one another, but do not appear to have any need to be separate. This is confusing and likely to introduce errors in the future.
+
+## High-Level Design
+
+* Add a `collect` package public API that can be called to run the collect logic, from any other package
+* change the preflight, support-bundle and collect binaries to call that API rather than their own collect routines
+
+## Detailed Design
+
+Package `preflight`:
+* Remove `CollectHost`, `Collect` and `CollectRemote`
+
+Package `supportbundle`:
+* Remove `runCollectors`, `CollectSupportBundleFromSpec`, and associated code
+
+Package `collect`:
+* Add a replacement for `runCollectors`, `CollectSupportBundleFromSpec` taken from `supportbundle`
+* Add replacements for `CollectHost`, `Collect` and `CollectRemote` taken from `preflight`
+* Where the above duplicate functionality, alter the `supportbundle` or `preflight` packages to ensure that a single new function handles the requirement
+
+CLI packages:
+* Alter to use the public functions from `collect`
+
+## Limitations
+
+Breaking change - KOTS at least imports `CollectSupportBundleFromSpec` plus potentially others.
+
+This does not affect the analysis and redaction portions of code.
+
+## Assumptions
+
+* there is no need to run collectors differently between preflight and support-bundle
+ 
+## Testing
+
+Any new function will need unit tests.
+
+Existing tests will need to be altered, and possibly consolidated.
+
+## Documentation
+
+The public function to call collection should be documented and at that point regarded stable.
+
+## Alternatives Considered
+
+## Security Considerations
+
+None identified.
+
+## Related changes
+
+TODO:
+* make an API for analyze and redact
+* create an API that calls collect, redact, and analyze - and decide if that can be called by preflight and support-bundle

docs/design/proposal-mergeable-spec.md

@@ -0,0 +1,138 @@
+# Provide the ability to specify multiple Troubleshoot specs in one run of support-bundle or preflight
+
+Troubleshoot doesn't have a modular way for different components to specify specifications. If a software project wanted to include project specific items the end user would have a hard time knowing where to find those and how to collect them. Furthermore if multiple projects were to do this the user would have to run troubleshoot multiple times.
+
+Ideally troubleshoot would allow merging of specs to allow building a spec either automatically or influenced by user input to target specific needs.
+
+## Goals
+
+Primary goal: Allow folks that develop a particular component to maintain Troubleshoot specs for that component, including Vendors for their application.
+
+Long term goal: allow folks to update the component specs without needing to run any other upgrades.
+
+This proposal initially adds the ability to supply multiple support bundle specs for a single run of support-bundle and/or preflight so that:
+
+* when Troubleshoot runs, the spec it uses is an aggregate of multiple specs from the same source - yaml file, URL, configMap, or (new) CRD
+* each software component can contribute a Troubleshoot spec that is specific to that software
+* Ownership of each individual spec per component transfers to the owner of that component
+
+This will:
+
+* Ensure support bundles generated by users are comprehensive and contain all needed information for a project maintainer to action
+* Allow multiple specs from different projects, should a cluster have multiple projects using Troubleshoot
+* Software developers to continually update specs for components to easily identify known issues and reduce support noise.
+
+## Non Goals
+
+* Compatibility with previous URL, configMap and yaml specs, both Redactors and SupportBundle types
+* Maintain the ability to read secrets from the Kubernetes API
+
+## Background
+
+When users of Troubleshoot create a support bundle from the CLI, they use a single spec that is provided from:
+
+* A secret installed in the cluster by an application such as [KOTS](kots.io)
+* A url like <http://kots.io>
+* some other single example spec, e.g. <https://github.com/replicatedhq/troubleshoot-specs>
+
+When KOTS collects a support bundles from the KOTS UI, the spec is a [merged](https://github.com/replicatedhq/kots/blob/main/pkg/supportbundle/spec.go#L426) combination of the following:
+
+* The [default spec](https://github.com/replicatedhq/kots/blob/main/pkg/supportbundle/defaultspec/spec.yaml) in the kots code
+* The spec provided by the Vendor’s application bundle
+* This merged spec is deduplicated by kots [here](https://github.com/replicatedhq/kots/blob/main/pkg/supportbundle/spec.go#L217).
+
+Redactors are [hard coded](https://github.com/replicatedhq/troubleshoot/blob/main/pkg/redact/redact.go#L160) into Troubleshoot as well as supplied in the spec.
+
+Although we’re currently making strides in improving the Troubleshoot project by creating new collectors, analyzers, and specs, we have no way to more quickly deliver Troubleshoot improvements to installations in the field without updating the kots application and pushing a new release, or upgrading kots to a new version.
+
+When folks find a support issue that could have been identified by Troubleshoot, we ask them to write a new collector, and/or analyzer, for that information.  However, if we do that, the new collector/analyzer is not easily available to end users.
+
+Some of the useful features of Troubleshoot are actually implemented as part of KOTS, while both open source Troubleshoot should address this independently.
+
+## High-Level Design
+
+Add CRD support to Troubleshoot:
+
+* Design a custom resource (CRD) that allows adding spec(s) to the Kubernetes cluster using `kubectl`.  There is no need to extend this to use [API server aggregation](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#api-server-aggregation).
+* Update Troubleshoot to allow consuming the first object found of the new custom resource, by default - i.e. if there are no specs provided on the CLI or entrypoint, use CRD
+* Once merge is implemented, update Troubleshoot to consume and merge all the instances of the CRD.
+* To minimize code changes in Troubleshoot, we could implement two CRDs, of `type: SupportBundle` and `type: Redactor`.  However, there is no specific need to separate the two and it maybe advantageous to keep things simple, combining them.
+
+Allow multiple specs to be merged by Troubleshoot:
+
+* create an interface for collectors, analyzers, and redactors to merge
+* each collector/analyzer/redactor can use a generic implementation of the interface for the merge, or can use a specific one for that task if that particular collector will benefit from a more intelligent merge.
+* the spec merge code in kots can, at this stage, be removed once kots ships CRDs for the Troubleshoot specs
+
+Spec sources:
+
+* Alter Troubleshoot to accept multiple yaml files on the CLI
+* Create a CRD containing a spec, have Troubleshoot search for spec CRDs and combine them all when run
+* maintain the URL compatibility as is
+* maintain the configMap compatibility as is
+
+## Detailed Design
+
+CRD: to be designed
+
+Merge:
+
+* define a new interface that provides the merge functionality for collectors, analyzers, and redactors
+* there should be a generic implementation of that interface which is used by default for all objects.  This can simply use `append()`.
+* specific collectors may have alternative implementations of the interface where overrides are required.
+
+Particular overrides known at this point in time:
+
+* clusterResources has an option namespaces config, these should be merged and deduplicated
+* Two runPod collectors with the same name and different commands are unmergable. Only one should be run and an error logged.
+* Two configMap collectors can be deduplicated and merged depending on the configurations
+* Two logs collectors likely only need deduplication to prevent collecting the same thing twice
+
+## Limitations
+
+### Visibility
+
+Users may collect more than intended with the new implementation if all available CRD objects are run. We therefore need to be sure the Troubleshoot client allows for selection of what to run. While the default would be to run everything, a user should be able to just run specific SupportBundle specs based on labels, namespaces, etc. By doing this no functionality is lost.
+
+### Airgap
+
+Some of the spec locations such as URL wouldn’t work here. There may be other considerations around airgap as well.
+
+Airgap installs are intentionally feature limited. Failure to retrieve new versions of specs should fail gracefully and proceed with the run.
+
+As a follow up feature to improve support bundle collection Troubleshoot could gain some abilities to help manage and upgrade SupportBundles found in a cluster in a fashion that allows the user to split the discovery, download, and upgrade so they could be run on different machines.
+
+An example implementation would be:
+
+* A command to find, deduplicate, and output a list of SupportBundles in the cluster. The list would include at least the upstream URL and version currently installed in the cluster.
+* A command to take the output of the above command and check for updates, downloading all updated SupportBundles into a single .tgz file.
+* A command to apply the above .tgz file to the cluster upgrading any existing SupportBundles with the newer versions.
+
+## Assumptions
+
+* all deployments are able to deploy CRDs to the Kubernetes cluster
+
+## Testing
+
+## Alternatives Considered
+
+### Use the existing URL functionality in Troubleshoot
+
+Proposal: Provide a custom URL for each install, that when called by Troubleshoot returns a spec composed of the ‘latest’ for every component spec specified in that installation, much like we do with <https://kurl.sh/latest> now.
+
+Pros:
+
+* No changes required to Troubleshoot
+* Always use the latest specs for components other than the Vendor’s application
+
+Cons:
+
+* Would not work for airgap installations
+* Software developers need to update their application in order to get new specs from all dependencies
+* Replicated would need to provide a new API/web service to host the specs, reducing the general community applicability of troubleshoot as a stand alone project
+* Discourages individual projects from maintaining Troubleshoot specs for that project
+
+## Security Considerations
+
+Passing control of component specs to individual projects presents a possibility of reducing the amount of review a spec goes through for each update, allowing a spec provided by, say, a kURL addon to run collectors.  The current implementation relies on the kots review process for default specs, plus the review of individual example specs.  Depending on the final implementation, it is unlikely that this change itself increases any risk since the delivery of automated and default specs to Troubleshoot is maintained within kots, and/or Troubleshoot itself much as it is already.
+

docs/design/proposal-sbctl-integration.md

@@ -0,0 +1,120 @@
+# Integrate SBCTL with Troubleshoot
+
+## Goals
+
+Make sbctl easier to maintain by consolidating code bases.
+
+Reduce code duplication.
+
+Improve end-user experience and improve discoverability of sbctl.
+
+## Non Goals
+
+## Background
+sbctl is our command line tool for examining K8s resources inside of Support Bundles generated by our troubleshoot project. With both projects having separate code bases we see the following problems:
+
+* Most users are familiar with the binaries from troubleshoot (support-bundle, preflight, etc.), but are unaware of the existince of sbctl because it's a separate project
+* sbctl and troubleshoot are naturally coupled together due to sbctl's reliance on support bundles to operate. Them being in separate repos leads to duplication of code in both projects increasing maintenance burden.
+
+## High-Level Design
+Because the functionality of sbctl and Troubleshoot are so tightly coupled together, they should live in the same repository. Moreover, as opposed to maintaing a separate binary for sbctl, all sbctl commands should become subcommands of `support-bundle`
+
+## Detailed Design
+The `serve` and `shell` commands become subcommands of the `support-bundle` CLI.
+
+```
+./bin/support-bundle --help
+A support bundle is an archive of files, output, metrics and state
+from a server that can be used to assist when troubleshooting a Kubernetes cluster.
+
+Usage:
+  support-bundle [url] [flags]
+  support-bundle [command]
+
+Available Commands:
+  analyze     analyze a support bundle
+  serve       Start API server
+  shell       Start interractive shell
+  completion  Generate the autocompletion script for the specified shell
+  ...
+```
+
+Similiar to the [Analyze](https://github.com/replicatedhq/troubleshoot/blob/main/cmd/troubleshoot/cli/analyze.go) subcommand, we add `serve.go` and `shell.go` to `cmd/troubleshoot/cli`
+
+### Standardize Cluster Resources Collector
+* In `pkg/collect` standardize the root directory location of the Cluster Resources collector with a variable instead of repeatedly specifying it as a string - https://github.com/replicatedhq/troubleshoot/blob/main/pkg/collect/cluster_resources.go#L121.
+* Import the directory the Cluster Resources collector uses from `pkg/collect` for usage in the APIs - https://github.com/replicatedhq/sbctl/blob/main/pkg/api/server.go#L220. This is an example of the way we can start making the sbctl code more efficient with this change.
+
+cluster_resources.go
+```go
+const ClusterResourcesPath = `cluster-resources`
+...
+
+path := filepath.Join(ClusterResourcesPath, "namespaces.json")
+output.SaveResult(c.BundlePath, path, bytes.NewBuffer(namespaces))
+```
+
+sbctl-server.go
+```go
+import (
+    ...
+    "github.com/replicatedhq/troubleshoot/pkg/collect"
+    ...
+)
+...
+
+dirName := filepath.Join(collect.ClusterResourcesPath, fmt.Sprintf("%s", resource))
+```
+
+### Package Structure
+```
+cmd
+    serve/
+    shell/
+pkg
+    serve/
+    shell/
+tests           # API tests, integration tests etc reside here.
+    serve/      # sbctl BDD tests.
+        # all tests and test fixtures moved here
+```
+
+### Makefile Changes
+
+We'll need to add make targets specific to these commands similar to the current ones
+```
+make serve run-serve
+make shell run-shell
+make ginkgo
+```
+
+### Docs 
+In troubleshoot.sh docs, add a new sub section under "Support Bundle" describing then new serve & shell subcommands.
+
+### Other Changes
+We would need to merge some of the support bundle functionality we see in both projects like so
+
+- Create a new sbutil module to store reusable support bundle functionality. At least `analyze` & `serve` modules will depend on this module
+
+```
+pkg
+    sbutil/
+```
+
+- Merge `troubleshoot/pkg/analyze/download.ExtractTroubleshootBundle` & `sbctl/pkg/sbctl/support-bundle.ExtractBundle` that duplicate support bundle archive extraction
+- Build on `sbctl/pkg/sbctl/support-bundle.ClusterData` to have it expose well known paths (ClusterResourcesDir, Version files, analysis results etc) and unmarshalled resources (this bit can be built on a need to have basis) in a support bundle especially once [Add generic kubernetes resource analyzer #780 PR](https://github.com/replicatedhq/troubleshoot/pull/780) is merged.
+- Build on `sbctl/pkg/sbctl/support-bundle.FindClusterData` to perform pre-validation of a support bundle to ensure it is valid before running any applications.
+
+## Limitations
+
+## Assumptions
+
+## Testing
+We will need to have a separate directory for sbctl (ginkgo BDD) tests. The test harness used is ginkgo cli instead of go test and there is no straight forward way of separating these tests. Also, from a directory structure point of view, such integration tests usually reside in modules in a root level tests directory. Changes to the test code need to be minimal, ideally no change, cause they will be used to ensure any refactored code does not break. We could now easily introduce tests which ensure that changes to collectors don't break APIs in sbctl.
+
+## Alternatives Considered
+* Have troubleshoot as a library dependency in sbctl keeping it as a separate binary and repo
+* Move sbctl to the Troubleshoot library "as is" and continue maintaing a separate binary
+* Leave things as they are
+
+## Security Considerations

docs/design/proposal-standard-interface.md

@@ -0,0 +1,74 @@
+# Provide an extendable API for accessing bundle information
+
+## Goals
+
+* Provide API based access to collected information, decoupling other projects from troubleshoot on-disk format
+* Reuse existing APIs when they exist to make the bundle compatible with existing tools without modification
+* Plan for extensibility for accessing information beyond just the standard kubernetes api
+
+## Non Goals
+
+* Compatibility with previous on-disk formats
+* Compatibility with existing collectors without modification
+  * There should be a plan to allow the implementation of existing collectors
+
+## Background
+
+While using the information gathered in a support bundle users were finding it hard to find information while manually reviewing the various files collected in the bundle. Users have to understand the folder structure, files structure, and process JSON files to find information about the cluster. The [sbctl](https://github.com/replicatedhq/sbctl) project was created to prove out the utility of providing api based access so that users could use existing tools which they already understood. This has been a very successful experiment with feedback being that most users now use this utility as their primary, or only, interface to the support bundle information.
+
+There are some drawbacks to the current approach. The `sbctl` project is tightly coupled to troubleshoot on-disk formats, each kubernetes API must be implemented in `sbctl` individually and will require being kept up to date as APIs change, and `sbctl` has no plan today to provide similar API based access to information other than the standard kubernetes api.
+
+This proposal is meant to take the learnings from `sbctl` and consider implementing it as a first class feature of troubleshoot while attempting to address the current maintenance and expandability limitations.
+
+## High-Level Design
+
+To help address standard access to API data, troubleshoot will start an etcd instance which collectors can then use to store collected information rather than writing to custom on-disk locations. Collectors that only need to collect Kubernetes API information then do not need to serve up data as the API server will be used to provide access to the collected data. Storing data directly in etcd will allow troubleshoot to later serve up this same information by again starting an api-server and etcd using the previously collected etcd data store. This should remove almost all maintenance from troubleshoot for implementing API calls to access the collected information.
+
+There will also be information that is desired to be stored that doesn't have any native representation in the api-server today. Examples could include custom collectors which execute into containers and extensions like [metrics server](https://github.com/kubernetes-sigs/metrics-server). These components can be addressed using the built in [Kubernetes API Aggregation Layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) which is how `metrics server` itself works to extend and provide api based access to node information. By registering additional API extensions troubleshoot plugins can implement both a collection and an API for retrieving custom information which is accessible in the same fashion as the rest of the api-server.
+
+The additional benefit to this, which can be demonstrated with `metrics-server`, is that collectors can be written for any other extension API and be compatible with existing tools the same way using the api-server provides compatibility with `kubectl`. Using `metrics-server` as an example, a collector can be written to collect node information which can be stored locally. The collector can then implement the standard [GET Endpoints](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) from the metrics-server and reply to them with the results it collected. By doing so, all tools that work with metrics-server today, like `kubectl top` will also work with information served from a support bundle. Additionally, the collector implementation handles any custom file formats without exposing that to any other tool making it easy to maintain.
+
+Any other access to the filesystem directly will be modified to instead use the provided api-server. This means analyzers will not directly reference files on disk and will instead run against the api-server to analyze the collected information. This decouples analyzers from how collectors store data providing clean separation of concerns for maintaining both collectors and analyzers. Decoupling these also creates a natural way to implement analyzers that use data from multiple collectors. This could also allow analyzers to run against existing clusters providing a use for analyzers independent of support bundle collection. This could encourage additional community contributions of analyzers.
+
+An initially unintended benefit of using the Aggregation Layer is that any HostCollector using this implementation would be very close to an implementation of an extension which you could install in clusters. This could make HostCollectors also useful to install as a service in a live cluster for operations information about hosts.
+
+## Detailed Design
+
+### Outstanding design questions
+
+1. How reasonable is it to start an api-server as part of troubleshoot? Consider the following known implementations that do something like this:
+
+* [envtest](https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/envtest) - requires binaries present on the machine
+* [microk8s implementation](https://github.com/canonical/microk8s/blob/master/build-scripts/patches/0000-Kubelite-integration.patch) - bundles slightly modified binaries
+* [k0s uses upstream binaries statically compiled](https://docs.k0sproject.io/v1.23.8+k0s.0/architecture/) - bundles statically compiled binaries that self extract and uses a process monitor to run them
+
+2. Can you in fact push metadata like "Status" into an api-server or do we have to write directly to etcd?
+
+* If we can't push to the api-server is just writing the information directly into etcd something we can do and have a reasonable expectation of compatibility?
+
+3. Is the overhead to write an Aggregation API going to add an unnecessary burden to writing new collector plugins? Can these be templated into a reasonably to ease collector creation?
+
+## Limitations
+
+Using the actual API server will provide limitations on the version skew which can be collected/displayed. This could be addressed by including multiple versions of the kubernetes-api server to allow serving a wide range of support bundles. This limitation likely already exists today but would exist in the tooling that is trying to collect, analyzer, or server the data.
+
+## Assumptions
+
+* Serving logs hasn't been designed yet, and presumably can be addressed in the detailed design to provide logs to the api-server in place of kubelet. Ideally this can be done using the standard upstream kubernetes-api server it is undesirable to fork it.
+* Running the api-server, etcd, and any other supporting services (like kubelet) as go routines while adding some overhead to the collection process won't cause a significant burden on ram or cpu to collect support bundles.
+
+## Testing
+
+## Alternatives Considered
+
+### Keep sbctl separate
+
+The current `sbctl` project could be left to run it's course independent of this project. This leaves the troubleshoot project reliant on a separate project to provide a good user experience for anything other than analyzers.
+
+## Security Considerations
+
+Consideration to how Redactors are implemented needs to be considered.
+
+## References
+
+Original PR discussion found [here](https://github.com/replicatedhq/troubleshoot/pull/611)

docs/design/proposal-updateable-specs.md

@@ -0,0 +1,95 @@
+# Provide a facility to automatically obtain updated specs
+
+## Background
+
+Troubleshoot is limited in that when folks write an update or a new spec for data collection and analysis, that upgrade is not available when Troubleshoot is invoked if specs for it are stored in a secret or a file which was deployed by an application.  Updating the local spec is simple enough, but may require an upgrade to the application (e.g. KOTS) in order to collect updates to the spec supplied by that application.  This update requirement delays folks from accessing updated Troubleshoot specs and therefore discourages people from writing new/updated specs.
+
+## Goals
+
+* Provide a means for a spec to optionally specify a location for a spec that can replace it if successfully reached.
+
+## Other requirements
+
+* Maintain the ability for Troubleshoot to run in an airgapped environment, though with some feature limitations.
+* Maintain compatilbility with existing Troubleshoot specs.
+
+## High-Level Design
+
+Add a new field to the Troubleshoot spec definition, which includes a URI used to locate a replacement spec.
+
+If the field is populated, Troubleshoot is to attempt to collect the spec from the location provided, and if successful, ignore the remainder of the spec provided and use the spec listed in the new field.
+
+If the additional spec is not found at the location (or, if there is no network access to that location), Troubleshoot is to continue processing the remainder of the spec provided, with a log message describing the failure to process the URI.
+
+Add a CLI flag (e.g. `--no-updates`) to disable the URI specified location from being accessed.  This would be useful in airgap environments and/or when we simply do not want to have the external spec used, without having to update the yaml, secret, or remote source.
+
+URI's provided may be any of the URI types already accepted by Troubleshoot, including web addresses (https://), secrets, or files.
+
+## Detailed Design
+
+Current spec format is like this example:
+
+```yaml
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: default
+spec:
+  collectors:
+    - clusterInfo: {}
+    - clusterResources: {}
+  analyzers:
+    - cephStatus: {}
+    - longhorn: {}
+```
+
+We could add a new type, `specURI`, which contains one or more URIs from which to obtain specs.  If the spec is retrieved successfully then the remainder of the provided spec is ignored, and replaced with the one downloaded:
+
+```yaml
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: default
+spec:
+  uri: https://raw.githubusercontent.com/replicatedhq/troubleshoot-specs/main/in-cluster/default.yaml
+  collectors:
+    - clusterInfo: {}
+    - clusterResources: {}
+  analyzers:
+    - cephStatus: {}
+    - longhorn: {}
+```
+
+When a spec is parsed from the initial call to Troubleshoot, the content should be read and if a `specURI` exists which is not blank, the code should attempt to download that URI.  Should that be successful, the collectors and analyzers sections of the downloaded content should be used to replace the remainder of the spec provided via the initial call.
+
+## Impact on kURL and KOTS
+
+This section is included because KOTS is a significant consumer of the Troubleshoot codebase, and as such deserves consideration when significant changes are made.
+
+The code changes proposed in this document do not require any changes to kURL or KOTS, and any changes to those repos are excluded from the scope of work described here.  The following notes are suggestions for how the kURL and KOTS repos could benefit from the changes in this document, and could relate to any project which calls Troubleshoot or includes Troubleshoot specs.
+
+For kURL, each component/addon installed could include adding an individual spec with a URI pointing at a specific spec for that component, which could be updated independently of other components.  Invoking troubleshoot with all the individual specs required would allow updated specs to be collected without needing to upgrade any particular component in the cluster.
+
+KOTS currently provides a spec to Troubleshoot which is a merge of a default spec provided by the KOTS codebase, and the spec provided by an application vendor.  Should either of those provide a URI, that would mean the downloaded spec would replace the entire spec.  This is undesirable since the URI would need to contain the application vendor's updated spec as well as the generic cluster-wide collectors and analyzers, which is a significant maintenance challenge.  To resolve this, it is desirable that the following is completed before KOTS uses the URI field:
+
+* Troubleshoot should accept multiple specs (see #650)
+* KOTS would need to be modified to provide the application vendor and the default specs independently of one another.
+
+## Limitations
+
+Redactors are currently excluded from this proposal, though it would be desirable to add a similar feature in the future.
+
+If a URI provided includes a spec which includes another URI, it is possible to get into some kind of recursion if the downloaded spec contains another URI.  For this reason, and to ensure that the results are predictable, we should only parse the URI field once per spec for specs passed to Troubleshoot on initiation via the CLI or entrypoint.
+
+## Assumptions
+
+## Testing
+
+## Alternatives Considered
+
+* Some mechanism to trigger a process to update secrets stored in Kubernetes.  This was rejected due to the need to run a manual update spec for something installed in the cluster.
+* Altering KOTS to provide a URL for the spec rather than storing it in code.  This was rejected to allow airgap compatibility.
+
+## Security Considerations
+
+This change will make additional network calls with default usage of Troubleshoot. To ensure a user has control of limiting these calls an argument to disable this feature entirely will be provided. This allows users with different security postures to select what's appropriate for their environment.

docs/design/template.md

@@ -0,0 +1,21 @@
+# Title
+
+## Goals
+
+## Non Goals
+
+## Background
+
+## High-Level Design
+
+## Detailed Design
+
+## Limitations
+
+## Assumptions
+
+## Testing
+
+## Alternatives Considered
+
+## Security Considerations

docs/preflight.md

@@ -0,0 +1,61 @@
+## preflight 
+
+Run and retrieve preflight checks in a cluster
+
+### Synopsis
+
+A preflight check is a set of validations that can and should be run to ensure
+that a cluster meets the requirements to run an application.
+
+```
+preflight [url] [flags]
+```
+
+### Options
+
+```
+      --as string                      Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
+      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                  UID to impersonate for the operation.
+      --auto-update                    enable automatic binary self-update check and install (default true)
+      --cache-dir string               Default cache directory (default "/Users/marccampbell/.kube/cache")
+      --certificate-authority string   Path to a cert file for the certificate authority
+      --client-certificate string      Path to a client certificate file for TLS
+      --client-key string              Path to a client key file for TLS
+      --cluster string                 The name of the kubeconfig cluster to use
+      --collect-without-permissions    always run preflight checks even if some require permissions that preflight does not have (default true)
+      --collector-image string         the full name of the collector image to use
+      --collector-pullpolicy string    the pull policy of the collector image
+      --context string                 The name of the kubeconfig context to use
+      --cpuprofile string              File path to write cpu profiling data
+      --debug                          enable debug logging
+      --disable-compression            If true, opt-out of response compression for all requests to the server
+      --dry-run                        print the preflight spec without running preflight checks
+      --format string                  output format, one of human, json, yaml. only used when interactive is set to false (default "human")
+  -h, --help                           help for preflight
+      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --interactive                    interactive preflights (default true)
+      --kubeconfig string              Path to the kubeconfig file to use for CLI requests.
+      --memprofile string              File path to write memory profiling data
+  -n, --namespace string               If present, the namespace scope for this CLI request
+      --no-uri                         When this flag is used, Preflight does not attempt to retrieve the spec referenced by the uri: field`
+  -o, --output string                  specify the output file path for the preflight checks
+      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --selector string                selector (label query) to filter remote collection nodes on.
+  -s, --server string                  The address and port of the Kubernetes API server
+      --since string                   force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.
+      --since-time string              force pod logs collectors to return logs after a specific date (RFC3339)
+      --tls-server-name string         Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
+      --token string                   Bearer token for authentication to the API server
+      --user string                    The name of the kubeconfig user to use
+  -v, --v Level                        number for the log level verbosity
+```
+
+### SEE ALSO
+
+* [preflight oci-fetch](preflight_oci-fetch.md)   - Fetch a preflight from an OCI registry and print it to standard out
+* [preflight template](preflight_template.md)     - Render a templated preflight spec with values
+* [preflight docs](preflight_docs.md)             - Extract and display documentation from a preflight spec
+* [preflight version](preflight_version.md)       - Print the current version and exit
+
+###### Auto generated by spf13/cobra on 15-Sep-2025

docs/preflight_docs.md

@@ -0,0 +1,60 @@
+## preflight docs
+
+Extract and display documentation from a preflight spec
+
+### Synopsis
+
+Extract all `docString` fields from enabled analyzers in one or more preflight YAML files. Templating is evaluated first using the provided values, so only documentation for analyzers that are enabled is emitted. The output is Markdown.
+
+```
+preflight docs [preflight-file...] [flags]
+```
+
+### Examples
+
+```
+# Extract docs with defaults
+preflight docs ml-platform-preflight.yaml
+
+# Multiple specs with values files (later values override earlier ones)
+preflight docs spec1.yaml spec2.yaml \
+  --values values-base.yaml --values values-prod.yaml
+
+# Inline overrides (Helm-style --set)
+preflight docs ml-platform-preflight.yaml \
+  --set monitoring.enabled=true --set ingress.enabled=false
+
+# Save to file
+preflight docs ml-platform-preflight.yaml -o requirements.md
+```
+
+### Options
+
+```
+      --values stringArray   Path to YAML files containing template values (can be used multiple times)
+      --set stringArray      Set template values on the command line (can be used multiple times)
+  -o,  --output string       Output file (default: stdout)
+```
+
+### Behavior
+
+- Accepts one or more preflight specs; all are rendered, and their docStrings are concatenated in input order.
+- Values merge: deep-merged left-to-right across `--values` files. `--set` overrides win last.
+- Rendering engine:
+  - If a spec references `.Values`, it is rendered with the Helm engine; otherwise Go text/template is used. A fallback to the legacy engine is applied for mixed templates.
+- Map normalization: values maps are normalized to `map[string]interface{}` before applying `--set` to avoid type errors.
+- Markdown formatting:
+  - The first line starting with `Title:` in a `docString` becomes a Markdown heading.
+  - If no `Title:` is present, the analyzer (or requirement) name is used.
+  - Sections are separated by blank lines.
+
+### v1beta3 docString extraction
+
+- v1beta3 layout uses `spec.analyzers: [...]`.
+- Each analyzer may include a sibling `docString` string.
+- The docs command extracts `spec.analyzers[*].docString` after rendering.
+- Backward compatibility: legacy `requirements` blocks are still supported and extracted when present.
+
+### SEE ALSO
+
+* [preflight](preflight.md)  - Run and retrieve preflight checks in a cluster