feat(collectors): Add TLS parameters to the postgres collector (#875)

For a postgres collector spec targeting a server configured to accept
(m)TLS connections we need to pass in the necessary parameters in order
to successfully connect to the server. Both preflight and support bundle
specs use this collector.

This change allows us to pass in the necessary TLS parameters via inlined
TLS configuration or via a secret reference.

Fixes #747

.devcontainer/Dockerfile

@@ -0,0 +1,115 @@
+#-------------------------------------------------------------------------------------------------------------
+# Modified from Codespaces default container image: https://github.com/microsoft/vscode-dev-containers/blob/main/containers/codespaces-linux/history/1.6.3.md
+# - Remove PHP, Ruby, Dotnet, Java, powershell, rust dependencies
+# - Remove fish shell
+# - Remove Oryx
+# - Remove git-lfs
+# - Change shell to zsh
+#
+# TODO (dans): find a better way to pull in library script dynamically from vscode repo
+# TODO (dans): AWS CLI - make a common script in the dev-containers repo
+# TODO (dans): Gcloud CLI - make a common script in the dev-containers repo
+# TODO (dans): add gcommands alias
+# TODO (dans): terraform 
+#-------------------------------------------------------------------------------------------------------------
+FROM mcr.microsoft.com/oryx/build:vso-focal-20210902.1 as replicated
+
+ARG USERNAME=codespace
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+ARG HOMEDIR=/home/$USERNAME
+
+ARG GO_VERSION="latest"
+
+# Default to bash shell (other shells available at /usr/bin/fish and /usr/bin/zsh)
+ENV SHELL=/bin/bash \
+    ORYX_ENV_TYPE=vsonline-present \
+    NODE_ROOT="${HOMEDIR}/.nodejs" \
+    PYTHON_ROOT="${HOMEDIR}/.python" \
+    HUGO_ROOT="${HOMEDIR}/.hugo" \
+    NVM_SYMLINK_CURRENT=true \
+    NVM_DIR="/home/${USERNAME}/.nvm" \
+    NVS_HOME="/home/${USERNAME}/.nvs" \
+    NPM_GLOBAL="/home/${USERNAME}/.npm-global" \
+    KREW_HOME="/home/${USERNAME}/.krew/bin" \
+    PIPX_HOME="/usr/local/py-utils" \
+    PIPX_BIN_DIR="/usr/local/py-utils/bin" \
+    GOROOT="/usr/local/go" \
+    GOPATH="/go" 
+
+ENV PATH="${PATH}:${KREW_HOME}:${NVM_DIR}/current/bin:${NPM_GLOBAL}/bin:${ORIGINAL_PATH}:${GOROOT}/bin:${GOPATH}/bin:${PIPX_BIN_DIR}:/opt/conda/condabin:${NODE_ROOT}/current/bin:${PYTHON_ROOT}/current/bin:${HUGO_ROOT}/current/bin:${ORYX_PATHS}"
+
+COPY library-scripts/* first-run-notice.txt /tmp/scripts/
+COPY ./config/* /etc/replicated/
+COPY ./lifecycle-scripts/* /var/lib/replicated/scripts/
+
+# Install needed utilities and setup non-root user. Use a separate RUN statement to add your own dependencies.
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+    # Restore man command
+    && yes | unminimize 2>&1 \ 
+    # Run common script and setup user
+    && bash /tmp/scripts/common-debian.sh "true" "${USERNAME}" "${USER_UID}" "${USER_GID}" "true" "true" "true" \
+    && bash /tmp/scripts/setup-user.sh "${USERNAME}" "${PATH}" \
+    # Change owner of opt contents since Oryx can dynamically install and will run as "codespace"
+    && chown ${USERNAME} /opt/* \
+    && chsh -s /bin/bash ${USERNAME} \
+    # Verify expected build and debug tools are present
+    && apt-get -y install build-essential cmake python3-dev \
+    # Install tools and shells not in common script
+    && apt-get install -yq vim vim-doc xtail software-properties-common libsecret-1-dev \
+    # Install additional tools (useful for 'puppeteer' project)
+    && apt-get install -y --no-install-recommends libnss3 libnspr4 libatk-bridge2.0-0 libatk1.0-0 libx11-6 libpangocairo-1.0-0 \
+                                                  libx11-xcb1 libcups2 libxcomposite1 libxdamage1 libxfixes3 libpango-1.0-0 libgbm1 libgtk-3-0 \
+    && bash /tmp/scripts/sshd-debian.sh \
+    && bash /tmp/scripts/github-debian.sh \
+    && bash /tmp/scripts/azcli-debian.sh \
+    # Install Moby CLI and Engine
+    && /bin/bash /tmp/scripts/docker-debian.sh "true" "/var/run/docker-host.sock" "/var/run/docker.sock" "${USERNAME}" "true" \
+    # && bash /tmp/scripts/docker-in-docker-debian.sh "true" "${USERNAME}" "true" \
+    && bash /tmp/scripts/kubectl-helm-debian.sh \
+    # Build latest git from source
+    && bash /tmp/scripts/git-from-src-debian.sh "latest" \
+    # Clean up
+    && apt-get autoremove -y && apt-get clean -y \
+    # Move first run notice to right spot
+    && mkdir -p /usr/local/etc/vscode-dev-containers/ \
+    && mv -f /tmp/scripts/first-run-notice.txt /usr/local/etc/vscode-dev-containers/
+
+# Install Python
+RUN bash /tmp/scripts/python-debian.sh "none" "/opt/python/latest" "${PIPX_HOME}" "${USERNAME}" "true" \
+    && apt-get clean -y
+
+# Setup Node.js, install NVM and NVS
+RUN bash /tmp/scripts/node-debian.sh "${NVM_DIR}" "none" "${USERNAME}" \
+    && (cd ${NVM_DIR} && git remote get-url origin && echo $(git log -n 1 --pretty=format:%H -- .)) > ${NVM_DIR}/.git-remote-and-commit \
+    # Install nvs (alternate cross-platform Node.js version-management tool)
+    && sudo -u ${USERNAME} git clone -c advice.detachedHead=false --depth 1 https://github.com/jasongin/nvs ${NVS_HOME} 2>&1 \
+    && (cd ${NVS_HOME} && git remote get-url origin && echo $(git log -n 1 --pretty=format:%H -- .)) > ${NVS_HOME}/.git-remote-and-commit \
+    && sudo -u ${USERNAME} bash ${NVS_HOME}/nvs.sh install \
+    && rm ${NVS_HOME}/cache/* \
+    # Set npm global location
+    && sudo -u ${USERNAME} npm config set prefix ${NPM_GLOBAL} \
+    && npm config -g set prefix ${NPM_GLOBAL} \
+    # Clean up
+    && rm -rf ${NVM_DIR}/.git ${NVS_HOME}/.git
+
+# Install Go
+RUN bash /tmp/scripts/go-debian.sh "${GO_VERSION}" "${GOROOT}" "${GOPATH}" "${USERNAME}" 
+
+# Install Replicated Tools
+RUN bash /tmp/scripts/replicated-debian.sh \
+    && rm -rf /tmp/scripts \
+    && apt-get clean -y 
+
+# Userspace
+ENV SHELL=/bin/zsh
+USER ${USERNAME}
+COPY --chown=${USERNAME}:root library-scripts/replicated-userspace.sh /tmp/scripts/
+RUN bash /usr/local/share/docker-init.sh \
+    && bash /tmp/scripts/replicated-userspace.sh \
+    && rm -rf /tmp/scripts/scripts
+
+# Fire Docker/Moby script if needed along with Oryx's benv
+ENTRYPOINT [ "/usr/local/share/docker-init.sh", "/usr/local/share/ssh-init.sh", "benv" ]
+CMD [ "sleep", "infinity" ]
+

.devcontainer/README.md

@@ -0,0 +1,7 @@
+# Replicated KOTS Codespace Container
+
+Most of the code here is borrowed from this [Microsoft repo of base images](https://github.com/microsoft/vscode-dev-containers), except for replicated specific things.
+
+## Notes
+* k3d *DOES NOT* work with DinD. You have to use the docker with docker install instead.
+* Might be faster to install kubectl plugins on the `$PATH` in the `Dockerfile` instead of downloading them `onCreate.sh`.

.devcontainer/config/k3d-cluster.yaml

@@ -0,0 +1,10 @@
+apiVersion: k3d.io/v1alpha3 
+kind: Simple 
+name: replicated
+servers: 1
+image: rancher/k3s:v1.21.4-k3s1 # v1.21.3-k3s1 default is broken
+registries:
+  create: 
+    name: k3d-replicated-registry.localhost
+    host: "0.0.0.0"
+    hostPort: "5000"

.devcontainer/devcontainer.json

@@ -0,0 +1,63 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the README at:
+// https://github.com/microsoft/vscode-dev-containers/tree/v0.162.0/containers/javascript-node
+{
+	"name": "Replicated Codeserver",
+	"build": {
+		"dockerfile": "Dockerfile",
+		"args": { 
+            "GO_VERSION": "1.17",
+        }
+	},
+
+	// Set *default* container specific settings.json values on container create.
+	"settings": { 
+        "terminal.integrated.shell.linux": "/usr/bin/zsh",
+        "go.toolsManagement.checkForUpdates": "local",
+        "go.useLanguageServer": true,
+        "go.gopath": "/go",
+        "go.goroot": "/usr/local/go",
+        "python.pythonPath": "/opt/python/latest/bin/python",
+        "python.linting.enabled": true,
+        "python.linting.pylintEnabled": true,
+        "python.formatting.autopep8Path": "/usr/local/py-utils/bin/autopep8",
+        "python.formatting.blackPath": "/usr/local/py-utils/bin/black",
+        "python.formatting.yapfPath": "/usr/local/py-utils/bin/yapf",
+        "python.linting.banditPath": "/usr/local/py-utils/bin/bandit",
+        "python.linting.flake8Path": "/usr/local/py-utils/bin/flake8",
+        "python.linting.mypyPath": "/usr/local/py-utils/bin/mypy",
+        "python.linting.pycodestylePath": "/usr/local/py-utils/bin/pycodestyle",
+        "python.linting.pydocstylePath": "/usr/local/py-utils/bin/pydocstyle",
+        "python.linting.pylintPath": "/usr/local/py-utils/bin/pylint",
+        "lldb.executable": "/usr/bin/lldb",
+        "files.watcherExclude": {
+            "**/target/**": true
+        }
+	},
+    "remoteUser": "codespace",
+	"overrideCommand": false,
+    "runArgs": [
+		"--privileged",
+		"--init"
+	],
+    "mounts": [
+		"source=/var/run/docker.sock,target=/var/run/docker-host.sock,type=bind",
+	],
+	// Add the IDs of extensions you want installed when the container is created.
+	"extensions": [
+		"dbaeumer.vscode-eslint",
+        "GitHub.vscode-pull-request-github",
+        "golang.go",
+        "github.copilot",
+        "lizebang.bash-extension-pack",
+        "streetsidesoftware.code-spell-checker",
+	],
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	"postCreateCommand": "bash /var/lib/replicated/scripts/onCreate.sh",
+
+    // Use 'postStartCommand' to run commands after the container is created like starting minikube.
+	"postStartCommand": "bash /var/lib/replicated/scripts/onStart.sh",
+
+	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
+	// "remoteUser": "node"
+}

.devcontainer/first-run-notice.txt

@@ -0,0 +1,9 @@
+👋 Welcome to your Replicated Codespace!
+
+There's a local Kubernetes cluster set up for you.
+
+Drivers Manual:
+* `k` alias is available for `kubectl` with auto-completion for your pleasure
+* This is a `zsh` terminal with Oh My Zsh installed. Just thought you should know.
+
+

.devcontainer/library-scripts/azcli-debian.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/azcli.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./azcli-debian.sh
+
+set -e
+
+MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc"
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Get central common setting
+get_common_setting() {
+    if [ "${common_settings_file_loaded}" != "true" ]; then
+        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
+        common_settings_file_loaded=true
+    fi
+    if [ -f "/tmp/vsdc-settings.env" ]; then
+        local multi_line=""
+        if [ "$2" = "true" ]; then multi_line="-z"; fi
+        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
+        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
+    fi
+    echo "$1=${!1}"
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+export DEBIAN_FRONTEND=noninteractive
+
+# Install dependencies
+check_packages apt-transport-https curl ca-certificates lsb-release gnupg2
+
+# Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
+. /etc/os-release
+get_common_setting MICROSOFT_GPG_KEYS_URI
+curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg
+echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/azure-cli/ ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/azure-cli.list
+apt-get update
+apt-get install -y azure-cli
+echo "Done!"

.devcontainer/library-scripts/common-debian.sh

@@ -0,0 +1,478 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/common.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./common-debian.sh [install zsh flag] [username] [user UID] [user GID] [upgrade packages flag] [install Oh My Zsh! flag] [Add non-free packages]
+
+set -e
+
+INSTALL_ZSH=${1:-"true"}
+USERNAME=${2:-"automatic"}
+USER_UID=${3:-"automatic"}
+USER_GID=${4:-"automatic"}
+UPGRADE_PACKAGES=${5:-"true"}
+INSTALL_OH_MYS=${6:-"true"}
+ADD_NON_FREE_PACKAGES=${7:-"false"}
+SCRIPT_DIR="$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)"
+MARKER_FILE="/usr/local/etc/vscode-dev-containers/common"
+
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Ensure that login shells get the correct path if the user updated the PATH using ENV.
+rm -f /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+chmod +x /etc/profile.d/00-restore-env.sh
+
+# If in automatic mode, determine if a user already exists, if not use vscode
+if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
+    USERNAME=""
+    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
+    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
+        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
+            USERNAME=${CURRENT_USER}
+            break
+        fi
+    done
+    if [ "${USERNAME}" = "" ]; then
+        USERNAME=vscode
+    fi
+elif [ "${USERNAME}" = "none" ]; then
+    USERNAME=root
+    USER_UID=0
+    USER_GID=0
+fi
+
+# Load markers to see which steps have already run
+if [ -f "${MARKER_FILE}" ]; then
+    echo "Marker file found:"
+    cat "${MARKER_FILE}"
+    source "${MARKER_FILE}"
+fi
+
+# Ensure apt is in non-interactive to avoid prompts
+export DEBIAN_FRONTEND=noninteractive
+
+# Function to call apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Run install apt-utils to avoid debconf warning then verify presence of other common developer tools and dependencies
+if [ "${PACKAGES_ALREADY_INSTALLED}" != "true" ]; then
+
+    package_list="apt-utils \
+        openssh-client \
+        gnupg2 \
+        iproute2 \
+        procps \
+        lsof \
+        htop \
+        net-tools \
+        psmisc \
+        curl \
+        wget \
+        rsync \
+        ca-certificates \
+        unzip \
+        zip \
+        nano \
+        vim-tiny \
+        less \
+        jq \
+        lsb-release \
+        apt-transport-https \
+        dialog \
+        libc6 \
+        libgcc1 \
+        libkrb5-3 \
+        libgssapi-krb5-2 \
+        libicu[0-9][0-9] \
+        liblttng-ust0 \
+        libstdc++6 \
+        zlib1g \
+        locales \
+        sudo \
+        ncdu \
+        man-db \
+        strace \
+        manpages \
+        manpages-dev \
+        init-system-helpers"
+        
+    # Needed for adding manpages-posix and manpages-posix-dev which are non-free packages in Debian
+    if [ "${ADD_NON_FREE_PACKAGES}" = "true" ]; then
+        # Bring in variables from /etc/os-release like VERSION_CODENAME
+        . /etc/os-release
+        sed -i -E "s/deb http:\/\/(deb|httpredir)\.debian\.org\/debian ${VERSION_CODENAME} main/deb http:\/\/\1\.debian\.org\/debian ${VERSION_CODENAME} main contrib non-free/" /etc/apt/sources.list
+        sed -i -E "s/deb-src http:\/\/(deb|httredir)\.debian\.org\/debian ${VERSION_CODENAME} main/deb http:\/\/\1\.debian\.org\/debian ${VERSION_CODENAME} main contrib non-free/" /etc/apt/sources.list
+        sed -i -E "s/deb http:\/\/(deb|httpredir)\.debian\.org\/debian ${VERSION_CODENAME}-updates main/deb http:\/\/\1\.debian\.org\/debian ${VERSION_CODENAME}-updates main contrib non-free/" /etc/apt/sources.list
+        sed -i -E "s/deb-src http:\/\/(deb|httpredir)\.debian\.org\/debian ${VERSION_CODENAME}-updates main/deb http:\/\/\1\.debian\.org\/debian ${VERSION_CODENAME}-updates main contrib non-free/" /etc/apt/sources.list
+        sed -i "s/deb http:\/\/security\.debian\.org\/debian-security ${VERSION_CODENAME}\/updates main/deb http:\/\/security\.debian\.org\/debian-security ${VERSION_CODENAME}\/updates main contrib non-free/" /etc/apt/sources.list
+        sed -i "s/deb-src http:\/\/security\.debian\.org\/debian-security ${VERSION_CODENAME}\/updates main/deb http:\/\/security\.debian\.org\/debian-security ${VERSION_CODENAME}\/updates main contrib non-free/" /etc/apt/sources.list
+        sed -i "s/deb http:\/\/deb\.debian\.org\/debian ${VERSION_CODENAME}-backports main/deb http:\/\/deb\.debian\.org\/debian ${VERSION_CODENAME}-backports main contrib non-free/" /etc/apt/sources.list 
+        sed -i "s/deb-src http:\/\/deb\.debian\.org\/debian ${VERSION_CODENAME}-backports main/deb http:\/\/deb\.debian\.org\/debian ${VERSION_CODENAME}-backports main contrib non-free/" /etc/apt/sources.list
+        echo "Running apt-get update..."
+        apt-get update
+        package_list="${package_list} manpages-posix manpages-posix-dev"
+    else
+        apt_get_update_if_needed
+    fi
+
+    # Install libssl1.1 if available
+    if [[ ! -z $(apt-cache --names-only search ^libssl1.1$) ]]; then
+        package_list="${package_list}       libssl1.1"
+    fi
+    
+    # Install appropriate version of libssl1.0.x if available
+    libssl_package=$(dpkg-query -f '${db:Status-Abbrev}\t${binary:Package}\n' -W 'libssl1\.0\.?' 2>&1 || echo '')
+    if [ "$(echo "$LIlibssl_packageBSSL" | grep -o 'libssl1\.0\.[0-9]:' | uniq | sort | wc -l)" -eq 0 ]; then
+        if [[ ! -z $(apt-cache --names-only search ^libssl1.0.2$) ]]; then
+            # Debian 9
+            package_list="${package_list}       libssl1.0.2"
+        elif [[ ! -z $(apt-cache --names-only search ^libssl1.0.0$) ]]; then
+            # Ubuntu 18.04, 16.04, earlier
+            package_list="${package_list}       libssl1.0.0"
+        fi
+    fi
+
+    echo "Packages to verify are installed: ${package_list}"
+    apt-get -y install --no-install-recommends ${package_list} 2> >( grep -v 'debconf: delaying package configuration, since apt-utils is not installed' >&2 )
+        
+    # Install git if not already installed (may be more recent than distro version)
+    if ! type git > /dev/null 2>&1; then
+        apt-get -y install --no-install-recommends git
+    fi
+
+    PACKAGES_ALREADY_INSTALLED="true"
+fi
+
+# Get to latest versions of all packages
+if [ "${UPGRADE_PACKAGES}" = "true" ]; then
+    apt_get_update_if_needed
+    apt-get -y upgrade --no-install-recommends
+    apt-get autoremove -y
+fi
+
+# Ensure at least the en_US.UTF-8 UTF-8 locale is available.
+# Common need for both applications and things like the agnoster ZSH theme.
+if [ "${LOCALE_ALREADY_SET}" != "true" ] && ! grep -o -E '^\s*en_US.UTF-8\s+UTF-8' /etc/locale.gen > /dev/null; then
+    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen 
+    locale-gen
+    LOCALE_ALREADY_SET="true"
+fi
+
+# Create or update a non-root user to match UID/GID.
+if id -u ${USERNAME} > /dev/null 2>&1; then
+    # User exists, update if needed
+    if [ "${USER_GID}" != "automatic" ] && [ "$USER_GID" != "$(id -G $USERNAME)" ]; then 
+        groupmod --gid $USER_GID $USERNAME 
+        usermod --gid $USER_GID $USERNAME
+    fi
+    if [ "${USER_UID}" != "automatic" ] && [ "$USER_UID" != "$(id -u $USERNAME)" ]; then 
+        usermod --uid $USER_UID $USERNAME
+    fi
+else
+    # Create user
+    if [ "${USER_GID}" = "automatic" ]; then
+        groupadd $USERNAME
+    else
+        groupadd --gid $USER_GID $USERNAME
+    fi
+    if [ "${USER_UID}" = "automatic" ]; then 
+        useradd -s /bin/bash --gid $USERNAME -m $USERNAME
+    else
+        useradd -s /bin/bash --uid $USER_UID --gid $USERNAME -m $USERNAME
+    fi
+fi
+
+# Add add sudo support for non-root user
+if [ "${USERNAME}" != "root" ] && [ "${EXISTING_NON_ROOT_USER}" != "${USERNAME}" ]; then
+    echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME
+    chmod 0440 /etc/sudoers.d/$USERNAME
+    EXISTING_NON_ROOT_USER="${USERNAME}"
+fi
+
+# ** Shell customization section **
+if [ "${USERNAME}" = "root" ]; then 
+    user_rc_path="/root"
+else
+    user_rc_path="/home/${USERNAME}"
+fi
+
+# Restore user .bashrc defaults from skeleton file if it doesn't exist or is empty
+if [ ! -f "${user_rc_path}/.bashrc" ] || [ ! -s "${user_rc_path}/.bashrc" ] ; then
+    cp  /etc/skel/.bashrc "${user_rc_path}/.bashrc"
+fi
+
+# Restore user .profile defaults from skeleton file if it doesn't exist or is empty
+if  [ ! -f "${user_rc_path}/.profile" ] || [ ! -s "${user_rc_path}/.profile" ] ; then
+    cp  /etc/skel/.profile "${user_rc_path}/.profile"
+fi
+
+# .bashrc/.zshrc snippet
+rc_snippet="$(cat << 'EOF'
+
+if [ -z "${USER}" ]; then export USER=$(whoami); fi
+if [[ "${PATH}" != *"$HOME/.local/bin"* ]]; then export PATH="${PATH}:$HOME/.local/bin"; fi
+
+# Display optional first run image specific notice if configured and terminal is interactive
+if [ -t 1 ] && [[ "${TERM_PROGRAM}" = "vscode" || "${TERM_PROGRAM}" = "codespaces" ]] && [ ! -f "$HOME/.config/vscode-dev-containers/first-run-notice-already-displayed" ]; then
+    if [ -f "/usr/local/etc/vscode-dev-containers/first-run-notice.txt" ]; then
+        cat "/usr/local/etc/vscode-dev-containers/first-run-notice.txt"
+    elif [ -f "/workspaces/.codespaces/shared/first-run-notice.txt" ]; then
+        cat "/workspaces/.codespaces/shared/first-run-notice.txt"
+    fi
+    mkdir -p "$HOME/.config/vscode-dev-containers"
+    # Mark first run notice as displayed after 10s to avoid problems with fast terminal refreshes hiding it
+    ((sleep 10s; touch "$HOME/.config/vscode-dev-containers/first-run-notice-already-displayed") &)
+fi
+
+# Set the default git editor if not already set
+if [ -z "$(git config --get core.editor)" ] && [ -z "${GIT_EDITOR}" ]; then
+    if  [ "${TERM_PROGRAM}" = "vscode" ]; then
+        if [[ -n $(command -v code-insiders) &&  -z $(command -v code) ]]; then 
+            export GIT_EDITOR="code-insiders --wait"
+        else 
+            export GIT_EDITOR="code --wait"
+        fi
+    fi
+fi
+
+EOF
+)"
+
+# code shim, it fallbacks to code-insiders if code is not available
+cat << 'EOF' > /usr/local/bin/code
+#!/bin/sh
+
+get_in_path_except_current() {
+    which -a "$1" | grep -A1 "$0" | grep -v "$0"
+}
+
+code="$(get_in_path_except_current code)"
+
+if [ -n "$code" ]; then
+    exec "$code" "$@"
+elif [ "$(command -v code-insiders)" ]; then
+    exec code-insiders "$@"
+else
+    echo "code or code-insiders is not installed" >&2
+    exit 127
+fi
+EOF
+chmod +x /usr/local/bin/code
+
+# systemctl shim - tells people to use 'service' if systemd is not running
+cat << 'EOF' > /usr/local/bin/systemctl
+#!/bin/sh
+set -e
+if [ -d "/run/systemd/system" ]; then
+    exec /bin/systemctl/systemctl "$@"
+else
+    echo '\n"systemd" is not running in this container due to its overhead.\nUse the "service" command to start services intead. e.g.: \n\nservice --status-all'
+fi
+EOF
+chmod +x /usr/local/bin/systemctl
+
+# Codespaces bash and OMZ themes - partly inspired by https://github.com/ohmyzsh/ohmyzsh/blob/master/themes/robbyrussell.zsh-theme
+codespaces_bash="$(cat \
+<<'EOF'
+
+# Codespaces bash prompt theme
+__bash_prompt() {
+    local userpart='`export XIT=$? \
+        && [ ! -z "${GITHUB_USER}" ] && echo -n "\[\033[0;32m\]@${GITHUB_USER} " || echo -n "\[\033[0;32m\]\u " \
+        && [ "$XIT" -ne "0" ] && echo -n "\[\033[1;31m\]➜" || echo -n "\[\033[0m\]➜"`'
+    local gitbranch='`\
+        export BRANCH=$(git symbolic-ref --short HEAD 2>/dev/null || git rev-parse --short HEAD 2>/dev/null); \
+        if [ "${BRANCH}" != "" ]; then \
+            echo -n "\[\033[0;36m\](\[\033[1;31m\]${BRANCH}" \
+            && if git ls-files --error-unmatch -m --directory --no-empty-directory -o --exclude-standard ":/*" > /dev/null 2>&1; then \
+                    echo -n " \[\033[1;33m\]✗"; \
+               fi \
+            && echo -n "\[\033[0;36m\]) "; \
+        fi`'
+    local lightblue='\[\033[1;34m\]'
+    local removecolor='\[\033[0m\]'
+    PS1="${userpart} ${lightblue}\w ${gitbranch}${removecolor}\$ "
+    unset -f __bash_prompt
+}
+__bash_prompt
+
+EOF
+)"
+
+codespaces_zsh="$(cat \
+<<'EOF'
+# Codespaces zsh prompt theme
+__zsh_prompt() {
+    local prompt_username
+    if [ ! -z "${GITHUB_USER}" ]; then 
+        prompt_username="@${GITHUB_USER}"
+    else
+        prompt_username="%n"
+    fi
+    PROMPT="%{$fg[green]%}${prompt_username} %(?:%{$reset_color%}➜ :%{$fg_bold[red]%}➜ )" # User/exit code arrow
+    PROMPT+='%{$fg_bold[blue]%}%(5~|%-1~/…/%3~|%4~)%{$reset_color%} ' # cwd
+    PROMPT+='$(git_prompt_info)%{$fg[white]%}$ %{$reset_color%}' # Git status
+    unset -f __zsh_prompt
+}
+ZSH_THEME_GIT_PROMPT_PREFIX="%{$fg_bold[cyan]%}(%{$fg_bold[red]%}"
+ZSH_THEME_GIT_PROMPT_SUFFIX="%{$reset_color%} "
+ZSH_THEME_GIT_PROMPT_DIRTY=" %{$fg_bold[yellow]%}✗%{$fg_bold[cyan]%})"
+ZSH_THEME_GIT_PROMPT_CLEAN="%{$fg_bold[cyan]%})"
+__zsh_prompt
+
+EOF
+)"
+
+# Add notice that Oh My Bash! has been removed from images and how to provide information on how to install manually
+omb_readme="$(cat \
+<<'EOF'
+"Oh My Bash!" has been removed from this image in favor of a simple shell prompt. If you 
+still wish to use it, remove "~/.oh-my-bash" and install it from: https://github.com/ohmybash/oh-my-bash
+You may also want to consider "Bash-it" as an alternative: https://github.com/bash-it/bash-it
+See here for infomation on adding it to your image or dotfiles: https://aka.ms/codespaces/omb-remove
+EOF
+)"
+omb_stub="$(cat \
+<<'EOF'
+#!/usr/bin/env bash
+if [ -t 1 ]; then
+    cat $HOME/.oh-my-bash/README.md
+fi
+EOF
+)"
+
+# Add RC snippet and custom bash prompt
+if [ "${RC_SNIPPET_ALREADY_ADDED}" != "true" ]; then
+    echo "${rc_snippet}" >> /etc/bash.bashrc
+    echo "${codespaces_bash}" >> "${user_rc_path}/.bashrc"
+    echo 'export PROMPT_DIRTRIM=4' >> "${user_rc_path}/.bashrc"
+    if [ "${USERNAME}" != "root" ]; then
+        echo "${codespaces_bash}" >> "/root/.bashrc"
+        echo 'export PROMPT_DIRTRIM=4' >> "/root/.bashrc"
+    fi
+    chown ${USERNAME}:${USERNAME} "${user_rc_path}/.bashrc"
+    RC_SNIPPET_ALREADY_ADDED="true"
+fi
+
+# Add stub for Oh My Bash!
+if [ ! -d "${user_rc_path}/.oh-my-bash}" ] && [ "${INSTALL_OH_MYS}" = "true" ]; then
+    mkdir -p "${user_rc_path}/.oh-my-bash" "/root/.oh-my-bash"
+    echo "${omb_readme}" >> "${user_rc_path}/.oh-my-bash/README.md"
+    echo "${omb_stub}" >> "${user_rc_path}/.oh-my-bash/oh-my-bash.sh"
+    chmod +x "${user_rc_path}/.oh-my-bash/oh-my-bash.sh"
+    if [ "${USERNAME}" != "root" ]; then
+        echo "${omb_readme}" >> "/root/.oh-my-bash/README.md"
+        echo "${omb_stub}" >> "/root/.oh-my-bash/oh-my-bash.sh"
+        chmod +x "/root/.oh-my-bash/oh-my-bash.sh"
+    fi
+    chown -R "${USERNAME}:${USERNAME}" "${user_rc_path}/.oh-my-bash"
+fi
+
+# Optionally install and configure zsh and Oh My Zsh!
+if [ "${INSTALL_ZSH}" = "true" ]; then
+    if ! type zsh > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get install -y zsh
+    fi
+    if [ "${ZSH_ALREADY_INSTALLED}" != "true" ]; then
+        echo "${rc_snippet}" >> /etc/zsh/zshrc
+        ZSH_ALREADY_INSTALLED="true"
+    fi
+
+    # Adapted, simplified inline Oh My Zsh! install steps that adds, defaults to a codespaces theme.
+    # See https://github.com/ohmyzsh/ohmyzsh/blob/master/tools/install.sh for official script.
+    oh_my_install_dir="${user_rc_path}/.oh-my-zsh"
+    if [ ! -d "${oh_my_install_dir}" ] && [ "${INSTALL_OH_MYS}" = "true" ]; then
+        template_path="${oh_my_install_dir}/templates/zshrc.zsh-template"
+        user_rc_file="${user_rc_path}/.zshrc"
+        umask g-w,o-w
+        mkdir -p ${oh_my_install_dir}
+        git clone --depth=1 \
+            -c core.eol=lf \
+            -c core.autocrlf=false \
+            -c fsck.zeroPaddedFilemode=ignore \
+            -c fetch.fsck.zeroPaddedFilemode=ignore \
+            -c receive.fsck.zeroPaddedFilemode=ignore \
+            "https://github.com/ohmyzsh/ohmyzsh" "${oh_my_install_dir}" 2>&1
+        echo -e "$(cat "${template_path}")\nDISABLE_AUTO_UPDATE=true\nDISABLE_UPDATE_PROMPT=true" > ${user_rc_file}
+        sed -i -e 's/ZSH_THEME=.*/ZSH_THEME="codespaces"/g' ${user_rc_file}
+
+        mkdir -p ${oh_my_install_dir}/custom/themes
+        echo "${codespaces_zsh}" > "${oh_my_install_dir}/custom/themes/codespaces.zsh-theme"
+        # Shrink git while still enabling updates
+        cd "${oh_my_install_dir}"
+        git repack -a -d -f --depth=1 --window=1
+        # Copy to non-root user if one is specified
+        if [ "${USERNAME}" != "root" ]; then
+            cp -rf "${user_rc_file}" "${oh_my_install_dir}" /root
+            chown -R ${USERNAME}:${USERNAME} "${user_rc_path}"
+        fi
+    fi
+fi
+
+# Persist image metadata info, script if meta.env found in same directory
+meta_info_script="$(cat << 'EOF'
+#!/bin/sh
+. /usr/local/etc/vscode-dev-containers/meta.env
+
+# Minimal output
+if [ "$1" = "version" ] || [ "$1" = "image-version" ]; then
+    echo "${VERSION}"
+    exit 0
+elif [ "$1" = "release" ]; then
+    echo "${GIT_REPOSITORY_RELEASE}"
+    exit 0
+elif [ "$1" = "content" ] || [ "$1" = "content-url" ] || [ "$1" = "contents" ] || [ "$1" = "contents-url" ]; then
+    echo "${CONTENTS_URL}"
+    exit 0
+fi
+
+#Full output
+echo
+echo "Development container image information"
+echo
+if [ ! -z "${VERSION}" ]; then echo "- Image version: ${VERSION}"; fi
+if [ ! -z "${DEFINITION_ID}" ]; then echo "- Definition ID: ${DEFINITION_ID}"; fi
+if [ ! -z "${VARIANT}" ]; then echo "- Variant: ${VARIANT}"; fi
+if [ ! -z "${GIT_REPOSITORY}" ]; then echo "- Source code repository: ${GIT_REPOSITORY}"; fi
+if [ ! -z "${GIT_REPOSITORY_RELEASE}" ]; then echo "- Source code release/branch: ${GIT_REPOSITORY_RELEASE}"; fi
+if [ ! -z "${BUILD_TIMESTAMP}" ]; then echo "- Timestamp: ${BUILD_TIMESTAMP}"; fi
+if [ ! -z "${CONTENTS_URL}" ]; then echo && echo "More info: ${CONTENTS_URL}"; fi
+echo
+EOF
+)"
+if [ -f "${SCRIPT_DIR}/meta.env" ]; then
+    mkdir -p /usr/local/etc/vscode-dev-containers/
+    cp -f "${SCRIPT_DIR}/meta.env" /usr/local/etc/vscode-dev-containers/meta.env
+    echo "${meta_info_script}" > /usr/local/bin/devcontainer-info
+    chmod +x /usr/local/bin/devcontainer-info
+fi
+
+# Write marker file
+mkdir -p "$(dirname "${MARKER_FILE}")"
+echo -e "\
+    PACKAGES_ALREADY_INSTALLED=${PACKAGES_ALREADY_INSTALLED}\n\
+    LOCALE_ALREADY_SET=${LOCALE_ALREADY_SET}\n\
+    EXISTING_NON_ROOT_USER=${EXISTING_NON_ROOT_USER}\n\
+    RC_SNIPPET_ALREADY_ADDED=${RC_SNIPPET_ALREADY_ADDED}\n\
+    ZSH_ALREADY_INSTALLED=${ZSH_ALREADY_INSTALLED}" > "${MARKER_FILE}"
+
+echo "Done!"

.devcontainer/library-scripts/docker-debian.sh

@@ -0,0 +1,224 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./docker-debian.sh [enable non-root docker socket access flag] [source socket] [target socket] [non-root user] [use moby]
+
+ENABLE_NONROOT_DOCKER=${1:-"true"}
+SOURCE_SOCKET=${2:-"/var/run/docker-host.sock"}
+TARGET_SOCKET=${3:-"/var/run/docker.sock"}
+USERNAME=${4:-"automatic"}
+USE_MOBY=${5:-"true"}
+MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc"
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Determine the appropriate non-root user
+if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
+    USERNAME=""
+    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
+    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
+        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
+            USERNAME=${CURRENT_USER}
+            break
+        fi
+    done
+    if [ "${USERNAME}" = "" ]; then
+        USERNAME=root
+    fi
+elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
+    USERNAME=root
+fi
+
+# Get central common setting
+get_common_setting() {
+    if [ "${common_settings_file_loaded}" != "true" ]; then
+        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
+        common_settings_file_loaded=true
+    fi
+    if [ -f "/tmp/vsdc-settings.env" ]; then
+        local multi_line=""
+        if [ "$2" = "true" ]; then multi_line="-z"; fi
+        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
+        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
+    fi
+    echo "$1=${!1}"
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+# Ensure apt is in non-interactive to avoid prompts
+export DEBIAN_FRONTEND=noninteractive
+
+# Install dependencies
+check_packages apt-transport-https curl ca-certificates gnupg2
+
+# Install Docker / Moby CLI if not already installed
+if type docker > /dev/null 2>&1; then
+    echo "Docker / Moby CLI already installed."
+else
+    # Source /etc/os-release to get OS info
+    . /etc/os-release
+    if [ "${USE_MOBY}" = "true" ]; then
+        # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
+        get_common_setting MICROSOFT_GPG_KEYS_URI
+        curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg
+        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list
+        apt-get update
+        apt-get -y install --no-install-recommends moby-cli moby-buildx moby-compose
+    else
+        # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
+        curl -fsSL https://download.docker.com/linux/${ID}/gpg | gpg --dearmor > /usr/share/keyrings/docker-archive-keyring.gpg
+        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list
+        apt-get update
+        apt-get -y install --no-install-recommends docker-ce-cli
+    fi
+fi
+
+# Install Docker Compose if not already installed  and is on a supported architecture
+if type docker-compose > /dev/null 2>&1; then
+    echo "Docker Compose already installed."
+else
+    TARGET_COMPOSE_ARCH="$(uname -m)"
+    if [ "${TARGET_COMPOSE_ARCH}" = "amd64" ]; then
+        TARGET_COMPOSE_ARCH="x86_64"
+    fi
+    if [ "${TARGET_COMPOSE_ARCH}" != "x86_64" ]; then
+        # Use pip to get a version that runns on this architecture
+        if ! dpkg -s python3-minimal python3-pip libffi-dev python3-venv pipx > /dev/null 2>&1; then
+            apt_get_update_if_needed
+            apt-get -y install python3-minimal python3-pip libffi-dev python3-venv pipx
+        fi
+        export PIPX_HOME=/usr/local/pipx
+        mkdir -p ${PIPX_HOME}
+        export PIPX_BIN_DIR=/usr/local/bin
+        export PIP_CACHE_DIR=/tmp/pip-tmp/cache
+        pipx install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' docker-compose
+        rm -rf /tmp/pip-tmp
+    else 
+        LATEST_COMPOSE_VERSION=$(basename "$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/docker/compose/releases/latest)")
+        curl -fsSL "https://github.com/docker/compose/releases/download/${LATEST_COMPOSE_VERSION}/docker-compose-$(uname -s)-${TARGET_COMPOSE_ARCH}" -o /usr/local/bin/docker-compose
+        chmod +x /usr/local/bin/docker-compose
+    fi
+fi
+
+# If init file already exists, exit
+if [ -f "/usr/local/share/docker-init.sh" ]; then
+    exit 0
+fi
+
+# By default, make the source and target sockets the same
+if [ "${SOURCE_SOCKET}" != "${TARGET_SOCKET}" ]; then
+    touch "${SOURCE_SOCKET}"
+    ln -s "${SOURCE_SOCKET}" "${TARGET_SOCKET}"
+fi
+
+# Add a stub if not adding non-root user access, user is root
+if [ "${ENABLE_NONROOT_DOCKER}" = "false" ] || [ "${USERNAME}" = "root" ]; then
+    echo '/usr/bin/env bash -c "\$@"' > /usr/local/share/docker-init.sh
+    chmod +x /usr/local/share/docker-init.sh
+    exit 0
+fi
+
+# If enabling non-root access and specified user is found, setup socat and add script
+chown -h "${USERNAME}":root "${TARGET_SOCKET}"        
+if ! dpkg -s socat > /dev/null 2>&1; then
+    apt_get_update_if_needed
+    apt-get -y install socat
+fi
+tee /usr/local/share/docker-init.sh > /dev/null \
+<< EOF 
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+
+set -e
+
+SOCAT_PATH_BASE=/tmp/vscr-docker-from-docker
+SOCAT_LOG=\${SOCAT_PATH_BASE}.log
+SOCAT_PID=\${SOCAT_PATH_BASE}.pid
+
+# Wrapper function to only use sudo if not already root
+sudoIf()
+{
+    if [ "\$(id -u)" -ne 0 ]; then
+        sudo "\$@"
+    else
+        "\$@"
+    fi
+}
+
+# Log messages
+log()
+{
+    echo -e "[\$(date)] \$@" | sudoIf tee -a \${SOCAT_LOG} > /dev/null
+}
+
+echo -e "\n** \$(date) **" | sudoIf tee -a \${SOCAT_LOG} > /dev/null
+log "Ensuring ${USERNAME} has access to ${SOURCE_SOCKET} via ${TARGET_SOCKET}"
+
+# If enabled, try to add a docker group with the right GID. If the group is root, 
+# fall back on using socat to forward the docker socket to another unix socket so 
+# that we can set permissions on it without affecting the host.
+if [ "${ENABLE_NONROOT_DOCKER}" = "true" ] && [ "${SOURCE_SOCKET}" != "${TARGET_SOCKET}" ] && [ "${USERNAME}" != "root" ] && [ "${USERNAME}" != "0" ]; then
+    SOCKET_GID=\$(stat -c '%g' ${SOURCE_SOCKET})
+    if [ "\${SOCKET_GID}" != "0" ]; then
+        log "Adding user to group with GID \${SOCKET_GID}."
+        if [ "\$(cat /etc/group | grep :\${SOCKET_GID}:)" = "" ]; then
+            sudoIf groupadd --gid \${SOCKET_GID} docker-host
+        fi
+        # Add user to group if not already in it
+        if [ "\$(id ${USERNAME} | grep -E "groups.*(=|,)\${SOCKET_GID}\(")" = "" ]; then
+            sudoIf usermod -aG \${SOCKET_GID} ${USERNAME}
+        fi
+    else
+        # Enable proxy if not already running
+        if [ ! -f "\${SOCAT_PID}" ] || ! ps -p \$(cat \${SOCAT_PID}) > /dev/null; then
+            log "Enabling socket proxy."
+            log "Proxying ${SOURCE_SOCKET} to ${TARGET_SOCKET} for vscode"
+            sudoIf rm -rf ${TARGET_SOCKET}
+            (sudoIf socat UNIX-LISTEN:${TARGET_SOCKET},fork,mode=660,user=${USERNAME} UNIX-CONNECT:${SOURCE_SOCKET} 2>&1 | sudoIf tee -a \${SOCAT_LOG} > /dev/null & echo "\$!" | sudoIf tee \${SOCAT_PID} > /dev/null)
+        else
+            log "Socket proxy already running."
+        fi
+    fi
+    log "Success"
+fi
+
+# Execute whatever commands were passed in (if any). This allows us 
+# to set this script to ENTRYPOINT while still executing the default CMD.
+set +e
+exec "\$@"
+EOF
+chmod +x /usr/local/share/docker-init.sh
+chown ${USERNAME}:root /usr/local/share/docker-init.sh
+echo "Done!"

.devcontainer/library-scripts/docker-in-docker-debian.sh

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker-in-docker.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./docker-in-docker-debian.sh [enable non-root docker access flag] [non-root user] [use moby]
+
+ENABLE_NONROOT_DOCKER=${1:-"true"}
+USERNAME=${2:-"automatic"}
+USE_MOBY=${3:-"true"}
+MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc"
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Determine the appropriate non-root user
+if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
+    USERNAME=""
+    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
+    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
+        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
+            USERNAME=${CURRENT_USER}
+            break
+        fi
+    done
+    if [ "${USERNAME}" = "" ]; then
+        USERNAME=root
+    fi
+elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
+    USERNAME=root
+fi
+
+# Get central common setting
+get_common_setting() {
+    if [ "${common_settings_file_loaded}" != "true" ]; then
+        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
+        common_settings_file_loaded=true
+    fi
+    if [ -f "/tmp/vsdc-settings.env" ]; then
+        local multi_line=""
+        if [ "$2" = "true" ]; then multi_line="-z"; fi
+        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
+        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
+    fi
+    echo "$1=${!1}"
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+# Ensure apt is in non-interactive to avoid prompts
+export DEBIAN_FRONTEND=noninteractive
+
+# Install dependencies
+check_packages apt-transport-https curl ca-certificates lxc pigz iptables gnupg2
+
+# Swap to legacy iptables for compatibility
+if type iptables-legacy > /dev/null 2>&1; then
+    update-alternatives --set iptables /usr/sbin/iptables-legacy
+    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+fi
+
+# Install Docker / Moby CLI if not already installed
+if type docker > /dev/null 2>&1 && type dockerd > /dev/null 2>&1; then
+    echo "Docker / Moby CLI and Engine already installed."
+else
+    # Source /etc/os-release to get OS info
+    . /etc/os-release
+    if [ "${USE_MOBY}" = "true" ]; then
+        # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
+        get_common_setting MICROSOFT_GPG_KEYS_URI
+        curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg
+        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list
+        apt-get update
+        apt-get -y install --no-install-recommends moby-cli moby-buildx moby-compose moby-engine
+    else
+        # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
+        curl -fsSL https://download.docker.com/linux/${ID}/gpg | gpg --dearmor > /usr/share/keyrings/docker-archive-keyring.gpg
+        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list
+        apt-get update
+        apt-get -y install --no-install-recommends docker-ce-cli docker-ce
+    fi
+fi
+
+echo "Finished installing docker / moby"
+
+# Install Docker Compose if not already installed  and is on a supported architecture
+if type docker-compose > /dev/null 2>&1; then
+    echo "Docker Compose already installed."
+else
+    TARGET_COMPOSE_ARCH="$(uname -m)"
+    if [ "${TARGET_COMPOSE_ARCH}" = "amd64" ]; then
+        TARGET_COMPOSE_ARCH="x86_64"
+    fi
+    if [ "${TARGET_COMPOSE_ARCH}" != "x86_64" ]; then
+        # Use pip to get a version that runns on this architecture
+        if ! dpkg -s python3-minimal python3-pip libffi-dev python3-venv > /dev/null 2>&1; then
+            apt_get_update_if_needed
+            apt-get -y install python3-minimal python3-pip libffi-dev python3-venv
+        fi
+        export PIPX_HOME=/usr/local/pipx
+        mkdir -p ${PIPX_HOME}
+        export PIPX_BIN_DIR=/usr/local/bin
+        export PYTHONUSERBASE=/tmp/pip-tmp
+        export PIP_CACHE_DIR=/tmp/pip-tmp/cache
+        pipx_bin=pipx
+        if ! type pipx > /dev/null 2>&1; then
+            pip3 install --disable-pip-version-check --no-warn-script-location  --no-cache-dir --user pipx
+            pipx_bin=/tmp/pip-tmp/bin/pipx
+        fi
+        ${pipx_bin} install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' docker-compose
+        rm -rf /tmp/pip-tmp
+    else
+        LATEST_COMPOSE_VERSION=$(basename "$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/docker/compose/releases/latest)")
+        curl -fsSL "https://github.com/docker/compose/releases/download/${LATEST_COMPOSE_VERSION}/docker-compose-$(uname -s)-${TARGET_COMPOSE_ARCH}" -o /usr/local/bin/docker-compose
+        chmod +x /usr/local/bin/docker-compose
+    fi
+fi
+
+# If init file already exists, exit
+if [ -f "/usr/local/share/docker-init.sh" ]; then
+    echo "/usr/local/share/docker-init.sh already exists, so exiting."
+    exit 0
+fi
+echo "docker-init doesnt exist..."
+
+# Add user to the docker group
+if [ "${ENABLE_NONROOT_DOCKER}" = "true" ]; then
+    if ! getent group docker > /dev/null 2>&1; then
+        groupadd docker
+    fi
+
+    usermod -aG docker ${USERNAME}
+fi
+
+tee /usr/local/share/docker-init.sh > /dev/null \
+<< 'EOF'
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+
+sudoIf()
+{
+    if [ "$(id -u)" -ne 0 ]; then
+        sudo "$@"
+    else
+        "$@"
+    fi
+}
+
+# explicitly remove dockerd and containerd PID file to ensure that it can start properly if it was stopped uncleanly
+# ie: docker kill <ID>
+sudoIf find /run /var/run -iname 'docker*.pid' -delete || :
+sudoIf find /run /var/run -iname 'container*.pid' -delete || :
+
+set -e
+
+## Dind wrapper script from docker team
+# Maintained: https://github.com/moby/moby/blob/master/hack/dind
+
+export container=docker
+
+if [ -d /sys/kernel/security ] && ! sudoIf mountpoint -q /sys/kernel/security; then
+	sudoIf mount -t securityfs none /sys/kernel/security || {
+		echo >&2 'Could not mount /sys/kernel/security.'
+		echo >&2 'AppArmor detection and --privileged mode might break.'
+	}
+fi
+
+# Mount /tmp (conditionally)
+if ! sudoIf mountpoint -q /tmp; then
+	sudoIf mount -t tmpfs none /tmp
+fi
+
+# cgroup v2: enable nesting
+if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
+	# move the init process (PID 1) from the root group to the /init group,
+	# otherwise writing subtree_control fails with EBUSY.
+	sudoIf mkdir -p /sys/fs/cgroup/init
+	sudoIf echo 1 > /sys/fs/cgroup/init/cgroup.procs
+	# enable controllers
+	sudoIf sed -e 's/ / +/g' -e 's/^/+/' < /sys/fs/cgroup/cgroup.controllers \
+		> /sys/fs/cgroup/cgroup.subtree_control
+fi
+## Dind wrapper over.
+
+# Handle DNS
+set +e
+cat /etc/resolv.conf | grep -i 'internal.cloudapp.net'
+if [ $? -eq 0 ]
+then
+  echo "Setting dockerd Azure DNS."
+  CUSTOMDNS="--dns 168.63.129.16"
+else
+  echo "Not setting dockerd DNS manually."
+  CUSTOMDNS=""
+fi
+set -e
+
+# Start docker/moby engine
+( sudoIf dockerd $CUSTOMDNS > /tmp/dockerd.log 2>&1 ) &
+
+set +e
+
+# Execute whatever commands were passed in (if any). This allows us
+# to set this script to ENTRYPOINT while still executing the default CMD.
+exec "$@"
+EOF
+
+chmod +x /usr/local/share/docker-init.sh
+chown ${USERNAME}:root /usr/local/share/docker-init.sh

.devcontainer/library-scripts/git-from-src-debian.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/git-from-src.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./git-from-src-debian.sh [version] [use PPA if available]
+
+GIT_VERSION=${1:-"latest"}
+USE_PPA_IF_AVAILABLE=${2:-"false"}
+
+GIT_CORE_PPA_ARCHIVE_GPG_KEY=E1DD270288B4E6030699E45FA1715D88E1DF1F24
+GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
+keyserver hkps://keys.openpgp.org
+keyserver hkp://keyserver.pgp.com"
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Get central common setting
+get_common_setting() {
+    if [ "${common_settings_file_loaded}" != "true" ]; then
+        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
+        common_settings_file_loaded=true
+    fi
+    if [ -f "/tmp/vsdc-settings.env" ]; then
+        local multi_line=""
+        if [ "$2" = "true" ]; then multi_line="-z"; fi
+        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
+        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
+    fi
+    echo "$1=${!1}"
+}
+
+# Import the specified key in a variable name passed in as 
+receive_gpg_keys() {
+    get_common_setting $1
+    local keys=${!1}
+    get_common_setting GPG_KEY_SERVERS true
+    local keyring_args=""
+    if [ ! -z "$2" ]; then
+        mkdir -p "$(dirname \"$2\")"
+        keyring_args="--no-default-keyring --keyring $2"
+    fi
+
+    # Use a temporary locaiton for gpg keys to avoid polluting image
+    export GNUPGHOME="/tmp/tmp-gnupg"
+    mkdir -p ${GNUPGHOME}
+    chmod 700 ${GNUPGHOME}
+    echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
+    # GPG key download sometimes fails for some reason and retrying fixes it.
+    local retry_count=0
+    local gpg_ok="false"
+    set +e
+    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; 
+    do
+        echo "(*) Downloading GPG key..."
+        ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true"
+        if [ "${gpg_ok}" != "true" ]; then
+            echo "(*) Failed getting key, retring in 10s..."
+            (( retry_count++ ))
+            sleep 10s
+        fi
+    done
+    set -e
+    if [ "${gpg_ok}" = "false" ]; then
+        echo "(!) Failed to install rvm."
+        exit 1
+    fi
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+export DEBIAN_FRONTEND=noninteractive
+
+# Source /etc/os-release to get OS info
+. /etc/os-release
+# If ubuntu, PPAs allowed, and latest - install from there
+if ([ "${GIT_VERSION}" = "latest" ] || [ "${GIT_VERSION}" = "lts" ] || [ "${GIT_VERSION}" = "current" ]) && [ "${ID}" = "ubuntu" ] && [ "${USE_PPA_IF_AVAILABLE}" = "true" ]; then
+    echo "Using PPA to install latest git..."
+    check_packages apt-transport-https curl ca-certificates gnupg2
+    receive_gpg_keys GIT_CORE_PPA_ARCHIVE_GPG_KEY /usr/share/keyrings/gitcoreppa-archive-keyring.gpg
+    echo -e "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/gitcoreppa-archive-keyring.gpg] http://ppa.launchpad.net/git-core/ppa/ubuntu ${VERSION_CODENAME} main\ndeb-src [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/gitcoreppa-archive-keyring.gpg] http://ppa.launchpad.net/git-core/ppa/ubuntu ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/git-core-ppa.list
+    apt-get update
+    apt-get -y install --no-install-recommends git 
+    rm -rf "/tmp/tmp-gnupg"
+    exit 0
+fi
+
+# Install required packages to build if missing
+check_packages build-essential curl ca-certificates tar gettext libssl-dev zlib1g-dev libcurl?-openssl-dev libexpat1-dev
+
+# Partial version matching
+if [ "$(echo "${GIT_VERSION}" | grep -o '\.' | wc -l)" != "2" ]; then
+    requested_version="${GIT_VERSION}"
+    version_list="$(curl -sSL -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/git/git/tags" | grep -oP '"name":\s*"v\K[0-9]+\.[0-9]+\.[0-9]+"' | tr -d '"' | sort -rV )"
+    if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "lts" ] || [ "${requested_version}" = "current" ]; then
+        GIT_VERSION="$(echo "${version_list}" | head -n 1)"
+    else
+        set +e
+        GIT_VERSION="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
+        set -e
+    fi
+    if [ -z "${GIT_VERSION}" ] || ! echo "${version_list}" | grep "^${GIT_VERSION//./\\.}$" > /dev/null 2>&1; then
+        echo "Invalid git version: ${requested_version}" >&2
+        exit 1
+    fi
+fi
+
+echo "Downloading source for ${GIT_VERSION}..."
+curl -sL https://github.com/git/git/archive/v${GIT_VERSION}.tar.gz | tar -xzC /tmp 2>&1
+echo "Building..."
+cd /tmp/git-${GIT_VERSION}
+make -s prefix=/usr/local all && make -s prefix=/usr/local install 2>&1
+rm -rf /tmp/git-${GIT_VERSION}
+echo "Done!"

.devcontainer/library-scripts/github-debian.sh

@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/github.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./github-debian.sh [version]
+
+CLI_VERSION=${1:-"latest"}
+
+GITHUB_CLI_ARCHIVE_GPG_KEY=C99B11DEB97541F0
+GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
+keyserver hkps://keys.openpgp.org
+keyserver hkp://keyserver.pgp.com"
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Get central common setting
+get_common_setting() {
+    if [ "${common_settings_file_loaded}" != "true" ]; then
+        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
+        common_settings_file_loaded=true
+    fi
+    if [ -f "/tmp/vsdc-settings.env" ]; then
+        local multi_line=""
+        if [ "$2" = "true" ]; then multi_line="-z"; fi
+        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
+        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
+    fi
+    echo "$1=${!1}"
+}
+
+# Import the specified key in a variable name passed in as 
+receive_gpg_keys() {
+    get_common_setting $1
+    local keys=${!1}
+    get_common_setting GPG_KEY_SERVERS true
+
+    # Use a temporary locaiton for gpg keys to avoid polluting image
+    export GNUPGHOME="/tmp/tmp-gnupg"
+    mkdir -p ${GNUPGHOME}
+    chmod 700 ${GNUPGHOME}
+    echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
+    # GPG key download sometimes fails for some reason and retrying fixes it.
+    local retry_count=0
+    local gpg_ok="false"
+    set +e
+    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; 
+    do
+        echo "(*) Downloading GPG key..."
+        ( echo "${keys}" | xargs -n 1 gpg --recv-keys) 2>&1 && gpg_ok="true"
+        if [ "${gpg_ok}" != "true" ]; then
+            echo "(*) Failed getting key, retring in 10s..."
+            (( retry_count++ ))
+            sleep 10s
+        fi
+    done
+    set -e
+    if [ "${gpg_ok}" = "false" ]; then
+        echo "(!) Failed to install rvm."
+        exit 1
+    fi
+}
+
+# Figure out correct version of a three part version number is not passed
+find_version_from_git_tags() {
+    local variable_name=$1
+    local requested_version=${!variable_name}
+    if [ "${requested_version}" = "none" ]; then return; fi
+    local repository=$2
+    local prefix=${3:-"tags/v"}
+    local separator=${4:-"."}
+    local last_part_optional=${5:-"false"}    
+    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
+        local escaped_separator=${separator//./\\.}
+        local last_part
+        if [ "${last_part_optional}" = "true" ]; then
+            last_part="(${escaped_separator}[0-9]+)?"
+        else
+            last_part="${escaped_separator}[0-9]+"
+        fi
+        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
+        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
+        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
+            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
+        else
+            set +e
+            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
+            set -e
+        fi
+    fi
+    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
+        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
+        exit 1
+    fi
+    echo "${variable_name}=${!variable_name}"
+}
+
+# Import the specified key in a variable name passed in as 
+receive_gpg_keys() {
+    get_common_setting $1
+    local keys=${!1}
+    get_common_setting GPG_KEY_SERVERS true
+    local keyring_args=""
+    if [ ! -z "$2" ]; then
+        keyring_args="--no-default-keyring --keyring $2"
+    fi
+
+    # Use a temporary locaiton for gpg keys to avoid polluting image
+    export GNUPGHOME="/tmp/tmp-gnupg"
+    mkdir -p ${GNUPGHOME}
+    chmod 700 ${GNUPGHOME}
+    echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
+    # GPG key download sometimes fails for some reason and retrying fixes it.
+    local retry_count=0
+    local gpg_ok="false"
+    set +e
+    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; 
+    do
+        echo "(*) Downloading GPG key..."
+        ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true"
+        if [ "${gpg_ok}" != "true" ]; then
+            echo "(*) Failed getting key, retring in 10s..."
+            (( retry_count++ ))
+            sleep 10s
+        fi
+    done
+    set -e
+    if [ "${gpg_ok}" = "false" ]; then
+        echo "(!) Failed to install rvm."
+        exit 1
+    fi
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+export DEBIAN_FRONTEND=noninteractive
+
+# Install curl, apt-transport-https, curl, gpg, or dirmngr, git if missing
+check_packages curl ca-certificates apt-transport-https dirmngr gnupg2
+if ! type git > /dev/null 2>&1; then
+    apt_get_update_if_needed
+    apt-get -y install --no-install-recommends git
+fi
+
+# Soft version matching
+if [ "${CLI_VERSION}" != "latest" ] && [ "${CLI_VERSION}" != "lts" ] && [ "${CLI_VERSION}" != "stable" ]; then
+    find_version_from_git_tags CLI_VERSION "https://github.com/cli/cli"
+    version_suffix="=${CLI_VERSION}"
+else
+    version_suffix=""
+fi
+
+# Install the GitHub CLI
+echo "Downloading github CLI..."
+# Import key safely (new method rather than deprecated apt-key approach) and install
+. /etc/os-release
+receive_gpg_keys GITHUB_CLI_ARCHIVE_GPG_KEY /usr/share/keyrings/githubcli-archive-keyring.gpg
+echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/github-cli.list
+apt-get update
+apt-get -y install "gh${version_suffix}"
+rm -rf "/tmp/gh/gnupg"
+echo "Done!"

.devcontainer/library-scripts/go-debian.sh

@@ -0,0 +1,201 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/go.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./go-debian.sh [Go version] [GOROOT] [GOPATH] [non-root user] [Add GOPATH, GOROOT to rc files flag] [Install tools flag]
+
+TARGET_GO_VERSION=${1:-"latest"}
+TARGET_GOROOT=${2:-"/usr/local/go"}
+TARGET_GOPATH=${3:-"/go"}
+USERNAME=${4:-"automatic"}
+UPDATE_RC=${5:-"true"}
+INSTALL_GO_TOOLS=${6:-"true"}
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Ensure that login shells get the correct path if the user updated the PATH using ENV.
+rm -f /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+chmod +x /etc/profile.d/00-restore-env.sh
+
+# Determine the appropriate non-root user
+if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
+    USERNAME=""
+    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
+    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
+        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
+            USERNAME=${CURRENT_USER}
+            break
+        fi
+    done
+    if [ "${USERNAME}" = "" ]; then
+        USERNAME=root
+    fi
+elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
+    USERNAME=root
+fi
+
+updaterc() {
+    if [ "${UPDATE_RC}" = "true" ]; then
+        echo "Updating /etc/bash.bashrc and /etc/zsh/zshrc..."
+        echo -e "$1" >> /etc/bash.bashrc
+        if [ -f "/etc/zsh/zshrc" ]; then
+            echo -e "$1" >> /etc/zsh/zshrc
+        fi
+    fi
+}
+
+# Figure out correct version of a three part version number is not passed
+find_version_from_git_tags() {
+    local variable_name=$1
+    local requested_version=${!variable_name}
+    if [ "${requested_version}" = "none" ]; then return; fi
+    local repository=$2
+    local prefix=${3:-"tags/v"}
+    local separator=${4:-"."}
+    local last_part_optional=${5:-"false"}    
+    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
+        local escaped_separator=${separator//./\\.}
+        local last_part
+        if [ "${last_part_optional}" = "true" ]; then
+            last_part="(${escaped_separator}[0-9]+)?"
+        else
+            last_part="${escaped_separator}[0-9]+"
+        fi
+        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
+        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
+        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
+            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
+        else
+            set +e
+            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
+            set -e
+        fi
+    fi
+    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
+        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
+        exit 1
+    fi
+    echo "${variable_name}=${!variable_name}"
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+export DEBIAN_FRONTEND=noninteractive
+
+# Install curl, tar, git, other dependencies if missing
+check_packages curl ca-certificates tar g++ gcc libc6-dev make pkg-config
+if ! type git > /dev/null 2>&1; then
+    apt_get_update_if_needed
+    apt-get -y install --no-install-recommends git
+fi
+
+# Get closest match for version number specified
+find_version_from_git_tags TARGET_GO_VERSION "https://go.googlesource.com/go" "tags/go" "." "true"
+
+architecture="$(uname -m)"
+case $architecture in
+    x86_64) architecture="amd64";;
+    aarch64 | armv8*) architecture="arm64";;
+    aarch32 | armv7* | armvhf*) architecture="armv6l";;
+    i?86) architecture="386";;
+    *) echo "(!) Architecture $architecture unsupported"; exit 1 ;;
+esac
+
+# Install Go
+GO_INSTALL_SCRIPT="$(cat <<EOF
+    set -e
+    echo "Downloading Go ${TARGET_GO_VERSION}..."
+    curl -sSL -o /tmp/go.tar.gz "https://golang.org/dl/go${TARGET_GO_VERSION}.linux-${architecture}.tar.gz"
+    echo "Extracting Go ${TARGET_GO_VERSION}..."
+    tar -xzf /tmp/go.tar.gz -C "${TARGET_GOROOT}" --strip-components=1
+    rm -f /tmp/go.tar.gz
+EOF
+)"
+if [ "${TARGET_GO_VERSION}" != "none" ] && ! type go > /dev/null 2>&1; then
+    mkdir -p "${TARGET_GOROOT}" "${TARGET_GOPATH}" 
+    chown -R ${USERNAME} "${TARGET_GOROOT}" "${TARGET_GOPATH}"
+    su ${USERNAME} -c "${GO_INSTALL_SCRIPT}"
+else
+    echo "Go already installed. Skipping."
+fi
+
+# Install Go tools that are isImportant && !replacedByGopls based on
+# https://github.com/golang/vscode-go/blob/0ff533d408e4eb8ea54ce84d6efa8b2524d62873/src/goToolsInformation.ts
+# Exception `dlv-dap` is a copy of github.com/go-delve/delve/cmd/dlv built from the master.
+GO_TOOLS="\
+    golang.org/x/tools/gopls@latest \
+    honnef.co/go/tools/cmd/staticcheck@latest \
+    golang.org/x/lint/golint@latest \
+    github.com/mgechev/revive@latest \
+    github.com/uudashr/gopkgs/v2/cmd/gopkgs@latest \
+    github.com/ramya-rao-a/go-outline@latest \
+    github.com/go-delve/delve/cmd/dlv@latest \
+    github.com/golangci/golangci-lint/cmd/golangci-lint@latest"
+if [ "${INSTALL_GO_TOOLS}" = "true" ]; then
+    echo "Installing common Go tools..."
+    export PATH=${TARGET_GOROOT}/bin:${PATH}
+    mkdir -p /tmp/gotools /usr/local/etc/vscode-dev-containers ${TARGET_GOPATH}/bin
+    cd /tmp/gotools
+    export GOPATH=/tmp/gotools
+    export GOCACHE=/tmp/gotools/cache
+
+    # Use go get for versions of go under 1.17
+    go_install_command=install
+    if [[ "1.16" > "$(go version | grep -oP 'go\K[0-9]+\.[0-9]+(\.[0-9]+)?')" ]]; then
+        export GO111MODULE=on
+        go_install_command=get
+        echo "Go version < 1.17, using go get."
+    fi 
+
+    (echo "${GO_TOOLS}" | xargs -n 1 go ${go_install_command} -v )2>&1 | tee -a /usr/local/etc/vscode-dev-containers/go.log
+
+    # Move Go tools into path and clean up
+    mv /tmp/gotools/bin/* ${TARGET_GOPATH}/bin/
+
+    # install dlv-dap (dlv@master)
+    go ${go_install_command} -v github.com/go-delve/delve/cmd/dlv@master 2>&1 | tee -a /usr/local/etc/vscode-dev-containers/go.log
+    mv /tmp/gotools/bin/dlv ${TARGET_GOPATH}/bin/dlv-dap
+
+    rm -rf /tmp/gotools
+    chown -R ${USERNAME} "${TARGET_GOPATH}"
+fi
+
+# Add GOPATH variable and bin directory into PATH in bashrc/zshrc files (unless disabled)
+updaterc "$(cat << EOF
+export GOPATH="${TARGET_GOPATH}"
+if [[ "\${PATH}" != *"\${GOPATH}/bin"* ]]; then export PATH="\${PATH}:\${GOPATH}/bin"; fi
+export GOROOT="${TARGET_GOROOT}"
+if [[ "\${PATH}" != *"\${GOROOT}/bin"* ]]; then export PATH="\${PATH}:\${GOROOT}/bin"; fi
+EOF
+)"
+
+echo "Done!"
+

.devcontainer/library-scripts/k3s-debian.sh

@@ -0,0 +1,105 @@
+
+#!/usr/bin/env bash
+#
+# This is a replicated script.
+#
+# Syntax: ./k3s-debian.sh [k3s version] [k3s SHA256]
+
+set -e
+
+K3S_VERSION="${1:-"latest"}" # latest is also valid
+K3S_SHA256="${2:-"automatic"}"
+
+GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
+keyserver hkps://keys.openpgp.org
+keyserver hkp://keyserver.pgp.com"
+
+architecture="$(uname -m)"
+case $architecture in
+    x86_64) architecture="amd64";;
+    aarch64 | armv8*) architecture="arm64";;
+    aarch32 | armv7* | armvhf*) architecture="armhf";;
+    *) echo "(!) Architecture $architecture unsupported"; exit 1 ;;
+esac
+
+# Figure out correct version of a three part version number is not passed
+find_version_from_git_tags() {
+    local variable_name=$1
+    local requested_version=${!variable_name}
+    if [ "${requested_version}" = "none" ]; then return; fi
+    local repository=$2
+    local prefix=${3:-"tags/v"}
+    local separator=${4:-"."}
+    local last_part_optional=${5:-"false"}    
+    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
+        local escaped_separator=${separator//./\\.}
+        local last_part
+        if [ "${last_part_optional}" = "true" ]; then
+            last_part="(${escaped_separator}[0-9ks\+]+)?"
+        else
+            last_part="${escaped_separator}[0-9ks\+]+"
+        fi
+        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
+        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
+        echo $version_list
+        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
+            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
+        else
+            set +e
+            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s+]|$)")"
+            set -e
+        fi
+    fi
+    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
+        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
+        exit 1
+    fi
+    echo "${variable_name}=${!variable_name}"
+}
+
+# Install K3s, verify checksum
+if [ "${K3S_VERSION}" != "none" ]; then
+    echo "Downloading k3s..."
+    urlPrefix=
+    if [ "${K3S_VERSION}" = "latest" ] || [ "${K3S_VERSION}" = "lts" ] || [ "${K3S_VERSION}" = "current" ] || [ "${K3S_VERSION}" = "stable" ]; then
+        K3S_VERSION="latest"
+        urlPrefix="https://github.com/k3s-io/k3s/releases/latest/download"
+    else
+        find_version_from_git_tags K3S_VERSION https://github.com/k3s-io/k3s
+        if [ "${K3S_VERSION::1}" != "v" ]; then
+            K3S_VERSION="v${K3S_VERSION}"
+        fi
+        urlPrefix="https://github.com/k3s-io/k3s/releases/download/${K3S_VERSION}"
+    fi
+    
+    # URL encode plus sign
+    K3S_VERSION="$(echo $K3S_VERSION | sed --expression='s/+/%2B/g')"
+
+    # latest is also valid in the download URLs
+    downloadUrl="${urlPrefix}/k3s${architecture}"
+    if [ "${architecture}" = "amd64" ]; then
+        downloadUrl="${urlPrefix}/k3s"
+    fi
+
+    curl -sSL -o /usr/local/bin/k3s "${downloadUrl}"
+    chmod 0755 /usr/local/bin/k3s
+
+    if [ "$K3S_SHA256" = "automatic" ]; then
+
+        shaUrl="${urlPrefix}/sha256sum-${architecture}.txt"
+        if [ "${architecture}" = "armhf" ]; then
+            shaUrl="${urlPrefix}/sha256sum-arm.txt"
+        fi
+
+        # Manifest contains image hashes, but we only need the binary
+        K3S_SHA256="$(curl -sSL $shaUrl | grep -P '(^|\s)\Kk3s(?=\s|$)' | cut -d ' ' -f1 )"
+    fi
+    echo $K3S_SHA256
+    ([ "${K3S_SHA256}" = "dev-mode" ] || (echo "${K3S_SHA256} */usr/local/bin/k3s" | sha256sum -c -))
+    if ! type k3s > /dev/null 2>&1; then
+        echo '(!) k3s installation failed!'
+        exit 1
+    fi
+fi
+
+echo -e "\nDone!"

.devcontainer/library-scripts/kubectl-helm-debian.sh

@@ -0,0 +1,218 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/kubectl-helm.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./kubectl-helm-debian.sh [kubectl verison] [Helm version] [minikube version] [kubectl SHA256] [Helm SHA256] [minikube SHA256]
+
+set -e
+
+KUBECTL_VERSION="${1:-"latest"}"
+HELM_VERSION="${2:-"latest"}"
+MINIKUBE_VERSION="${3:-"none"}" # latest is also valid
+KUBECTL_SHA256="${4:-"automatic"}"
+HELM_SHA256="${5:-"automatic"}"
+MINIKUBE_SHA256="${6:-"automatic"}"
+
+HELM_GPG_KEYS_URI="https://raw.githubusercontent.com/helm/helm/main/KEYS"
+GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
+keyserver hkps://keys.openpgp.org
+keyserver hkp://keyserver.pgp.com"
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Get central common setting
+get_common_setting() {
+    if [ "${common_settings_file_loaded}" != "true" ]; then
+        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
+        common_settings_file_loaded=true
+    fi
+    if [ -f "/tmp/vsdc-settings.env" ]; then
+        local multi_line=""
+        if [ "$2" = "true" ]; then multi_line="-z"; fi
+        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
+        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
+    fi
+    echo "$1=${!1}"
+}
+
+# Figure out correct version of a three part version number is not passed
+find_version_from_git_tags() {
+    local variable_name=$1
+    local requested_version=${!variable_name}
+    if [ "${requested_version}" = "none" ]; then return; fi
+    local repository=$2
+    local prefix=${3:-"tags/v"}
+    local separator=${4:-"."}
+    local last_part_optional=${5:-"false"}    
+    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
+        local escaped_separator=${separator//./\\.}
+        local last_part
+        if [ "${last_part_optional}" = "true" ]; then
+            last_part="(${escaped_separator}[0-9]+)?"
+        else
+            last_part="${escaped_separator}[0-9]+"
+        fi
+        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
+        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
+        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
+            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
+        else
+            set +e
+            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
+            set -e
+        fi
+    fi
+    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
+        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
+        exit 1
+    fi
+    echo "${variable_name}=${!variable_name}"
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+# Ensure apt is in non-interactive to avoid prompts
+export DEBIAN_FRONTEND=noninteractive
+
+# Install dependencies
+check_packages curl ca-certificates coreutils gnupg2 dirmngr bash-completion
+if ! type git > /dev/null 2>&1; then
+    apt_get_update_if_needed
+    apt-get -y install --no-install-recommends git
+fi
+
+architecture="$(uname -m)"
+case $architecture in
+    x86_64) architecture="amd64";;
+    aarch64 | armv8*) architecture="arm64";;
+    aarch32 | armv7* | armvhf*) architecture="arm";;
+    i?86) architecture="386";;
+    *) echo "(!) Architecture $architecture unsupported"; exit 1 ;;
+esac
+
+# Install the kubectl, verify checksum
+echo "Downloading kubectl..."
+if [ "${KUBECTL_VERSION}" = "latest" ] || [ "${KUBECTL_VERSION}" = "lts" ] || [ "${KUBECTL_VERSION}" = "current" ] || [ "${KUBECTL_VERSION}" = "stable" ]; then
+    KUBECTL_VERSION="$(curl -sSL https://dl.k8s.io/release/stable.txt)"
+else
+    find_version_from_git_tags KUBECTL_VERSION https://github.com/kubernetes/kubernetes
+fi
+if [ "${KUBECTL_VERSION::1}" != 'v' ]; then
+    KUBECTL_VERSION="v${KUBECTL_VERSION}"
+fi
+curl -sSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${architecture}/kubectl"
+chmod 0755 /usr/local/bin/kubectl
+if [ "$KUBECTL_SHA256" = "automatic" ]; then
+    KUBECTL_SHA256="$(curl -sSL "https://dl.k8s.io/${KUBECTL_VERSION}/bin/linux/${architecture}/kubectl.sha256")"
+fi
+([ "${KUBECTL_SHA256}" = "dev-mode" ] || (echo "${KUBECTL_SHA256} */usr/local/bin/kubectl" | sha256sum -c -))
+if ! type kubectl > /dev/null 2>&1; then
+    echo '(!) kubectl installation failed!'
+    exit 1
+fi
+
+# kubectl bash completion
+kubectl completion bash > /etc/bash_completion.d/kubectl
+
+# kubectl zsh completion
+mkdir -p /home/${USERNAME}/.oh-my-zsh/completions
+kubectl completion zsh > /home/${USERNAME}/.oh-my-zsh/completions/_kubectl
+
+# Install Helm, verify signature and checksum
+echo "Downloading Helm..."
+find_version_from_git_tags HELM_VERSION "https://github.com/helm/helm"
+if [ "${HELM_VERSION::1}" != 'v' ]; then
+    HELM_VERSION="v${HELM_VERSION}"
+fi
+mkdir -p /tmp/helm
+helm_filename="helm-${HELM_VERSION}-linux-${architecture}.tar.gz"
+tmp_helm_filename="/tmp/helm/${helm_filename}"
+curl -sSL "https://get.helm.sh/${helm_filename}" -o "${tmp_helm_filename}"
+curl -sSL "https://github.com/helm/helm/releases/download/${HELM_VERSION}/${helm_filename}.asc" -o "${tmp_helm_filename}.asc"
+export GNUPGHOME="/tmp/helm/gnupg"
+mkdir -p "${GNUPGHOME}"
+chmod 700 ${GNUPGHOME}
+get_common_setting HELM_GPG_KEYS_URI
+get_common_setting GPG_KEY_SERVERS true
+curl -sSL "${HELM_GPG_KEYS_URI}" -o /tmp/helm/KEYS
+echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
+gpg -q --import "/tmp/helm/KEYS"
+if ! gpg --verify "${tmp_helm_filename}.asc" > ${GNUPGHOME}/verify.log 2>&1; then
+    echo "Verification failed!"
+    cat /tmp/helm/gnupg/verify.log
+    exit 1
+fi
+if [ "${HELM_SHA256}" = "automatic" ]; then
+    curl -sSL "https://get.helm.sh/${helm_filename}.sha256" -o "${tmp_helm_filename}.sha256"
+    curl -sSL "https://github.com/helm/helm/releases/download/${HELM_VERSION}/${helm_filename}.sha256.asc" -o "${tmp_helm_filename}.sha256.asc"
+    if ! gpg --verify "${tmp_helm_filename}.sha256.asc" > /tmp/helm/gnupg/verify.log 2>&1; then
+        echo "Verification failed!"
+        cat /tmp/helm/gnupg/verify.log
+        exit 1
+    fi
+    HELM_SHA256="$(cat "${tmp_helm_filename}.sha256")"
+fi
+([ "${HELM_SHA256}" = "dev-mode" ] || (echo "${HELM_SHA256} *${tmp_helm_filename}" | sha256sum -c -))
+tar xf "${tmp_helm_filename}" -C /tmp/helm
+mv -f "/tmp/helm/linux-${architecture}/helm" /usr/local/bin/
+chmod 0755 /usr/local/bin/helm
+rm -rf /tmp/helm
+if ! type helm > /dev/null 2>&1; then
+    echo '(!) Helm installation failed!'
+    exit 1
+fi
+
+# Install Minikube, verify checksum
+if [ "${MINIKUBE_VERSION}" != "none" ]; then
+    echo "Downloading minikube..."
+    if [ "${MINIKUBE_VERSION}" = "latest" ] || [ "${MINIKUBE_VERSION}" = "lts" ] || [ "${MINIKUBE_VERSION}" = "current" ] || [ "${MINIKUBE_VERSION}" = "stable" ]; then
+        MINIKUBE_VERSION="latest"
+    else
+        find_version_from_git_tags MINIKUBE_VERSION https://github.com/kubernetes/minikube
+        if [ "${MINIKUBE_VERSION::1}" != "v" ]; then
+            MINIKUBE_VERSION="v${MINIKUBE_VERSION}"
+        fi
+    fi
+    # latest is also valid in the download URLs 
+    curl -sSL -o /usr/local/bin/minikube "https://storage.googleapis.com/minikube/releases/${MINIKUBE_VERSION}/minikube-linux-${architecture}"    
+    chmod 0755 /usr/local/bin/minikube
+    if [ "$MINIKUBE_SHA256" = "automatic" ]; then
+        MINIKUBE_SHA256="$(curl -sSL "https://storage.googleapis.com/minikube/releases/${MINIKUBE_VERSION}/minikube-linux-${architecture}.sha256")"
+    fi
+    ([ "${MINIKUBE_SHA256}" = "dev-mode" ] || (echo "${MINIKUBE_SHA256} */usr/local/bin/minikube" | sha256sum -c -))
+    if ! type minikube > /dev/null 2>&1; then
+        echo '(!) minikube installation failed!'
+        exit 1
+    fi
+fi
+
+if ! type docker > /dev/null 2>&1; then
+    echo -e '\n(*) Warning: The docker command was not found.\n\nYou can use one of the following scripts to install it:\n\nhttps://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker-in-docker.md\n\nor\n\nhttps://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker.md'
+fi
+
+echo -e "\nDone!"

.devcontainer/library-scripts/meta.env

@@ -0,0 +1 @@
+VERSION='dev'

.devcontainer/library-scripts/node-debian.sh

@@ -0,0 +1,141 @@
+#!/bin/bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/node.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./node-debian.sh [directory to install nvm] [node version to install (use "none" to skip)] [non-root user] [Update rc files flag]
+
+export NVM_DIR=${1:-"/usr/local/share/nvm"}
+export NODE_VERSION=${2:-"lts"}
+USERNAME=${3:-"automatic"}
+UPDATE_RC=${4:-"true"}
+export NVM_VERSION="0.38.0"
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Ensure that login shells get the correct path if the user updated the PATH using ENV.
+rm -f /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+chmod +x /etc/profile.d/00-restore-env.sh
+
+# Determine the appropriate non-root user
+if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
+    USERNAME=""
+    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
+    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
+        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
+            USERNAME=${CURRENT_USER}
+            break
+        fi
+    done
+    if [ "${USERNAME}" = "" ]; then
+        USERNAME=root
+    fi
+elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
+    USERNAME=root
+fi
+
+updaterc() {
+    if [ "${UPDATE_RC}" = "true" ]; then
+        echo "Updating /etc/bash.bashrc and /etc/zsh/zshrc..."
+        echo -e "$1" >> /etc/bash.bashrc
+        if [ -f "/etc/zsh/zshrc" ]; then
+            echo -e "$1" >> /etc/zsh/zshrc
+        fi
+    fi
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+# Ensure apt is in non-interactive to avoid prompts
+export DEBIAN_FRONTEND=noninteractive
+
+# Install dependencies
+check_packages apt-transport-https curl ca-certificates tar gnupg2
+
+# Install yarn
+if type yarn > /dev/null 2>&1; then
+    echo "Yarn already installed."
+else
+    # Import key safely (new method rather than deprecated apt-key approach) and install
+    curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/yarn-archive-keyring.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list
+    apt-get update
+    apt-get -y install --no-install-recommends yarn
+fi
+
+# Adjust node version if required
+if [ "${NODE_VERSION}" = "none" ]; then
+    export NODE_VERSION=
+elif [ "${NODE_VERSION}" = "lts" ]; then
+    export NODE_VERSION="lts/*"
+fi
+
+# Install the specified node version if NVM directory already exists, then exit
+if [ -d "${NVM_DIR}" ]; then
+    echo "NVM already installed."
+    if [ "${NODE_VERSION}" != "" ]; then
+       su ${USERNAME} -c ". $NVM_DIR/nvm.sh && nvm install ${NODE_VERSION} && nvm clear-cache"
+    fi
+    exit 0
+fi
+
+# Create nvm group, nvm dir, and set sticky bit
+if ! cat /etc/group | grep -e "^nvm:" > /dev/null 2>&1; then
+    groupadd -r nvm
+fi
+umask 0002
+usermod -a -G nvm ${USERNAME}
+mkdir -p ${NVM_DIR}
+chown :nvm ${NVM_DIR}
+chmod g+s ${NVM_DIR}
+su ${USERNAME} -c "$(cat << EOF
+    set -e
+    umask 0002
+    # Do not update profile - we'll do this manually
+    export PROFILE=/dev/null
+    curl -so- https://raw.githubusercontent.com/nvm-sh/nvm/v${NVM_VERSION}/install.sh | bash 
+    source ${NVM_DIR}/nvm.sh
+    if [ "${NODE_VERSION}" != "" ]; then
+        nvm alias default ${NODE_VERSION}
+    fi
+    nvm clear-cache 
+EOF
+)" 2>&1
+# Update rc files
+if [ "${UPDATE_RC}" = "true" ]; then
+updaterc "$(cat <<EOF
+export NVM_DIR="${NVM_DIR}"
+[ -s "\$NVM_DIR/nvm.sh" ] && . "\$NVM_DIR/nvm.sh"
+[ -s "\$NVM_DIR/bash_completion" ] && . "\$NVM_DIR/bash_completion"
+EOF
+)"
+fi 
+
+echo "Done!"

.devcontainer/library-scripts/python-debian.sh

@@ -0,0 +1,307 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/python.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./python-debian.sh [Python Version] [Python intall path] [PIPX_HOME] [non-root user] [Update rc files flag] [install tools]
+
+PYTHON_VERSION=${1:-"latest"}
+PYTHON_INSTALL_PATH=${2:-"/usr/local/python"}
+export PIPX_HOME=${3:-"/usr/local/py-utils"}
+USERNAME=${4:-"automatic"}
+UPDATE_RC=${5:-"true"}
+INSTALL_PYTHON_TOOLS=${6:-"true"}
+USE_PPA_IF_AVAILABLE=${7:-"true"}
+
+DEADSNAKES_PPA_ARCHIVE_GPG_KEY="F23C5A6CF475977595C89F51BA6932366A755776"
+PYTHON_SOURCE_GPG_KEYS="64E628F8D684696D B26995E310250568 2D347EA6AA65421D FB9921286F5E1540 3A5CA953F73C700D 04C367C218ADD4FF 0EDDC5F26A45C816 6AF053F07D9DC8D2 C9BE28DEE6DF025C 126EB563A74B06BF D9866941EA5BBD71 ED9D77D5"
+GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
+keyserver hkps://keys.openpgp.org
+keyserver hkp://keyserver.pgp.com"
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Ensure that login shells get the correct path if the user updated the PATH using ENV.
+rm -f /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+chmod +x /etc/profile.d/00-restore-env.sh
+
+# Determine the appropriate non-root user
+if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
+    USERNAME=""
+    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
+    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
+        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
+            USERNAME=${CURRENT_USER}
+            break
+        fi
+    done
+    if [ "${USERNAME}" = "" ]; then
+        USERNAME=root
+    fi
+elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
+    USERNAME=root
+fi
+
+updaterc() {
+    if [ "${UPDATE_RC}" = "true" ]; then
+        echo "Updating /etc/bash.bashrc and /etc/zsh/zshrc..."
+        echo -e "$1" >> /etc/bash.bashrc
+        if [ -f "/etc/zsh/zshrc" ]; then
+            echo -e "$1" >> /etc/zsh/zshrc
+        fi
+    fi
+}
+
+# Get central common setting
+get_common_setting() {
+    if [ "${common_settings_file_loaded}" != "true" ]; then
+        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
+        common_settings_file_loaded=true
+    fi
+    if [ -f "/tmp/vsdc-settings.env" ]; then
+        local multi_line=""
+        if [ "$2" = "true" ]; then multi_line="-z"; fi
+        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
+        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
+    fi
+    echo "$1=${!1}"
+}
+
+# Import the specified key in a variable name passed in as 
+receive_gpg_keys() {
+    get_common_setting $1
+    local keys=${!1}
+    get_common_setting GPG_KEY_SERVERS true
+    local keyring_args=""
+    if [ ! -z "$2" ]; then
+        mkdir -p "$(dirname \"$2\")"
+        keyring_args="--no-default-keyring --keyring $2"
+    fi
+
+    # Use a temporary locaiton for gpg keys to avoid polluting image
+    export GNUPGHOME="/tmp/tmp-gnupg"
+    mkdir -p ${GNUPGHOME}
+    chmod 700 ${GNUPGHOME}
+    echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
+    # GPG key download sometimes fails for some reason and retrying fixes it.
+    local retry_count=0
+    local gpg_ok="false"
+    set +e
+    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; 
+    do
+        echo "(*) Downloading GPG key..."
+        ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true"
+        if [ "${gpg_ok}" != "true" ]; then
+            echo "(*) Failed getting key, retring in 10s..."
+            (( retry_count++ ))
+            sleep 10s
+        fi
+    done
+    set -e
+    if [ "${gpg_ok}" = "false" ]; then
+        echo "(!) Failed to install rvm."
+        exit 1
+    fi
+}
+
+# Figure out correct version of a three part version number is not passed
+find_version_from_git_tags() {
+    local variable_name=$1
+    local requested_version=${!variable_name}
+    if [ "${requested_version}" = "none" ]; then return; fi
+    local repository=$2
+    local prefix=${3:-"tags/v"}
+    local separator=${4:-"."}
+    local last_part_optional=${5:-"false"}    
+    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
+        local escaped_separator=${separator//./\\.}
+        local last_part
+        if [ "${last_part_optional}" = "true" ]; then
+            last_part="(${escaped_separator}[0-9]+)?"
+        else
+            last_part="${escaped_separator}[0-9]+"
+        fi
+        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
+        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
+        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
+            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
+        else
+            set +e
+            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
+            set -e
+        fi
+    fi
+    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
+        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
+        exit 1
+    fi
+    echo "${variable_name}=${!variable_name}"
+}
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+install_from_ppa() {
+    local requested_version="python${PYTHON_VERSION}"
+    echo "Using PPA to install Python..."
+    check_packages apt-transport-https curl ca-certificates gnupg2
+    receive_gpg_keys DEADSNAKES_PPA_ARCHIVE_GPG_KEY /usr/share/keyrings/deadsnakes-archive-keyring.gpg 
+    echo -e "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/deadsnakes-archive-keyring.gpg] http://ppa.launchpad.net/deadsnakes/ppa/ubuntu ${VERSION_CODENAME} main\ndeb-src [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/deadsnakes-archive-keyring.gpg] http://ppa.launchpad.net/deadsnakes/ppa/ubuntu ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/deadsnakes-ppa.list
+    apt-get update
+    if [ "${PYTHON_VERSION}" = "latest" ] || [ "${PYTHON_VERSION}" = "current" ] || [ "${PYTHON_VERSION}" = "lts" ]; then
+        requested_version="$(apt-cache search '^python3\.[0-9]$' | grep -oE '^python3\.[0-9]' | sort -rV | head -n 1)"
+        echo "Using ${requested_version} in place of ${PYTHON_VERSION}."
+    fi
+    apt-get -y install ${requested_version}
+    rm -rf /tmp/tmp-gnupg
+    exit 0
+}
+
+install_from_source() {
+    if [ -d "${PYTHON_INSTALL_PATH}" ]; then
+        echo "Path ${PYTHON_INSTALL_PATH} already exists. Remove this existing path or select a different one."
+        exit 1
+    else
+        echo "Building Python ${PYTHON_VERSION} from source..."
+        # Install prereqs if missing
+        check_packages curl ca-certificates tar make build-essential libssl-dev zlib1g-dev \
+                    wget libbz2-dev libreadline-dev libxml2-dev xz-utils tk-dev gnupg2 \
+                    libxmlsec1-dev libsqlite3-dev libffi-dev liblzma-dev llvm dirmngr
+        if ! type git > /dev/null 2>&1; then
+            apt_get_update_if_needed
+            apt-get -y install --no-install-recommends git
+        fi
+
+        # Find version using soft match
+        find_version_from_git_tags PYTHON_VERSION "https://github.com/python/cpython"
+
+        # Download tgz of source
+        mkdir -p /tmp/python-src "${PYTHON_INSTALL_PATH}"
+        cd /tmp/python-src
+        TGZ_FILENAME="Python-${PYTHON_VERSION}.tgz"
+        TGZ_URL="https://www.python.org/ftp/python/${PYTHON_VERSION}/${TGZ_FILENAME}"
+        echo "Downloading ${TGZ_FILENAME}..."
+        curl -sSL -o "/tmp/python-src/${TGZ_FILENAME}" "${TGZ_URL}"
+
+        # Verify signature
+        if [ "${SKIP_SIGNATURE_CHECK}" != "true" ]; then
+            receive_gpg_keys PYTHON_SOURCE_GPG_KEYS
+            echo "Downloading ${TGZ_FILENAME}.asc..."
+            curl -sSL -o "/tmp/python-src/${TGZ_FILENAME}.asc" "${TGZ_URL}.asc"
+            gpg --verify "${TGZ_FILENAME}.asc"
+        fi
+
+        # Update min protocol for testing only - https://bugs.python.org/issue41561
+        cp /etc/ssl/openssl.cnf /tmp/python-src/
+        sed -i -E 's/MinProtocol[=\ ]+.*/MinProtocol = TLSv1.0/g' /tmp/python-src/openssl.cnf
+        export OPENSSL_CONF=/tmp/python-src/openssl.cnf
+
+        # Untar and build
+        tar -xzf "/tmp/python-src/${TGZ_FILENAME}" -C "/tmp/python-src" --strip-components=1
+        ./configure --prefix="${PYTHON_INSTALL_PATH}" --enable-optimizations --with-ensurepip=install
+        make -j 8
+        make install
+        cd /tmp
+        rm -rf /tmp/python-src ${GNUPGHOME} /tmp/vscdc-settings.env
+        chown -R ${USERNAME} "${PYTHON_INSTALL_PATH}"
+        ln -s ${PYTHON_INSTALL_PATH}/bin/python3 ${PYTHON_INSTALL_PATH}/bin/python
+        ln -s ${PYTHON_INSTALL_PATH}/bin/pip3 ${PYTHON_INSTALL_PATH}/bin/pip
+        ln -s ${PYTHON_INSTALL_PATH}/bin/idle3 ${PYTHON_INSTALL_PATH}/bin/idle
+        ln -s ${PYTHON_INSTALL_PATH}/bin/pydoc3 ${PYTHON_INSTALL_PATH}/bin/pydoc
+        ln -s ${PYTHON_INSTALL_PATH}/bin/python3-config ${PYTHON_INSTALL_PATH}/bin/python-config
+        updaterc "export PATH=${PYTHON_INSTALL_PATH}/bin:\${PATH}"
+    fi
+}
+
+# Ensure apt is in non-interactive to avoid prompts
+export DEBIAN_FRONTEND=noninteractive
+
+# Install python from source if needed
+if [ "${PYTHON_VERSION}" != "none" ]; then
+    # Source /etc/os-release to get OS info
+    . /etc/os-release
+    # If ubuntu, PPAs allowed - install from there
+    if [ "${ID}" = "ubuntu" ] && [ "${USE_PPA_IF_AVAILABLE}" = "true" ]; then
+        install_from_ppa
+    else
+        install_from_source
+    fi
+fi
+
+# If not installing python tools, exit
+if [ "${INSTALL_PYTHON_TOOLS}" != "true" ]; then
+    echo "Done!"
+    exit 0;
+fi
+
+DEFAULT_UTILS="\
+    pylint \
+    flake8 \
+    autopep8 \
+    black \
+    yapf \
+    mypy \
+    pydocstyle \
+    pycodestyle \
+    bandit \
+    pipenv \
+    virtualenv"
+
+export PIPX_BIN_DIR=${PIPX_HOME}/bin
+export PATH=${PYTHON_INSTALL_PATH}/bin:${PIPX_BIN_DIR}:${PATH}
+
+# Update pip
+echo "Updating pip..."
+python3 -m pip install --no-cache-dir --upgrade pip
+
+# Create pipx group, dir, and set sticky bit
+if ! cat /etc/group | grep -e "^pipx:" > /dev/null 2>&1; then
+    groupadd -r pipx
+fi
+usermod -a -G pipx ${USERNAME}
+umask 0002
+mkdir -p ${PIPX_BIN_DIR}
+chown :pipx ${PIPX_HOME} ${PIPX_BIN_DIR}
+chmod g+s ${PIPX_HOME} ${PIPX_BIN_DIR}
+
+# Install tools
+echo "Installing Python tools..."
+export PYTHONUSERBASE=/tmp/pip-tmp
+export PIP_CACHE_DIR=/tmp/pip-tmp/cache
+pip3 install --disable-pip-version-check --no-warn-script-location  --no-cache-dir --user pipx
+/tmp/pip-tmp/bin/pipx install --pip-args=--no-cache-dir pipx
+echo "${DEFAULT_UTILS}" | xargs -n 1 /tmp/pip-tmp/bin/pipx install --system-site-packages --pip-args '--no-cache-dir --force-reinstall'
+rm -rf /tmp/pip-tmp
+
+updaterc "$(cat << EOF
+export PIPX_HOME="${PIPX_HOME}"
+export PIPX_BIN_DIR="${PIPX_BIN_DIR}"
+if [[ "\${PATH}" != *"\${PIPX_BIN_DIR}"* ]]; then export PATH="\${PATH}:\${PIPX_BIN_DIR}"; fi
+EOF
+)"

.devcontainer/library-scripts/replicated-debian.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# k3d
+# v5 RC is needed to deterministically set the Registry port. Should be replaces with official release
+curl -s https://raw.githubusercontent.com/rancher/k3d/main/install.sh | TAG=v5.0.0-rc.4 bash
+
+# kustomize
+pushd /tmp
+curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"  | bash
+popd
+sudo mv /tmp/kustomize /usr/local/bin/ 
+
+

.devcontainer/library-scripts/replicated-userspace.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+# install Krew 
+# TODO (dans): ditch krew and just download the latest binaries on the path in Dockerfile
+(
+  set -x; cd "$(mktemp -d)" &&
+  OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
+  ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
+  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/krew.tar.gz" &&
+  tar zxvf krew.tar.gz &&
+  KREW=./krew-"${OS}_${ARCH}" &&
+  "$KREW" install krew
+)
+
+# install krew plugins
+kubectl krew install schemahero
+kubectl krew install support-bundle
+kubectl krew install preflights
+kubectl krew install view-secret
+
+# Make the cache from master branch
+pushd /tmp 
+git clone https://github.com/replicatedhq/troubleshoot.git
+pushd troubleshoot
+# TODO (dans): find a way to cache images on image build
+go mod download
+popd
+rm -rf kots
+popd
+
+# Clone any extra repos here
+
+# Autocomplete Kubernetes
+cat >> ~/.zshrc << EOF
+
+source <(kubectl completion zsh)
+alias k=kubectl
+complete -F __start_kubectl k
+EOF
+
+# Set Git Editor Preference
+cat >> ~/.zshrc << EOF
+
+export VISUAL=vim
+export EDITOR="$VISUAL"
+EOF

.devcontainer/library-scripts/setup-user.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# modified from https://github.com/microsoft/vscode-dev-containers/blob/main/containers/codespaces-linux/.devcontainer/setup-user.sh
+# not part of the standard script library
+
+USERNAME=${1:-codespace}
+SECURE_PATH_BASE=${2:-$PATH}
+
+echo "Defaults secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin:${SECURE_PATH_BASE}\"" >> /etc/sudoers.d/securepath
+
+# Add user to a Docker group
+sudo -u ${USERNAME} mkdir /home/${USERNAME}/.vsonline
+groupadd -g 800 docker
+usermod -a -G docker ${USERNAME}
+
+# Create user's .local/bin
+sudo -u ${USERNAME} mkdir -p /home/${USERNAME}/.local/bin

.devcontainer/library-scripts/sshd-debian.sh

@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+#
+# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/sshd.md
+# Maintainer: The VS Code and Codespaces Teams
+#
+# Syntax: ./sshd-debian.sh [SSH Port (don't use 22)] [non-root user] [start sshd now flag] [new password for user] [fix environment flag]
+#
+# Note: You can change your user's password with "sudo passwd $(whoami)" (or just "passwd" if running as root).
+
+SSHD_PORT=${1:-"2222"}
+USERNAME=${2:-"automatic"}
+START_SSHD=${3:-"false"}
+NEW_PASSWORD=${4:-"skip"}
+FIX_ENVIRONMENT=${5:-"true"}
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Determine the appropriate non-root user
+if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
+    USERNAME=""
+    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
+    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
+        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
+            USERNAME=${CURRENT_USER}
+            break
+        fi
+    done
+    if [ "${USERNAME}" = "" ]; then
+        USERNAME=root
+    fi
+elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
+    USERNAME=root
+fi
+
+# Function to run apt-get if needed
+apt_get_update_if_needed()
+{
+    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
+        echo "Running apt-get update..."
+        apt-get update
+    else
+        echo "Skipping apt-get update."
+    fi
+}
+
+# Checks if packages are installed and installs them if not
+check_packages() {
+    if ! dpkg -s "$@" > /dev/null 2>&1; then
+        apt_get_update_if_needed
+        apt-get -y install --no-install-recommends "$@"
+    fi
+}
+
+# Ensure apt is in non-interactive to avoid prompts
+export DEBIAN_FRONTEND=noninteractive
+
+# Install openssh-server openssh-client
+check_packages openssh-server openssh-client lsof
+
+# Generate password if new password set to the word "random"
+if [ "${NEW_PASSWORD}" = "random" ]; then
+    NEW_PASSWORD="$(openssl rand -hex 16)"
+    EMIT_PASSWORD="true"
+elif [ "${NEW_PASSWORD}" != "skip" ]; then
+    # If new password not set to skip, set it for the specified user
+    echo "${USERNAME}:${NEW_PASSWORD}" | chpasswd
+fi
+
+# Add user to ssh group
+if [ "${USERNAME}" != "root" ]; then
+    usermod -aG ssh ${USERNAME}
+fi
+
+# Setup sshd
+mkdir -p /var/run/sshd
+sed -i 's/session\s*required\s*pam_loginuid\.so/session optional pam_loginuid.so/g' /etc/pam.d/sshd
+sed -i 's/#*PermitRootLogin prohibit-password/PermitRootLogin yes/g' /etc/ssh/sshd_config
+sed -i -E "s/#*\s*Port\s+.+/Port ${SSHD_PORT}/g" /etc/ssh/sshd_config
+# Need to UsePAM so /etc/environment is processed
+sed -i -E "s/#?\s*UsePAM\s+.+/UsePAM yes/g" /etc/ssh/sshd_config
+
+# Script to store variables that exist at the time the ENTRYPOINT is fired
+store_env_script="$(cat << 'EOF'
+# Wire in codespaces secret processing to zsh if present (since may have been added to image after script was run)
+if [ -f  /etc/zsh/zlogin ] && ! grep '/etc/profile.d/00-restore-secrets.sh' /etc/zsh/zlogin > /dev/null 2>&1; then
+    echo -e "if [ -f /etc/profile.d/00-restore-secrets.sh ]; then . /etc/profile.d/00-restore-secrets.sh; fi\n$(cat /etc/zsh/zlogin 2>/dev/null || echo '')" | sudoIf tee /etc/zsh/zlogin > /dev/null
+fi
+EOF
+)"
+
+# Script to ensure login shells get the latest Codespaces secrets
+restore_secrets_script="$(cat << 'EOF'
+#!/bin/sh
+if [ "${CODESPACES}" != "true" ] || [ "${VSCDC_FIXED_SECRETS}" = "true" ] || [ ! -z "${GITHUB_CODESPACES_TOKEN}" ]; then
+    # Not codespaces, already run, or secrets already in environment, so return
+    return
+fi
+if [ -f /workspaces/.codespaces/shared/.env ]; then
+    set -o allexport
+    . /workspaces/.codespaces/shared/.env
+    set +o allexport
+fi
+export VSCDC_FIXED_SECRETS=true
+EOF
+)"
+
+# Write out a scripts that can be referenced as an ENTRYPOINT to auto-start sshd and fix login environments
+tee /usr/local/share/ssh-init.sh > /dev/null \
+<< 'EOF'
+#!/usr/bin/env bash
+# This script is intended to be run as root with a container that runs as root (even if you connect with a different user)
+# However, it supports running as a user other than root if passwordless sudo is configured for that same user.
+
+set -e 
+
+sudoIf()
+{
+    if [ "$(id -u)" -ne 0 ]; then
+        sudo "$@"
+    else
+        "$@"
+    fi
+}
+
+EOF
+if [ "${FIX_ENVIRONMENT}" = "true" ]; then
+    echo "${store_env_script}" >> /usr/local/share/ssh-init.sh
+    echo "${restore_secrets_script}" > /etc/profile.d/00-restore-secrets.sh
+    chmod +x /etc/profile.d/00-restore-secrets.sh
+    # Wire in zsh if present
+    if type zsh > /dev/null 2>&1; then
+        echo -e "if [ -f /etc/profile.d/00-restore-secrets.sh ]; then . /etc/profile.d/00-restore-secrets.sh; fi\n$(cat /etc/zsh/zlogin 2>/dev/null || echo '')" > /etc/zsh/zlogin
+    fi
+fi
+tee -a /usr/local/share/ssh-init.sh > /dev/null \
+<< 'EOF'
+
+# ** Start SSH server **
+sudoIf /etc/init.d/ssh start 2>&1 | sudoIf tee /tmp/sshd.log > /dev/null
+
+set +e
+exec "$@"
+EOF
+chmod +x /usr/local/share/ssh-init.sh
+
+# If we should start sshd now, do so
+if [ "${START_SSHD}" = "true" ]; then
+    /usr/local/share/ssh-init.sh
+fi
+
+# Output success details
+echo -e "Done!\n\n- Port: ${SSHD_PORT}\n- User: ${USERNAME}"
+if [ "${EMIT_PASSWORD}" = "true" ]; then
+    echo "- Password: ${NEW_PASSWORD}"
+fi
+echo -e "\nForward port ${SSHD_PORT} to your local machine and run:\n\n  ssh -p ${SSHD_PORT} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null ${USERNAME}@localhost\n"

.devcontainer/lifecycle-scripts/onCreate.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+# Setup the cluster
+k3d cluster create --config /etc/replicated/k3d-cluster.yaml --kubeconfig-update-default
+
+# Clone any extra repos here
+
+

.devcontainer/lifecycle-scripts/onStart.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+# Start the cluster here
+k3d cluster start replicated
+

.fossa.yml

@@ -0,0 +1,4 @@
+version: 3
+
+project:
+  id: github.com/replicatedhq/troubleshoot

.github/CODEOWNERS

@@ -1 +1,17 @@
-* @replicatedhq/day2
+# Lines starting with '#' are comments.
+# Each line is a file pattern followed by one or more owners.
+
+# More details are here: https://help.github.com/articles/about-codeowners/
+
+# The '*' pattern is global owners.
+
+# Order is important. The last matching pattern has the most precedence.
+# The folders are ordered as follows:
+
+# In each subsection folders are ordered first by depth, then alphabetically.
+# This should make it easy to add new rules without breaking existing ones.
+
+## RULES 
+
+* @replicatedhq/troubleshoot
+*.md @replicatedhq/cre

.github/ISSUE_TEMPLATE/feature_epic.md

@@ -0,0 +1,28 @@
+---
+name: Feature Epic
+about: Create a tracking issue for a change that is larger than a single task
+labels: 'epic'
+
+---
+
+# Design Proposal
+
+Link to the [proposal](https://github.com/replicatedhq/troubleshoot/tree/main/design/template.md)
+
+# Definition of done
+
+Describe what specific goals can measure if this overall task is considered completed. Things to consider are documentation, high level description of the feature working, and tests.
+
+* [ ]
+
+# Subtasks
+
+Create a list of the smaller tasks to implement this design. Task can start as simple descriptions but should be converted to issues before work is started.
+
+## Started
+
+* [ ]
+
+## Planned
+
+* [ ]

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,11 +7,11 @@ labels: 'feature'
 
 **Describe the rationale for the suggested feature.**
 
-Insert a description of the rationale for the new feature here. For example, you could describe a problem that Troubleshoot doesn't address, a limitation, or an idea to improve Troubleshoot. 
+Insert a description of the rationale for the new feature here. For example, you could describe a problem that Troubleshoot doesn't address, a limitation, or an idea to improve Troubleshoot.
 
 **Describe the feature**
 
-Insert a description of the feature here.  Be specific about how it addresses the any problems, limitations, or suggested improvements outlined in the rationale for the feature.
+Insert a description of the feature here. Be specific about how it addresses the problem. Mention any limitations, or suggested improvements outlined in the rationale for the feature.
 
 **Describe alternatives you've considered**
 
@@ -19,4 +19,4 @@ Describe alternative solutions here. Include any workarounds you've considered.
 
 **Additional context**
 
-Add additional context about the feature request.  If the change is substantial, consider attaching files to the issue  outlining architectural changes, data flows, file formats etc., anything that helps describe the requested change. 
+Add additional context about the feature request.  If the change is substantial, consider attaching files to the issue  outlining architectural changes, data flows, file formats etc., anything that helps describe the requested change.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+## Description, Motivation and Context
+
+Please include a summary of the change or what problem it solves. Please also include relevant motivation and context.
+
+<!--- If it relates to an open issue, please link to the issue here.
+e.g.
+Fixes: #414
+-->
+
+## Checklist
+
+- [ ] New and existing tests pass locally with the changes.
+- [ ] Tests for the changes have been added (for bug fixes / features)
+- [ ] The commit message(s) are informative and highlight any breaking changes
+
+## Does this PR introduce a breaking change?
+- [ ] Yes
+- [ ] No
+
+<!-- If this PR contains a breaking change, please describe the impact and migration path for existing applications below. -->
+

.github/dependabot.yml

@@ -0,0 +1,27 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "gomod" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    labels:
+      - "dependencies"
+      - "go"
+      - "type::chore"
+    schedule:
+      interval: "weekly"
+      
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the
+    # default location of `.github/workflows`
+    directory: "/"
+    labels:
+      - "dependencies"
+      - "github-actions"
+      - "type::chore"
+    schedule:
+      interval: "weekly"

.github/workflows/build-test-deploy.yaml

@@ -1,20 +1,24 @@
 on:
   pull_request:
     branches:
-      - master
+      - main
   push:
     branches:
-      - "master"
+      - "main"
     tags:
       - "v*.*.*"
-  
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  build:
-    runs-on: ubuntu-18.04
+  test:
+    runs-on: ubuntu-20.04
     steps:
-      - uses: actions/setup-go@v1
+      - uses: actions/setup-go@v3
         with:
-          go-version: "1.14"
+          go-version: "1.19"
 
       - name: setup env
         run: |
@@ -22,57 +26,114 @@ jobs:
           echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
         shell: bash
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
+
+      - run: make test
+
+  ensure-schemas-are-generated:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: '1.19'
+      - name: setup env
+        run: |
+          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
+          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
+        shell: bash
+      - uses: actions/checkout@v3
+      - run: make check-schemas
 
-      - run: make 
-  
   compile-preflight:
     runs-on: ubuntu-latest
-    needs: build
     steps:
-      - uses: actions/setup-go@v1
+      - uses: actions/setup-go@v3
         with:
-          go-version: '1.14'
+          go-version: '1.19'
       - name: setup env
         run: |
           echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
           echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
         shell: bash
-      - uses: actions/checkout@master
-      - run: make preflight
-      - uses: actions/upload-artifact@v1
+      - uses: actions/checkout@v3
+      - run: make generate preflight
+      - uses: actions/upload-artifact@v3
         with:
           name: preflight
           path: bin/preflight
-        
+
   validate-preflight:
     runs-on: ubuntu-latest
     needs: compile-preflight
     steps:
+      - uses: replicatedhq/action-k3s@main
+        id: k3s
+        with:
+          version: v1.23.6-k3s1
       - name: Download preflight binary
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@v3
         with:
           name: preflight
           path: bin/
-      - uses: engineerd/setup-kind@v0.5.0
       - run: chmod +x bin/preflight
-      - run: ./bin/preflight --interactive=false --format=json https://preflight.replicated.com
+      - run: |
+          ./bin/preflight --interactive=false --format=json https://preflight.replicated.com > result.json
+          cat result.json
+
+          EXIT_STATUS=0
+          if grep -q "was not collected" result.json; then
+            echo "Some files were not collected"
+            EXIT_STATUS=1
+          fi
+
+          if (( `jq '.pass | length' result.json` < 1 )); then
+            echo "No passing preflights found"
+            EXIT_STATUS=1
+          fi
+
+          if (( `jq '.warn | length' result.json` < 1 )); then
+            echo "No warnings found"
+            EXIT_STATUS=1
+          fi
+
+          if (( `jq '.fail | length' result.json` < 1 )); then
+            echo "No failed preflights found"
+            EXIT_STATUS=1
+          fi
+
+          exit $EXIT_STATUS
+
+  validate-preflight-e2e:
+    runs-on: ubuntu-latest
+    needs: compile-preflight
+    steps:
+      - uses: actions/checkout@v3
+      - uses: replicatedhq/action-k3s@main
+        id: k3s
+        with:
+          version: v1.23.6-k3s1
+      - name: Download preflight binary
+        uses: actions/download-artifact@v3
+        with:
+          name: preflight
+          path: bin/
+      - run: chmod +x bin/preflight
+      - run: make preflight-e2e-test
 
   compile-supportbundle:
     runs-on: ubuntu-latest
-    needs: build
     steps:
-      - uses: actions/setup-go@v1
+      - uses: actions/setup-go@v3
         with:
-          go-version: '1.14'
+          go-version: '1.19'
       - name: setup env
         run: |
           echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
           echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
         shell: bash
-      - uses: actions/checkout@master
-      - run: make support-bundle
-      - uses: actions/upload-artifact@v1
+      - uses: actions/checkout@v3
+      - run: make generate support-bundle
+      - uses: actions/upload-artifact@v3
         with:
           name: support-bundle
           path: bin/support-bundle
@@ -81,27 +142,87 @@ jobs:
     runs-on: ubuntu-latest
     needs: compile-supportbundle
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v3
+      - uses: replicatedhq/action-k3s@main
+        id: k3s
+        with:
+          version: v1.23.6-k3s1
       - name: Download support-bundle binary
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@v3
         with:
           name: support-bundle
           path: bin/
-      - uses: engineerd/setup-kind@v0.5.0
       - run: chmod +x bin/support-bundle
       - run: ./bin/support-bundle ./examples/support-bundle/sample-collectors.yaml
       - run: ./bin/support-bundle ./examples/support-bundle/sample-supportbundle.yaml
       - run: ./bin/support-bundle https://kots.io
 
+  validate-supportbundle-e2e:
+    runs-on: ubuntu-latest
+    needs: compile-supportbundle
+    steps:
+      - uses: actions/checkout@v3
+      - uses: replicatedhq/action-k3s@main
+        id: k3s
+        with:
+          version: v1.23.6-k3s1
+      - name: Download support bundle binary
+        uses: actions/download-artifact@v3
+        with:
+          name: support-bundle
+          path: bin/
+      - run: chmod +x bin/support-bundle
+      - run: make support-bundle-e2e-test
+
+  compile-collect:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: '1.19'
+      - name: setup env
+        run: |
+          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
+          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
+        shell: bash
+      - uses: actions/checkout@v3
+      - run: make generate collect
+      - uses: actions/upload-artifact@v3
+        with:
+          name: collect
+          path: bin/collect
+
+  goreleaser-test:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v') != true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Unshallow
+        run: git fetch --prune --unshallow
+
+      - uses: actions/setup-go@v3
+        with:
+          go-version: "1.19"
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v3
+        with:
+          version: "v0.183.0"
+          args: build --rm-dist --snapshot --config deploy/.goreleaser.yaml
+
   goreleaser:
     runs-on: ubuntu-latest
     needs:
       - validate-preflight
+      - validate-preflight-e2e
+      - validate-supportbundle
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
-  
+        uses: actions/checkout@v3
+
       - uses: azure/docker-login@v1
         with:
           username: repldeploy2
@@ -109,10 +230,10 @@ jobs:
 
       - name: Unshallow
         run: git fetch --prune --unshallow
-  
-      - uses: actions/setup-go@v1
+
+      - uses: actions/setup-go@v3
         with:
-          go-version: "1.14"
+          go-version: "1.19"
 
       - uses: sigstore/cosign-installer@main
         with:
@@ -123,28 +244,28 @@ jobs:
           echo $COSIGN_KEY | base64 -d > ./cosign.key
         env:
           COSIGN_KEY: ${{secrets.COSIGN_KEY}}
-          
+
       - name: Generate SBOM
         run: |
           make sbom
         env:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
-   
+
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v3
         with:
-          version: latest
+          version: "v0.183.0"
           args: release --rm-dist --config deploy/.goreleaser.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 
       - name: Update new preflight version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.38
+        uses: rajatjindal/krew-release-bot@v0.0.43
         with:
           krew_template_file: deploy/krew/preflight.yaml
       - name: Update new support-bundle version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.38
+        uses: rajatjindal/krew-release-bot@v0.0.43
         with:
           krew_template_file: deploy/krew/support-bundle.yaml

.github/workflows/daily-scan.yaml

@@ -0,0 +1,27 @@
+name: Scan vulnerabilities
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+jobs:
+  scan_troubleshoot_files_systems:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Run Trivy vulnerability scanner in repo mode
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          ignore-unfixed: true
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'HIGH,CRITICAL'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'

.github/workflows/pr-license-scan.yaml

@@ -0,0 +1,18 @@
+name: PR license scan
+
+on:
+  pull_request_target: # this is safe as these scans do not execute provided code
+
+jobs:
+  fossa-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: refs/pull/${{ github.event.number }}/merge
+      - name: "Install FOSSA" 
+        uses: replicatedhq/action-fossa/install@main
+      - name: "Run FOSSA Scan"
+        uses: replicatedhq/action-fossa/scan@main
+        with:
+          api-key: ${{ secrets.FOSSA_API_KEY }}

.github/workflows/require-pr-labels.yaml

@@ -0,0 +1,25 @@
+name: Require pull request labels
+
+permissions:
+  pull-requests: read
+
+on:
+  pull_request:
+    types:
+      - opened
+      - labeled
+      - unlabeled
+      - synchronize
+
+jobs:
+  require-pr-labels:
+    uses: replicatedhq/reusable-workflows/.github/workflows/pr-enforce-labels.yaml@main
+  require-bug-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: mheap/github-action-required-labels@v2
+        if: ${{ github.event.label.name == 'type::bug' }}
+        with:
+          mode: exactly
+          count: 1
+          labels: "bug::normal, bug::regression"

.gitignore

@@ -6,6 +6,7 @@
 *.so
 *.dylib
 bin
+.DS_Store
 
 # Test binary, build with `go test -c`
 *.test
@@ -34,3 +35,9 @@ workspace.*
 
 cosign.key
 sbom/
+
+# Ignore local pre-commit config
+.pre-commit-config.yaml
+
+# Ignore generated support bundles
+*.tar.gz

.golangci.yaml

@@ -0,0 +1,12 @@
+# https://golangci-lint.run/usage/configuration/#config-file
+
+run:
+  allow-parallel-runners: true
+  timeout: 30s
+
+linters:
+  enable:
+    - gocritic
+    - gocyclo
+    - gofmt
+    - gosec

CONTRIBUTING.md

@@ -1,11 +1,88 @@
 # Contributing to Troubleshoot
 
-Thank you for your interest in Troubleshoot, we welcome your participation. Please familiarize yourself with our [Code of Conduct](https://github.com/replicatedhq/troubleshoot/blob/master/CODE_OF_CONDUCT.md) prior to contributing. There are a number of ways to participate in Troubleshoot as outlined below:
+Thank you for your interest in Troubleshoot, we welcome your participation. Please familiarize yourself with our [Code of Conduct](https://github.com/replicatedhq/troubleshoot/blob/main/CODE_OF_CONDUCT.md) prior to contributing. There are a number of ways to participate in Troubleshoot as outlined below:
+
+# Community
+
+For discussions about developing Troubleshoot, there's an [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot), plus IRC using [Libera](ircs://irc.libera.chat:6697/#troubleshoot) (#troubleshoot).
+
+There are [community meetings](https://calendar.google.com/calendar/u/0?cid=Y19mMGx1aGhiZGtscGllOGo5dWpicXMwNnN1a0Bncm91cC5jYWxlbmRhci5nb29nbGUuY29t) on a regular basis, with a shared calendar and [public notes](https://hackmd.io/yZbotEHdTg6TfRZBzb8Tcg)
 
 ## Issues
-- [Request a New Feature](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=feature&template=feature_enhancement.md) Create an issue to add functionality that addresses a problem or adds an enhancement.  
-- [Report a Bug](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=bug&template=bug_report.md) Report a problem or unexpected behaviour with Troubleshoot. 
 
-## Pull Requests
+- [Request a New Feature](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=feature&template=feature_enhancement.md) Create an issue to add functionality that addresses a problem or adds an enhancement.
+- [Report a Bug](https://github.com/replicatedhq/troubleshoot/issues/new?assignees=&labels=bug&template=bug_report.md) Report a problem or unexpected behaviour with Troubleshoot.
 
-If you are interested in contributing a change to the code or documentation please open a pull request with your set of changes. The pull request will be reviewed in a timely manner.
+## Design Principles
+
+When implementing a new feature please review the [design principles](./design/design-principles.md) to help guide the approach.
+
+## Development Environment
+
+To get started we recommend:
+
+1. Go (v1.19 or later)
+2. A Kubernetes cluster (we recommend <https://k3d.io/>. This requires Docker v20.10.5 or later)
+3. Fork and clone the repo to $GOPATH/src/github.com/replicatedhq/
+4. Run `make support-bundle preflight` to generate binaries
+5. Run `make run-troubleshoot` to generate a support bundle with the `sample-troubleshoot.yaml` in the root of the repo
+
+> Note: recent versions of Go support easy cross-compilation.  For example, to cross-compile a Linux binary from MacOS:
+> `GOOS=linux GOARCH=amd64 make support-bundle preflight`
+
+6. Install [golangci-lint] linter and run `make lint` to execute additional code linters.
+
+### Testing
+
+To run the tests locally run the following:
+
+```bash
+make test
+```
+
+Additionally, e2e tests can be run with:
+
+```bash
+make support-bundle preflight e2e-test
+```
+
+A Kubernetes cluster as well as `jq` are required to run e2e tests.
+
+## Contribution workflow
+
+This is a rough outline of how to prepare a contribution:
+
+- Create a fork of this repo.
+- Create a topic branch from where you want to base your work (branched from `main` is a safe choice).
+- Make commits of logical units.
+- When your changes are ready to merge, squash your history to 1 commit.
+  - For example, if you want to squash your last 3 commits and write a new commit message:
+      ```
+      git reset --soft HEAD~3 &&
+      git commit
+      ```
+
+  - If you want to keep the previous commit messages and concatenate them all into a new commit, you can do something like this instead:
+      ```
+      git reset --soft HEAD~3 &&
+      git commit --edit -m"$(git log --format=%B --reverse HEAD..HEAD@{1})"
+      ```
+- Push your changes to a topic branch in your fork of the repository.
+- Submit a pull request to the original repository. It will be reviewed in a timely manner.
+
+### Pull Requests
+
+A pull request should address a single issue, feature or bug. For example, lets say you've written code that fixes two issues. That's great! However, you should submit two small pull requests, one for each issue as opposed to combining them into a single larger pull request. In general the size of the pull request should be kept small in order to make it easy for a reviewer to understand, and to minimize risks from integrating many changes at the same time. For example, if you are working on a large feature you should break it into several smaller PRs by implementing the feature as changes to several packages and submitting a separate pull request for each one.  Squash commit history when preparing your PR so it merges as 1 commit.
+
+Code submitted in pull requests must be properly documented, formatted and tested in order to be approved and merged. The following guidelines describe the things a reviewer will look for when they evaluate your pull request. Here's a tip. If your reviewer doesn't understand what the code is doing, they won't approve the pull request. Strive to make code clear and well documented. If possible, request a reviewer that has some context on the PR.
+
+### Commit messages
+
+Commit messages should follow the general guidelines:
+
+- Breaking changes should be highlighted in the heading of the commit message.
+- Commits should be clear about their purpose (and a single commit per thing that changed)
+- Messages should be descriptive:
+  - First line, 50 chars or less, as a heading/title that people can find
+  - Then a paragraph explaining things
+- Consider a footer with links to which bugs they fix etc, bearing in mind that Github does some of this magic already

Makefile

@@ -1,8 +1,6 @@
 
 # Image URL to use all building/pushing image targets
 IMG ?= controller:latest
-export GO111MODULE=on
-export GOPROXY=https://proxy.golang.org
 
 SHELL := /bin/bash -o pipefail
 VERSION_PACKAGE = github.com/replicatedhq/troubleshoot/pkg/version
@@ -37,28 +35,40 @@ endef
 
 BUILDFLAGS = -tags "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp" -installsuffix netgo
 
-all: test
+all: test support-bundle preflight collect
 
 .PHONY: ffi
 ffi: fmt vet
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/troubleshoot.so -buildmode=c-shared ffi/main.go
 
-# Run tests
+.PHONY: test
 test: generate fmt vet
 	go test ${BUILDFLAGS} ./pkg/... ./cmd/... -coverprofile cover.out
 
+.PHONY: preflight-e2e-test
+preflight-e2e-test:
+	./test/validate-preflight-e2e.sh
+
+.PHONY: support-bundle-e2e-test
+support-bundle-e2e-test:
+	./test/validate-support-bundle-e2e.sh
+
 .PHONY: support-bundle
-support-bundle: generate fmt vet
+support-bundle:
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/support-bundle github.com/replicatedhq/troubleshoot/cmd/troubleshoot
 
 .PHONY: preflight
-preflight: generate fmt vet
+preflight:
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/preflight github.com/replicatedhq/troubleshoot/cmd/preflight
 
 .PHONY: analyze
-analyze: generate fmt vet
+analyze:
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/analyze github.com/replicatedhq/troubleshoot/cmd/analyze
 
+.PHONY: collect
+collect:
+	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/collect github.com/replicatedhq/troubleshoot/cmd/collect
+
 .PHONY: fmt
 fmt:
 	go fmt ./pkg/... ./cmd/...
@@ -72,6 +82,7 @@ generate: controller-gen client-gen
 	$(CONTROLLER_GEN) \
 		object:headerFile=./hack/boilerplate.go.txt paths=./pkg/apis/...
 	$(CLIENT_GEN) \
+		--output-base=./../../../ \
 		--output-package=github.com/replicatedhq/troubleshoot/pkg/client \
 		--clientset-name troubleshootclientset \
 		--input-base github.com/replicatedhq/troubleshoot/pkg/apis \
@@ -84,19 +95,31 @@ openapischema: controller-gen
 	controller-gen crd +output:dir=./config/crds  paths=./pkg/apis/troubleshoot/v1beta1
 	controller-gen crd +output:dir=./config/crds  paths=./pkg/apis/troubleshoot/v1beta2
 
+check-schemas: generate schemas
+	@if [ -n "$(shell git status --short)" ]; then \
+    	echo -e "\033[31mThe git repo is dirty :( Ensure all generated files are committed e.g CRD schema files\033[0;m"; \
+    	git status --short; \
+    	exit 1; \
+	fi
+
 .PHONY: schemas
 schemas: fmt vet openapischema
 	go build ${LDFLAGS} -o bin/schemagen github.com/replicatedhq/troubleshoot/cmd/schemagen
 	./bin/schemagen --output-dir ./schemas
 
+.PHONY: docs
+docs: fmt vet
+	go build ${LDFLAGS} -o bin/docsgen github.com/replicatedhq/troubleshoot/cmd/docsgen
+	./bin/docsgen
+
 controller-gen:
-	go get sigs.k8s.io/controller-tools/cmd/controller-gen@v0.7.0
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.7.0
 CONTROLLER_GEN=$(shell which controller-gen)
 
 .PHONY: client-gen
 client-gen:
 ifeq (, $(shell which client-gen))
-	go get k8s.io/code-generator/cmd/client-gen@kubernetes-1.18.0
+	go install k8s.io/code-generator/cmd/client-gen@v0.22.2
 CLIENT_GEN=$(shell go env GOPATH)/bin/client-gen
 else
 CLIENT_GEN=$(shell which client-gen)
@@ -148,10 +171,39 @@ generate-sbom: install-spdx-sbom-generator
 	$(SPDX_GENERATOR) -o ./sbom/spdx
 
 sbom/assets/troubleshoot-sbom.tgz: generate-sbom
-	tar -czf sbom/assets/troubleshoot-sbom.tgz sbom/spdx/*.spdx 
+	tar -czf sbom/assets/troubleshoot-sbom.tgz sbom/spdx/*.spdx
 
 sbom: sbom/assets/troubleshoot-sbom.tgz
 	cosign sign-blob -key cosign.key sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig
 	cosign public-key -key cosign.key -outfile sbom/assets/key.pub
 
+longhorn:
+	git clone https://github.com/longhorn/longhorn-manager.git
+	cd longhorn-manager && git checkout v1.2.2 && cd ..
+	rm -rf pkg/longhorn
+	mv longhorn-manager/k8s/pkg pkg/longhorn
+	mv longhorn-manager/types pkg/longhorn/types
+	mv longhorn-manager/util pkg/longhorn/util
+	rm -rf pkg/longhorn/util/daemon
+	rm -rf pkg/longhorn/util/server
+	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/k8s\/pkg/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn/g"
+	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/types/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn\/types/g"
+	find pkg/longhorn -type f | xargs sed -i "s/github.com\/longhorn\/longhorn-manager\/util/github.com\/replicatedhq\/troubleshoot\/pkg\/longhorn\/util/g"
+	rm -rf longhorn-manager
 
+.PHONY: scan
+scan:
+	trivy fs \
+		--security-checks vuln \
+		--exit-code=1 \
+		--severity="HIGH,CRITICAL" \
+		--ignore-unfixed \
+		./
+
+.PHONY: lint
+lint:
+	golangci-lint run -c .golangci.yaml
+
+.PHONY: lint-and-fix
+lint-and-fix:
+	golangci-lint run --fix -c .golangci.yaml

README.md

@@ -9,15 +9,17 @@ Preflight checks are an easy-to-run set of conformance tests that can be written
 
 To run a sample preflight check from a sample application, install the preflight kubectl plugin:
 
-```shell
+```
 curl https://krew.sh/preflight | bash
 ```
- and run:
+ and run, where https://preflight.replicated.com provides an **example** preflight spec:
  
-```shell
+```
 kubectl preflight https://preflight.replicated.com
 ```
 
+**NOTE** this is an example. Do **not** use to validate real scenarios. 
+
 For more details on creating the custom resource files that drive preflight checks, visit [creating preflight checks](https://troubleshoot.sh/docs/preflight/introduction/).
 
 
@@ -26,16 +28,21 @@ A support bundle is an archive that's created in-cluster, by collecting logs and
 
 To collect a sample support bundle, install the troubleshoot kubectl plugin:
 
-```shell
+```
 curl https://krew.sh/support-bundle | bash
 ```
- and run:
+ and run, where https://support-bundle.replicated.com provides an **example** support bundle spec:
  
-```shell
+```
 kubectl support-bundle https://support-bundle.replicated.com
 ```
+
+**NOTE** this is an example. Do **not** use to validate real scenarios. 
+
 For more details on creating the custom resource files that drive support-bundle collection, visit [creating collectors](https://troubleshoot.sh/docs/collect/) and [creating analyzers](https://troubleshoot.sh/docs/analyze/).
 
+And see our other tool [sbctl](https://github.com/replicatedhq/sbctl) that makes it easier to interact with support bundles using `kubectl` commands you already know
+
 # Community
 
 For questions about using Troubleshoot, there's a [Replicated Community](https://help.replicated.com/community) forum, and a [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot).
@@ -48,7 +55,7 @@ A signed SBOM  that includes Troubleshoot dependencies is included in each relea
 
 The following example illustrates using [cosign](https://github.com/sigstore/cosign) to verify that **troubleshoot-sbom.tgz** has
 not been tampered with.
-```shell
+```
 $ cosign verify-blob -key key.pub -signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz
 Verified OK
-```
+```

cmd/analyze/cli/root.go

@@ -4,10 +4,12 @@ import (
 	"os"
 	"strings"
 
+	"github.com/go-logr/logr"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
 func RootCmd() *cobra.Command {
@@ -18,7 +20,12 @@ func RootCmd() *cobra.Command {
 		Long:         `Run a series of analyzers on a support bundle archive`,
 		SilenceUsage: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+			v := viper.GetViper()
+			v.BindPFlags(cmd.Flags())
+
+			if !v.GetBool("debug") {
+				klog.SetLogger(logr.Discard())
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
@@ -32,6 +39,7 @@ func RootCmd() *cobra.Command {
 	cobra.OnInitialize(initConfig)
 
 	cmd.Flags().String("analyzers", "", "filename or url of the analyzers to use")
+	cmd.Flags().Bool("debug", false, "enable debug logging")
 
 	viper.BindPFlags(cmd.Flags())
 

cmd/collect/cli/root.go

@@ -0,0 +1,73 @@
+package cli
+
+import (
+	"os"
+	"strings"
+
+	"github.com/go-logr/logr"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+)
+
+func RootCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:          "collect [url]",
+		Args:         cobra.MinimumNArgs(1),
+		Short:        "Run a collector",
+		Long:         `Run a collector and output the results.`,
+		SilenceUsage: true,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			v := viper.GetViper()
+			v.BindPFlags(cmd.Flags())
+
+			if !v.GetBool("debug") {
+				klog.SetLogger(logr.Discard())
+			}
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			logger.SetQuiet(v.GetBool("quiet"))
+			return runCollect(v, args[0])
+		},
+	}
+
+	cobra.OnInitialize(initConfig)
+
+	cmd.AddCommand(VersionCmd())
+
+	cmd.Flags().StringSlice("redactors", []string{}, "names of the additional redactors to use")
+	cmd.Flags().Bool("redact", true, "enable/disable default redactions")
+	cmd.Flags().String("format", "json", "output format, one of json or raw.")
+	cmd.Flags().String("collector-image", "", "the full name of the collector image to use")
+	cmd.Flags().String("collector-pull-policy", "", "the pull policy of the collector image")
+	cmd.Flags().String("selector", "", "selector (label query) to filter remote collection nodes on.")
+	cmd.Flags().Bool("collect-without-permissions", false, "always generate a support bundle, even if it some require additional permissions")
+	cmd.Flags().Bool("debug", false, "enable debug logging")
+
+	// hidden in favor of the `insecure-skip-tls-verify` flag
+	cmd.Flags().Bool("allow-insecure-connections", false, "when set, do not verify TLS certs when retrieving spec and reporting results")
+	cmd.Flags().MarkHidden("allow-insecure-connections")
+
+	viper.BindPFlags(cmd.Flags())
+
+	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+
+	k8sutil.AddFlags(cmd.Flags())
+
+	return cmd
+}
+
+func InitAndExecute() {
+	if err := RootCmd().Execute(); err != nil {
+		os.Exit(1)
+	}
+}
+
+func initConfig() {
+	viper.SetEnvPrefix("TROUBLESHOOT")
+	viper.AutomaticEnv()
+}

cmd/collect/cli/run.go

@@ -0,0 +1,184 @@
+package cli
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/cmd/util"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
+	troubleshootclientsetscheme "github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/replicatedhq/troubleshoot/pkg/docrewrite"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/specs"
+	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
+	"github.com/spf13/viper"
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+const (
+	defaultTimeout = 30 * time.Second
+)
+
+func runCollect(v *viper.Viper, arg string) error {
+	go func() {
+		signalChan := make(chan os.Signal, 1)
+		signal.Notify(signalChan, os.Interrupt)
+		<-signalChan
+		os.Exit(0)
+	}()
+
+	var collectorContent []byte
+	var err error
+	if strings.HasPrefix(arg, "secret/") {
+		// format secret/namespace-name/secret-name
+		pathParts := strings.Split(arg, "/")
+		if len(pathParts) != 3 {
+			return errors.Errorf("path %s must have 3 components", arg)
+		}
+
+		spec, err := specs.LoadFromSecret(pathParts[1], pathParts[2], "collect-spec")
+		if err != nil {
+			return errors.Wrap(err, "failed to get spec from secret")
+		}
+
+		collectorContent = spec
+	} else if _, err = os.Stat(arg); err == nil {
+		b, err := ioutil.ReadFile(arg)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = b
+	} else {
+		if !util.IsURL(arg) {
+			return fmt.Errorf("%s is not a URL and was not found (err %s)", arg, err)
+		}
+
+		req, err := http.NewRequest("GET", arg, nil)
+		if err != nil {
+			return err
+		}
+		req.Header.Set("User-Agent", "Replicated_Collect/v1beta2")
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = body
+	}
+
+	collectorContent, err = docrewrite.ConvertToV1Beta2(collectorContent)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert to v1beta2")
+	}
+
+	multidocs := strings.Split(string(collectorContent), "\n---\n")
+
+	troubleshootclientsetscheme.AddToScheme(scheme.Scheme)
+	decode := scheme.Codecs.UniversalDeserializer().Decode
+
+	additionalRedactors := &troubleshootv1beta2.Redactor{}
+	for idx, redactor := range v.GetStringSlice("redactors") {
+		redactorObj, err := supportbundle.GetRedactorFromURI(redactor)
+		if err != nil {
+			return errors.Wrapf(err, "failed to get redactor spec %s, #%d", redactor, idx)
+		}
+
+		if redactorObj != nil {
+			additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, redactorObj.Spec.Redactors...)
+		}
+	}
+
+	for i, additionalDoc := range multidocs {
+		if i == 0 {
+			continue
+		}
+		additionalDoc, err := docrewrite.ConvertToV1Beta2([]byte(additionalDoc))
+		if err != nil {
+			return errors.Wrap(err, "failed to convert to v1beta2")
+		}
+		obj, _, err := decode(additionalDoc, nil, nil)
+		if err != nil {
+			return errors.Wrapf(err, "failed to parse additional doc %d", i)
+		}
+		multidocRedactors, ok := obj.(*troubleshootv1beta2.Redactor)
+		if !ok {
+			continue
+		}
+		additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, multidocRedactors.Spec.Redactors...)
+	}
+
+	// make sure we don't block any senders
+	progressCh := make(chan interface{})
+	defer close(progressCh)
+	go func() {
+		for range progressCh {
+		}
+	}()
+
+	restConfig, err := k8sutil.GetRESTConfig()
+	if err != nil {
+		return errors.Wrap(err, "failed to convert kube flags to rest config")
+	}
+
+	labelSelector, err := labels.Parse(v.GetString("selector"))
+	if err != nil {
+		return errors.Wrap(err, "unable to parse selector")
+	}
+
+	namespace := v.GetString("namespace")
+	if namespace == "" {
+		namespace = "default"
+	}
+
+	timeout := v.GetDuration("request-timeout")
+	if timeout == 0 {
+		timeout = defaultTimeout
+	}
+
+	createOpts := collect.CollectorRunOpts{
+		CollectWithoutPermissions: v.GetBool("collect-without-permissions"),
+		KubernetesRestConfig:      restConfig,
+		Image:                     v.GetString("collector-image"),
+		PullPolicy:                v.GetString("collector-pullpolicy"),
+		LabelSelector:             labelSelector.String(),
+		Namespace:                 namespace,
+		Timeout:                   timeout,
+		ProgressChan:              progressCh,
+	}
+
+	// we only support HostCollector or RemoteCollector kinds.
+	hostCollector, err := collect.ParseHostCollectorFromDoc([]byte(multidocs[0]))
+	if err == nil {
+		results, err := collect.CollectHost(hostCollector, additionalRedactors, createOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to collect from host")
+		}
+		return showHostStdoutResults(v.GetString("format"), hostCollector.Name, results)
+	}
+
+	remoteCollector, err := collect.ParseRemoteCollectorFromDoc([]byte(multidocs[0]))
+	if err == nil {
+		results, err := collect.CollectRemote(remoteCollector, additionalRedactors, createOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to collect from remote host(s)")
+		}
+		return showRemoteStdoutResults(v.GetString("format"), remoteCollector.Name, results)
+	}
+
+	return errors.New("failed to parse hostCollector or remoteCollector")
+}

cmd/collect/cli/stdout_results.go

@@ -0,0 +1,103 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+)
+
+const (
+	// FormatJSON is intended for CLI output.
+	FormatJSON = "json"
+
+	// FormatRaw is intended for consumption by a remote collector.  Output is a
+	// string of quoted JSON.
+	FormatRaw = "raw"
+)
+
+func showHostStdoutResults(format string, collectName string, results *collect.HostCollectResult) error {
+	switch format {
+	case FormatJSON:
+		return showHostStdoutResultsJSON(collectName, results.AllCollectedData)
+	case FormatRaw:
+		return showHostStdoutResultsRaw(collectName, results.AllCollectedData)
+	default:
+		return errors.Errorf("unknown output format: %q", format)
+	}
+}
+
+func showRemoteStdoutResults(format string, collectName string, results *collect.RemoteCollectResult) error {
+	switch format {
+	case FormatJSON:
+		return showRemoteStdoutResultsJSON(collectName, results.AllCollectedData)
+	case FormatRaw:
+		return errors.Errorf("raw format not supported for remote collectors")
+	default:
+		return errors.Errorf("unknown output format: %q", format)
+	}
+}
+
+func showHostStdoutResultsJSON(collectName string, results map[string][]byte) error {
+	output := make(map[string]interface{})
+	for file, collectorResult := range results {
+		var collectedItems map[string]interface{}
+		if err := json.Unmarshal([]byte(collectorResult), &collectedItems); err != nil {
+			return errors.Wrap(err, "failed to marshal collector results")
+		}
+		output[file] = collectedItems
+	}
+
+	formatted, err := json.MarshalIndent(output, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+
+	fmt.Print(string(formatted))
+	return nil
+}
+
+// showHostStdoutResultsRaw outputs the collector output as a string of quoted json.
+func showHostStdoutResultsRaw(collectName string, results map[string][]byte) error {
+	strData := map[string]string{}
+	for k, v := range results {
+		strData[k] = string(v)
+	}
+	formatted, err := json.MarshalIndent(strData, "", "    ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+	fmt.Print(string(formatted))
+	return nil
+}
+
+func showRemoteStdoutResultsJSON(collectName string, results map[string][]byte) error {
+	type CollectorResult map[string]interface{}
+	type NodeResult map[string]CollectorResult
+
+	var output = make(map[string]NodeResult)
+
+	for node, result := range results {
+		var nodeResult map[string]string
+		if err := json.Unmarshal(result, &nodeResult); err != nil {
+			return errors.Wrap(err, "failed to marshal node results")
+		}
+		nr := make(NodeResult)
+		for file, collectorResult := range nodeResult {
+			var collectedItems map[string]interface{}
+			if err := json.Unmarshal([]byte(collectorResult), &collectedItems); err != nil {
+				return errors.Wrap(err, "failed to marshal collector results")
+			}
+			nr[file] = collectedItems
+		}
+		output[node] = nr
+	}
+
+	formatted, err := json.MarshalIndent(output, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to convert output to json")
+	}
+	fmt.Print(string(formatted))
+	return nil
+}

cmd/collect/cli/version.go

@@ -0,0 +1,22 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/replicatedhq/troubleshoot/pkg/version"
+	"github.com/spf13/cobra"
+)
+
+func VersionCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "version",
+		Short: "Print the current version and exit",
+		Long:  `Print the current version and exit`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			fmt.Printf("Replicated Collect %s\n", version.Version())
+
+			return nil
+		},
+	}
+	return cmd
+}

cmd/collect/main.go

@@ -0,0 +1,10 @@
+package main
+
+import (
+	"github.com/replicatedhq/troubleshoot/cmd/collect/cli"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+)
+
+func main() {
+	cli.InitAndExecute()
+}

cmd/docsgen/cli/root.go

@@ -0,0 +1,37 @@
+package cli
+
+import (
+	"log"
+	"os"
+
+	preflightcli "github.com/replicatedhq/troubleshoot/cmd/preflight/cli"
+	troubleshootcli "github.com/replicatedhq/troubleshoot/cmd/troubleshoot/cli"
+	"github.com/spf13/cobra"
+
+	"github.com/spf13/cobra/doc"
+)
+
+func RootCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "docsgen",
+		Short: "Generate markdown docs for the commands in this project",
+	}
+	preflight := preflightcli.RootCmd()
+	troubleshoot := troubleshootcli.RootCmd()
+	commands := []*cobra.Command{preflight, troubleshoot}
+
+	for _, command := range commands {
+		err := doc.GenMarkdownTree(command, "./docs")
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+
+	return cmd
+}
+
+func InitAndExecute() {
+	if err := RootCmd().Execute(); err != nil {
+		os.Exit(1)
+	}
+}

cmd/docsgen/main.go

@@ -0,0 +1,10 @@
+package main
+
+import (
+	"github.com/replicatedhq/troubleshoot/cmd/docsgen/cli"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+)
+
+func main() {
+	cli.InitAndExecute()
+}

cmd/preflight/cli/root.go

@@ -4,9 +4,12 @@ import (
 	"os"
 	"strings"
 
+	"github.com/go-logr/logr"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
 func RootCmd() *cobra.Command {
@@ -18,25 +21,23 @@ func RootCmd() *cobra.Command {
 that a cluster meets the requirements to run an application.`,
 		SilenceUsage: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+			v := viper.GetViper()
+			v.BindPFlags(cmd.Flags())
+
+			if !v.GetBool("debug") {
+				klog.SetLogger(logr.Discard())
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
-			return runPreflights(v, args[0])
+			return preflight.RunPreflights(v.GetBool("interactive"), v.GetString("output"), v.GetString("format"), args[0])
 		},
 	}
 
 	cobra.OnInitialize(initConfig)
 
 	cmd.AddCommand(VersionCmd())
-
-	cmd.Flags().Bool("interactive", true, "interactive preflights")
-	cmd.Flags().String("format", "human", "output format, one of human, json, yaml. only used when interactive is set to false")
-	cmd.Flags().String("collector-image", "", "the full name of the collector image to use")
-	cmd.Flags().String("collector-pullpolicy", "", "the pull policy of the collector image")
-	cmd.Flags().Bool("collect-without-permissions", true, "always run preflight checks even if some require permissions that preflight does not have")
-	cmd.Flags().String("since-time", "", "force pod logs collectors to return logs after a specific date (RFC3339)")
-	cmd.Flags().String("since", "", "force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.")
+	preflight.AddFlags(cmd.PersistentFlags())
 
 	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
 

cmd/troubleshoot/cli/interactive_results.go

@@ -204,10 +204,11 @@ func drawDetails(analysisResult *analyzerunner.AnalyzeResult) {
 		uri := widgets.NewParagraph()
 		uri.Text = fmt.Sprintf("For more information: %s", analysisResult.URI)
 		uri.Border = false
-		height = estimateNumberOfLines(uri.Text, termWidth/2)
+		// For long urls that lead to wrapping text, make the rectangle bigger by
+		// increasing the calculated height by 2
+		height = estimateNumberOfLines(uri.Text, termWidth/2) + 2
 		uri.SetRect(termWidth/2, currentTop, termWidth, currentTop+height)
 		ui.Render(uri)
-		currentTop = currentTop + height + 1
 	}
 }
 

cmd/troubleshoot/cli/root.go

@@ -5,29 +5,35 @@ import (
 	"os"
 	"strings"
 
-	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/go-logr/logr"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
 )
 
 func RootCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "support-bundle [url]",
-		Args:  cobra.MinimumNArgs(1),
+		Args:  cobra.MinimumNArgs(0),
 		Short: "Generate a support bundle",
 		Long: `A support bundle is an archive of files, output, metrics and state
 from a server that can be used to assist when troubleshooting a Kubernetes cluster.`,
 		SilenceUsage: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
+			v := viper.GetViper()
+			v.BindPFlags(cmd.Flags())
+
+			if !v.GetBool("debug") {
+				klog.SetLogger(logr.Discard())
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
 			logger.SetQuiet(v.GetBool("quiet"))
-			return runTroubleshoot(v, args[0])
+			return runTroubleshoot(v, args)
 		},
 	}
 
@@ -40,13 +46,21 @@ from a server that can be used to assist when troubleshooting a Kubernetes clust
 	cmd.Flags().Bool("redact", true, "enable/disable default redactions")
 	cmd.Flags().Bool("interactive", true, "enable/disable interactive mode")
 	cmd.Flags().Bool("collect-without-permissions", true, "always generate a support bundle, even if it some require additional permissions")
+	cmd.Flags().StringSliceP("selector", "l", []string{"troubleshoot.io/kind=supportbundle-spec"}, "selector to filter on for loading additional support bundle specs found in secrets within the cluster")
+	cmd.Flags().Bool("load-cluster-specs", false, "enable/disable loading additional troubleshoot specs found within the cluster. required when no specs are provided on the command line")
 	cmd.Flags().String("since-time", "", "force pod logs collectors to return logs after a specific date (RFC3339)")
 	cmd.Flags().String("since", "", "force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.")
+	cmd.Flags().StringP("output", "o", "", "specify the output file path for the support bundle")
+	cmd.Flags().Bool("debug", false, "enable debug logging")
 
 	// hidden in favor of the `insecure-skip-tls-verify` flag
 	cmd.Flags().Bool("allow-insecure-connections", false, "when set, do not verify TLS certs when retrieving spec and reporting results")
 	cmd.Flags().MarkHidden("allow-insecure-connections")
 
+	// `no-uri` references the `followURI` functionality where we can use an upstream spec when creating a support bundle
+	// This flag makes sure we can also disable this and fall back to the default spec.
+	cmd.Flags().Bool("no-uri", false, "When this flag is used, Troubleshoot does not attempt to retrieve the bundle referenced by the uri: field in the spec.`")
+
 	viper.BindPFlags(cmd.Flags())
 
 	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
@@ -67,19 +81,6 @@ func initConfig() {
 	viper.AutomaticEnv()
 }
 
-func ensureCollectorInList(list []*troubleshootv1beta2.Collect, collector troubleshootv1beta2.Collect) []*troubleshootv1beta2.Collect {
-	for _, inList := range list {
-		if collector.ClusterResources != nil && inList.ClusterResources != nil {
-			return list
-		}
-		if collector.ClusterInfo != nil && inList.ClusterInfo != nil {
-			return list
-		}
-	}
-
-	return append(list, &collector)
-}
-
 func writeFile(filename string, contents []byte) error {
 	if err := ioutil.WriteFile(filename, contents, 0644); err != nil {
 		return err

cmd/troubleshoot/cli/run.go

@@ -22,16 +22,23 @@ import (
 	"github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
 	troubleshootclientsetscheme "github.com/replicatedhq/troubleshoot/pkg/client/troubleshootclientset/scheme"
 	"github.com/replicatedhq/troubleshoot/pkg/convert"
-	"github.com/replicatedhq/troubleshoot/pkg/docrewrite"
 	"github.com/replicatedhq/troubleshoot/pkg/httputil"
 	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/logger"
+	"github.com/replicatedhq/troubleshoot/pkg/specs"
 	"github.com/replicatedhq/troubleshoot/pkg/supportbundle"
 	"github.com/spf13/viper"
 	spin "github.com/tj/go-spin"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 )
 
-func runTroubleshoot(v *viper.Viper, arg string) error {
+func runTroubleshoot(v *viper.Viper, arg []string) error {
+	if v.GetBool("load-cluster-specs") == false && len(arg) < 1 {
+		return errors.New("flag load-cluster-specs must be set if no specs are provided on the command line")
+	}
+
 	interactive := v.GetBool("interactive") && isatty.IsTerminal(os.Stdout.Fd())
 
 	if interactive {
@@ -68,23 +75,139 @@ func runTroubleshoot(v *viper.Viper, arg string) error {
 		})
 	}
 
-	collectorContent, err := supportbundle.LoadSupportBundleSpec(arg)
-	if err != nil {
-		return errors.Wrap(err, "failed to load collector spec")
-	}
-
-	multidocs := strings.Split(string(collectorContent), "\n---\n")
-
-	// we support both raw collector kinds and supportbundle kinds here
-	supportBundle, err := supportbundle.ParseSupportBundleFromDoc([]byte(multidocs[0]))
-	if err != nil {
-		return errors.Wrap(err, "failed to parse collector")
-	}
+	var mainBundle *troubleshootv1beta2.SupportBundle
 
 	troubleshootclientsetscheme.AddToScheme(scheme.Scheme)
-	decode := scheme.Codecs.UniversalDeserializer().Decode
-
 	additionalRedactors := &troubleshootv1beta2.Redactor{}
+
+	// Defining `v` below will render using `v` in reference to Viper unusable.
+	// Therefore refactoring `v` to `val` will make sure we can still use it.
+	for i, val := range arg {
+
+		collectorContent, err := supportbundle.LoadSupportBundleSpec(val)
+		if err != nil {
+			return errors.Wrap(err, "failed to load support bundle spec")
+		}
+		multidocs := strings.Split(string(collectorContent), "\n---\n")
+		// Referencing `ParseSupportBundle with a secondary arg of `no-uri`
+		// Will make sure we can enable or disable the use of the `Spec.uri` field for an upstream spec.
+		// This change will not have an impact on KOTS' usage of `ParseSupportBundle`
+		// As Kots uses `load.go` directly.
+		supportBundle, err := supportbundle.ParseSupportBundle([]byte(multidocs[0]), !v.GetBool("no-uri"))
+		if err != nil {
+			return errors.Wrap(err, "failed to parse support bundle spec")
+		}
+
+		if i == 0 {
+			mainBundle = supportBundle
+		} else {
+			mainBundle = supportbundle.ConcatSpec(mainBundle, supportBundle)
+		}
+
+		parsedRedactors, err := supportbundle.ParseRedactorsFromDocs(multidocs)
+		if err != nil {
+			return errors.Wrap(err, "failed to parse redactors from doc")
+		}
+		additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, parsedRedactors...)
+	}
+
+	if v.GetBool("load-cluster-specs") {
+		labelSelector := strings.Join(v.GetStringSlice("selector"), ",")
+
+		parsedSelector, err := labels.Parse(labelSelector)
+		if err != nil {
+			return errors.Wrap(err, "unable to parse selector")
+		}
+
+		namespace := ""
+		if v.GetString("namespace") != "" {
+			namespace = v.GetString("namespace")
+		}
+
+		config, err := k8sutil.GetRESTConfig()
+		if err != nil {
+			return errors.Wrap(err, "failed to convert kube flags to rest config")
+		}
+
+		client, err := kubernetes.NewForConfig(config)
+		if err != nil {
+			return errors.Wrap(err, "failed to convert create k8s client")
+		}
+
+		var bundlesFromCluster []string
+
+		// Search cluster for Troubleshoot objects in cluster
+		bundlesFromSecrets, err := specs.LoadFromSecretMatchingLabel(client, parsedSelector.String(), namespace, specs.SupportBundleKey)
+		if err != nil {
+			logger.Printf("failed to load support bundle spec from secrets: %s", err)
+		}
+		bundlesFromCluster = append(bundlesFromCluster, bundlesFromSecrets...)
+
+		bundlesFromConfigMaps, err := specs.LoadFromConfigMapMatchingLabel(client, parsedSelector.String(), namespace, specs.SupportBundleKey)
+		if err != nil {
+			logger.Printf("failed to load support bundle spec from secrets: %s", err)
+		}
+		bundlesFromCluster = append(bundlesFromCluster, bundlesFromConfigMaps...)
+
+		for _, bundle := range bundlesFromCluster {
+			multidocs := strings.Split(string(bundle), "\n---\n")
+			parsedBundleFromSecret, err := supportbundle.ParseSupportBundleFromDoc([]byte(multidocs[0]))
+			if err != nil {
+				logger.Printf("failed to parse support bundle spec:  %s", err)
+				continue
+			}
+
+			if mainBundle == nil {
+				mainBundle = parsedBundleFromSecret
+			} else {
+				mainBundle = supportbundle.ConcatSpec(mainBundle, parsedBundleFromSecret)
+			}
+
+			parsedRedactors, err := supportbundle.ParseRedactorsFromDocs(multidocs)
+			if err != nil {
+				logger.Printf("failed to parse redactors from doc:  %s", err)
+				continue
+			}
+
+			additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, parsedRedactors...)
+		}
+
+		var redactorsFromCluster []string
+
+		// Search cluster for Troubleshoot objects in ConfigMaps
+		redactorsFromSecrets, err := specs.LoadFromSecretMatchingLabel(client, parsedSelector.String(), namespace, specs.RedactorKey)
+		if err != nil {
+			logger.Printf("failed to load redactor specs from config maps: %s", err)
+		}
+		redactorsFromCluster = append(redactorsFromCluster, redactorsFromSecrets...)
+
+		redactorsFromConfigMaps, err := specs.LoadFromConfigMapMatchingLabel(client, parsedSelector.String(), namespace, specs.RedactorKey)
+		if err != nil {
+			logger.Printf("failed to load redactor specs from config maps: %s", err)
+		}
+		redactorsFromCluster = append(redactorsFromCluster, redactorsFromConfigMaps...)
+
+		for _, redactor := range redactorsFromCluster {
+			multidocs := strings.Split(string(redactor), "\n---\n")
+			parsedRedactors, err := supportbundle.ParseRedactorsFromDocs(multidocs)
+			if err != nil {
+				logger.Printf("failed to parse redactors from doc:  %s", err)
+			}
+
+			additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, parsedRedactors...)
+		}
+
+		if mainBundle == nil {
+			return errors.New("no specs found in cluster")
+		}
+	}
+
+	if mainBundle == nil {
+		return errors.New("no support bundle specs provided to run")
+	} else if mainBundle.Spec.Collectors == nil && mainBundle.Spec.HostCollectors == nil {
+		return errors.New("no collectors specified in support bundle")
+	}
+
 	for idx, redactor := range v.GetStringSlice("redactors") {
 		redactorObj, err := supportbundle.GetRedactorFromURI(redactor)
 		if err != nil {
@@ -96,25 +219,6 @@ func runTroubleshoot(v *viper.Viper, arg string) error {
 		}
 	}
 
-	for i, additionalDoc := range multidocs {
-		if i == 0 {
-			continue
-		}
-		additionalDoc, err := docrewrite.ConvertToV1Beta2([]byte(additionalDoc))
-		if err != nil {
-			return errors.Wrap(err, "failed to convert to v1beta2")
-		}
-		obj, _, err := decode(additionalDoc, nil, nil)
-		if err != nil {
-			return errors.Wrapf(err, "failed to parse additional doc %d", i)
-		}
-		multidocRedactors, ok := obj.(*troubleshootv1beta2.Redactor)
-		if !ok {
-			continue
-		}
-		additionalRedactors.Spec.Redactors = append(additionalRedactors.Spec.Redactors, multidocRedactors.Spec.Redactors...)
-	}
-
 	var collectorCB func(chan interface{}, string)
 	progressChan := make(chan interface{}) // non-zero buffer can result in missed messages
 	finishedCh := make(chan bool, 1)
@@ -181,6 +285,8 @@ func runTroubleshoot(v *viper.Viper, arg string) error {
 		Namespace:                 v.GetString("namespace"),
 		ProgressChan:              progressChan,
 		SinceTime:                 sinceTime,
+		OutputPath:                v.GetString("output"),
+		Redact:                    v.GetBool("redact"),
 		FromCLI:                   true,
 	}
 
@@ -191,7 +297,7 @@ func runTroubleshoot(v *viper.Viper, arg string) error {
 		c.Println(fmt.Sprintf("\r%s\r", cursor.ClearEntireLine()))
 	}
 
-	response, err := supportbundle.CollectSupportBundleFromSpec(&supportBundle.Spec, additionalRedactors, createOpts)
+	response, err := supportbundle.CollectSupportBundleFromSpec(&mainBundle.Spec, additionalRedactors, createOpts)
 	if err != nil {
 		return errors.Wrap(err, "failed to run collect and analyze process")
 	}
@@ -200,7 +306,7 @@ func runTroubleshoot(v *viper.Viper, arg string) error {
 			close(finishedCh) // this removes the spinner
 			isFinishedChClosed = true
 
-			if err := showInteractiveResults(supportBundle.Name, response.AnalyzerResults); err != nil {
+			if err := showInteractiveResults(mainBundle.Name, response.AnalyzerResults); err != nil {
 				interactive = false
 			}
 		} else {
@@ -209,7 +315,7 @@ func runTroubleshoot(v *viper.Viper, arg string) error {
 	}
 
 	if !response.FileUploaded {
-		if appName := supportBundle.Labels["applicationName"]; appName != "" {
+		if appName := mainBundle.Labels["applicationName"]; appName != "" {
 			f := `A support bundle for %s has been created in this directory
 named %s. Please upload it on the Troubleshoot page of
 the %s Admin Console to begin analysis.`

config/crds/troubleshoot.replicated.com_analyzers.yaml

@@ -687,7 +687,6 @@ spec:
                           type: string
                       required:
                       - outcomes
-                      - storageClassName
                       type: object
                     textAnalyze:
                       properties:

config/crds/troubleshoot.replicated.com_preflights.yaml

@@ -687,7 +687,6 @@ spec:
                           type: string
                       required:
                       - outcomes
-                      - storageClassName
                       type: object
                     textAnalyze:
                       properties:

config/crds/troubleshoot.replicated.com_supportbundles.yaml

@@ -718,7 +718,6 @@ spec:
                           type: string
                       required:
                       - outcomes
-                      - storageClassName
                       type: object
                     textAnalyze:
                       properties:

config/crds/troubleshoot.sh_hostpreflights.yaml

@@ -41,8 +41,14 @@ spec:
                   properties:
                     blockDevices:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
+                        collectorName:
+                          type: string
                         exclude:
                           type: BoolString
                         includeUnmountedPartitions:
@@ -82,6 +88,8 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - includeUnmountedPartitions
                       - minimumAcceptableSize
@@ -89,6 +97,10 @@ spec:
                       type: object
                     certificate:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
                         collectorName:
@@ -127,13 +139,21 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     cpu:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
+                        collectorName:
+                          type: string
                         exclude:
                           type: BoolString
                         outcomes:
@@ -168,11 +188,17 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     diskUsage:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
                         collectorName:
@@ -211,11 +237,17 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     filesystemPerformance:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
                         collectorName:
@@ -254,13 +286,70 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
+                    hostOS:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     hostServices:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
+                        collectorName:
+                          type: string
                         exclude:
                           type: BoolString
                         outcomes:
@@ -295,11 +384,17 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     http:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
                         collectorName:
@@ -338,11 +433,17 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     httpLoadBalancer:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
                         collectorName:
@@ -381,13 +482,21 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     ipv4Interfaces:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
+                        collectorName:
+                          type: string
                         exclude:
                           type: BoolString
                         outcomes:
@@ -422,13 +531,70 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
+                    kernelModules:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     memory:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
+                        collectorName:
+                          type: string
                         exclude:
                           type: BoolString
                         outcomes:
@@ -463,11 +629,66 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
+                      required:
+                      - outcomes
+                      type: object
+                    systemPackages:
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        checkName:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        outcomes:
+                          items:
+                            properties:
+                              fail:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              pass:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                              warn:
+                                properties:
+                                  message:
+                                    type: string
+                                  uri:
+                                    type: string
+                                  when:
+                                    type: string
+                                type: object
+                            type: object
+                          type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     tcpConnect:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
                         collectorName:
@@ -506,11 +727,17 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     tcpLoadBalancer:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
                         collectorName:
@@ -549,11 +776,17 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     tcpPortStatus:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
                         collectorName:
@@ -592,13 +825,21 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
                     time:
                       properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
                         checkName:
                           type: string
+                        collectorName:
+                          type: string
                         exclude:
                           type: BoolString
                         outcomes:
@@ -633,6 +874,8 @@ spec:
                                 type: object
                             type: object
                           type: array
+                        strict:
+                          type: BoolString
                       required:
                       - outcomes
                       type: object
@@ -758,6 +1001,371 @@ spec:
                       - backgroundWriteIOPSJobs
                       - enableBackgroundIOPS
                       type: object
+                    hostOS:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    hostServices:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    http:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        get:
+                          properties:
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        post:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        put:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                      type: object
+                    httpLoadBalancer:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        path:
+                          type: string
+                        port:
+                          type: integer
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      - path
+                      - port
+                      type: object
+                    ipv4Interfaces:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    kernelModules:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    kubernetes:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    memory:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    run:
+                      properties:
+                        args:
+                          items:
+                            type: string
+                          type: array
+                        collectorName:
+                          type: string
+                        command:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      required:
+                      - args
+                      - command
+                      type: object
+                    systemPackages:
+                      properties:
+                        amzn:
+                          items:
+                            type: string
+                          type: array
+                        amzn2:
+                          items:
+                            type: string
+                          type: array
+                        centos:
+                          items:
+                            type: string
+                          type: array
+                        centos7:
+                          items:
+                            type: string
+                          type: array
+                        centos8:
+                          items:
+                            type: string
+                          type: array
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        ol:
+                          items:
+                            type: string
+                          type: array
+                        ol7:
+                          items:
+                            type: string
+                          type: array
+                        ol8:
+                          items:
+                            type: string
+                          type: array
+                        rhel:
+                          items:
+                            type: string
+                          type: array
+                        rhel7:
+                          items:
+                            type: string
+                          type: array
+                        rhel8:
+                          items:
+                            type: string
+                          type: array
+                        ubuntu:
+                          items:
+                            type: string
+                          type: array
+                        ubuntu16:
+                          items:
+                            type: string
+                          type: array
+                        ubuntu18:
+                          items:
+                            type: string
+                          type: array
+                        ubuntu20:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    tcpConnect:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      type: object
+                    tcpLoadBalancer:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        port:
+                          type: integer
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      - port
+                      type: object
+                    tcpPortStatus:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        interface:
+                          type: string
+                        port:
+                          type: integer
+                      required:
+                      - port
+                      type: object
+                    time:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                  type: object
+                type: array
+              remoteCollectors:
+                items:
+                  properties:
+                    blockDevices:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    certificate:
+                      properties:
+                        certificatePath:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        keyPath:
+                          type: string
+                      required:
+                      - certificatePath
+                      - keyPath
+                      type: object
+                    cpu:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    diskUsage:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        path:
+                          type: string
+                      required:
+                      - path
+                      type: object
+                    filesystemPerformance:
+                      description: RemoteFilesystemPerformance benchmarks sequential
+                        write latency on a single file. The optional background IOPS
+                        feature attempts to mimic real-world conditions by running
+                        read and write workloads prior to and during benchmark execution.
+                      properties:
+                        backgroundIOPSWarmupSeconds:
+                          description: How long to run the background IOPS read and
+                            write workloads prior to starting the benchmarks.
+                          type: integer
+                        backgroundReadIOPS:
+                          description: The target read IOPS to run while benchmarking.
+                            This is a limit and there is no guarantee it will be reached.
+                            This is the total IOPS for all background read jobs.
+                          type: integer
+                        backgroundReadIOPSJobs:
+                          description: Number of threads to use for background read
+                            IOPS. This should be set high enough to reach the target
+                            specified in BackgrounReadIOPS.
+                          type: integer
+                        backgroundWriteIOPS:
+                          description: The target write IOPS to run while benchmarking.
+                            This is a limit and there is no guarantee it will be reached.
+                            This is the total IOPS for all background write jobs.
+                          type: integer
+                        backgroundWriteIOPSJobs:
+                          description: 'Number of threads to use for background write
+                            IOPS. This should be set high enough to reach the target
+                            specified in BackgroundWriteIOPS. Example: If BackgroundWriteIOPS
+                            is 100 and write latency is 10ms then a single job would
+                            barely be able to reach 100 IOPS so this should be at
+                            least 2.'
+                          type: integer
+                        collectorName:
+                          type: string
+                        datasync:
+                          description: Whether to call datasync on the file after
+                            each write. Skipped if Sync is also true. Does not apply
+                            to background IOPS task.
+                          type: boolean
+                        directory:
+                          description: The directory where the benchmark will create
+                            files.
+                          type: string
+                        enableBackgroundIOPS:
+                          description: Enable the background IOPS feature.
+                          type: boolean
+                        exclude:
+                          type: BoolString
+                        fileSize:
+                          description: The size of the file used in the benchmark.
+                            The number of IO operations for the benchmark will be
+                            FileSize / OperationSizeBytes. Accepts valid Kubernetes
+                            resource units such as Mi.
+                          type: string
+                        operationSize:
+                          description: The size of each write operation performed
+                            while benchmarking. This does not apply to the background
+                            IOPS feature if enabled, since those must be fixed at
+                            4096.
+                          format: int64
+                          type: integer
+                        sync:
+                          description: Whether to call sync on the file after each
+                            write. Does not apply to background IOPS task.
+                          type: boolean
+                        timeout:
+                          description: Total timeout, including background IOPS setup
+                            and warmup if enabled.
+                          type: string
+                      required:
+                      - backgroundIOPSWarmupSeconds
+                      - backgroundReadIOPS
+                      - backgroundReadIOPSJobs
+                      - backgroundWriteIOPS
+                      - backgroundWriteIOPSJobs
+                      - enableBackgroundIOPS
+                      type: object
                     hostServices:
                       properties:
                         collectorName:
@@ -841,7 +1449,7 @@ spec:
                         exclude:
                           type: BoolString
                       type: object
-                    kubernetes:
+                    kernelModules:
                       properties:
                         collectorName:
                           type: string
@@ -855,6 +1463,13 @@ spec:
                         exclude:
                           type: BoolString
                       type: object
+                    systemPackages:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
                     tcpConnect:
                       properties:
                         address:

config/crds/troubleshoot.sh_remotecollectors.yaml

@@ -0,0 +1,361 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.7.0
+  creationTimestamp: null
+  name: remotecollectors.troubleshoot.sh
+spec:
+  group: troubleshoot.sh
+  names:
+    kind: RemoteCollector
+    listKind: RemoteCollectorList
+    plural: remotecollectors
+    singular: remotecollector
+  scope: Namespaced
+  versions:
+  - name: v1beta2
+    schema:
+      openAPIV3Schema:
+        description: RemoteCollector is the Schema for the remote collectors API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RemoteCollectorSpec defines the desired state of the RemoteCollector
+            properties:
+              afterCollection:
+                items:
+                  properties:
+                    callback:
+                      properties:
+                        method:
+                          type: string
+                        redactUri:
+                          type: string
+                        uri:
+                          type: string
+                      required:
+                      - method
+                      - redactUri
+                      - uri
+                      type: object
+                    uploadResultsTo:
+                      properties:
+                        method:
+                          type: string
+                        redactUri:
+                          type: string
+                        uri:
+                          type: string
+                      required:
+                      - method
+                      - redactUri
+                      - uri
+                      type: object
+                  type: object
+                type: array
+              collectors:
+                items:
+                  properties:
+                    blockDevices:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    certificate:
+                      properties:
+                        certificatePath:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        keyPath:
+                          type: string
+                      required:
+                      - certificatePath
+                      - keyPath
+                      type: object
+                    cpu:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    diskUsage:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        path:
+                          type: string
+                      required:
+                      - path
+                      type: object
+                    filesystemPerformance:
+                      description: RemoteFilesystemPerformance benchmarks sequential
+                        write latency on a single file. The optional background IOPS
+                        feature attempts to mimic real-world conditions by running
+                        read and write workloads prior to and during benchmark execution.
+                      properties:
+                        backgroundIOPSWarmupSeconds:
+                          description: How long to run the background IOPS read and
+                            write workloads prior to starting the benchmarks.
+                          type: integer
+                        backgroundReadIOPS:
+                          description: The target read IOPS to run while benchmarking.
+                            This is a limit and there is no guarantee it will be reached.
+                            This is the total IOPS for all background read jobs.
+                          type: integer
+                        backgroundReadIOPSJobs:
+                          description: Number of threads to use for background read
+                            IOPS. This should be set high enough to reach the target
+                            specified in BackgrounReadIOPS.
+                          type: integer
+                        backgroundWriteIOPS:
+                          description: The target write IOPS to run while benchmarking.
+                            This is a limit and there is no guarantee it will be reached.
+                            This is the total IOPS for all background write jobs.
+                          type: integer
+                        backgroundWriteIOPSJobs:
+                          description: 'Number of threads to use for background write
+                            IOPS. This should be set high enough to reach the target
+                            specified in BackgroundWriteIOPS. Example: If BackgroundWriteIOPS
+                            is 100 and write latency is 10ms then a single job would
+                            barely be able to reach 100 IOPS so this should be at
+                            least 2.'
+                          type: integer
+                        collectorName:
+                          type: string
+                        datasync:
+                          description: Whether to call datasync on the file after
+                            each write. Skipped if Sync is also true. Does not apply
+                            to background IOPS task.
+                          type: boolean
+                        directory:
+                          description: The directory where the benchmark will create
+                            files.
+                          type: string
+                        enableBackgroundIOPS:
+                          description: Enable the background IOPS feature.
+                          type: boolean
+                        exclude:
+                          type: BoolString
+                        fileSize:
+                          description: The size of the file used in the benchmark.
+                            The number of IO operations for the benchmark will be
+                            FileSize / OperationSizeBytes. Accepts valid Kubernetes
+                            resource units such as Mi.
+                          type: string
+                        operationSize:
+                          description: The size of each write operation performed
+                            while benchmarking. This does not apply to the background
+                            IOPS feature if enabled, since those must be fixed at
+                            4096.
+                          format: int64
+                          type: integer
+                        sync:
+                          description: Whether to call sync on the file after each
+                            write. Does not apply to background IOPS task.
+                          type: boolean
+                        timeout:
+                          description: Total timeout, including background IOPS setup
+                            and warmup if enabled.
+                          type: string
+                      required:
+                      - backgroundIOPSWarmupSeconds
+                      - backgroundReadIOPS
+                      - backgroundReadIOPSJobs
+                      - backgroundWriteIOPS
+                      - backgroundWriteIOPSJobs
+                      - enableBackgroundIOPS
+                      type: object
+                    hostServices:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    http:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        get:
+                          properties:
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        post:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                        put:
+                          properties:
+                            body:
+                              type: string
+                            headers:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            insecureSkipVerify:
+                              type: boolean
+                            url:
+                              type: string
+                          required:
+                          - url
+                          type: object
+                      type: object
+                    httpLoadBalancer:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        path:
+                          type: string
+                        port:
+                          type: integer
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      - path
+                      - port
+                      type: object
+                    ipv4Interfaces:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    kernelModules:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    memory:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    systemPackages:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                    tcpConnect:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      type: object
+                    tcpLoadBalancer:
+                      properties:
+                        address:
+                          type: string
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        port:
+                          type: integer
+                        timeout:
+                          type: string
+                      required:
+                      - address
+                      - port
+                      type: object
+                    tcpPortStatus:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                        interface:
+                          type: string
+                        port:
+                          type: integer
+                      required:
+                      - port
+                      type: object
+                    time:
+                      properties:
+                        collectorName:
+                          type: string
+                        exclude:
+                          type: BoolString
+                      type: object
+                  type: object
+                type: array
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                type: object
+            type: object
+          status:
+            description: CollectorStatus defines the observed state of Collector
+            type: object
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

config/samples/troubleshoot_v1beta2_collector.yaml

@@ -3,6 +3,7 @@ kind: Collector
 metadata:
   name: collector-sample
 spec:
+  uri: https://raw.githubusercontent.com/replicatedhq/troubleshoot-specs/main/in-cluster/default.yaml
   collectors:
     - clusterInfo: {}
     - clusterResources: {}
@@ -15,7 +16,7 @@ spec:
     #       - name=nginx-ingress-microk8s
     #     namespace: default
     #     limits:
-    #       maxAge: 30d
+    #       maxAge: 720h # 30*24
     #       maxLines: 10000
     # - run:
     #     collectorName: ping-google

deploy/.goreleaser.yaml

@@ -11,6 +11,7 @@ builds:
       - windows
     goarch:
       - amd64
+      - arm64
     env:
       - CGO_ENABLED=0
     main: cmd/preflight/main.go
@@ -29,6 +30,7 @@ builds:
       - windows
     goarch:
       - amd64
+      - arm64
     env:
       - CGO_ENABLED=0
     main: cmd/troubleshoot/main.go
@@ -40,6 +42,25 @@ builds:
     flags: -tags netgo -tags containers_image_ostree_stub -tags exclude_graphdriver_devicemapper -tags exclude_graphdriver_btrfs -tags containers_image_openpgp -installsuffix netgo
     binary: support-bundle
     hooks: {}
+  - id: collect
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    env:
+      - CGO_ENABLED=0
+    main: cmd/collect/main.go
+    ldflags: -s -w
+      -X github.com/replicatedhq/troubleshoot/pkg/version.version={{.Version}}
+      -X github.com/replicatedhq/troubleshoot/pkg/version.gitSHA={{.Commit}}
+      -X github.com/replicatedhq/troubleshoot/pkg/version.buildTime={{.Date}}
+      -extldflags "-static"
+    flags: -tags netgo -tags containers_image_ostree_stub -tags exclude_graphdriver_devicemapper -tags exclude_graphdriver_btrfs -tags containers_image_openpgp -installsuffix netgo
+    binary: collect
+    hooks: {}
 archives:
   - id: preflight
     builds:
@@ -81,6 +102,26 @@ archives:
       - src: 'sbom/assets/*'
         dst: .
         strip_parent: true # this is needed to make up for the way unzips work in krew v0.4.1
+  - id: collect
+    builds:
+      - collect
+    format: tar.gz
+    format_overrides:
+      - goos: windows
+        format: zip
+    name_template: 'collect_{{ .Os }}_{{ .Arch }}'
+    files:
+      - licence*
+      - LICENCE*
+      - license*
+      - LICENSE*
+      - readme*
+      - README*
+      - changelog*
+      - CHANGELOG*
+      - src: 'sbom/assets/*'
+        dst: .
+        strip_parent: true # this is needed to make up for the way unzips work in krew v0.4.1
 dockers:
   - dockerfile: ./deploy/Dockerfile.troubleshoot
     image_templates:
@@ -91,6 +132,7 @@ dockers:
     ids:
       - support-bundle
       - preflight
+      - collect
   - dockerfile: ./deploy/Dockerfile.troubleshoot
     image_templates:
       - "replicated/preflight:latest"
@@ -100,3 +142,4 @@ dockers:
     ids:
       - support-bundle
       - preflight
+      - collect

deploy/Dockerfile.troubleshoot

@@ -3,10 +3,11 @@ WORKDIR /
 
 RUN apt-get -qq update \
  && apt-get -qq -y install \
-    ca-certificates
+    ca-certificates kmod
 
 COPY support-bundle /troubleshoot/support-bundle
 COPY preflight /troubleshoot/preflight
+COPY collect /troubleshoot/collect
 
 ENV PATH="/troubleshoot:${PATH}"
 

deploy/krew/preflight.yaml

@@ -27,6 +27,17 @@ spec:
     - from: LICENSE
       to: .
     bin: preflight
+  - selector:
+      matchLabels:
+        os: darwin
+        arch: arm64
+    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/preflight_darwin_arm64.tar.gz" .TagName }}
+    files:
+    - from: preflight
+      to: .
+    - from: LICENSE
+      to: .
+    bin: preflight    
   - selector:
       matchLabels:
         os: windows

deploy/krew/support-bundle.yaml

@@ -27,6 +27,17 @@ spec:
     - from: LICENSE
       to: .
     bin: support-bundle
+  - selector:
+      matchLabels:
+        os: darwin
+        arch: arm64
+    {{addURIAndSha "https://github.com/replicatedhq/troubleshoot/releases/download/{{ .TagName }}/support-bundle_darwin_arm64.tar.gz" .TagName }}
+    files:
+    - from: support-bundle
+      to: .
+    - from: LICENSE
+      to: .
+    bin: support-bundle    
   - selector:
       matchLabels:
         os: windows

design/design-principles.md

@@ -0,0 +1,27 @@
+# Troubleshoot Design Principles
+
+This document captures design principles that the Troubleshoot project abides by. This is intended to provide new contributors with guidance on how to approach problems and a better understanding of what to consider and address while implementing features.
+
+## Client not Cluster based
+
+Troubleshoot has to communicate with the Kubernetes API server to gather information. However, Troubleshoot should interact with the cluster as little as reasonably possible and has no intention of having a persistent in-cluster presence. There are several reasons for this approach, in no particular order those include:
+
+* Users experiencing an issue in their cluster may discover Troubleshoot after they have a problem and requiring installed components may exclude them from solving their problem.
+* A user may have limited cluster access and requiring cluster wide installation like a CRD or Operator can prevent them for using tools to recover from their errors.
+* By definition Troubleshoot is being used because there is an issue with the cluster, to prevent exasperating the issue Troubleshoot should avoid writing to the cluster.
+
+## Tools not specs
+
+The Troubleshoot project should include tools which can be used to diagnose issues but is not attempting to include Specs built into the project itself. The number of issues and projects which could benefit from Troubleshoot is very large and we intended to enable those projects to better support their project. It is unreasonable and undesirable for Troubleshoot to be the source of truth for all possible cluster and software issues.
+
+## Fail forward
+
+Clusters with issues can be unpredictable, the scope of error conditions is likely unbounded. Troubleshoot should keep this in mind when doing error handling and fail forward proceeding with as much of the intended operation as possible while logging the errors. For example if a collector fails to collect information that should not prevent other collectors from running. Any condition that causes Troubleshoot to hang or not complete a run is considered a bug.
+
+## Provide a predictable user experience
+
+When things go wrong people can be stressed and stressed people aren't likely to thoroughly read documentation. Whenever possible default values, command line flags, etc should be set to provide a user the best experience possible with the input provided. Some examples of this include:
+
+* When accepting flags for things like Namespaces, as much as possible, use the same syntax that `kubectl` accepts which users are likely to try instinctively.
+* Default to gathering more information not less, rarely is it easier to diagnose an issue with less information.
+

design/proposal-consolidate-collection.md

@@ -0,0 +1,66 @@
+# Consolidate collector code
+ 
+## Goals
+
+Reduce code maintenance needs.
+
+Improve consistency between preflight and support-bundle.
+
+## Non Goals
+
+## Background
+
+In the current Troubleshoot code base, there are three separate paths to running collectors.  These include preflights, support-bundle, and the collect package.  The three have diverged over time and are different to one another, but do not appear to have any need to be separate. This is confusing and likely to introduce errors in the future.
+
+## High-Level Design
+
+* Add a `collect` package public API that can be called to run the collect logic, from any other package
+* change the preflight, support-bundle and collect binaries to call that API rather than their own collect routines
+
+## Detailed Design
+
+Package `preflight`:
+* Remove `CollectHost`, `Collect` and `CollectRemote`
+
+Package `supportbundle`:
+* Remove `runCollectors`, `CollectSupportBundleFromSpec`, and associated code
+
+Package `collect`:
+* Add a replacement for `runCollectors`, `CollectSupportBundleFromSpec` taken from `supportbundle`
+* Add replacements for `CollectHost`, `Collect` and `CollectRemote` taken from `preflight`
+* Where the above duplicate functionality, alter the `supportbundle` or `preflight` packages to ensure that a single new function handles the requirement
+
+CLI packages:
+* Alter to use the public functions from `collect`
+
+## Limitations
+
+Breaking change - KOTS at least imports `CollectSupportBundleFromSpec` plus potentially others.
+
+This does not affect the analysis and redaction portions of code.
+
+## Assumptions
+
+* there is no need to run collectors differently between preflight and support-bundle
+ 
+## Testing
+
+Any new function will need unit tests.
+
+Existing tests will need to be altered, and possibly consolidated.
+
+## Documentation
+
+The public function to call collection should be documented and at that point regarded stable.
+
+## Alternatives Considered
+
+## Security Considerations
+
+None identified.
+
+## Related changes
+
+TODO:
+* make an API for analyze and redact
+* create an API that calls collect, redact, and analyze - and decide if that can be called by preflight and support-bundle

design/proposal-mergeable-spec.md

@@ -0,0 +1,138 @@
+# Provide the ability to specify multiple Troubleshoot specs in one run of support-bundle or preflight
+
+Troubleshoot doesn't have a modular way for different components to specify specifications. If a software project wanted to include project specific items the end user would have a hard time knowing where to find those and how to collect them. Furthermore if multiple projects were to do this the user would have to run troubleshoot multiple times.
+
+Ideally troubleshoot would allow merging of specs to allow building a spec either automatically or influenced by user input to target specific needs.
+
+## Goals
+
+Primary goal: Allow folks that develop a particular component to maintain Troubleshoot specs for that component, including Vendors for their application.
+
+Long term goal: allow folks to update the component specs without needing to run any other upgrades.
+
+This proposal initially adds the ability to supply multiple support bundle specs for a single run of support-bundle and/or preflight so that:
+
+* when Troubleshoot runs, the spec it uses is an aggregate of multiple specs from the same source - yaml file, URL, configMap, or (new) CRD
+* each software component can contribute a Troubleshoot spec that is specific to that software
+* Ownership of each individual spec per component transfers to the owner of that component
+
+This will:
+
+* Ensure support bundles generated by users are comprehensive and contain all needed information for a project maintainer to action
+* Allow multiple specs from different projects, should a cluster have multiple projects using Troubleshoot
+* Software developers to continually update specs for components to easily identify known issues and reduce support noise.
+
+## Non Goals
+
+* Compatibility with previous URL, configMap and yaml specs, both Redactors and SupportBundle types
+* Maintain the ability to read secrets from the Kubernetes API
+
+## Background
+
+When users of Troubleshoot create a support bundle from the CLI, they use a single spec that is provided from:
+
+* A secret installed in the cluster by an application such as [KOTS](kots.io)
+* A url like <http://kots.io>
+* some other single example spec, e.g. <https://github.com/replicatedhq/troubleshoot-specs>
+
+When KOTS collects a support bundles from the KOTS UI, the spec is a [merged](https://github.com/replicatedhq/kots/blob/main/pkg/supportbundle/spec.go#L426) combination of the following:
+
+* The [default spec](https://github.com/replicatedhq/kots/blob/main/pkg/supportbundle/defaultspec/spec.yaml) in the kots code
+* The spec provided by the Vendor’s application bundle
+* This merged spec is deduplicated by kots [here](https://github.com/replicatedhq/kots/blob/main/pkg/supportbundle/spec.go#L217).
+
+Redactors are [hard coded](https://github.com/replicatedhq/troubleshoot/blob/main/pkg/redact/redact.go#L160) into Troubleshoot as well as supplied in the spec.
+
+Although we’re currently making strides in improving the Troubleshoot project by creating new collectors, analyzers, and specs, we have no way to more quickly deliver Troubleshoot improvements to installations in the field without updating the kots application and pushing a new release, or upgrading kots to a new version.
+
+When folks find a support issue that could have been identified by Troubleshoot, we ask them to write a new collector, and/or analyzer, for that information.  However, if we do that, the new collector/analyzer is not easily available to end users.
+
+Some of the useful features of Troubleshoot are actually implemented as part of KOTS, while both open source Troubleshoot should address this independently.
+
+## High-Level Design
+
+Add CRD support to Troubleshoot:
+
+* Design a custom resource (CRD) that allows adding spec(s) to the Kubernetes cluster using `kubectl`.  There is no need to extend this to use [API server aggregation](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#api-server-aggregation).
+* Update Troubleshoot to allow consuming the first object found of the new custom resource, by default - i.e. if there are no specs provided on the CLI or entrypoint, use CRD
+* Once merge is implemented, update Troubleshoot to consume and merge all the instances of the CRD.
+* To minimize code changes in Troubleshoot, we could implement two CRDs, of `type: SupportBundle` and `type: Redactor`.  However, there is no specific need to separate the two and it maybe advantageous to keep things simple, combining them.
+
+Allow multiple specs to be merged by Troubleshoot:
+
+* create an interface for collectors, analyzers, and redactors to merge
+* each collector/analyzer/redactor can use a generic implementation of the interface for the merge, or can use a specific one for that task if that particular collector will benefit from a more intelligent merge.
+* the spec merge code in kots can, at this stage, be removed once kots ships CRDs for the Troubleshoot specs
+
+Spec sources:
+
+* Alter Troubleshoot to accept multiple yaml files on the CLI
+* Create a CRD containing a spec, have Troubleshoot search for spec CRDs and combine them all when run
+* maintain the URL compatibility as is
+* maintain the configMap compatibility as is
+
+## Detailed Design
+
+CRD: to be designed
+
+Merge:
+
+* define a new interface that provides the merge functionality for collectors, analyzers, and redactors
+* there should be a generic implementation of that interface which is used by default for all objects.  This can simply use `append()`.
+* specific collectors may have alternative implementations of the interface where overrides are required.
+
+Particular overrides known at this point in time:
+
+* clusterResources has an option namespaces config, these should be merged and deduplicated
+* Two runPod collectors with the same name and different commands are unmergable. Only one should be run and an error logged.
+* Two configMap collectors can be deduplicated and merged depending on the configurations
+* Two logs collectors likely only need deduplication to prevent collecting the same thing twice
+
+## Limitations
+
+### Visibility
+
+Users may collect more than intended with the new implementation if all available CRD objects are run. We therefore need to be sure the Troubleshoot client allows for selection of what to run. While the default would be to run everything, a user should be able to just run specific SupportBundle specs based on labels, namespaces, etc. By doing this no functionality is lost.
+
+### Airgap
+
+Some of the spec locations such as URL wouldn’t work here. There may be other considerations around airgap as well.
+
+Airgap installs are intentionally feature limited. Failure to retrieve new versions of specs should fail gracefully and proceed with the run.
+
+As a follow up feature to improve support bundle collection Troubleshoot could gain some abilities to help manage and upgrade SupportBundles found in a cluster in a fashion that allows the user to split the discovery, download, and upgrade so they could be run on different machines.
+
+An example implementation would be:
+
+* A command to find, deduplicate, and output a list of SupportBundles in the cluster. The list would include at least the upstream URL and version currently installed in the cluster.
+* A command to take the output of the above command and check for updates, downloading all updated SupportBundles into a single .tgz file.
+* A command to apply the above .tgz file to the cluster upgrading any existing SupportBundles with the newer versions.
+
+## Assumptions
+
+* all deployments are able to deploy CRDs to the Kubernetes cluster
+
+## Testing
+
+## Alternatives Considered
+
+### Use the existing URL functionality in Troubleshoot
+
+Proposal: Provide a custom URL for each install, that when called by Troubleshoot returns a spec composed of the ‘latest’ for every component spec specified in that installation, much like we do with <https://kurl.sh/latest> now.
+
+Pros:
+
+* No changes required to Troubleshoot
+* Always use the latest specs for components other than the Vendor’s application
+
+Cons:
+
+* Would not work for airgap installations
+* Software developers need to update their application in order to get new specs from all dependencies
+* Replicated would need to provide a new API/web service to host the specs, reducing the general community applicability of troubleshoot as a stand alone project
+* Discourages individual projects from maintaining Troubleshoot specs for that project
+
+## Security Considerations
+
+Passing control of component specs to individual projects presents a possibility of reducing the amount of review a spec goes through for each update, allowing a spec provided by, say, a kURL addon to run collectors.  The current implementation relies on the kots review process for default specs, plus the review of individual example specs.  Depending on the final implementation, it is unlikely that this change itself increases any risk since the delivery of automated and default specs to Troubleshoot is maintained within kots, and/or Troubleshoot itself much as it is already.
+

design/proposal-standard-interface.md

@@ -0,0 +1,74 @@
+# Provide an extendable API for accessing bundle information
+
+## Goals
+
+* Provide API based access to collected information, decoupling other projects from troubleshoot on-disk format
+* Reuse existing APIs when they exist to make the bundle compatible with existing tools without modification
+* Plan for extensibility for accessing information beyond just the standard kubernetes api
+
+## Non Goals
+
+* Compatibility with previous on-disk formats
+* Compatibility with existing collectors without modification
+  * There should be a plan to allow the implementation of existing collectors
+
+## Background
+
+While using the information gathered in a support bundle users were finding it hard to find information while manually reviewing the various files collected in the bundle. Users have to understand the folder structure, files structure, and process JSON files to find information about the cluster. The [sbctl](https://github.com/replicatedhq/sbctl) project was created to prove out the utility of providing api based access so that users could use existing tools which they already understood. This has been a very successful experiment with feedback being that most users now use this utility as their primary, or only, interface to the support bundle information.
+
+There are some drawbacks to the current approach. The `sbctl` project is tightly coupled to troubleshoot on-disk formats, each kubernetes API must be implemented in `sbctl` individually and will require being kept up to date as APIs change, and `sbctl` has no plan today to provide similar API based access to information other than the standard kubernetes api.
+
+This proposal is meant to take the learnings from `sbctl` and consider implementing it as a first class feature of troubleshoot while attempting to address the current maintenance and expandability limitations.
+
+## High-Level Design
+
+To help address standard access to API data, troubleshoot will start an etcd instance which collectors can then use to store collected information rather than writing to custom on-disk locations. Collectors that only need to collect Kubernetes API information then do not need to serve up data as the API server will be used to provide access to the collected data. Storing data directly in etcd will allow troubleshoot to later serve up this same information by again starting an api-server and etcd using the previously collected etcd data store. This should remove almost all maintenance from troubleshoot for implementing API calls to access the collected information.
+
+There will also be information that is desired to be stored that doesn't have any native representation in the api-server today. Examples could include custom collectors which execute into containers and extensions like [metrics server](https://github.com/kubernetes-sigs/metrics-server). These components can be addressed using the built in [Kubernetes API Aggregation Layer](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) which is how `metrics server` itself works to extend and provide api based access to node information. By registering additional API extensions troubleshoot plugins can implement both a collection and an API for retrieving custom information which is accessible in the same fashion as the rest of the api-server.
+
+The additional benefit to this, which can be demonstrated with `metrics-server`, is that collectors can be written for any other extension API and be compatible with existing tools the same way using the api-server provides compatibility with `kubectl`. Using `metrics-server` as an example, a collector can be written to collect node information which can be stored locally. The collector can then implement the standard [GET Endpoints](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) from the metrics-server and reply to them with the results it collected. By doing so, all tools that work with metrics-server today, like `kubectl top` will also work with information served from a support bundle. Additionally, the collector implementation handles any custom file formats without exposing that to any other tool making it easy to maintain.
+
+Any other access to the filesystem directly will be modified to instead use the provided api-server. This means analyzers will not directly reference files on disk and will instead run against the api-server to analyze the collected information. This decouples analyzers from how collectors store data providing clean separation of concerns for maintaining both collectors and analyzers. Decoupling these also creates a natural way to implement analyzers that use data from multiple collectors. This could also allow analyzers to run against existing clusters providing a use for analyzers independent of support bundle collection. This could encourage additional community contributions of analyzers.
+
+An initially unintended benefit of using the Aggregation Layer is that any HostCollector using this implementation would be very close to an implementation of an extension which you could install in clusters. This could make HostCollectors also useful to install as a service in a live cluster for operations information about hosts.
+
+## Detailed Design
+
+### Outstanding design questions
+
+1. How reasonable is it to start an api-server as part of troubleshoot? Consider the following known implementations that do something like this:
+
+* [envtest](https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/envtest) - requires binaries present on the machine
+* [microk8s implementation](https://github.com/canonical/microk8s/blob/master/build-scripts/patches/0000-Kubelite-integration.patch) - bundles slightly modified binaries
+* [k0s uses upstream binaries statically compiled](https://docs.k0sproject.io/v1.23.8+k0s.0/architecture/) - bundles statically compiled binaries that self extract and uses a process monitor to run them
+
+2. Can you in fact push metadat like "Status" into an api-server or do we have to write directly to etcd?
+
+* If we can't push to the api-server is just writing the information directly into etcd something we can do and have a reasonable expectation of compatibility?
+
+3. Is the overhead to write an Aggregation API going to add an unnecessary burden to writing new collector plugins? Can these be templated into a reasonably to ease collector creation?
+
+## Limitations
+
+Using the actual API server will provide limitations on the version skew which can be collected/displayed. This could be addressed by including multiple versions of the kubernetes-api server to allow serving a wide range of support bundles. This limitation likely already exists today but would exist in the tooling that is trying to collect, analyzer, or server the data.
+
+## Assumptions
+
+* Serving logs hasn't been designed yet, and presumably can be addressed in the detailed design to provide logs to the api-server in place of kubelet. Ideally this can be done using the standard upstream kubernetes-api server it is undesirable to fork it.
+* Running the api-server, etcd, and any other supporting services (like kubelet) as go routines while adding some overhead to the collection process won't cause a significant burden on ram or cpu to collect support bundles.
+
+## Testing
+
+## Alternatives Considered
+
+### Keep sbctl separate
+
+The current `sbctl` project could be left to run it's course independent of this project. This leaves the troubleshoot project reliant on a separate project to provide a good user experience for anything other than analyzers.
+
+## Security Considerations
+
+Consideration to how Redactors are implemented needs to be considered.
+
+## References
+
+Original PR discussion found [here](https://github.com/replicatedhq/troubleshoot/pull/611)

design/proposal-updateable-specs.md

@@ -0,0 +1,95 @@
+# Provide a facility to automatically obtain updated specs
+
+## Background
+
+Troubleshoot is limited in that when folks write an update or a new spec for data collection and analysis, that upgrade is not available when Troubleshoot is invoked if specs for it are stored in a secret or a file which was deployed by an application.  Updating the local spec is simple enough, but may require an upgrade to the application (e.g. KOTS) in order to collect updates to the spec supplied by that application.  This update requirement delays folks from accessing updated Troubleshoot specs and therefore discourages people from writing new/updated specs.
+
+## Goals
+
+* Provide a means for a spec to optionally specify a location for a spec that can replace it if successfully reached.
+
+## Other requirements
+
+* Maintain the ability for Troubleshoot to run in an airgapped environment, though with some feature limitations.
+* Maintain compatilbility with existing Troubleshoot specs.
+
+## High-Level Design
+
+Add a new field to the Troubleshoot spec definition, which includes a URI used to locate a replacement spec.
+
+If the field is populated, Troubleshoot is to attempt to collect the spec from the location provided, and if successful, ignore the remainder of the spec provided and use the spec listed in the new field.
+
+If the additional spec is not found at the location (or, if there is no network access to that location), Troubleshoot is to continue processing the remainder of the spec provided, with a log message describing the failure to process the URI.
+
+Add a CLI flag (e.g. `--no-updates`) to disable the URI specified location from being accessed.  This would be useful in airgap environments and/or when we simply do not want to have the external spec used, without having to update the yaml, secret, or remote source.
+
+URI's provided may be any of the URI types already accepted by Troubleshoot, including web addresses (https://), secrets, or files.
+
+## Detailed Design
+
+Current spec format is like this example:
+
+```yaml
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: default
+spec:
+  collectors:
+    - clusterInfo: {}
+    - clusterResources: {}
+  analyzers:
+    - cephStatus: {}
+    - longhorn: {}
+```
+
+We could add a new type, `specURI`, which contains one or more URIs from which to obtain specs.  If the spec is retrieved successfully then the remainder of the provided spec is ignored, and replaced with the one downloaded:
+
+```yaml
+apiVersion: troubleshoot.sh/v1beta2
+kind: SupportBundle
+metadata:
+  name: default
+spec:
+  uri: https://raw.githubusercontent.com/replicatedhq/troubleshoot-specs/main/in-cluster/default.yaml
+  collectors:
+    - clusterInfo: {}
+    - clusterResources: {}
+  analyzers:
+    - cephStatus: {}
+    - longhorn: {}
+```
+
+When a spec is parsed from the initial call to Troubleshoot, the content should be read and if a `specURI` exists which is not blank, the code should attempt to download that URI.  Should that be successful, the collectors and analyzers sections of the downloaded content should be used to replace the remainder of the spec provided via the initial call.
+
+## Impact on kURL and KOTS
+
+This section is included because KOTS is a significant consumer of the Troubleshoot codebase, and as such deserves consideration when significant changes are made.
+
+The code changes proposed in this document do not require any changes to kURL or KOTS, and any changes to those repos are excluded from the scope of work described here.  The following notes are suggestions for how the kURL and KOTS repos could benefit from the changes in this document, and could relate to any project which calls Troubleshoot or includes Troubleshoot specs.
+
+For kURL, each component/addon installed could include adding an individual spec with a URI pointing at a specific spec for that component, which could be updated independently of other components.  Invoking troubleshoot with all the individual specs required would allow updated specs to be collected without needing to upgrade any particular component in the cluster.
+
+KOTS currently provides a spec to Troubleshoot which is a merge of a default spec provided by the KOTS codebase, and the spec provided by an application vendor.  Should either of those provide a URI, that would mean the downloaded spec would replace the entire spec.  This is undesirable since the URI would need to contain the application vendor's updated spec as well as the generic cluster-wide collectors and analyzers, which is a significant maintenance challenge.  To resolve this, it is desirable that the following is completed before KOTS uses the URI field:
+
+* Troubleshoot should accept multiple specs (see #650)
+* KOTS would need to be modified to provide the application vendor and the default specs independently of one another.
+
+## Limitations
+
+Redactors are currently excluded from this proposal, though it would be desirable to add a similar feature in the future.
+
+If a URI provided includes a spec which includes another URI, it is possible to get into some kind of recursion if the downloaded spec contains another URI.  For this reason, and to ensure that the results are predictable, we should only parse the URI field once per spec for specs passed to Troubleshoot on initiation via the CLI or entrypoint.
+
+## Assumptions
+
+## Testing
+
+## Alternatives Considered
+
+* Some mechanism to trigger a process to update secrets stored in Kubernetes.  This was rejected due to the need to run a manual update spec for something installed in the cluster.
+* Altering KOTS to provide a URL for the spec rather than storing it in code.  This was rejected to allow airgap compatibility.
+
+## Security Considerations
+
+This change will make additional network calls with default usage of Troubleshoot. To ensure a user has control of limiting these calls an argument to disable this feature entirely will be provided. This allows users with different security postures to select what's appropriate for their environment.

design/template.md

@@ -0,0 +1,21 @@
+# Title
+
+## Goals
+
+## Non Goals
+
+## Background
+
+## High-Level Design
+
+## Detailed Design
+
+## Limitations
+
+## Assumptions
+
+## Testing
+
+## Alternatives Considered
+
+## Security Considerations

docs/arch/adr-001-ipaddress-redaction.md

@@ -0,0 +1,76 @@
+# ADR 001: remove IP address redaction by default
+
+## Context
+
+Since PR #8 IP addresses have automatically been redacted throughout support bundles.  This was originally
+added so that folks with security requirements that include not sharing IP addresses can avoid needing to add
+individual redactors for that purpose.
+
+The general requirement for environments that protect network infrastructure from being communicated outside also
+includes hostnames, port numbers, and mac addresses.  The Troubleshoot code does not redact these.
+
+The experience of support engineers making use of Troubleshoot support bundles has been that in many cases,
+a further set of logs, and data collection information needs to be collected for issues that involve network
+infrastructure in order to be able to assist.  This involves collection that does not redact IP addresses, and
+introduces significant delays in the resolution of issues due to back and forth.
+
+A review of Replicated support cases where end users posted an IP address in GitHub found 71 different issues
+in 2022 (as of October 2022). This doesn't cover uploaded files, phone calls, screen shares, etc. It also
+doesn't include anything else networking like mac address, hostnames, ports.
+
+The problem discussed in this document:
+
+* Users of Troubleshoot need to avoid redaction if they have networking issues, in order to share IP addresses
+  that are redacted by default.
+* The user experience of the product is based around "define what you want", however with default redactors built
+  into the product in addition to the defined spec is confusing and, in some cases, problematic if you do not want
+  the built in redactors.
+* A default set of redactors gives product users a false sense of security in that though the default redactors
+  do cover some redaction, they do not cover every possible combination for every particular sensitive item.
+  Redaction of hostnames is almost impossible given the freeform nature of hostnames, and the built in Password
+  redactor does not cover all passwords, merely a particular json combination.
+
+## Decision
+
+We will remove the code that redacts IP addresses by default from Troubleshoot.  Folks that wish to redact IP addresses will
+need to add that redactor to their individual Troubleshoot specs.
+
+## Solution
+
+The following changes need to be made:
+
+* [Documentation](https://troubleshoot.sh/docs/redact/ip-addresses/) for the IP address redaction needs altering to reflect that Troubleshoot
+  does not automatically redact IP addresses, but if users wish to there is an example yaml spec available.
+* Removal of the IP address redactor from [the code](https://github.com/replicatedhq/troubleshoot/blob/v0.45.0/pkg/redact/redact.go#L170)
+* Clear release notes on release of this change, communicating that those wishing to redact IP addresses need to add that redactor to their spec.
+* Possible broadcast communication since this is a change to default behavior.
+
+## Status
+
+Proposed
+
+## Consequences
+
+Describe the resulting context, after applying the decision. All consequences should be listed here,
+not just the "positive" ones. A particular decision may have positive, negative, and neutral consequences,
+but all of them affect the team and project in the future.
+
+Those that wish to have IP addresses redacted by Troubleshoot need to ensure that the redactor specified during `support-bundle` runs includes a
+regex for IP address redaction.
+
+Example regex for IP redaction:
+
+```yaml
+apiVersion: troubleshoot.sh/v1beta2
+kind: Redactor
+metadata:
+  name: IP Addresses
+spec:
+  redactors:
+  - name: Redact ipv4 addresses
+    removals:
+      regex:
+      - redactor: '(?P<mask>\b(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)'
+```
+
+Folks that have not specified the IP address regex above will, on support bundle creation, share their IP address information in that bundle by default.

docs/arch/adr-002-mergeable-preflights.md

@@ -0,0 +1,37 @@
+# ADR 002: Mergeable preflight specs
+
+When the `preflight` binary, or pacakge, is called, it supports only one spec definition at a time.
+
+Recent changes in Troubleshoot allow the `support-bundle` binary to be called with multiple specs at a time.  This allows cluster components to contribute independant Troubleshoot specs for their scope, and have Troubleshoot assemble them at run time.
+
+Tools such as kURL have components which are maintained with a degree of separation to one another.  It would be helpful to the maintainers of such projects to be able to call `preflight` specifying a number of specs at runtime, allowing Troubleshoot to assemble them into one spec for collection/analysis.
+
+Currently if the `preflight` binary is called with multiple specs, it simply ignores all after the first.
+
+## Decision
+
+Modify the `preflight` CLI and package to be able to read multiple args rather than just one.
+
+Introduce a merge mechanism in the same way that the `support-bundle` binary runs, to merge and deduplicate Preflight specs.
+
+## Status
+
+Proposed
+
+## Consequences
+
+There are no backward compatibility consequences or breaking changes in this proposal.
+
+The project benefits:
+* Folks maintaining kURL add-ons can contribute unique preflight specs for their add-on (and the same for other projects simlarly structured)
+* Folks using `preflight` from the CLI without other applications (e.g. for a Helm install) are able to specify a list of preflights for their application rather than having to assemble one spec for each environment.
+
+## Design notes
+
+This proposal does not include adding the `uri:` field to `kind: Preflight`.
+
+The file `cmd/preflight/cli/root.go` calls `preflight.RunPreflights` with `args[0]` which is likely to need to change to just `args`.
+
+Func `RunPreflights` takes a single string arg (`arg string`) for the spec definition.  This is likely to need to change to `arg []string`.
+
+File `cmd/troubleshoot/cli/run.go` loops through the list of args, concatenating them together.  A similar process is suitable for this change.

docs/arch/readme.md

@@ -0,0 +1,81 @@
+# Architecture Decision Records
+
+_ADR_ for short.
+
+## What is an Architecturally Significant Decision?
+
+See [Documenting Architecture
+Decisions](http://thinkrelevance.com/blog/2011/11/15/documenting-architecture-decisions)
+for more information.
+
+The basic idea is to capture key decisions having to do with anything _architectural_
+in a way that promotes better communication than simple word-of-mouth.
+
+What is an _architectural_ decision?  If one or more of the following ideas apply you
+might be dealing with an architectural decision.
+
+Does the design decision...
+
+* Alter externally visible system properties?
+* Modify public interfaces?
+* Directly influence high priority quality attributes?
+* Include or remove dependencies?
+* Result from a discussion where you learned more about technical or business constraints?
+* Involve taking on strategic technical debt?
+* Change the structures of the system (static, dynamic, or physical)?
+* Require other developers to update construction techniques or development environments?
+
+
+## Template
+
+Use this template in any new ADRs.  Replace the help text as you write the ADR.
+
+```
+# ADR N: Brief Decision Title
+
+Context goes here.
+
+Describe the forces at play, including technological, political, social, and project local.
+These forces are likely in tension, and should be called out as such. The language in this
+section is value-neutral. It is simply describing facts.
+
+## Decision
+
+This section describes our response to these forces. It is stated in full sentences,
+with active voice. "We will ..."
+
+
+## Status
+
+choose one: [Proposed | Accepted | Deprecated | Superseded]
+
+if deprecated, include a rationale.
+
+If superseded, include a link to the new ADR
+
+
+## Consequences
+
+Describe the resulting context, after applying the decision. All consequences should be listed here,
+not just the "positive" ones. A particular decision may have positive, negative, and neutral consequences,
+but all of them affect the team and project in the future.
+```
+
+## Tips and Hints
+
+* Titles should be descriptive, concise, and precise
+* The whole document should be one or two pages long at most.
+* Think of the document as a conversation with a future developer. This means write well and use full
+  sentences.
+* Update consequences as they become known.  The ADR becomes like a diary for seeing how the design
+  decisions we make impact the system over time.
+* Include diagrams as necessary.
+
+
+## References
+
+Nygard, Michael. Documenting Architecture Decisions, from _Think Relevance_ blog. [Web](http://thinkrelevance.com/blog/2011/11/15/documenting-architecture-decisions)
+
+Kruchten, Philippe. _The Decision View's Role in Software Architecture Practice_, IEEE Software 26:36-42, February 2009
+
+Tyree, J. and Akerman, A. _Architecture Decisions: Demystifying Architecture_, IEEE Software 22:2:19-27, March-April 2005 [PDF](http://www.utdallas.edu/~chung/SA/zz-Impreso-architecture_decisions-tyree-05.pdf)

docs/preflight.md

@@ -0,0 +1,51 @@
+## preflight
+
+Run and retrieve preflight checks in a cluster
+
+### Synopsis
+
+A preflight check is a set of validations that can and should be run to ensure
+that a cluster meets the requirements to run an application.
+
+```
+preflight [url] [flags]
+```
+
+### Options
+
+```
+      --as string                      Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
+      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                  UID to impersonate for the operation.
+      --cache-dir string               Default cache directory (default "/Users/xavpaice/.kube/cache")
+      --certificate-authority string   Path to a cert file for the certificate authority
+      --client-certificate string      Path to a client certificate file for TLS
+      --client-key string              Path to a client key file for TLS
+      --cluster string                 The name of the kubeconfig cluster to use
+      --collect-without-permissions    always run preflight checks even if some require permissions that preflight does not have (default true)
+      --collector-image string         the full name of the collector image to use
+      --collector-pullpolicy string    the pull policy of the collector image
+      --context string                 The name of the kubeconfig context to use
+      --debug                          enable debug logging
+      --format string                  output format, one of human, json, yaml. only used when interactive is set to false (default "human")
+  -h, --help                           help for preflight
+      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --interactive                    interactive preflights (default true)
+      --kubeconfig string              Path to the kubeconfig file to use for CLI requests.
+  -n, --namespace string               If present, the namespace scope for this CLI request
+  -o, --output string                  specify the output file path for the preflight checks
+      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --selector string                selector (label query) to filter remote collection nodes on.
+  -s, --server string                  The address and port of the Kubernetes API server
+      --since string                   force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.
+      --since-time string              force pod logs collectors to return logs after a specific date (RFC3339)
+      --tls-server-name string         Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
+      --token string                   Bearer token for authentication to the API server
+      --user string                    The name of the kubeconfig user to use
+```
+
+### SEE ALSO
+
+* [preflight version](preflight_version.md)	 - Print the current version and exit
+
+###### Auto generated by spf13/cobra on 21-Nov-2022

docs/preflight_version.md

@@ -0,0 +1,38 @@
+## preflight version
+
+Print the current version and exit
+
+### Synopsis
+
+Print the current version and exit
+
+```
+preflight version [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for version
+```
+
+### Options inherited from parent commands
+
+```
+      --collect-without-permissions   always run preflight checks even if some require permissions that preflight does not have (default true)
+      --collector-image string        the full name of the collector image to use
+      --collector-pullpolicy string   the pull policy of the collector image
+      --debug                         enable debug logging
+      --format string                 output format, one of human, json, yaml. only used when interactive is set to false (default "human")
+      --interactive                   interactive preflights (default true)
+  -o, --output string                 specify the output file path for the preflight checks
+      --selector string               selector (label query) to filter remote collection nodes on.
+      --since string                  force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.
+      --since-time string             force pod logs collectors to return logs after a specific date (RFC3339)
+```
+
+### SEE ALSO
+
+* [preflight](preflight.md)	 - Run and retrieve preflight checks in a cluster
+
+###### Auto generated by spf13/cobra on 21-Nov-2022

docs/support-bundle.md

@@ -0,0 +1,53 @@
+## support-bundle
+
+Generate a support bundle
+
+### Synopsis
+
+A support bundle is an archive of files, output, metrics and state
+from a server that can be used to assist when troubleshooting a Kubernetes cluster.
+
+```
+support-bundle [url] [flags]
+```
+
+### Options
+
+```
+      --as string                      Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
+      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                  UID to impersonate for the operation.
+      --cache-dir string               Default cache directory (default "/Users/xavpaice/.kube/cache")
+      --certificate-authority string   Path to a cert file for the certificate authority
+      --client-certificate string      Path to a client certificate file for TLS
+      --client-key string              Path to a client key file for TLS
+      --cluster string                 The name of the kubeconfig cluster to use
+      --collect-without-permissions    always generate a support bundle, even if it some require additional permissions (default true)
+      --context string                 The name of the kubeconfig context to use
+      --debug                          enable debug logging
+  -h, --help                           help for support-bundle
+      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --interactive                    enable/disable interactive mode (default true)
+      --kubeconfig string              Path to the kubeconfig file to use for CLI requests.
+      --load-cluster-specs             enable/disable loading additional troubleshoot specs found within the cluster. required when no specs are provided on the command line
+  -n, --namespace string               If present, the namespace scope for this CLI request
+      --no-uri                         When this flag is used, Troubleshoot does not attempt to retrieve the bundle referenced by the uri: field in the spec.`
+  -o, --output string                  specify the output file path for the support bundle
+      --redact                         enable/disable default redactions (default true)
+      --redactors strings              names of the additional redactors to use
+      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+  -l, --selector strings               selector to filter on for loading additional support bundle specs found in secrets within the cluster (default [troubleshoot.io/kind=supportbundle-spec])
+  -s, --server string                  The address and port of the Kubernetes API server
+      --since string                   force pod logs collectors to return logs newer than a relative duration like 5s, 2m, or 3h.
+      --since-time string              force pod logs collectors to return logs after a specific date (RFC3339)
+      --tls-server-name string         Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
+      --token string                   Bearer token for authentication to the API server
+      --user string                    The name of the kubeconfig user to use
+```
+
+### SEE ALSO
+
+* [support-bundle analyze](support-bundle_analyze.md)	 - analyze a support bundle
+* [support-bundle version](support-bundle_version.md)	 - Print the current version and exit
+
+###### Auto generated by spf13/cobra on 21-Nov-2022

docs/support-bundle_analyze.md

@@ -0,0 +1,26 @@
+## support-bundle analyze
+
+analyze a support bundle
+
+### Synopsis
+
+Analyze a support bundle using the Analyzer definitions provided
+
+```
+support-bundle analyze [url] [flags]
+```
+
+### Options
+
+```
+      --bundle string   filename of the support bundle to analyze
+  -h, --help            help for analyze
+      --output string   output format: json, yaml
+      --quiet           enable/disable error messaging and only show parseable output
+```
+
+### SEE ALSO
+
+* [support-bundle](support-bundle.md)	 - Generate a support bundle
+
+###### Auto generated by spf13/cobra on 21-Nov-2022

docs/support-bundle_version.md

@@ -0,0 +1,23 @@
+## support-bundle version
+
+Print the current version and exit
+
+### Synopsis
+
+Print the current version and exit
+
+```
+support-bundle version [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for version
+```
+
+### SEE ALSO
+
+* [support-bundle](support-bundle.md)	 - Generate a support bundle
+
+###### Auto generated by spf13/cobra on 21-Nov-2022

examples/collect/host/block-devices.yaml

@@ -0,0 +1,8 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: block
+spec:
+  collectors:
+    - blockDevices: {}
+

examples/collect/host/certificate.yaml

@@ -0,0 +1,9 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: certificate
+spec:
+  collectors:
+    - certificate:
+        certificatePath: /etc/ssl/corp.crt
+        keyPath: /etc/ssl/corp.key

examples/collect/host/cpu.yaml

@@ -0,0 +1,7 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: cpu
+spec:
+  collectors:
+    - cpu: {}

examples/collect/host/disk-usage.yaml

@@ -0,0 +1,9 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: diskUsage
+spec:
+  collectors:
+    - diskUsage:
+        collectorName: ephemeral
+        path: /var/lib/kubelet

examples/collect/host/filesystem-performance.yaml

@@ -0,0 +1,19 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: fsperf
+spec:
+  collectors:
+    - filesystemPerformance:
+        collectorName: etcd-perf
+        timeout: 2m
+        directory: /var/lib/etcd
+        fileSize: 22Mi
+        operationSizeBytes: 2300
+        datasync: true
+        enableBackgroundIOPS: true
+        backgroundIOPSWarmupSeconds: 10
+        backgroundWriteIOPS: 300
+        backgroundWriteIOPSJobs: 6
+        backgroundReadIOPS: 50
+        backgroundReadIOPSJobs: 1

examples/collect/host/http-load-balancer.yaml

@@ -0,0 +1,11 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: httploadbalancer
+spec:
+  collectors:
+    - httpLoadBalancer:
+        collectorName: httploadbalancer
+        port: 80
+        address: http://app.corporate.internal
+        timeout: 10s

examples/collect/host/http.yaml

@@ -0,0 +1,10 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: http
+spec:
+  collectors:
+    - http:
+        collectorName: registry
+        get:
+          url: https://registry.replicated.com

examples/collect/host/ipv4-interfaces.yaml

@@ -0,0 +1,7 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: ipv4Interfaces
+spec:
+  collectors:
+    - ipv4Interfaces: {}

examples/collect/host/kernel-modules.yaml

@@ -0,0 +1,7 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: modules
+spec:
+  collectors:
+    - kernelModules: {}

examples/collect/host/memory.yaml

@@ -0,0 +1,8 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: memory
+spec:
+  collectors:
+    - memory:
+        collectorName: memory

examples/collect/host/ntp.yaml

@@ -0,0 +1,7 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: ntp
+spec:
+  collectors:
+    - time: {}

examples/collect/host/sample.yaml

@@ -0,0 +1,38 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: example
+spec:
+  collectors:
+    - blockDevices: {}
+    - certificate:
+        certificatePath: /etc/ssl/corp.crt
+        keyPath: /etc/ssl/corp.key
+    - cpu: {}
+    - diskUsage:
+        collectorName: ephemeral
+        path: /var/lib/kubelet
+    - httpLoadBalancer:
+        collectorName: httploadbalancer
+        port: 80
+        address: http://app.corporate.internal
+        timeout: 10s
+    - http:
+        collectorName: registry
+        get:
+          url: https://registry.replicated.com
+    - ipv4Interfaces: {}
+    - memory: {}
+    - time: {}
+    - tcpConnect:
+        collectorName: weave host 1
+        address: 10.128.0.2:6783
+        timeout: 2s
+    - tcpLoadBalancer:
+        collectorName: LB1
+        address: 10.128.0.20:6443
+        port: 6443
+        timeout: 5000ms
+    - tcpPortStatus:
+        collectorName: k8s
+        port: 6443

examples/collect/host/tcp-connect.yaml

@@ -0,0 +1,9 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: connect
+spec:
+  collectors:
+    - tcpConnect:
+        collectorName: weave host 1
+        address: 10.128.0.2:6783

examples/collect/host/tcp-load-balancer.yaml

@@ -0,0 +1,10 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: loadbalancer
+spec:
+  collectors:
+    - tcpLoadBalancer:
+        collectorName: loadbalancer
+        port: 7443
+        address: 10.128.0.29:7444

examples/collect/host/tcp-port.yaml

@@ -0,0 +1,9 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: port
+spec:
+  collectors:
+    - tcpPortStatus:
+        collectorName: k8s
+        port: 7443

examples/collect/host/timezone.yaml

@@ -0,0 +1,7 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: HostCollector
+metadata:
+  name: timezone
+spec:
+  collectors:
+    - time: {}

examples/collect/remote/block-devices.yaml

@@ -0,0 +1,8 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: RemoteCollector
+metadata:
+  name: block
+spec:
+  collectors:
+    - blockDevices: {}
+

examples/collect/remote/certificate.yaml

@@ -0,0 +1,9 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: RemoteCollector
+metadata:
+  name: certificate
+spec:
+  collectors:
+    - certificate:
+        certificatePath: /etc/ssl/corp.crt
+        keyPath: /etc/ssl/corp.key

examples/collect/remote/cpu.yaml

@@ -0,0 +1,7 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: RemoteCollector
+metadata:
+  name: cpu
+spec:
+  collectors:
+    - cpu: {}

examples/collect/remote/disk-usage.yaml

@@ -0,0 +1,9 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: RemoteCollector
+metadata:
+  name: diskUsage
+spec:
+  collectors:
+    - diskUsage:
+        collectorName: ephemeral
+        path: /var/lib/kubelet

examples/collect/remote/filesystem-performance.yaml

@@ -0,0 +1,19 @@
+apiVersion: troubleshoot.sh/v1beta2
+kind: RemoteCollector
+metadata:
+  name: fsperf
+spec:
+  collectors:
+    - filesystemPerformance:
+        collectorName: etcd-perf
+        timeout: 2m
+        directory: /var/lib/etcd
+        fileSize: 22Mi
+        operationSizeBytes: 2300
+        datasync: true
+        enableBackgroundIOPS: true
+        backgroundIOPSWarmupSeconds: 10
+        backgroundWriteIOPS: 300
+        backgroundWriteIOPSJobs: 6
+        backgroundReadIOPS: 50
+        backgroundReadIOPSJobs: 1