WIP : feat(support-bundle): add consolidated support-bundle.sh collector - #40
Open
brathina-spectro wants to merge 2 commits into
Open
WIP : feat(support-bundle): add consolidated support-bundle.sh collector#40brathina-spectro wants to merge 2 commits into
brathina-spectro wants to merge 2 commits into
Conversation
Consolidate support-bundle-edge.sh (host + cluster) and
support-bundle-infra.sh (cluster-only) into a single capability-driven
script, per CONSOLIDATION-DESIGN.md. The legacy scripts are kept intact
as fallbacks until the consolidated script is widely adopted.
Highlights:
- Never aborts mid-run: every collector runs through run_step and
records OK / SKIP / FAIL / DENIED into collection-summary.txt inside
the bundle; the only fatal errors are temp-dir/archive failures.
- Advisory RBAC coverage: denied namespaces/resources are pruned and
recorded with remediation guidance (namespace-coverage.txt) instead
of exiting 1.
- Capability probe: API-server reachability (10s timeout), edge-host
and agent-mode detection, distro detection, and an ordered non-fatal
kubeconfig resolver (flag, env, /run/kubeconfig, admin.conf, HOME,
SUDO_USER home, rke2/k3s/canonical paths).
- New flags on top of the union of both legacy flag sets:
-k kubeconfig, -K host-only, -H cluster-only (no root required),
-q quiet, -v version.
- Archive to CWD by default (-d overrides), bundle named
<cluster>-<hostname>-<ts> degrading to <hostname>-<ts>; cluster name
applied at tar time so the console.log tee pipe is never broken.
- Fixes ported in passing: quoted DISTRO checks, ${DISTRO:-runtime}
output paths, compgen-guarded pod-log globs, O(n^2) namespace pruning
replaced with single-listing rebuild, rke2 now collects var-log-pods,
cleanup can no longer delete the tarball it just produced, LOGNAME
sanitized against shell-hostile hostnames.
Docs: README-support-bundle.md added; README.md indexes the new script.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
brathina-spectro
changed the title
There was a problem hiding this comment.
Pull request overview
Adds a new consolidated, capability-driven support-bundle.sh that unifies the legacy edge (host+cluster) and infra (cluster-only) support bundle collectors, along with documentation updates to introduce and explain the new flow.
Changes:
- Introduces
support-bundle.shwith capability probes, non-fatal step execution, collection summaries, and unified flag set. - Updates support-bundle docs to reference and document the consolidated script (flags, kubeconfig resolution, RBAC behavior, output format).
- Keeps legacy scripts available as documented fallbacks while the consolidated script is adopted.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| support-bundle/support-bundle.sh | New consolidated collector script spanning host + Kubernetes collection with capability gating and summary output. |
| support-bundle/README.md | Adds an index section for the consolidated script and links to the new documentation. |
| support-bundle/README-support-bundle.md | New consolidated-script documentation (flags, kubeconfig resolution, RBAC behavior, output). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+140
to
+142
| function setup() { | ||
| TMPDIR_BASE=$(mktemp -d $MKTEMP_BASEDIR) || { techo 'Creating temporary directory failed, please check options'; exit 1; } | ||
| techo "Created temporary directory: $TMPDIR_BASE" |
Comment on lines
+282
to
+284
| [ -n "$KUBECONFIG_FLAG" ] && CANDIDATES+=("$KUBECONFIG_FLAG") | ||
| [ -n "$KUBECONFIG" ] && CANDIDATES+=("$KUBECONFIG") | ||
| CANDIDATES+=("$DEFAULT_KUBECONFIG" "/etc/kubernetes/admin.conf" "$HOME/.kube/config") |
Comment on lines
+455
to
+459
| function networking-info() { | ||
| techo "Collecting network info" | ||
| mkdir -p $TMPDIR/networking | ||
| iptables-save > $TMPDIR/networking/iptablessave 2>&1 | ||
| ip6tables-save > $TMPDIR/networking/ip6tablessave 2>&1 |
Comment on lines
+518
to
+522
| for logfile in /var/log/*log*; do | ||
| if file "$logfile" | grep -q "text"; then | ||
| cp -p "$logfile" "$TMPDIR/var/log" 2>&1 | ||
| fi | ||
| done |
Comment on lines
+1521
to
+1523
| fi | ||
| MONGO_AUTH="-u root -p $DB_PASSWORD --authenticationDatabase admin" | ||
| fi |
| * **Kubernetes tier** (skipped with `-K`): cluster info and dump, cluster- and namespace-scoped resources, custom resources, helm release secrets, metrics, previous pod logs, and — on Enterprise/PCG clusters — MongoDB replica set status, per-pod disk usage, and database/collection sizes. | ||
| * **Distro tier** (host + detected distribution): kubeadm manifests/certs/etcd, k3s/rke2 pod logs and certs, Canonical snap k8s files/dqlite state. | ||
|
|
||
| Secrets are not collected, except helm release secrets for the spectro namespaces. Certificates are captured parsed (`openssl x509 -text -noout`), never as raw keys. |
Review feedback on #40: edge hosts often have read-only partitions, so the archive must never default to the current working directory, and bundle names should stay recognizable per scope. - Host-scope runs archive into the mktemp base dir and are named <hostname>-<ts>, exactly as support-bundle-edge.sh did (-d still relocates the base). - Cluster-only (-H) runs archive to -d, else CWD, and are named <cluster-name>-<ts>, exactly as support-bundle-infra.sh did. - Drop the combined <cluster>-<hostname>-<ts> naming scheme. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates
support-bundle-edge.sh(host + cluster) andsupport-bundle-infra.sh(cluster-only) into a single capability-driven script,support-bundle.sh, per the consolidation design. The legacy scripts are kept intact as fallbacks until the consolidated script is widely adopted; they can be phased out later.support-bundle.sh≈support-bundle-edge.sh(full scope, root required)support-bundle.sh -H≈support-bundle-infra.sh(cluster-only, no root)Design
run_stepwrapper and recordsOK / SKIP / FAIL / DENIEDintocollection-summary.txtinside the bundle. Only temp-dir/archive failures are fatal.-kflag →$KUBECONFIG→/run/kubeconfig→admin.conf→$HOME→$SUDO_USERhome → rke2/k3s/canonical paths).-k <kubeconfig>,-K(host-only),-H(cluster-only),-q(quiet),-v(version).<hostname>-<ts>.tar.gzin the mktemp base dir (edge behavior — never writes to CWD, since edge hosts often have read-only partitions;-drelocates the base); cluster-only-Hruns produce<cluster-name>-<ts>.tar.gzin-d/CWD (infra behavior).exit 1in both scripts): denied namespaces/resources are pruned, recorded asDENIEDwith remediation guidance innamespace-coverage.txt, and collection continues.KUBECONFIGno longer aborts (infra exited 1): Kubernetes collection is recorded asSKIPand the host bundle is still produced.-Hruns rootless, matching the infra script's historical behavior.Bugs fixed in passing
${DISTRO}test;$TMPDIR//crictlpaths whenDISTROunset (now${DISTRO:-runtime})var-log-podsglob errors when nothing matches (nowcompgen-guarded)var-log-pods(kubeadm/k3s/canonical already did)cleanup()can no longer delete the tarball it just producedLOGNAMEsanitized against shell-hostile hostnames ($TMPDIRis used unquoted throughout the ported collectors)spectro-cloud-driverorjetin jet-system, guarded by the enterprise checkDocs
README-support-bundle.md(flags, kubeconfig resolution, summary statuses, RBAC behavior, per-scope output naming/locations, differences from legacy scripts)README.mdindexes the new scriptTesting
bash -nandshellcheck --severity=errorclean-K, cluster-only-H,-K -Hrejection, root gate with/withoutDEV): summary table, per-scope tarball destination/naming, and cleanup all verifiedNotes / open items
SB_VERSIONis20260817+dev; the publish workflow should stamp<UTC date>+<git sha>(D5) — both published legacy scripts currently share a stale version string despite differing content.set -euo pipefaildeliberately omitted (as in both legacy scripts): it contradicts the never-abort collection design.🤖 Generated with Claude Code