Automated support bundle collection?

How do I?
,
1

So we’d like to trigger a support bundle collection via an API, then have a way to obtain the bundle and/or maybe upload it to vendor portal. The usecase is an app layer fault might want to trigger its own SB collection.

I immediately thought this would be a nice feature for replicated-sdk but was surprised to not see that feature in its API.

So plan B might be one of my services in a pod can package the troubleshoot app and jump to it, to examine the app and host (this is for EC situations) it’s running on. Has anyone done this and is an example of that posted anywhere? What permissions would such a pod require?

Thanks for reading!

2

Still curious about the SDK, but here’s an update on a Plan B experiment. Mostly straightforward: a ServiceAccount, ClusterRole, ClusterRoleBinding, and a pod. The pod downloads SB, mounts my support-bundle secret in there to use as its spec, and then runs collection. It’ll have to stick the generated SB somewhere else. The role permissions look like below (at least for my collectors).

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: collect-support-bundle
rules:
- apiGroups: ["apps"]
  resources: ["daemonsets"]
  verbs: ["create","get"]
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["create","list","get", "watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["list","get"]
- apiGroups: ["storage.k8s.io"]
  resources: ["storageclasses"]
  verbs: ["list","get"]
- apiGroups: [""]
  resources: ["namespaces","nodes", "configmaps"]
  verbs: ["list","get"]
3

Hey, Mitch. We’ve discussed allowing the SDK to generate a support bundle. The main reason we haven’t so far is that the SDK is used heavily in Helm installations, where it’s much more likely to lack cluster-scoped permissions that are typically required to generate a support bundle. I’m noting internally that you brought this up—you’re not the first customer—but that’s the reason we haven’t implemented that to date.