Collecting a Support Bundle - HiddenLayer Docs

Embedded Cluster

In the Admin Console, go to Troubleshoot > Analyze to collect logs, resources, and cluster data. Nothing leaves the cluster until you download the bundle and send it. The command-line equivalent, for hosts with no browser access, is:

sudo ./aisec-platform support-bundle

Review a bundle before sending it. Redactors mask credential values by name, so a credential stored under a different name stays in clear. Check the archive for such values, and treat the bundle as sensitive.

Helm

A support bundle gathers logs, resource state, and Helm release history into one archive for HiddenLayer support.

On a workstation where kubectl reaches the cluster as a cluster administrator, download the collector for that workstation, verify its checksum, and unpack it.
platform=$(uname -sm | tr 'A-Z ' 'a-z_' | sed 's/x86_64/amd64/;s/aarch64/arm64/;s/darwin_.*/darwin_all/') release=https://github.com/replicatedhq/troubleshoot/releases/download/v0.134.1 curl -fLO $release/support-bundle_$platform.tar.gz curl -fLO $release/troubleshoot_0.134.1_checksums.txt grep " support-bundle_$platform.tar.gz$" troubleshoot_0.134.1_checksums.txt | sha256sum -c && tar xzf support-bundle_$platform.tar.gz support-bundle
- On macOS, run shasum -a 256 -c in place of sha256sum -c.
- The archive is unpacked only when the check prints OK.
- Archives exist for linux_amd64, linux_arm64, and darwin_all (macOS). exec format error means you downloaded the archive for another platform.
- On an air-gapped network, download the workstation’s archive and troubleshoot_0.134.1_checksums.txt elsewhere and carry both in with the images.
Generate the bundle.
./support-bundle --load-cluster-specs --auto-update=false
- --auto-update=false keeps this version. Without it, each run tries to replace the binary with the newest release from GitHub.
- On a terminal, the command ends on a results screen. Press q to leave it.
- The archive is written to the current directory, and nothing is uploaded. Treat it as confidential in transit and at rest.

For an install problem, also mask the credentials in installer.log from the verify step.

sed -E \
  -e 's/^([[:space:]+-]*value:[[:space:]]*).*/\1<masked>/' \
  -e 's/(^|[^A-Za-z0-9_.-])("?[A-Za-z0-9_.-]*([Ss][Ee][Cc][Rr][Ee][Tt]|[Kk][Ee][Yy]|[Pp][Aa][Ss][Ss][Ww]([Oo][Rr])?[Dd]|[Tt][Oo][Kk][Ee][Nn]|[Cc][Rr][Ee][Dd]|[Ll][Ii][Cc][Ee][Nn][CcSs][Ee])[A-Za-z0-9_.-]*"?[[:space:]]*[:=][[:space:]]*).*/\1\2<masked>/' \
  -e 's#(://[^:/@[:space:]]*:)[^@/[:space:]]+@#\1<masked>@#g' \
  -e 's/([Bb]earer|[Bb]asic)[[:space:]]+[^[:space:]"]+/\1 <masked>/g' \
  installer.log > installer-masked.log

The command masks only values that sit on one line after a : or =. A multi-line value, such as a PEM block after |, or a credential passed as a separate command argument stays in clear. Check installer-masked.log for -----BEGIN and such arguments before you send it.

Send the archive to HiddenLayer support, with installer-masked.log if step 3 applied.

​Embedded Cluster

​Helm

Embedded Cluster

Helm