feat: infrahub-collect troubleshooting-bundle tool (INFP-415)

[fatih-acar]

Summary

Adds infrahub-collect, the third CLI binary in this repo, implementing the troubleshooting-bundle collection tool from Jira INFP-415 (spec 003-collect-tool). It replaces the Python invoke bundle collect script and adds first-class Kubernetes support. Collection is strictly read-only — it never stops, restarts, or scales any workload — so it is safe to run against a degraded production instance.

Stacked on top of fac/collect-tool-docs (the user docs + spec + constitution amendment, reviewed separately). This PR is the implementation only; base it on the docs branch so the diff stays focused.

infrahub-collect create produces a single support_bundle_<timestamp>.tar.gz with an identical internal layout on Docker Compose and Kubernetes, plus a bundle_information.json manifest recording an explicit outcome (success / failed / skipped) for every collector.

What it collects

• Service logs for every Infrahub service, all replicas, plus previous-container logs for restarted pods on Kubernetes
• Parity diagnostics: Neo4j server logs, RabbitMQ status, Redis status, Prefect worker/manager state, server info (version, packages, API info/config/schema, env)
• Container metrics (docker stats / kubectl top)
• Opt-in: --include-backup (delegates to the existing backup logic unmodified), --benchmark, --include-queries
• Secret masking (key-name based) on all env/config dumps before they are written

Design

• Thin Cobra entry point at src/cmd/infrahub-collect; all logic in src/internal/app (constitution Principle I). Reuses the existing environment abstraction, CommandExecutor, tarball helper, and CNPG-primary detection.
• Collector framework: each collector is time-bounded and non-fatal — a failure is recorded in the manifest and the run continues, still exiting 0 with a partial bundle (FR-009). A degraded instance is the primary use case.
• No new Go module dependencies; Docker/Kubernetes accessed by shelling out to docker/kubectl like the existing backends.

Testing

• 69 new Go unit test functions (89 incl. subtests), all passing; make fmt / vet / lint (0 issues) / test green.
• Docker e2e (tests/e2e/test_docker_collect.py, 5 tests) — passed locally against a real compose stack (Infrahub 1.8.2): full bundle, project selection, log-lines flag/env precedence, degraded-cache (exit 0 + cache-status: failed), include-backup.
• Kubernetes e2e (tests/e2e/test_k8s_collect.py) — passed locally against a real vcluster + Helm stack (Infrahub 1.10.2): multi-replica logs, induced-restart .previous.log, manifest schema, and a before/after read-only assertion (SC-003).
• Collect e2e tests are wired into the existing docker/k8s CI jobs (they carry the -m docker/-m k8s markers).

Review

A multi-lens review (correctness, error handling, test coverage, types/comments/simplify) ran across the full diff. All HIGH and MEDIUM findings were fixed and re-verified, notably:

• Bounded every collector subprocess (CopyFrom, server-info/version execs, k8s pod resolution) so a wedged container can't hang the run — collect-only bounded variants added without touching the shared helpers backup depends on.
• Hardened Kubernetes replica enumeration so a cluster/API/RBAC failure records failed instead of masquerading as "service not deployed" (which would have produced a misleadingly-empty bundle).
• Added panic recovery around collectors, fixed timeout-reason fidelity in the manifest, and added unit coverage for --include-queries and the read-only guarantee.

Lower-severity items (key-name masking not catching inline connection-string credentials; double-SIGINT archive window) are documented as by-design/deferred in specs/003-collect-tool/opsmill-implement-report.md.

🤖 Generated with Claude Code

---

Summary by cubic

Add infrahub-collect, a read-only troubleshooting-bundle CLI for Infrahub on Docker Compose and Kubernetes, with logs, diagnostics, metrics, and opt-in backup/benchmark. Implements INFP-415, integrates full build/CI, and adds developer ADRs/guidelines with the spec archived.

• New Features

  • create writes support_bundle_<timestamp>.tar.gz with a uniform layout and bundle_information.json manifest across Docker and Kubernetes.
  • Collects per-service logs (all replicas; .previous.log on Kubernetes), diagnostics (Neo4j, RabbitMQ, Redis, Prefect, server info/config/schema/env), and container metrics; secrets masked; per-collector timeouts.
  • Opt-in: --include-backup (delegates to existing backup; artifact path recorded) and --benchmark (uses INFRAHUB_BENCHMARK_IMAGE; writes benchmark.log/json; skipped if the image can’t be pulled).
  • Docker: per-replica exec/logs/stats and compose project discovery. Kubernetes: multi-replica and previous-container logs, metrics via kubectl top.
  • Build/CI: added to Makefile and flake.nix; CI builds all binaries and runs Docker/K8s e2e; no new Go module deps. Docs/dev: extracted ADRs/guidelines/knowledge under dev/, archived spec under specs/archive/, updated guides (Go 1.25; benchmark measures host resources; documented INFRAHUB_BENCHMARK_IMAGE).

• Bug Fixes

  • Bounded exec/copy and pod resolution with precise timeout reasons; collector panics recovered so runs don’t abort.
  • Kubernetes replica discovery distinguishes “not deployed” from API/RBAC failures.
  • Fixed Docker combined-log pipe leak; partial failures recorded without losing collected data.
  • Safe fallbacks: Neo4j query-log enumeration when empty, Prefect events pagination capped; read-only guard enforced.
  • --include-backup: run with force=true to avoid unbounded running-tasks wait on busy instances; records a clear outcome.

^{Written for commit 5fd8210. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying infrahub-ops-cli with    Cloudflare Pages

Latest commit:	5fd8210
Status:	⚡️  Build in progress...

View logs