Skip to content
Free Diagnostics Bundle

Free Kubernetes Resource Audit Bundle

Collect resource, workload, and namespace signals locally, inspect the bundle yourself, then decide whether to upload it for a principal-level diagnostic report.

Download Release Start Upload Intake Start Paid Review

The download path and upload path are separate by design. Running the collector does not send data to TacitSoft. Generated raw inventory is customer-confidential and is not customer-shareable merely because someone reviewed it.

How it works

  1. 1 Download the public collector and review what it does.
  2. 2 Run locally against your cluster context and inspect the generated files.
  3. 3 Upload only when ready and receive a prioritized report with remediation guidance.

What it collects

  • Cluster and namespace resource inventory.
  • Exact Kubernetes, k3s, runtime, node OS, kernel, and kubelet versions.
  • Warning events, best-effort k3s certificate status, and filtered security-relevant kubelet warnings.
  • Workload requests, limits, replicas, and scheduling metadata.
  • PodScheduled conditions, container waiting states, and namespace events.
  • PVC, PV, StorageClass, service, ingress, and configuration references.
  • Deployment, StatefulSet, DaemonSet, Job, and ReplicaSet owner chains.
  • Privileged execution, host access, container security context, and service-account metadata.
  • Pod Security Admission, NetworkPolicy, RBAC, service exposure, and ingress TLS metadata.
  • Pod and controller image references, resolved digests, and pull failures.
  • Optional normalized local Syft, Grype, Trivy, and version results.
  • Service, ingress, storage, and configuration references.
  • Optional node and per-container usage samples from the metrics API.
  • Machine-readable capability coverage and advisor input index.

What it does not collect

  • No kubernetes secret objects or values.
  • No certificate private keys or certificate contents.
  • No unfiltered node or workload journals.
  • No workload environment values or arbitrary annotations.
  • No registry credentials, docker authentication configuration, or raw scan artifacts.
  • No container filesystem contents.
  • No live workload traffic.
  • No automatic upload. You review the bundle before anything leaves your environment.
Sample Report

Anonymized report preview

The uploaded bundle becomes a concise diagnostic report focused on risk, waste, and the next practical fix.

Finding

CPU requests exceed observed usage

Several services reserve materially more CPU than recent behavior indicates, creating avoidable scheduling pressure.

Impact

Capacity waste and noisy scaling

Over-reservation can force extra nodes online while masking workloads that actually need limits or autoscaling.

Recommendation

Right-size in two stages

Adjust low-risk deployments first, watch eviction and latency signals, then apply the pattern to critical services.

Release flow

Version 0.2.0 ships as a public preview release bundle with a published checksum and explicit dry-run path.

Release status: checksum-published unsigned public preview

SHA-256: bf1cf65eac994d0caf9006ee8d2e4ffb7d327254e1d6b297347fde5323dbfa2e

curl -fsSLO https://tacitsoft.dev/downloads/collectors/k8s-resource-audit/0.2.0/k8s-resource-audit-0.2.0.tar.gz

curl -fsSLO https://tacitsoft.dev/downloads/collectors/k8s-resource-audit/0.2.0/SHA256SUMS

sha256sum -c SHA256SUMS

tar -xzf k8s-resource-audit-0.2.0.tar.gz

./k8s-resource-audit/install.sh --prefix ./out/k8s-resource-audit

Inspect the bundle before upload

The generated raw bundle stays local until you decide to submit it for controlled internal review. Review the handling state, redaction coverage, file list, checksums, and raw inventory before starting intake.

The bundle is created locally under the output path and is not uploaded automatically.

bundle.json identifies collector, schema, and contract versions, cluster context, safety flags, and capability coverage.

Raw inventory is customer-confidential: bundle.json sets contains_sensitive_data=true and handling_state=raw.

upload_safe_after_review permits controlled internal upload only; it never makes raw content customer-shareable.

redaction/coverage.json records raw, redacted, omitted, or not-collected status for every artifact class.

bundle.json and redaction/coverage.json are included in the manifest and checksum chain.

Files left under raw/ remain raw regardless of a conflicting coverage claim.

raw/ contains sanitized Kubernetes metadata without Secret objects or values, environment values, arbitrary annotations, or live traffic capture.

Reports identify checks unavailable because optional collector capabilities were missing.

Start Upload Intake Book Discovery Call View Release Notes