Steps to collect Konnector support bundle from Kubernetes connector using ktool

Cortex cloud has a ktool support tool to collect all necessary details related to kubernetes connectors for troubleshooting.
This tool collects logs, describe of workloads(pod, replicaset, deployment, service) initiated by Kubernetes connector.
This document provides steps to collect troubleshooting details for Kubernetes connector.

Cortex cloud.
Kubernetes connector.

Cortex cloud has developed a ktool support tool to collect all necessary details related to kubernetes connectors.
This tool collects logs, describe of workloads(pod, replicaset, deployment, service) initiated by Kubernetes connector.
Below are the steps to be followed to collect detailed logs for kubernetes connectors.

1. Enable debug logs and restart cortex-manager.
2. Trigger a cluster scan.
3. Install ktool and fetch ktool log file.
4. Post Data collection set the log levels back to Error and restart cortex-manager.

1. Enable Debug Logs

• Enable debug log on the K8s Cluster by running the following commands:

kubectl patch configmap konnector-globals -n panw --type merge -p '{"data":{"UPLOAD_LOG_LEVEL":"DEBUG"}}'
kubectl patch configmap konnector-globals -n panw --type merge -p '{"data":{"CONSOLE_LOG_LEVEL":"DEBUG"}}'

• Restart cortex-manager for the configs to take effect.

kubectl rollout restart deployment cortex-manager -n panw

Note! Please note to replace the “panw” default namespace if needed

2. Trigger the cluster scan:

• To provide us with full visibility, the best will be to take the support file after running a cluster scan. Run the below command to trigger the job-orchestrator.

kubectl create job --from=cronjob/cortex-job-orchestrator test-job$(date +%Y%m%d-%H%M%S) -n panw

It creates the new Job with the name “test-job$(date +%Y%m%d-%H%M%S)” which in turn runs the pods

Once you hit enter, Kubernetes will create a Job with this name, which will then spin up the actual Pod.

3. Install ktool:

• Download ktool and install in bash.

curl -fsSL https://raw.githubusercontent.com/PaloAltoNetworks/ktool/main/install.sh | bash

Running the ktool support tool:

• Collect the diagnostic snapshot from the cluster

kubectl ktool collect-logs -n panw

Note! In this example, the konnector is installed under the “panw” namespace

If you face issues moving the "kubectl-ktool" into /usr/local/bin. It is nomally stored in /tmp/.

You can run the script using the command:

/tmp/kubectl-ktool collect-logs -n panw

Gathering logs:

This will generate ./konnector-support-bundle-panw-ktool-v0.0.4-<timestamp>.tar.gz
Sample file name: konnector-support-bundle-pan-ktool-v0.0.4-xxxxx.tar.gz

Download this konnector support bundle and you can upload it to the support case for further review.

 
4. Post the issue is identified:

• Set log levels back to "Error" on the K8s Cluster by running the following commands:

kubectl patch configmap konnector-globals -n panw --type merge -p '{"data":{"UPLOAD_LOG_LEVEL":"ERROR"}}'
kubectl patch configmap konnector-globals -n panw --type merge -p '{"data":{"CONSOLE_LOG_LEVEL":"ERROR"}}'

• Restart cortex-manager for the configs to take effect.

kubectl rollout restart deployment cortex-manager -n panw

In Kubernetes, a CronJob doesn't actually run code directly; it acts as a blueprint or a timer. When its schedule hits, the CronJob creates a Job, and that Job creates a Pod.

By running kubectl create job --from=cronjob/...:

• You are telling Kubernetes: "Don't wait for the schedule. Use the exact same blueprint (container image, variables, commands) from cortex-job-orchestrator and run it right now."

• It will not mess up or change the regular schedule of your existing CronJob. It simply creates an immediate, one-off, manual run.