Merge ~dan-emmons/ubuntu/+source/sosreport:sos-jammy-4.10.2 into ubuntu/+source/sosreport:ubuntu/jammy-devel

[Dan Emmons]

[Arif Ali (arif-ali)]

Thanks for the work on this

Uploaded

D: Setting host argument.
Checking signature on .changes
gpg: ../sosreport_4.10.2-0ubuntu0~22.04.1_source.changes: Valid signature from 7E6C0B9EB5944CEB
Checking signature on .dsc
gpg: ../sosreport_4.10.2-0ubuntu0~22.04.1.dsc: Valid signature from 7E6C0B9EB5944CEB
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading sosreport_4.10.2-0ubuntu0~22.04.1.dsc: done.
  Uploading sosreport_4.10.2.orig.tar.gz: done.
  Uploading sosreport_4.10.2-0ubuntu0~22.04.1.debian.tar.xz: done.
  Uploading sosreport_4.10.2-0ubuntu0~22.04.1_source.buildinfo: done.
  Uploading sosreport_4.10.2-0ubuntu0~22.04.1_source.changes: done.
Successfully uploaded packages.

review: Approve

Unmerged commits

6115374... by Dan Emmons on 2025-12-19

Update changelog

1d02bc5... by Dan Emmons on 2025-12-19

Add gpg to Recommends

07dc55f... by Dan Emmons on 2025-12-19

Sync copyright with Debian

647516c... by Dan Emmons on 2025-12-19

Remove patches now not needed

2fb376f... by Dan Emmons on 2025-12-19

import of 4.10.2

diff --git a/.cirrus.yml b/.cirrus.yml
index 1555c18..7db1c60 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -6,13 +6,14 @@ env:
     FEDORA_NAME: "fedora-42"
     FEDORA_PRIOR_NAME: "fedora-41"
 
+    DEBIAN_13_NAME: "debian-13"
     DEBIAN_12_NAME: "debian-12"
     DEBIAN_11_NAME: "debian-11"
 
     UBUNTU_DEVEL_NAME: "ubuntu-25.10"
     UBUNTU_LATEST_NAME: "ubuntu-25.04"
-    UBUNTU_NAME: "ubuntu-24.04"
-    UBUNTU_PRIOR_NAME: "ubuntu-22.04"
+    UBUNTU_2404_NAME: "ubuntu-24.04"
+    UBUNTU_2204_NAME: "ubuntu-22.04"
 
     CENTOS_9_NAME: "centos-stream-9"
 
@@ -25,17 +26,18 @@ env:
 
     # Images exist on GCP already
     CENTOS_9_FAMILY_NAME: "centos-stream-9"
+    DEBIAN_13_FAMILY_NAME: "debian-13"
     DEBIAN_12_FAMILY_NAME: "debian-12"
     DEBIAN_11_FAMILY_NAME: "debian-11"
     FEDORA_FAMILY_NAME: "fedora-cloud-42-x86-64"
     FEDORA_PRIOR_FAMILY_NAME: "fedora-cloud-41-x86-64"
 
+    UBUNTU_DEVEL_FAMILY_NAME: "ubuntu-2510-amd64"
     UBUNTU_DEB_FAMILY_NAME: "ubuntu-minimal-2504-amd64"
     UBUNTU_LATEST_FAMILY_NAME: "ubuntu-2504-amd64"
-    UBUNTU_FAMILY_NAME: "ubuntu-2404-lts-amd64"
-    UBUNTU_PRIOR_FAMILY_NAME: "ubuntu-2204-lts"
     UBUNTU_SNAP_FAMILY_NAME: "ubuntu-2404-lts-amd64"
-    UBUNTU_DEVEL_FAMILY_NAME: "ubuntu-2510-amd64"
+    UBUNTU_2404_FAMILY_NAME: "ubuntu-2404-lts-amd64"
+    UBUNTU_2204_FAMILY_NAME: "ubuntu-2204-lts"
 
     # Curl-command prefix for downloading task artifacts, simply add the
     # the url-encoded task name, artifact name, and path as a suffix.
@@ -106,14 +108,14 @@ rpm_build_task:
             PROJECT: ${CENTOS_PROJECT}
             BUILD_NAME: ${CENTOS_9_NAME}
             VM_FAMILY_NAME: ${CENTOS_9_FAMILY_NAME}
-        - env: &fedora
-            PROJECT: ${FEDORA_PROJECT}
-            BUILD_NAME: ${FEDORA_NAME}
-            VM_FAMILY_NAME: ${FEDORA_FAMILY_NAME}
-        - env: &fedoraprior
-            PROJECT: ${FEDORA_PROJECT}
-            BUILD_NAME: ${FEDORA_PRIOR_NAME}
-            VM_FAMILY_NAME: ${FEDORA_PRIOR_FAMILY_NAME}
+#        - env: &fedora
+#            PROJECT: ${FEDORA_PROJECT}
+#            BUILD_NAME: ${FEDORA_NAME}
+#            VM_FAMILY_NAME: ${FEDORA_FAMILY_NAME}
+#        - env: &fedoraprior
+#            PROJECT: ${FEDORA_PROJECT}
+#            BUILD_NAME: ${FEDORA_PRIOR_NAME}
+#            VM_FAMILY_NAME: ${FEDORA_PRIOR_FAMILY_NAME}
     setup_script: |
         dnf clean all
         dnf -y install rpm-build rpmdevtools gettext python3-devel python3-pexpect python3-pyyaml
@@ -151,11 +153,16 @@ deb_build_task:
             PROJECT: ${DEBIAN_PROJECT}
             BUILD_NAME: ${DEBIAN_12_NAME}
             VM_FAMILY_NAME: ${DEBIAN_12_FAMILY_NAME}
+        - env: &debian-13-deb-pkg
+            PROJECT: ${DEBIAN_PROJECT}
+            BUILD_NAME: ${DEBIAN_13_NAME}
+            VM_FAMILY_NAME: ${DEBIAN_13_FAMILY_NAME}
         - env: &ubuntu-latest-deb-pkg
             PROJECT: ${UBUNTU_PROJECT}
             BUILD_NAME: ${UBUNTU_LATEST_NAME}
             VM_FAMILY_NAME: ${UBUNTU_DEB_FAMILY_NAME}
     setup_script: |
+        [[ ${BUILD_NAME} == "${DEBIAN_11_NAME}" ]] && sudo sed -i '/-backports/ s/^/#/' /etc/apt/sources.list
         apt update --allow-releaseinfo-change
         apt -y install devscripts equivs python3-pip
         mk-build-deps
@@ -206,18 +213,18 @@ report_stageone_task:
     gce_instance: *standardvm
     matrix:
         - env: *centos9
-        - env: *fedora
-        - env: *fedoraprior
-        - env: &ubuntu
+#        - env: *fedora
+#        - env: *fedoraprior
+        - env: &ubuntu-2404
             PKG: "snap"
             PROJECT: ${UBUNTU_PROJECT}
-            BUILD_NAME: "${UBUNTU_NAME} - ${PKG}"
-            VM_FAMILY_NAME: ${UBUNTU_FAMILY_NAME}
-        - env: &ubuntuprior
+            BUILD_NAME: "${UBUNTU_2404_NAME} - ${PKG}"
+            VM_FAMILY_NAME: ${UBUNTU_2404_FAMILY_NAME}
+        - env: &ubuntu-2204
             PKG: "snap"
             PROJECT: ${UBUNTU_PROJECT}
-            BUILD_NAME: "${UBUNTU_PRIOR_NAME} - ${PKG}"
-            VM_FAMILY_NAME: ${UBUNTU_PRIOR_FAMILY_NAME}
+            BUILD_NAME: "${UBUNTU_2204_NAME} - ${PKG}"
+            VM_FAMILY_NAME: ${UBUNTU_2204_FAMILY_NAME}
         - env: &ubuntu-latest-snap
             PKG: "snap"
             PROJECT: ${UBUNTU_PROJECT}
@@ -229,6 +236,10 @@ report_stageone_task:
             BUILD_NAME: "${UBUNTU_LATEST_NAME} - ${PKG}"
             DEB_BUILD_NAME: ${UBUNTU_LATEST_NAME}
             VM_FAMILY_NAME: ${UBUNTU_LATEST_FAMILY_NAME}
+        - env: &debian-13
+            <<: *debian-13-deb-pkg
+            PKG: "deb"
+            DEB_BUILD_NAME: ${BUILD_NAME}
         - env: &debian-12
             <<: *debian-12-deb-pkg
             PKG: "deb"
@@ -239,6 +250,7 @@ report_stageone_task:
             DEB_BUILD_NAME: ${BUILD_NAME}
     setup_script: &setup |
         if [ $(command -v apt) ]; then
+            [[ ${BUILD_NAME} == "${DEBIAN_11_NAME}" ]] && sudo sed -i '/-backports/ s/^/#/' /etc/apt/sources.list
             [[ "$(dpkg -l sos)" ]] && apt -y purge sos ubuntu-server
             [[ "$(dpkg -l sosreport)" ]] && apt -y purge sosreport ubuntu-server
             apt update --allow-releaseinfo-change
@@ -309,11 +321,11 @@ report_stagetwo_task:
     gce_instance: *standardvm
     matrix:
         - env: *centos9
-        - env: *fedora
-        - env: *ubuntu
+#        - env: *fedora
+        - env: *ubuntu-2404
         - env: *ubuntu-latest-snap
         - env: *ubuntu-latest-deb
-        - env: *debian-12
+        - env: *debian-13
     setup_script: *setup
     install_pexpect_script: |
         if [ $(command -v apt) ]; then
@@ -349,13 +361,16 @@ report_foreman_task:
     alias: "foreman_integration"
     name: "Integration Test - Foreman ${FOREMAN_VER} - ${BUILD_NAME}"
     depends_on: stageone_report
+    environment:
+      FOREMAN_VER: "3.15"
+      KATELLO_VER: "4.17"
     gce_instance: &bigvm
         <<: *standardvm
-        type: e2-standard-2
+        type: e2-highmem-4
     matrix:
-        - env:
-            <<: *debian-11
-            FOREMAN_VER: "3.7"
+        - env: *centos9
+        - env: *debian-12
+        - env: *ubuntu-2204
     setup_script: *setup
     foreman_setup_script: ./tests/test_data/foreman_setup.sh
     main_script: PYTHONPATH=tests/ avocado run -p TESTLOCAL=true --max-parallel-tasks=1 -t foreman tests/product_tests/foreman/
diff --git a/.github/workflows/snap.yaml b/.github/workflows/snap.yaml
deleted file mode 100644
index d7d8935..0000000
--- a/.github/workflows/snap.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: snap
-on:
-  push:
-    branches:
-      - main
-  release:
-    types:
-      - published
-
-jobs:
-  build:
-    runs-on: ubuntu-22.04
-    concurrency:
-      group: snap-build
-      cancel-in-progress: true
-    steps:
-    - uses: actions/checkout@v3
-      with:
-        fetch-depth: 0
-    - uses: snapcore/action-build@v1
-      id: build-snap
-    # Make sure the snap is installable
-    - run: |
-        sudo apt -y remove sosreport
-        sudo snap install --classic --dangerous ${{ steps.build-snap.outputs.snap }}
-        sudo snap alias sosreport.sos sos
-    # Do some testing with the snap
-    - run: |
-        sudo sos help
-    - uses: snapcore/action-publish@v1
-      if: ${{ github.event_name == 'push' }}
-      env:
-        SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_LOGIN }}
-      with:
-        snap: ${{ steps.build-snap.outputs.snap }}
-        release: "latest/edge"
-    - uses: snapcore/action-publish@v1
-      if: ${{ github.event_name == 'release' }}
-      env:
-        SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_LOGIN }}
-      with:
-        snap: ${{ steps.build-snap.outputs.snap }}
-        release: "latest/candidate"
diff --git a/README.md b/README.md
index c940ec8..0842741 100644
--- a/README.md
+++ b/README.md
@@ -114,11 +114,6 @@ You can simply run from the git checkout now:
 ```
 $ sudo ./bin/sos report 
 ```
-The command `sosreport` is still available, as a legacy redirector,
-and can be used like this:
-```
-$ sudo ./bin/sosreport 
-```
 
 To see a list of all available plugins and plugin options, run
 ```
diff --git a/debian/changelog b/debian/changelog
index 43ae474..2d3374e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,23 @@
+sosreport (4.10.2-0ubuntu0~22.04.1) jammy; urgency=medium
+
+  * New 4.10.2 upstream release. (LP: #2136302)
+
+  * For more details, full release note is available here:
+    - https://github.com/sosreport/sos/releases/tag/4.10.2
+
+  * d/control: Add gpg to Recommends so that we are able to encrypt and
+    decrypt sos reports
+
+  * d/copyright: Aligned copyright with upstream Debian
+
+  * Former patch, now fixed:
+    - d/p/0002-component-Grab-tmpdir-from-policy.patch
+
+  * Remaining patches:
+    - d/p/0001-debian-change-tmp-dir-location.patch
+
+ -- Dan Emmons <[e-mail]>  Fri, 19 Dec 2025 17:58:00 +0000
+
 sosreport (4.9.2-0ubuntu0~22.04.1) jammy; urgency=medium
 
   * New 4.9.2 upstream release. (LP: #2114840)
diff --git a/debian/control b/debian/control
index f26edad..460ce51 100644
--- a/debian/control
+++ b/debian/control
@@ -30,6 +30,8 @@ Depends:
  python3-yaml,
  ${misc:Depends},
  ${python3:Depends},
+Recommends:
+ gpg,
 Description: Set of tools to gather troubleshooting data from a system
  Sos is a set of tools that gathers information about system
  hardware and configuration. The information can then be used for
diff --git a/debian/copyright b/debian/copyright
index f79e87b..f4906bf 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -34,6 +34,24 @@ Files: sos/policies/distros/rocky.py
 Copyright: (C) Louis Abel <[e-mail]>
 License: GPL-2
 
+Files: sos/report/plugins/aap_containerized.py
+Copyright: (C) 2025 Nagoor Shaik <[e-mail]>
+License: GPL-2
+
+Files: sos/report/plugins/aap_eda.py
+Copyright: (C) 2025 Rudnei Bertol Jr <[e-mail]>
+ (C) 2025 Nagoor Shaik <[e-mail]>
+License: GPL-2
+
+Files: sos/report/plugins/aap_gateway.py
+Copyright: (C) 2024 Lucas Benedito <[e-mail]>
+ (C) 2025 Nagoor Shaik <[e-mail]>
+License: GPL-2
+
+Files: sos/report/plugins/aws.py
+Copyright: (C) 2025, Javier Blanco <[e-mail]>
+License: GPL-2
+
 Files: sos/report/plugins/elastic.py
 Copyright: (C) 2018 Amit Ghadge <[e-mail]>
 License: GPL-2
diff --git a/debian/patches/0002-component-Grab-tmpdir-from-policy.patch b/debian/patches/0002-component-Grab-tmpdir-from-policy.patch
deleted file mode 100644
index d7a56e4..0000000
--- a/debian/patches/0002-component-Grab-tmpdir-from-policy.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Arif Ali <[e-mail]>
-Date: Fri, 20 Jun 2025 11:33:07 +0100
-Subject: [PATCH] [component] Grab tmpdir from policy
-
-Rather than using /var/tmp by default, grab the tmp_dir from the
-policy. The default will be from tempfile.gettempdir() from the
-sos.policies, so should be getting it from the OS default.
-
-Closes: #4061
-
-Signed-off-by: Arif Ali <[e-mail]>
-Forwarded: https://github.com/sosreport/sos/pull/4062
-Bug-Upstream: https://github.com/sosreport/sos/issues/4061
-Origin: upstream, https://github.com/sosreport/sos/commit/57bbc89a0c6406a391a90c1330f5c532ee0b2c66
----
- sos/component.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/sos/component.py b/sos/component.py
-index d0660cf..a110c27 100644
---- a/sos/component.py
-+++ b/sos/component.py
-@@ -168,7 +168,7 @@ class SoSComponent():
-         if self.opts.tmp_dir:
-             tmpdir = os.path.abspath(self.opts.tmp_dir)
-         else:
--            tmpdir = os.getenv('TMPDIR', None) or '/var/tmp'
-+            tmpdir = os.getenv('TMPDIR', None) or self.policy.get_tmp_dir(None)
- 
-         if os.getenv('HOST', None) and os.getenv('container', None):
-             tmpdir = os.path.join(os.getenv('HOST'), tmpdir.lstrip('/'))
diff --git a/debian/patches/series b/debian/patches/series
index 272c46e..3d9fdd4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1 @@
 0001-debian-change-tmp-dir-location.patch
-0002-component-Grab-tmpdir-from-policy.patch
diff --git a/docs/conf.py b/docs/conf.py
index b1b1968..fc9c526 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -58,9 +58,9 @@ project_copyright = '2014, Bryn Reeves'
 # built documents.
 #
 # The short X.Y version.
-version = '4.9.2'
+version = '4.10.2'
 # The full version, including alpha/beta/rc tags.
-release = '4.9.2'
+release = '4.10.2'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
diff --git a/man/en/sos.1 b/man/en/sos.1
index cb91053..1ba3165 100644
--- a/man/en/sos.1
+++ b/man/en/sos.1
@@ -10,8 +10,7 @@ sos \- A unified tool for collecting system logs and other debug information
 support representatives, and the like to assist in troubleshooting issues with
 a system or group of systems.
 
-The most well known function is \fB sos report\fR or \fBsos report\fR as it was
-previously known.
+The most well known function is \fBsos report\fR.
 
 An sos archive is typically requested by support organizations to collect baseline
 configuration and system data from which to begin the troubleshooting process.
@@ -31,7 +30,7 @@ services, or system architecture is detected.
 
 See \fBsos report --help\fR and \fBman sos-report\fR for more information.
 
-May also be invoked via the alias \fBrep\fR or the deprecated command \fBsos report\fR.
+May also be invoked via the alias \fBrep\fR.
 
 .TP
 .B collect
diff --git a/plugins_overview.py b/plugins_overview.py
index f7ef042..b315519 100644
--- a/plugins_overview.py
+++ b/plugins_overview.py
@@ -55,7 +55,10 @@ def add_all_items(method, dest, plugfd, wrapopen=r'\(', wrapclose=r'\)'):
                         # dirty hack to remove spaces and "Plugin"
                         if "Plugin" not in it:
                             continue
-                        it = it.strip(' ()')[0:-6]
+                        if "=" in it:
+                            it = re.sub(r"Plugin.*", "Plugin", it)
+                        plug_col_len = 9 if "PluginOpt" in it else 6
+                        it = it.strip(' ()')[:-plug_col_len]
                         if len(it):
                             dest.append(it)
         # list of specs separated by comma ..
@@ -94,7 +97,8 @@ for plugfile in sorted(os.listdir(PLUGDIR)):
         pfd_content = pfd.read().replace('\n', '')
         add_all_items(
             "from sos.report.plugins import ", plugs_data[plugname]['distros'],
-            pfd_content, wrapopen='', wrapclose='(class|from|import)'
+            pfd_content, wrapopen='',
+            wrapclose=r'(class|from|import|#|\))'
         )
         add_all_items("profiles = ", plugs_data[plugname]['profiles'],
                       pfd_content, wrapopen='')
diff --git a/sos.spec b/sos.spec
index b7a010e..fa3f3b9 100644
--- a/sos.spec
+++ b/sos.spec
@@ -1,6 +1,6 @@
 Summary: A set of tools to gather troubleshooting information from a system
 Name: sos
-Version: 4.9.2
+Version: 4.10.2
 Release: 1%{?dist}
 Source0: https://github.com/sosreport/sos/archive/%{name}-%{version}.tar.gz
 License: GPL-2.0-only
@@ -33,20 +33,20 @@ support technicians and developers.
 %prep
 %setup -qn %{name}-%{version}
 
-%if 0%{?fedora} >= 39
+%if 0%{?fedora} >= 39 || 0%{?rhel} >= 11
 %generate_buildrequires
 %pyproject_buildrequires
 %endif
 
 %build
-%if 0%{?fedora} >= 39
+%if 0%{?fedora} >= 39 || 0%{?rhel} >= 11
 %pyproject_wheel
 %else
 %py3_build
 %endif
 
 %install
-%if 0%{?fedora} >= 39
+%if 0%{?fedora} >= 39 || 0%{?rhel} >= 11
 %pyproject_install
 %pyproject_save_files sos
 %else
@@ -69,7 +69,7 @@ rm -rf %{buildroot}/usr/config/
 # internationalization is currently broken. Uncomment this line once fixed.
 # %%files -f %%{name}.lang
 %files
-%if 0%{?fedora} >= 39
+%if 0%{?fedora} >= 39 || 0%{?rhel} >= 11
 %{_bindir}/sos
 %else
 %{_sbindir}/sos
@@ -89,6 +89,15 @@ rm -rf %{buildroot}/usr/config/
 %config(noreplace) %{_sysconfdir}/sos/sos.conf
 
 %changelog
+* Mon Dec 15 2025 Pavel Moravec <[e-mail]> = 4.10.2
+- New upstream release
+
+* Wed Oct 15 2025 Pavel Moravec <[e-mail]> = 4.10.1
+- New upstream release
+
+* Mon Aug 18 2025 Jake Hunsaker <[e-mail]> = 4.10.0
+- New upstream release
+
 * Tue Jun 17 2025 Pavel Moravec <[e-mail]> = 4.9.2
 - New upstream release
 
diff --git a/sos/__init__.py b/sos/__init__.py
index 1e292e3..259593f 100644
--- a/sos/__init__.py
+++ b/sos/__init__.py
@@ -14,7 +14,7 @@
 This module houses the i18n setup and message function. The default is to use
 gettext to internationalize messages.
 """
-__version__ = "4.9.2"
+__version__ = "4.10.2"
 
 import os
 import sys
diff --git a/sos/archive.py b/sos/archive.py
index 41a6974..0ac3e76 100644
--- a/sos/archive.py
+++ b/sos/archive.py
@@ -726,18 +726,24 @@ class TarFileArchive(FileCacheArchive):
         return f"{self._archive_root}.{self._suffix}"
 
     def _build_archive(self, method):
+        _mode = 'w'
         if method == 'auto':
             method = 'xz' if find_spec('lzma') is not None else 'gzip'
-        _comp_mode = method.strip('ip')
-        self._archive_name = f"{self._archive_name}.{_comp_mode}"
+        if method is not None:
+            _comp_mode = method.strip('ip')
+            self._archive_name = f"{self._archive_name}.{_comp_mode}"
+            self._suffix += f".{_comp_mode}"
+            _mode = f"w:{_comp_mode}"
         # tarfile does not currently have a consistent way to define comnpress
         # level for both xz and gzip ('preset' for xz, 'compresslevel' for gz)
-        if method == 'gzip':
-            kwargs = {'compresslevel': 6}
-        else:
-            kwargs = {'preset': 3}
-        with tarfile.open(self._archive_name, mode=f"w:{_comp_mode}",
-                          **kwargs) as tar:
+        kwargs = {
+            None: {},
+            'gzip': {'compresslevel': 6},
+            'xz':   {'preset': 3}
+        }
+        with tarfile.open(self._archive_name,
+                          mode=_mode,
+                          **kwargs[method]) as tar:
             # Add commonly reviewed files first, so that they can be more
             # easily read from memory without needing to extract
             # the whole archive
@@ -751,7 +757,6 @@ class TarFileArchive(FileCacheArchive):
             # want the names used in the archive to be relative.
             tar.add(self._archive_root, arcname=self._name,
                     filter=self.copy_permissions_filter)
-        self._suffix += f".{_comp_mode}"
         return self.name()
 
 
diff --git a/sos/cleaner/__init__.py b/sos/cleaner/__init__.py
index 175da18..2e502d2 100644
--- a/sos/cleaner/__init__.py
+++ b/sos/cleaner/__init__.py
@@ -13,10 +13,9 @@ import json
 import logging
 import os
 import shutil
-import tempfile
 import fnmatch
 
-from concurrent.futures import ThreadPoolExecutor
+from concurrent.futures import ProcessPoolExecutor
 from datetime import datetime
 from pwd import getpwuid
 
@@ -35,8 +34,13 @@ from sos.cleaner.archives.sos import (SoSReportArchive, SoSReportDirectory,
                                       SoSCollectorDirectory)
 from sos.cleaner.archives.generic import DataDirArchive, TarballArchive
 from sos.cleaner.archives.insights import InsightsArchive
-from sos.utilities import (get_human_readable, import_module, ImporterHelper,
-                           file_is_binary)
+from sos.utilities import (get_human_readable, import_module,
+                           ImporterHelper, is_executable)
+
+
+# an auxiliary method to kick off child processes over its instances
+def obfuscate_arc_files(arc, flist):
+    return arc.obfuscate_arc_files(flist)
 
 
 class SoSCleaner(SoSComponent):
@@ -62,7 +66,8 @@ class SoSCleaner(SoSComponent):
     In the case of IP addresses, support is for IPv4 and IPv6 - effort is made
     to keep network topology intact so that later analysis is as accurate and
     easily understandable as possible. If an IP address is encountered that we
-    cannot determine the netmask for, a random IP address is used instead.
+    cannot determine the netmask for, a private IP address from 172.17.0.0/22
+    range is used instead.
 
     For IPv6, note that IPv4-mapped addresses, e.g. ::ffff:10.11.12.13, are
     NOT supported currently, and will remain unobfuscated.
@@ -92,7 +97,8 @@ class SoSCleaner(SoSComponent):
         'no_update': False,
         'keep_binary_files': False,
         'target': '',
-        'usernames': []
+        'usernames': [],
+        'treat_certificates': 'obfuscate'
     }
 
     def __init__(self, parser=None, args=None, cmdline=None, in_place=False,
@@ -111,8 +117,9 @@ class SoSCleaner(SoSComponent):
             self.policy = hook_commons['policy']
             self.manifest = hook_commons['manifest']
             self.from_cmdline = False
+            # precede 'report -t' option above 'cleaner --jobs'
             if not hasattr(self.opts, 'jobs'):
-                self.opts.jobs = 4
+                self.opts.jobs = self.opts.threads
             self.opts.archive_type = 'auto'
             self.soslog = logging.getLogger('sos')
             self.ui_log = logging.getLogger('sos_ui')
@@ -129,14 +136,20 @@ class SoSCleaner(SoSComponent):
 
         self.cleaner_md = self.manifest.components.add_section('cleaner')
 
-        skip_cleaning_files = self.opts.skip_cleaning_files
+        cleaner_dir = os.path.dirname(self.opts.map_file) \
+            if self.opts.map_file else '/etc/sos/cleaner'
+        parser_args = [
+            self.cleaner_mapping,
+            cleaner_dir,
+            self.opts.skip_cleaning_files,
+        ]
         self.parsers = [
-            SoSHostnameParser(self.cleaner_mapping, skip_cleaning_files),
-            SoSIPParser(self.cleaner_mapping, skip_cleaning_files),
-            SoSIPv6Parser(self.cleaner_mapping, skip_cleaning_files),
-            SoSMacParser(self.cleaner_mapping, skip_cleaning_files),
-            SoSKeywordParser(self.cleaner_mapping, skip_cleaning_files),
-            SoSUsernameParser(self.cleaner_mapping, skip_cleaning_files)
+            SoSHostnameParser(*parser_args),
+            SoSIPParser(*parser_args),
+            SoSIPv6Parser(*parser_args),
+            SoSMacParser(*parser_args),
+            SoSKeywordParser(*parser_args),
+            SoSUsernameParser(*parser_args),
         ]
 
         for _parser in self.opts.disable_parsers:
@@ -289,6 +302,15 @@ third party.
         clean_grp.add_argument('--usernames', dest='usernames', default=[],
                                action='extend',
                                help='List of usernames to obfuscate')
+        clean_grp.add_argument('--treat-certificates', default='obfuscate',
+                               choices=['obfuscate', 'keep', 'remove'],
+                               dest='treat_certificates',
+                               help=(
+                                   'How to treat certificate files '
+                                   '[.csr .crt .pem]. Defaults to "obfuscate" '
+                                   'after convert the file to text. '
+                                   '"Key" certificate files are always '
+                                   'removed.'))
 
     def set_target_path(self, path):
         """For use by report and collect to set the TARGET option appropriately
@@ -308,14 +330,19 @@ third party.
             check_type = self.opts.archive_type.replace('-', '_')
             for archive in self.archive_types:
                 if archive.type_name == check_type:
-                    _arc = archive(self.opts.target, self.tmpdir)
+                    _arc = archive(self.opts.target, self.tmpdir,
+                                   self.opts.keep_binary_files,
+                                   self.opts.treat_certificates)
         else:
             for arc in self.archive_types:
                 if arc.check_is_type(self.opts.target):
-                    _arc = arc(self.opts.target, self.tmpdir)
+                    _arc = arc(self.opts.target, self.tmpdir,
+                               self.opts.keep_binary_files,
+                               self.opts.treat_certificates)
                     break
         if not _arc:
             return
+        self.main_archive = _arc
         self.report_paths.append(_arc)
         if _arc.is_nested:
             self.report_paths.extend(_arc.get_nested_archives())
@@ -554,7 +581,8 @@ third party.
         try:
             msg = (
                 f"Found {len(self.report_paths)} total reports to obfuscate, "
-                f"processing up to {self.opts.jobs} concurrently\n"
+                f"processing up to {self.opts.jobs} concurrently within one "
+                "archive\n"
             )
             self.ui_log.info(msg)
             if self.opts.keep_binary_files:
@@ -562,9 +590,33 @@ third party.
                     "WARNING: binary files that potentially contain sensitive "
                     "information will NOT be removed from the final archive\n"
                 )
-            pool = ThreadPoolExecutor(self.opts.jobs)
-            pool.map(self.obfuscate_report, self.report_paths, chunksize=1)
-            pool.shutdown(wait=True)
+            if (self.opts.treat_certificates == "obfuscate"
+                    and not is_executable("openssl")):
+                self.opts.treat_certificates = "remove"
+                self.ui_log.warning(
+                    "WARNING: No `openssl` command available. Replacing "
+                    "`--treat-certificates` from `obfuscate` to `remove`."
+                )
+            if self.opts.treat_certificates == "obfuscate":
+                self.ui_log.warning(
+                    "WARNING: certificate files that potentially contain "
+                    "sensitive information will be CONVERTED to text and "
+                    "OBFUSCATED in the final archive.\n"
+                )
+            elif self.opts.treat_certificates == "keep":
+                self.ui_log.warning(
+                    "WARNING: certificate files that potentially contain "
+                    "sensitive information will be KEPT in the final "
+                    "archive as is.\n"
+                )
+            elif self.opts.treat_certificates == "remove":
+                self.ui_log.warning(
+                    "WARNING: certificate files that potentially contain "
+                    "sensitive information will be REMOVED in the final "
+                    "archive.\n")
+            for report_path in self.report_paths:
+                self.ui_log.info(f"Obfuscating {report_path.archive_path}")
+                self.obfuscate_report(report_path)
             # finally, obfuscate the nested archive if one exists
             if self.nested_archive:
                 self._replace_obfuscated_archives()
@@ -635,6 +687,8 @@ third party.
 
             for ritem in prepper.regex_items[pname]:
                 _parser.mapping.add_regex_item(ritem)
+        # we must initialize stuff inside (cloned processes') archive - REALLY?
+        archive.set_parsers(self.parsers)
 
     def get_preppers(self):
         """
@@ -661,6 +715,7 @@ third party.
         for prepper in self.get_preppers():
             for archive in self.report_paths:
                 self._prepare_archive_with_prepper(archive, prepper)
+        self.main_archive.set_parsers(self.parsers)
 
     def obfuscate_report(self, archive):  # pylint: disable=too-many-branches
         """Individually handle each archive or directory we've discovered by
@@ -668,8 +723,9 @@ third party.
 
         Positional arguments:
 
-            :param report str:      Filepath to the directory or archive
+            :param archive str:      Filepath to the directory or archive
         """
+
         try:
             arc_md = self.cleaner_md.add_section(archive.archive_name)
             start_time = datetime.now()
@@ -679,30 +735,47 @@ third party.
                 archive.extract()
             archive.report_msg("Beginning obfuscation...")
 
-            for fname in archive.get_file_list():
-                short_name = fname.split(archive.archive_name + '/')[1]
-                if archive.should_skip_file(short_name):
-                    continue
-                if (not self.opts.keep_binary_files and
-                        archive.should_remove_file(short_name)):
-                    # We reach this case if the option --keep-binary-files
-                    # was not used, and the file is in a list to be removed
-                    archive.remove_file(short_name)
-                    continue
-                if (self.opts.keep_binary_files and
-                        (file_is_binary(fname) or
-                         archive.should_remove_file(short_name))):
-                    # We reach this case if the option --keep-binary-files
-                    # is used. In this case we want to make sure
-                    # the cleaner doesn't try to clean a binary file
-                    continue
-                try:
-                    count = self.obfuscate_file(fname, short_name,
-                                                archive.archive_name)
-                    if count:
-                        archive.update_sub_count(short_name, count)
-                except Exception as err:
-                    self.log_debug(f"Unable to parse file {short_name}: {err}")
+            file_list = list(archive.get_files())
+            # we can't call simple
+            # executor.map(archive.obfuscate_arc_files,archive.get_files())
+            # because a child process does not carry forward internal changes
+            # (e.g. mappings' datasets) from one call of obfuscate_arc_files
+            # method to another. Each obfuscate_arc_files method starts with
+            # vanilla parent archive, that is initialised *once* at its
+            # beginning via initializer=archive.load_parser_entries
+            # - but not afterwards..
+            #
+            # So we must pass list of all files for each worker at the
+            # beginning. This means less granularity of the child processes
+            # work (one worker can finish much sooner than the other), but
+            # it is the best we can have (or have found)
+            #
+            # At least, the "file_list[i::self.opts.jobs]" means subsequent
+            # files (speculativelly of similar size and content) are
+            # distributed to different processes, which attempts to split the
+            # load evenly. Yet better approach might be reorderig file_list
+            # based on files' sizes.
+
+            files_obfuscated_count = total_sub_count = removed_file_count = 0
+            archive_list = [archive for i in range(self.opts.jobs)]
+            with ProcessPoolExecutor(
+                    max_workers=self.opts.jobs,
+                    initializer=archive.load_parser_entries) as executor:
+                futures = executor.map(obfuscate_arc_files, archive_list,
+                                       [file_list[i::self.opts.jobs] for i in
+                                        range(self.opts.jobs)])
+                for (foc, tsc, rfc) in futures:
+                    files_obfuscated_count += foc
+                    total_sub_count += tsc
+                    removed_file_count += rfc
+
+            # As there is no easy way to get dataset dicts from child
+            # processes' mappings, we can reload our own parent-process
+            # archive from the disk files. The trick is that sequence of
+            # files/entries is the source of truth of *sequence* of calling
+            # *all* mapping.all(item) methods - so replaying this will
+            # generate the right datasets!
+            archive.load_parser_entries()
 
             try:
                 self.obfuscate_directory_names(archive)
@@ -737,95 +810,20 @@ third party.
             end_time = datetime.now()
             arc_md.add_field('end_time', end_time)
             arc_md.add_field('run_time', end_time - start_time)
-            arc_md.add_field('files_obfuscated', len(archive.file_sub_list))
-            arc_md.add_field('total_substitutions', archive.total_sub_count)
+            arc_md.add_field('files_obfuscated', files_obfuscated_count)
+            arc_md.add_field('total_substitutions', total_sub_count)
             rmsg = ''
-            if archive.removed_file_count:
+            if removed_file_count:
                 rmsg = " [removed %s unprocessable files]"
-                rmsg = rmsg % archive.removed_file_count
+                rmsg = rmsg % removed_file_count
             archive.report_msg(f"Obfuscation completed{rmsg}")
 
         except Exception as err:
             self.ui_log.info("Exception while processing "
                              f"{archive.archive_name}: {err}")
 
-    def obfuscate_file(self, filename, short_name=None, arc_name=None):
-        # pylint: disable=too-many-locals
-        """Obfuscate and individual file, line by line.
-
-        Lines processed, even if no substitutions occur, are then written to a
-        temp file without our own tmpdir. Once the file has been completely
-        iterated through, if there have been substitutions then the temp file
-        overwrites the original file. If there are no substitutions, then the
-        original file is left in place.
-
-        Positional arguments:
-
-            :param filename str:        Filename relative to the extracted
-                                        archive root
-        """
-        if not filename:
-            # the requested file doesn't exist in the archive
-            return None
-        subs = 0
-        if not short_name:
-            short_name = filename.split('/')[-1]
-        if not os.path.islink(filename):
-            # don't run the obfuscation on the link, but on the actual file
-            # at some other point.
-            _parsers = [
-                _p for _p in self.parsers if not
-                any(
-                    _skip.match(short_name) for _skip in _p.skip_patterns
-                )
-            ]
-            if not _parsers:
-                self.log_debug(
-                    f"Skipping obfuscation of {short_name or filename} due to "
-                    f"matching file skip pattern"
-                )
-                return 0
-            self.log_debug(f"Obfuscating {short_name or filename}",
-                           caller=arc_name)
-            with tempfile.NamedTemporaryFile(mode='w', dir=self.tmpdir) \
-                    as tfile:
-                with open(filename, 'r', encoding='utf-8',
-                          errors='replace') as fname:
-                    for line in fname:
-                        try:
-                            line, count = self.obfuscate_line(line, _parsers)
-                            subs += count
-                            tfile.write(line)
-                        except Exception as err:
-                            self.log_debug(f"Unable to obfuscate {short_name}:"
-                                           f"{err}", caller=arc_name)
-                tfile.seek(0)
-                if subs:
-                    shutil.copyfile(tfile.name, filename)
-
-        _ob_short_name = self.obfuscate_string(short_name.split('/')[-1])
-        _ob_filename = short_name.replace(short_name.split('/')[-1],
-                                          _ob_short_name)
-
-        if _ob_filename != short_name:
-            arc_path = filename.split(short_name)[0]
-            _ob_path = os.path.join(arc_path, _ob_filename)
-            # ensure that any plugin subdirs that contain obfuscated strings
-            # get created with obfuscated counterparts
-            if not os.path.islink(filename):
-                os.rename(filename, _ob_path)
-            else:
-                # generate the obfuscated name of the link target
-                _target_ob = self.obfuscate_string(os.readlink(filename))
-                # remove the unobfuscated original symlink first, in case the
-                # symlink name hasn't changed but the target has
-                os.remove(filename)
-                # create the newly obfuscated symlink, pointing to the
-                # obfuscated target name, which may not exist just yet, but
-                # when the actual file is obfuscated, will be created
-                os.symlink(_target_ob, _ob_path)
-
-        return subs
+    def obfuscate_file(self, filename):
+        self.main_archive.obfuscate_arc_files([filename])
 
     def obfuscate_symlinks(self, archive):
         """Iterate over symlinks in the archive and obfuscate their names.
@@ -894,6 +892,8 @@ third party.
                         )
                         os.rename(_dirname, _ob_arc_dir)
 
+    # TODO: this is a duplicate method from SoSObfuscationArchive but we can't
+    # easily remove either of them..?
     def obfuscate_string(self, string_data):
         for parser in self.parsers:
             try:
@@ -902,34 +902,6 @@ third party.
                 self.log_info(f"Error obfuscating string data: {err}")
         return string_data
 
-    def obfuscate_line(self, line, parsers=None):
-        """Run a line through each of the obfuscation parsers, keeping a
-        cumulative total of substitutions done on that particular line.
-
-        Positional arguments:
-
-            :param line str:        The raw line as read from the file being
-                                    processed
-            :param parsers:         A list of parser objects to obfuscate
-                                    with. If None, use all.
-
-        Returns the fully obfuscated line and the number of substitutions made
-        """
-        # don't iterate over blank lines, but still write them to the tempfile
-        # to maintain the same structure when we write a scrubbed file back
-        count = 0
-        if not line.strip():
-            return line, count
-        if parsers is None:
-            parsers = self.parsers
-        for parser in parsers:
-            try:
-                line, _count = parser.parse_line(line)
-                count += _count
-            except Exception as err:
-                self.log_debug(f"failed to parse line: {err}", parser.name)
-        return line, count
-
     def write_stats_to_manifest(self):
         """Write some cleaner-level, non-report-specific stats to the manifest
         """
diff --git a/sos/cleaner/archives/__init__.py b/sos/cleaner/archives/__init__.py
index a70ae5d..e918e2e 100644
--- a/sos/cleaner/archives/__init__.py
+++ b/sos/cleaner/archives/__init__.py
@@ -13,10 +13,12 @@ import os
 import shutil
 import stat
 import tarfile
+import tempfile
 import re
 
 from concurrent.futures import ProcessPoolExecutor
-from sos.utilities import file_is_binary
+from sos.utilities import (file_is_binary, sos_get_command_output,
+                           file_is_certificate)
 
 
 # python older than 3.8 will hit a pickling error when we go to spawn a new
@@ -54,7 +56,7 @@ class SoSObfuscationArchive():
     class. All report-level operations should be contained within this class.
     """
 
-    file_sub_list = []
+    files_obfuscated_count = 0
     total_sub_count = 0
     removed_file_count = 0
     type_name = 'undetermined'
@@ -62,7 +64,8 @@ class SoSObfuscationArchive():
     is_nested = False
     prep_files = {}
 
-    def __init__(self, archive_path, tmpdir):
+    def __init__(self, archive_path, tmpdir, keep_binary_files,
+                 treat_certificates):
         self.archive_path = archive_path
         self.final_archive_path = self.archive_path
         self.tmpdir = tmpdir
@@ -74,10 +77,158 @@ class SoSObfuscationArchive():
         self.is_extracted = False
         self._load_self()
         self.archive_root = ''
+        self.keep_binary_files = keep_binary_files
+        self.treat_certificates = treat_certificates
+        self.parsers = ()
         self.log_info(
             f"Loaded {self.archive_path} as type {self.description}"
         )
 
+    def obfuscate_string(self, string_data):
+        for parser in self.parsers:
+            try:
+                string_data = parser.parse_string_for_keys(string_data)
+            except Exception as err:
+                self.log_info(f"Error obfuscating string data: {err}")
+        return string_data
+
+    # TODO: merge content to obfuscate_arc_files as that is the only place we
+    # call obfuscate_filename ?
+    def obfuscate_filename(self, short_name, filename):
+        _ob_short_name = self.obfuscate_string(short_name.split('/')[-1])
+        _ob_filename = short_name.replace(short_name.split('/')[-1],
+                                          _ob_short_name)
+
+        if _ob_filename != short_name:
+            arc_path = filename.split(short_name)[0]
+            _ob_path = os.path.join(arc_path, _ob_filename)
+            # ensure that any plugin subdirs that contain obfuscated strings
+            # get created with obfuscated counterparts
+            if not os.path.islink(filename):
+                os.rename(filename, _ob_path)
+            else:
+                # generate the obfuscated name of the link target
+                _target_ob = self.obfuscate_string(os.readlink(filename))
+                # remove the unobfuscated original symlink first, in case the
+                # symlink name hasn't changed but the target has
+                os.remove(filename)
+                # create the newly obfuscated symlink, pointing to the
+                # obfuscated target name, which may not exist just yet, but
+                # when the actual file is obfuscated, will be created
+                os.symlink(_target_ob, _ob_path)
+
+    def set_parsers(self, parsers):
+        self.parsers = parsers  # TODO: include this in __init__?
+
+    def load_parser_entries(self):
+        for parser in self.parsers:
+            parser.load_map_entries()
+
+    def obfuscate_line(self, line, parsers=None):
+        """Run a line through each of the obfuscation parsers, keeping a
+        cumulative total of substitutions done on that particular line.
+
+        Positional arguments:
+
+            :param line str:        The raw line as read from the file being
+                                    processed
+            :param parsers:         A list of parser objects to obfuscate
+                                    with. If None, use all.
+
+        Returns the fully obfuscated line and the number of substitutions made
+        """
+        # don't iterate over blank lines, but still write them to the tempfile
+        # to maintain the same structure when we write a scrubbed file back
+        count = 0
+        if not line.strip():
+            return line, count
+        if parsers is None:
+            parsers = self.parsers
+        for parser in parsers:
+            try:
+                line, _count = parser.parse_line(line)
+                count += _count
+            except Exception as err:
+                self.log_debug(f"failed to parse line: {err}", parser.name)
+        return line, count
+
+    def obfuscate_arc_files(self, flist):
+        for filename in flist:
+            self.log_debug(f"    pid={os.getpid()}: obfuscating {filename}")
+            try:
+                short_name = filename.split(self.archive_name + '/')[1]
+                if self.should_skip_file(short_name):
+                    continue
+                if (not self.keep_binary_files and
+                        self.should_remove_file(short_name)):
+                    # We reach this case if the option --keep-binary-files
+                    # was not used, and the file is in a list to be removed
+                    self.remove_file(short_name)
+                    continue
+                if (self.keep_binary_files and
+                        (file_is_binary(filename) or
+                         self.should_remove_file(short_name))):
+                    # We reach this case if the option --keep-binary-files
+                    # is used. In this case we want to make sure
+                    # the cleaner doesn't try to clean a binary file
+                    continue
+                if os.path.islink(filename):
+                    # don't run the obfuscation on the link, but on the actual
+                    # file at some other point.
+                    continue
+                is_certificate = file_is_certificate(filename)
+                if is_certificate:
+                    if is_certificate == "certificatekey":
+                        # Always remove certificate Key files
+                        self.remove_file(short_name)
+                        continue
+                    if self.treat_certificates == "keep":
+                        continue
+                    if self.treat_certificates == "remove":
+                        self.remove_file(short_name)
+                        continue
+                    if self.treat_certificates == "obfuscate":
+                        self.certificate_to_text(filename)
+                _parsers = [
+                    _p for _p in self.parsers if not
+                    any(
+                        _skip.match(short_name) for _skip in _p.skip_patterns
+                    )
+                ]
+                if not _parsers:
+                    self.log_debug(
+                        f"Skipping obfuscation of {short_name or filename} "
+                        f"due to matching file skip pattern"
+                    )
+                    continue
+                self.log_debug(f"Obfuscating {short_name or filename}")
+                subs = 0
+                with tempfile.NamedTemporaryFile(mode='w', dir=self.tmpdir) \
+                        as tfile:
+                    with open(filename, 'r', encoding='utf-8',
+                              errors='replace') as fname:
+                        for line in fname:
+                            try:
+                                line, cnt = self.obfuscate_line(line, _parsers)
+                                subs += cnt
+                                tfile.write(line)
+                            except Exception as err:
+                                self.log_debug(f"Unable to obfuscate "
+                                               f"{short_name}: {err}")
+                    tfile.seek(0)
+                    if subs:
+                        shutil.copyfile(tfile.name, filename)
+                        self.update_sub_count(subs)
+
+                self.obfuscate_filename(short_name, filename)
+
+            except Exception as err:
+                self.log_debug(f"    pid={os.getpid()}: caught exception on "
+                               f"obfuscating file {filename}: {err}")
+
+        return (self.files_obfuscated_count, self.total_sub_count,
+                self.removed_file_count)
+
     @classmethod
     def check_is_type(cls, arc_path):
         """Check if the archive is a well-known type we directly support"""
@@ -120,14 +271,18 @@ class SoSObfuscationArchive():
         """Helper to easily format ui messages on a per-report basis"""
         self.ui_log.info(f"{self.ui_name + ' :':<50} {msg}")
 
-    def _fmt_log_msg(self, msg):
-        return f"[cleaner:{self.archive_name}] {msg}"
+    def _fmt_log_msg(self, msg, caller=None):
+        return f"[cleaner{f':{caller}' if caller else ''}" \
+               f"[{self.archive_name}]] {msg}"
+
+    def log_debug(self, msg, caller=None):
+        self.soslog.debug(self._fmt_log_msg(msg, caller))
 
-    def log_debug(self, msg):
-        self.soslog.debug(self._fmt_log_msg(msg))
+    def log_info(self, msg, caller=None):
+        self.soslog.info(self._fmt_log_msg(msg, caller))
 
-    def log_info(self, msg):
-        self.soslog.info(self._fmt_log_msg(msg))
+    def log_error(self, msg, caller=None):
+        self.soslog.error(self._fmt_log_msg(msg, caller))
 
     def _load_skip_list(self):
         """Provide a list of files and file regexes to skip obfuscation on
@@ -150,6 +305,16 @@ class SoSObfuscationArchive():
         except Exception:
             return False
 
+    def certificate_to_text(self, fname):
+        """Convert a certificate to text. This is used when cleaner encounters
+        a certificate file and the option 'treat_certificates' is 'obfuscate'.
+        """
+        self.log_info(f"Converting certificate file '{fname}' to text")
+        sos_get_command_output(
+            f"openssl storeutl -noout -text -certs {str(fname)}",
+            to_file=f"{fname}.text")
+        os.remove(fname)
+
     def remove_file(self, fname):
         """Remove a file from the archive. This is used when cleaner encounters
         a binary file, which we cannot reliably obfuscate.
@@ -201,6 +366,7 @@ class SoSObfuscationArchive():
                 self.report_msg("Extracting...")
             self.extracted_path = self.extract_self()
             self.is_extracted = True
+            self.tarobj = None    # we can't pickle this & not further needed
         else:
             self.extracted_path = self.archive_path
         # if we're running as non-root (e.g. collector), then we can have a
@@ -326,7 +492,7 @@ class SoSObfuscationArchive():
                 if os.path.islink(_fname):
                     yield _fname
 
-    def get_file_list(self):
+    def get_files(self):
         """Iterator for a list of files in the archive, to allow clean to
         iterate over.
 
@@ -345,11 +511,11 @@ class SoSObfuscationArchive():
             dir_list.append(dirname)
         return dir_list
 
-    def update_sub_count(self, fname, count):
+    def update_sub_count(self, count):
         """Called when a file has finished being parsed and used to track
         total substitutions made and number of files that had changes made
         """
-        self.file_sub_list.append(fname)
+        self.files_obfuscated_count += 1
         self.total_sub_count += count
 
     def get_file_path(self, fname):
diff --git a/sos/cleaner/archives/sos.py b/sos/cleaner/archives/sos.py
index ace71d5..bf010ec 100644
--- a/sos/cleaner/archives/sos.py
+++ b/sos/cleaner/archives/sos.py
@@ -69,7 +69,9 @@ class SoSCollectorArchive(SoSObfuscationArchive):
         for fname in os.listdir(_path):
             arc_name = os.path.join(_path, fname)
             if 'sosreport-' in fname and tarfile.is_tarfile(arc_name):
-                archives.append(SoSReportArchive(arc_name, self.tmpdir))
+                archives.append(SoSReportArchive(arc_name, self.tmpdir,
+                                                 self.keep_binary_files,
+                                                 self.treat_certificates))
         return archives
 
 
diff --git a/sos/cleaner/mappings/__init__.py b/sos/cleaner/mappings/__init__.py
index b5009bb..2a04ff2 100644
--- a/sos/cleaner/mappings/__init__.py
+++ b/sos/cleaner/mappings/__init__.py
@@ -9,8 +9,9 @@
 # See the LICENSE file in the source distribution for further information.
 
 import re
-
-from threading import Lock
+import os
+import tempfile
+from pathlib import Path
 
 
 class SoSMap():
@@ -28,11 +29,33 @@ class SoSMap():
     ignore_short_items = False
     match_full_words_only = False
 
-    def __init__(self):
+    def __init__(self, workdir):
         self.dataset = {}
         self._regexes_made = set()
         self.compiled_regexes = []
-        self.lock = Lock()
+        self.cname = self.__class__.__name__.lower()
+        # workdir's default value '/tmp' is used just by avocado tests,
+        # otherwise we override it to /etc/sos/cleaner (or map_file dir)
+        self.workdir = workdir
+        self.cache_dir = os.path.join(self.workdir, 'cleaner_cache',
+                                      self.cname)
+        self.load_entries()
+
+    def load_entries(self):
+        """ Load cached entries from the disk. This method must be called when
+        we initialize a Map instance and whenever we want to retrieve
+        self.dataset (e.g. to store default_mapping file). The later is
+        essential since a concurrent Map can add more objects to the cache,
+        so we need to update self.dataset up to date.
+
+        Keep in mind that size of self.dataset is usually bigger than number
+        of files in the corresponding cleaner's directory: directory contains
+        just whole items (e.g. IP addresses) while dataset contains more
+        derived objects (e.g. subnets).
+        """
+
+        Path(self.cache_dir).mkdir(parents=True, exist_ok=True)
+        self.load_new_entries_from_dir(1)
 
     def ignore_item(self, item):
         """Some items need to be completely ignored, for example link-local or
@@ -46,6 +69,36 @@ class SoSMap():
                 return True
         return False
 
+    def add_sanitised_item_to_dataset(self, item):
+        try:
+            self.dataset[item] = self.sanitize_item(item)
+        except Exception:
+            self.dataset[item] = item
+        if self.compile_regexes:
+            self.add_regex_item(item)
+
+    def load_new_entries_from_dir(self, counter):
+        # this is a performance hack; there can be gaps in counter values as
+        # e.g. sanitised item #14 is an IP address (in file) while item #15
+        # is its network (in dataset but not in files). So the next file
+        # number is 16. The diffs should be at most 2, the above is so far
+        # the only type of "underneath dataset growth". But let be
+        # conservative and test next 5 numbers "only".
+        no_files_cnt = 5
+        while no_files_cnt > 0:
+            fname = os.path.join(self.cache_dir, f"{counter}")
+            while os.path.isfile(fname):
+                no_files_cnt = 5
+                with open(fname, 'r', encoding='utf-8') as f:
+                    item = f.read()
+                if not self.dataset.get(item, False):
+                    self.add_sanitised_item_to_dataset(item)
+                counter += 1
+                fname = os.path.join(self.cache_dir, f"{counter}")
+            # no next file, but try a new next ones until no_files_cnt==0
+            no_files_cnt -= 1
+            counter += 1
+
     def add(self, item):
         """Add a particular item to the map, generating an obfuscated pair
         for it.
@@ -56,11 +109,23 @@ class SoSMap():
         """
         if self.ignore_item(item):
             return item
-        with self.lock:
-            self.dataset[item] = self.sanitize_item(item)
-            if self.compile_regexes:
-                self.add_regex_item(item)
-            return self.dataset[item]
+
+        tmpfile = None
+        while not self.dataset.get(item, False):
+            if not tmpfile:
+                # pylint: disable=consider-using-with
+                tmpfile = tempfile.NamedTemporaryFile(dir=self.cache_dir)
+                with open(tmpfile.name, 'w', encoding='utf-8') as f:
+                    f.write(item)
+            try:
+                counter = len(self.dataset) + 1
+                os.link(tmpfile.name, os.path.join(self.cache_dir,
+                                                   f"{counter}"))
+                self.add_sanitised_item_to_dataset(item)
+            except FileExistsError:
+                self.load_new_entries_from_dir(counter)
+
+        return self.dataset[item]
 
     def add_regex_item(self, item):
         """Add an item to the regexes dict and then re-sort the list that the
diff --git a/sos/cleaner/mappings/ip_map.py b/sos/cleaner/mappings/ip_map.py
index be6230d..9c5376c 100644
--- a/sos/cleaner/mappings/ip_map.py
+++ b/sos/cleaner/mappings/ip_map.py
@@ -9,7 +9,6 @@
 # See the LICENSE file in the source distribution for further information.
 
 import ipaddress
-import random
 
 from sos.cleaner.mappings import SoSMap
 
@@ -45,6 +44,11 @@ class SoSIPMap(SoSMap):
     network_first_octet = 100
     skip_network_octets = ['127', '169', '172', '192']
     compile_regexes = False
+    # counter for obfuscating a single IP address; the value stands for
+    # 172.17.0.0; we use a private block of IP addresses and ignore
+    # 172.16.0.0/16 block as those addresses are more often used in real
+    # (an attempt to prevent confusion)
+    _saddr_cnt = 2886795264
 
     def ip_in_dataset(self, ipaddr):
         """There are multiple ways in which an ip address could be handed to us
@@ -162,13 +166,14 @@ class SoSIPMap(SoSMap):
         return self._new_obfuscated_single_address()
 
     def _new_obfuscated_single_address(self):
-        def _gen_address():
-            _octets = []
-            for _ in range(0, 4):
-                _octets.append(random.randint(11, 99))
-            return f"{_octets[0]}.{_octets[1]}.{_octets[2]}.{_octets[3]}"
-
-        _addr = _gen_address()
+        # increment the counter and ignore *.0 and *.255 addresses
+        self._saddr_cnt += 1
+        while self._saddr_cnt % 256 in (0, 255):
+            self._saddr_cnt += 1
+        # split the counter value to four octets (i.e. % 256) to get an
+        # obfuscated IP address
+        _addr = f"{self._saddr_cnt >> 24}.{(self._saddr_cnt >> 16) % 256}." \
+            f"{(self._saddr_cnt >> 8) % 256}.{self._saddr_cnt % 256}"
         if _addr in self.dataset.values():
             return self._new_obfuscated_single_address()
         return _addr
diff --git a/sos/cleaner/mappings/ipv6_map.py b/sos/cleaner/mappings/ipv6_map.py
index 10b1cbc..053c6df 100644
--- a/sos/cleaner/mappings/ipv6_map.py
+++ b/sos/cleaner/mappings/ipv6_map.py
@@ -10,39 +10,9 @@
 
 import ipaddress
 
-from random import getrandbits
 from sos.cleaner.mappings import SoSMap
 
 
-def generate_hextets(hextets):
-    """Generate a random set of hextets, based on the length of the source
-    hextet. If any hextets are compressed, keep that compression.
-
-    E.G. '::1234:bcd' will generate a leading empty '' hextet, followed by two
-    4-character hextets.
-
-    :param hextets:     The extracted hextets from a source address
-    :type hextets:      ``list``
-
-    :returns:           A set of randomized hextets for use in an obfuscated
-                        address
-    :rtype:             ``list``
-    """
-    return [random_hex(4) if h else '' for h in hextets]
-
-
-def random_hex(length):
-    """Generate a string of size length of random hex characters.
-
-    :param length:  The number of characters to generate
-    :type length:   ``int``
-
-    :returns:       A string of ``length`` hex characters
-    :rtype:         ``str``
-    """
-    return f"{getrandbits(4*length):0{length}x}"
-
-
 class SoSIPv6Map(SoSMap):
     """Mapping for IPv6 addresses and networks.
 
@@ -137,6 +107,9 @@ class ObfuscatedIPv6Network():
     an obfuscation string is not passed, one will be created during init.
     """
 
+    # dict of counters for obfuscated hexes generation
+    ob_counters = {}
+
     def __init__(self, addr, obfuscation='', used_hexes=None):
         """Basic setup for the obfuscated network. Minor validation on the addr
         used to create the instance, as well as on an optional ``obfuscation``
@@ -179,6 +152,37 @@ class ObfuscatedIPv6Network():
     def original_address(self):
         return self.addr.compressed
 
+    def generate_hextets(self, hextets):
+        """Generate a set of obfuscated hextets, based on the length of the
+        source hextet. If any hextets are compressed, keep that compression.
+
+        E.G. '::1234:bcd' will generate a leading empty '' hextet, followed by
+        two 4-character hextets, e.g. '::0005:0006'.
+
+        :param hextets:     The extracted hextets from a source address
+        :type hextets:      ``list``
+
+        :returns:           A set of generated hextets for use in an obfuscated
+                            address
+        :rtype:             ``list``
+        """
+        return [self.obfuscate_hex(4) if h else '' for h in hextets]
+
+    def obfuscate_hex(self, length):
+        """Generate a string of size length of hex characters. Due to the need
+        of deterministic generation in concurrent cleaner, generation starts
+        from zero values and is incremented by one (for a given length).
+
+        :param length:  The number of characters to generate
+        :type length:   ``int``
+
+        :returns:       A string of ``length`` hex characters
+        :rtype:         ``str``
+        """
+        val = self.ob_counters.get(length, 0) + 1
+        self.ob_counters[length] = val
+        return f"{val:0{length}x}"
+
     def _obfuscate_network_address(self):
         """Generate the obfuscated pair for the network address. This is
         determined based on the netmask of the network this class was built
@@ -202,7 +206,7 @@ class ObfuscatedIPv6Network():
         sos-specific identifier that could never be seen in the wild,
         '534f:'
 
-        We then randomize the subnet hextet.
+        We then obfuscate the subnet hextet.
         """
         _hextets = self.network_addr.split(':')[1:]
         _ob_hex = ['534f']
@@ -213,24 +217,25 @@ class ObfuscatedIPv6Network():
             # Set the leading bits to 53, but increment upwards from there for
             # when we exceed 256 networks obfuscated in this manner.
             _start = 53 + (len(self.first_hexes) // 256)
-            _ob_hex = f"{_start}{random_hex(2)}"
+            _ob_hex = f"{_start}{self.obfuscate_hex(2)}"
             while _ob_hex in self.first_hexes:
                 # prevent duplicates
-                _ob_hex = f"{_start}{random_hex(2)}"
+                _ob_hex = f"{_start}{self.obfuscate_hex(2)}"
             self.first_hexes.append(_ob_hex)
             _ob_hex = [_ob_hex]
-        _ob_hex.extend(generate_hextets(_hextets))
+        ext = self.generate_hextets(_hextets)
+        _ob_hex.extend(ext)
         return ':'.join(_ob_hex)
 
     def _obfuscate_private_address(self):
         """The first 8 bits will always be 'fd', the next 40 bits are meant
         to be a global ID, followed by 16 bits for the subnet. To keep things
         relatively simply we maintain the first hextet as 'fd53', and then
-        randomize any remaining hextets
+        obfuscate any remaining hextets.
         """
         _hextets = self.network_addr.split(':')[1:]
         _ob_hex = ['fd53']
-        _ob_hex.extend(generate_hextets(_hextets))
+        _ob_hex.extend(self.generate_hextets(_hextets))
         return ':'.join(_ob_hex)
 
     def obfuscate_host_address(self, addr):
@@ -259,7 +264,7 @@ class ObfuscatedIPv6Network():
         def _generate_address(host):
             return ''.join([
                 self._obfuscated_network,
-                ':'.join(generate_hextets(host.split(':')))
+                ':'.join(self.generate_hextets(host.split(':')))
             ])
 
         if addr.compressed not in self.hosts:
diff --git a/sos/cleaner/mappings/mac_map.py b/sos/cleaner/mappings/mac_map.py
index cf6744e..78403be 100644
--- a/sos/cleaner/mappings/mac_map.py
+++ b/sos/cleaner/mappings/mac_map.py
@@ -8,7 +8,6 @@
 #
 # See the LICENSE file in the source distribution for further information.
 
-import random
 import re
 
 from sos.cleaner.mappings import SoSMap
@@ -20,8 +19,9 @@ class SoSMacMap(SoSMap):
     MAC addresses added to this map will be broken into two halves, vendor and
     device like how MAC addresses are normally crafted. For the vendor hextets,
     obfuscation will take the form of 53:4f:53, or 'SOS' in hex. The following
-    device hextets will be randomized, for example a MAC address of
-    '60:55:cb:4b:c9:27' may be obfuscated into '53:4f:53:79:ac:29' or similar
+    device hextets will be obfuscated by a series of suffixes starting from
+    zeroes. For example a MAC address of '60:55:cb:4b:c9:27' may be obfuscated
+    into '53:4f:53:00:00:1a' or similar.
 
     This map supports both 48-bit and 64-bit MAC addresses.
 
@@ -49,6 +49,7 @@ class SoSMacMap(SoSMap):
     mac6_template = '53:4f:53:ff:fe:%s:%s:%s'
     mac6_quad_template = '534f:53ff:fe%s:%s%s'
     compile_regexes = False
+    ob_hextets_cnt = 0
 
     def add(self, item):
         item = item.replace('-', ':').lower().strip('=.,').strip()
@@ -59,15 +60,20 @@ class SoSMacMap(SoSMap):
         return super().get(item)
 
     def sanitize_item(self, item):
-        """Randomize the device hextets, and append those to our 'vendor'
+        """Obfuscate the device hextets, and append those to our 'vendor'
         hextet
         """
         hexdigits = "0123456789abdcef"
-        hextets = []
-        for _ in range(0, 3):
-            hextets.append(''.join(random.choice(hexdigits) for x in range(2)))
+        self.ob_hextets_cnt += 1
+        # we need to convert the counter to a triple of double hex-digits
+        hextets = [
+            self.ob_hextets_cnt >> 16,
+            (self.ob_hextets_cnt >> 8) % 256,
+            self.ob_hextets_cnt % 256
+        ]
+        hextets = tuple(f'{hexdigits[i//16]}{hexdigits[i % 16]}'
+                        for i in hextets)
 
-        hextets = tuple(hextets)
         # match 64-bit IPv6 MAC addresses matching MM:MM:MM:FF:FE:SS:SS:SS
         if re.match('(([0-9a-fA-F]{2}:){7}[0-9a-fA-F]{2})', item):
             return self.mac6_template % hextets
diff --git a/sos/cleaner/parsers/__init__.py b/sos/cleaner/parsers/__init__.py
index e422f32..9ca22af 100644
--- a/sos/cleaner/parsers/__init__.py
+++ b/sos/cleaner/parsers/__init__.py
@@ -55,6 +55,9 @@ class SoSCleanerParser():
         self.skip_cleaning_files = skip_cleaning_files
         self._generate_skip_regexes()
 
+    def load_map_entries(self):
+        self.mapping.load_entries()
+
     def _generate_skip_regexes(self):
         """Generate the regexes for the parser's configured parser_skip_files
         or global skip_cleaning_files, so that we don't regenerate them on
diff --git a/sos/cleaner/parsers/hostname_parser.py b/sos/cleaner/parsers/hostname_parser.py
index 2828732..357e345 100644
--- a/sos/cleaner/parsers/hostname_parser.py
+++ b/sos/cleaner/parsers/hostname_parser.py
@@ -21,8 +21,8 @@ class SoSHostnameParser(SoSCleanerParser):
         r'(((\b|_)[a-zA-Z0-9-\.]{1,200}\.[a-zA-Z]{1,63}(\b|_)))'
     ]
 
-    def __init__(self, config, skip_cleaning_files=[]):
-        self.mapping = SoSHostnameMap()
+    def __init__(self, config, workdir, skip_cleaning_files=[]):
+        self.mapping = SoSHostnameMap(workdir)
         super().__init__(config, skip_cleaning_files)
 
     def parse_line(self, line):
diff --git a/sos/cleaner/parsers/ip_parser.py b/sos/cleaner/parsers/ip_parser.py
index 0545175..b0925c8 100644
--- a/sos/cleaner/parsers/ip_parser.py
+++ b/sos/cleaner/parsers/ip_parser.py
@@ -45,6 +45,6 @@ class SoSIPParser(SoSCleanerParser):
     map_file_key = 'ip_map'
     compile_regexes = False
 
-    def __init__(self, config, skip_cleaning_files=[]):
-        self.mapping = SoSIPMap()
+    def __init__(self, config, workdir, skip_cleaning_files=[]):
+        self.mapping = SoSIPMap(workdir)
         super().__init__(config, skip_cleaning_files)
diff --git a/sos/cleaner/parsers/ipv6_parser.py b/sos/cleaner/parsers/ipv6_parser.py
index c8d37db..315241f 100644
--- a/sos/cleaner/parsers/ipv6_parser.py
+++ b/sos/cleaner/parsers/ipv6_parser.py
@@ -27,7 +27,7 @@ class SoSIPv6Parser(SoSCleanerParser):
         # a trailing prefix for the network bits.
         r"(?<![:\\.\\-a-z0-9])((([0-9a-f]{1,4})(:[0-9a-f]{1,4}){7})|"
         r"(([0-9a-f]{1,4}(:[0-9a-f]{0,4}){0,5}))([^.])::(([0-9a-f]{1,4}"
-        r"(:[0-9a-f]{1,4}){0,5})?))(/\d{1,3})?(?![:\\a-z0-9])"
+        r"(:[0-9a-f]{1,4}){0,5})?)(\/\d{1,3})?)(?!([a-z0-9]|:[a-z0-9]))"
     ]
     parser_skip_files = [
         'etc/dnsmasq.conf.*',
@@ -35,8 +35,8 @@ class SoSIPv6Parser(SoSCleanerParser):
     ]
     compile_regexes = False
 
-    def __init__(self, config, skip_cleaning_files=[]):
-        self.mapping = SoSIPv6Map()
+    def __init__(self, config, workdir, skip_cleaning_files=[]):
+        self.mapping = SoSIPv6Map(workdir)
         super().__init__(config, skip_cleaning_files)
 
     def get_map_contents(self):
diff --git a/sos/cleaner/parsers/keyword_parser.py b/sos/cleaner/parsers/keyword_parser.py
index 685fb47..f9dc6e3 100644
--- a/sos/cleaner/parsers/keyword_parser.py
+++ b/sos/cleaner/parsers/keyword_parser.py
@@ -20,8 +20,8 @@ class SoSKeywordParser(SoSCleanerParser):
     name = 'Keyword Parser'
     map_file_key = 'keyword_map'
 
-    def __init__(self, config, skip_cleaning_files=[]):
-        self.mapping = SoSKeywordMap()
+    def __init__(self, config, workdir, skip_cleaning_files=[]):
+        self.mapping = SoSKeywordMap(workdir)
         super().__init__(config, skip_cleaning_files)
 
     def _parse_line(self, line):
diff --git a/sos/cleaner/parsers/mac_parser.py b/sos/cleaner/parsers/mac_parser.py
index 35882eb..2068693 100644
--- a/sos/cleaner/parsers/mac_parser.py
+++ b/sos/cleaner/parsers/mac_parser.py
@@ -53,8 +53,8 @@ class SoSMacParser(SoSCleanerParser):
     map_file_key = 'mac_map'
     compile_regexes = False
 
-    def __init__(self, config, skip_cleaning_files=[]):
-        self.mapping = SoSMacMap()
+    def __init__(self, config, workdir, skip_cleaning_files=[]):
+        self.mapping = SoSMacMap(workdir)
         super().__init__(config, skip_cleaning_files)
 
     def reduce_mac_match(self, match):
diff --git a/sos/cleaner/parsers/username_parser.py b/sos/cleaner/parsers/username_parser.py
index 7af19ce..664b562 100644
--- a/sos/cleaner/parsers/username_parser.py
+++ b/sos/cleaner/parsers/username_parser.py
@@ -26,8 +26,8 @@ class SoSUsernameParser(SoSCleanerParser):
     map_file_key = 'username_map'
     regex_patterns = []
 
-    def __init__(self, config, skip_cleaning_files=[]):
-        self.mapping = SoSUsernameMap()
+    def __init__(self, config, workdir, skip_cleaning_files=[]):
+        self.mapping = SoSUsernameMap(workdir)
         super().__init__(config, skip_cleaning_files)
 
     def _parse_line(self, line):
diff --git a/sos/collector/__init__.py b/sos/collector/__init__.py
index 87a36a5..87149ce 100644
--- a/sos/collector/__init__.py
+++ b/sos/collector/__init__.py
@@ -130,6 +130,7 @@ class SoSCollector(SoSComponent):
         'ssh_user': 'root',
         'timeout': 600,
         'transport': 'auto',
+        'treat_certificates': 'obfuscate',
         'verify': False,
         'usernames': [],
         'upload': False,
@@ -516,6 +517,15 @@ class SoSCollector(SoSComponent):
         cleaner_grp.add_argument('--usernames', dest='usernames', default=[],
                                  action='extend',
                                  help='List of usernames to obfuscate')
+        cleaner_grp.add_argument('--treat-certificates', default='obfuscate',
+                                 choices=['obfuscate', 'keep', 'remove'],
+                                 dest='treat_certificates',
+                                 help=(
+                                    'How to treat the certificate files '
+                                    '[.csr .crt .pem]. Defaults to "obfuscate"'
+                                    ' after convert the file to text. '
+                                    '"Key" certificate files are always '
+                                    'removed.'))
 
     @classmethod
     def display_help(cls, section):
@@ -1405,19 +1415,16 @@ this utility or remote systems that it connects to.
             if do_clean:
                 _dir = os.path.join(self.tmpdir, self.archive._name)
                 cleaner.obfuscate_file(
-                    os.path.join(_dir, 'sos_logs', 'sos.log'),
-                    short_name='sos.log'
+                        os.path.join(_dir, 'sos_logs', 'sos.log')
                 )
                 cleaner.obfuscate_file(
-                    os.path.join(_dir, 'sos_logs', 'ui.log'),
-                    short_name='ui.log'
+                    os.path.join(_dir, 'sos_logs', 'ui.log')
                 )
                 cleaner.obfuscate_file(
-                    os.path.join(_dir, 'sos_reports', 'manifest.json'),
-                    short_name='manifest.json'
+                    os.path.join(_dir, 'sos_reports', 'manifest.json')
                 )
 
-            arc_name = self.archive.finalize(self.opts.compression_type)
+            arc_name = self.archive.finalize(method=None)
             final_name = os.path.join(self.sys_tmp, os.path.basename(arc_name))
             if do_clean:
                 final_name = cleaner.obfuscate_string(
diff --git a/sos/collector/clusters/ocp.py b/sos/collector/clusters/ocp.py
index 265c1e4..a293323 100644
--- a/sos/collector/clusters/ocp.py
+++ b/sos/collector/clusters/ocp.py
@@ -79,7 +79,7 @@ class ocp(Cluster):
             self._oc_cmd = 'oc'
             if self.primary.host.in_container():
                 _oc_path = self.primary.run_command(
-                    'which oc', chroot=self.primary.host.sysroot
+                    'which oc'
                 )
                 if _oc_path['status'] == 0:
                     self._oc_cmd = os.path.join(
diff --git a/sos/component.py b/sos/component.py
index d0660cf..0056067 100644
--- a/sos/component.py
+++ b/sos/component.py
@@ -168,10 +168,7 @@ class SoSComponent():
         if self.opts.tmp_dir:
             tmpdir = os.path.abspath(self.opts.tmp_dir)
         else:
-            tmpdir = os.getenv('TMPDIR', None) or '/var/tmp'
-
-        if os.getenv('HOST', None) and os.getenv('container', None):
-            tmpdir = os.path.join(os.getenv('HOST'), tmpdir.lstrip('/'))
+            tmpdir = os.getenv('TMPDIR', None) or self.policy.get_tmp_dir(None)
 
         # no standard library method exists for this, so call out to stat to
         # avoid bringing in a dependency on psutil
@@ -303,7 +300,7 @@ class SoSComponent():
             if not self.preset:
                 self.preset = self.policy.probe_preset()
             # now merge preset options to opts
-            opts.merge(self.preset.opts)
+            opts.merge(self.preset.opts, prefer_new=True)
             # re-apply any cmdline overrides to the preset
             opts = self.apply_options_from_cmdline(opts)
 
diff --git a/sos/options.py b/sos/options.py
index ec80d9a..26354b5 100644
--- a/sos/options.py
+++ b/sos/options.py
@@ -28,7 +28,7 @@ def str_to_bool(val):
 
 class SoSOptions():
 
-    def _merge_opt(self, opt, src, is_default):
+    def _merge_opt(self, opt, src, is_default, prefer_new):
         def _unset(val):
             return (val == "" or val is None)
 
@@ -39,9 +39,11 @@ class SoSOptions():
             # - we replace unset option by a real value
             # - new default is set, or
             # - non-sequential variable keeps its default value
+            # pylint: disable=too-many-boolean-expressions
             if (_unset(oldvalue) and not _unset(newvalue)) or \
                is_default or \
-               ((opt not in self._nondefault) and (not _is_seq(newvalue))):
+               ((opt not in self._nondefault) and (not _is_seq(newvalue))) or \
+               prefer_new:
                 # Overwrite atomic values
                 setattr(self, opt, newvalue)
                 if is_default:
@@ -52,11 +54,11 @@ class SoSOptions():
                 # Concatenate sequence types
                 setattr(self, opt, newvalue + oldvalue)
 
-    def _merge_opts(self, src, is_default):
+    def _merge_opts(self, src, is_default, prefer_new):
         if not isinstance(src, dict):
             src = vars(src)
         for arg in self.arg_names:
-            self._merge_opt(arg, src, is_default)
+            self._merge_opt(arg, src, is_default, prefer_new)
 
     def __str(self, quote=False, sep=" ", prefix="", suffix=""):
         """Format a SoSOptions object as a human or machine readable string.
@@ -124,7 +126,7 @@ class SoSOptions():
             :returntype: SoSOptions
         """
         opts = SoSOptions(**vars(args), arg_defaults=arg_defaults)
-        opts._merge_opts(args, True)
+        opts._merge_opts(args, True, False)
         return opts
 
     @classmethod
@@ -233,7 +235,7 @@ class SoSOptions():
                 if not key.split('.')[0] in self.skip_plugins:
                     self.plugopts.append(key + '=' + val)
 
-    def merge(self, src, skip_default=True):
+    def merge(self, src, skip_default=True, prefer_new=False):
         """Merge another set of ``SoSOptions`` into this object.
 
             Merge two ``SoSOptions`` objects by setting unset or default
@@ -241,12 +243,13 @@ class SoSOptions():
 
             :param src: the ``SoSOptions`` object to copy from
             :param is_default: ``True`` if new default values are to be set.
+            :param prefer_new: ``False`` if new default is not preferred.
         """
         for arg in self.arg_names:
             if not hasattr(src, arg):
                 continue
             if getattr(src, arg) is not None or not skip_default:
-                self._merge_opt(arg, src, False)
+                self._merge_opt(arg, src, False, prefer_new=prefer_new)
 
     def dict(self, preset_filter=True):
         """Return this ``SoSOptions`` option values as a dictionary of
diff --git a/sos/policies/distros/debian.py b/sos/policies/distros/debian.py
index 0d90603..6f3cbc5 100644
--- a/sos/policies/distros/debian.py
+++ b/sos/policies/distros/debian.py
@@ -16,7 +16,7 @@ class DebianPolicy(LinuxPolicy):
     vendor_urls = [('Community Website', 'https://www.debian.org/')]
     os_release_name = 'Debian'
     os_release_file = '/etc/debian_version'
-    _tmp_dir = "/tmp"
+    _tmp_dir = "/var/tmp"
     name_pattern = 'friendly'
     valid_subclasses = [DebianPlugin]
     PATH = "/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games" \
diff --git a/sos/report/__init__.py b/sos/report/__init__.py
index 074afcf..e50de8e 100644
--- a/sos/report/__init__.py
+++ b/sos/report/__init__.py
@@ -149,7 +149,8 @@ class SoSReport(SoSComponent):
         'upload_s3_object_prefix': None,
         'upload_target': None,
         'add_preset': '',
-        'del_preset': ''
+        'del_preset': '',
+        'treat_certificates': 'obfuscate'
     }
 
     def __init__(self, parser, args, cmdline):
@@ -396,6 +397,15 @@ class SoSReport(SoSComponent):
         cleaner_grp.add_argument('--usernames', dest='usernames', default=[],
                                  action='extend',
                                  help='List of usernames to obfuscate')
+        cleaner_grp.add_argument('--treat-certificates', default='obfuscate',
+                                 choices=['obfuscate', 'keep', 'remove'],
+                                 dest='treat_certificates',
+                                 help=(
+                                    'How to treat the certificate files '
+                                    '[.csr .crt .pem]. Defaults to "obfuscate"'
+                                    ' after convert the file to text. '
+                                    ' "Key" certificate files are always '
+                                    'removed.'))
 
     @classmethod
     def display_help(cls, section):
@@ -1571,13 +1581,10 @@ class SoSReport(SoSComponent):
         # Now, separately clean the log files that cleaner also wrote to
         if do_clean:
             _dir = os.path.join(self.tmpdir, self.archive._name)
-            cleaner.obfuscate_file(os.path.join(_dir, 'sos_logs', 'sos.log'),
-                                   short_name='sos.log')
-            cleaner.obfuscate_file(os.path.join(_dir, 'sos_logs', 'ui.log'),
-                                   short_name='ui.log')
+            cleaner.obfuscate_file(os.path.join(_dir, 'sos_logs', 'sos.log'))
+            cleaner.obfuscate_file(os.path.join(_dir, 'sos_logs', 'ui.log'))
             cleaner.obfuscate_file(
-                os.path.join(_dir, 'sos_reports', 'manifest.json'),
-                short_name='manifest.json'
+                    os.path.join(_dir, 'sos_reports', 'manifest.json')
             )
 
         # Now, just (optionally) pack the report and print work outcome; let
diff --git a/sos/report/plugins/__init__.py b/sos/report/plugins/__init__.py
index 459c016..e1d90d9 100644
--- a/sos/report/plugins/__init__.py
+++ b/sos/report/plugins/__init__.py
@@ -532,6 +532,7 @@ class Plugin():
     kernel_mods = ()
     services = ()
     containers = ()
+    runtime = None
     architectures = None
     archive = None
     profiles = ()
@@ -1669,7 +1670,8 @@ class Plugin():
                 self.manifest.files.append(manifest_data)
 
     def add_copy_spec(self, copyspecs, sizelimit=None, maxage=None,
-                      tailit=True, pred=None, tags=[], container=None):
+                      tailit=True, pred=None, tags=[], container=None,
+                      runas=None):
         """Add a file, directory, or globs matching filepaths to the archive
 
         :param copyspecs: Files, directories, or globs matching filepaths
@@ -1697,6 +1699,10 @@ class Plugin():
         :param container: Container(s) from which this file should be copied
         :type container: ``str`` or a ``list`` of strings
 
+        :param runas: When collecting data from a container, run it under this
+                      user.
+        :type runas: ``str``
+
         `copyspecs` will be expanded and/or globbed as appropriate. Specifying
         a directory here will cause the plugin to attempt to collect the entire
         directory, recursively.
@@ -1806,14 +1812,14 @@ class Plugin():
                 if isinstance(container, str):
                     container = [container]
                 for con in container:
-                    if not self.container_exists(con):
+                    if not self.container_exists(con) and runas is None:
                         continue
                     _tail = False
                     if sizelimit:
                         # to get just the size, stat requires a literal '%s'
                         # which conflicts with python string formatting
                         cmd = f"stat -c %s {copyspec}"
-                        ret = self.exec_cmd(cmd, container=con)
+                        ret = self.exec_cmd(cmd, container=con, runas=runas)
                         if ret['status'] == 0:
                             try:
                                 consize = int(ret['output'])
@@ -1833,7 +1839,7 @@ class Plugin():
                                 f"{ret['output']}")
                             continue
                     self.container_copy_paths.append(
-                        (con, copyspec, sizelimit, _tail, _spec_tags)
+                        (con, copyspec, sizelimit, _tail, _spec_tags, runas)
                     )
                     self._log_info(
                         f"added collection of '{copyspec}' from container "
@@ -2059,7 +2065,7 @@ class Plugin():
     def add_dir_listing(self, paths, tree=False, recursive=False, chroot=True,
                         env=None, sizelimit=None, pred=None, subdir=None,
                         tags=[], runas=None, container=None,
-                        suggest_filename=None):
+                        suggest_filename=None, extra_opts=None):
         """
         Used as a way to standardize our collections of directory listings,
         either as an output of `ls` or `tree` depending on if the `tree`
@@ -2082,12 +2088,14 @@ class Plugin():
 
         if container:
             paths = [p for p in paths if
-                     self.container_path_exists(p, container=container)]
+                     self.container_path_exists(p, container=container,
+                                                runas=runas)]
         else:
             paths = [p for p in paths if self.path_exists(p)]
 
         if not tree:
-            options = f"alZ{'R' if recursive else ''}"
+            options = (f"alZ{'R' if recursive else ''}"
+                       f"{extra_opts if extra_opts else ''}")
         else:
             options = 'lp'
 
@@ -2105,7 +2113,8 @@ class Plugin():
                        sizelimit=None, pred=None, subdir=None,
                        changes=False, foreground=False, tags=[],
                        priority=10, cmd_as_tag=False, container=None,
-                       to_file=False, runas=None, snap_cmd=False):
+                       to_file=False, runas=None, snap_cmd=False,
+                       runtime=None):
         """Run a program or a list of programs and collect the output
 
         Output will be limited to `sizelimit`, collecting the last X amount
@@ -2184,6 +2193,9 @@ class Plugin():
 
         :param snap_cmd: Are the commands being run from a snap?
         :type snap_cmd: ``bool``
+
+        :param runtime: Specific runtime to use to run container cmd
+        :type runtime: ``str``
         """
         if isinstance(cmds, str):
             cmds = [cmds]
@@ -2198,7 +2210,8 @@ class Plugin():
             if container:
                 ocmd = cmd
                 container_cmd = (ocmd, container)
-                cmd = self.fmt_container_cmd(container, cmd)
+                cmd = self.fmt_container_cmd(container, cmd, runtime=runtime,
+                                             runas=runas)
                 if not cmd:
                     self._log_debug(f"Skipping command '{ocmd}' as the "
                                     f"requested container '{container}' does "
@@ -2547,7 +2560,8 @@ class Plugin():
             self.manifest.commands.append(manifest_cmd)
             if container_cmd:
                 self._add_container_cmd_to_manifest(manifest_cmd.copy(),
-                                                    container_cmd)
+                                                    container_cmd,
+                                                    suggest_filename)
         return result
 
     def collect_cmd_output(self, cmd, suggest_filename=None,
@@ -2629,7 +2643,7 @@ class Plugin():
     def exec_cmd(self, cmd, timeout=None, stderr=True, chroot=True,
                  runat=None, env=None, binary=False, pred=None,
                  foreground=False, container=False, quotecmd=False,
-                 runas=None):
+                 runas=None, runtime=None):
         """Execute a command right now and return the output and status, but
         do not save the output within the archive.
 
@@ -2674,6 +2688,10 @@ class Plugin():
         :param runas:               Run the `cmd` as the `runas` user
         :type runas: ``str``
 
+        :param runtime:             Specific runtime to use to execute the
+                                    container command
+        :type runtime: ``str``
+
         :returns:                   Command exit status and output
         :rtype: ``dict``
         """
@@ -2696,8 +2714,9 @@ class Plugin():
                 self._log_info(f"Cannot run cmd '{cmd}' in container "
                                f"{container}: no runtime detected on host.")
                 return _default
-            if self.container_exists(container):
-                cmd = self.fmt_container_cmd(container, cmd, quotecmd)
+            if self.container_exists(container, runtime) or runas is not None:
+                cmd = self.fmt_container_cmd(container, cmd, quotecmd,
+                                             runtime, runas)
             else:
                 self._log_info(f"Cannot run cmd '{cmd}' in container "
                                f"{container}: no such container is running.")
@@ -2731,7 +2750,7 @@ class Plugin():
             'tags': tags
         })
 
-    def _add_container_cmd_to_manifest(self, manifest, contup):
+    def _add_container_cmd_to_manifest(self, manifest, contup, suggest_fname):
         """Adds a command collection to the manifest for a particular container
         and creates a symlink to that collection from the relevant
         sos_containers/ location
@@ -2752,7 +2771,7 @@ class Plugin():
 
         _cdir = f"sos_containers/{container}/sos_commands/{self.name()}"
         _outloc = f"../../../../{manifest['filepath']}"
-        cmdfn = self._mangle_command(cmd)
+        cmdfn = suggest_fname if suggest_fname else self._mangle_command(cmd)
         conlnk = f"{_cdir}/{cmdfn}"
 
         # If check_path return None, it means that the sym link already exits,
@@ -2777,17 +2796,20 @@ class Plugin():
                     return self.policy.runtimes[pol_runtime]
         return None
 
-    def container_exists(self, name):
+    def container_exists(self, name, runtime=None):
         """If a container runtime is present, check to see if a container with
         a given name is currently running
 
         :param name:    The name or ID of the container to check presence of
         :type name: ``str``
 
+        :param runtime:    The runtime to use
+        :type runtime: ``str``
+
         :returns: ``True`` if `name` exists, else ``False``
         :rtype: ``bool``
         """
-        _runtime = self._get_container_runtime()
+        _runtime = self._get_container_runtime(runtime or self.runtime)
         if _runtime is not None:
             return (_runtime.container_exists(name) or
                     _runtime.get_container_by_name(name) is not None)
@@ -2811,16 +2833,19 @@ class Plugin():
             return [c for c in _containers if re.match(regex, c[1])]
         return []
 
-    def get_container_by_name(self, name):
+    def get_container_by_name(self, name, runtime=None):
         """Get the container ID for a specific container
 
         :param name:    The name of the container
         :type name: ``str``
 
+        :param runtime: The runtime to use
+        :type runtime: ``str``
+
         :returns: The ID of the container if it exists
         :rtype: ``str`` or ``None``
         """
-        _runtime = self._get_container_runtime()
+        _runtime = self._get_container_runtime(runtime)
         if _runtime is not None:
             return _runtime.get_container_by_name(name)
         return None
@@ -2914,7 +2939,8 @@ class Plugin():
                     cmd = _runtime.get_logs_command(_con[1])
                     self.add_cmd_output(cmd, **kwargs)
 
-    def fmt_container_cmd(self, container, cmd, quotecmd=False):
+    def fmt_container_cmd(self, container, cmd, quotecmd=False, runtime=None,
+                          runas=None):
         """Format a command to be executed by the loaded ``ContainerRuntime``
         in a specified container
 
@@ -2927,12 +2953,21 @@ class Plugin():
         :param quotecmd:    Whether the cmd should be quoted.
         :type quotecmd: ``bool``
 
+        :param runtime:     The specific runtime to use to run the command
+                            within the container
+        :type runtime: ``str``
+
+        :param runas:       What user runs the container. If set, we trust
+                            the container really runs (we dont keep them atm)
+        :type runas: ``str``
+
         :returns: The command to execute so that the specified `cmd` will run
                   within the `container` and not on the host
         :rtype: ``str``
         """
-        if self.container_exists(container):
-            _runtime = self._get_container_runtime()
+        if self.container_exists(container, runtime) or \
+           ((_runtime := self._get_container_runtime(runtime)) and
+           runas is not None):
             return _runtime.fmt_container_cmd(container, cmd, quotecmd)
         return ''
 
@@ -3171,7 +3206,7 @@ class Plugin():
                            "files from containers. Skipping collections.")
             return
         for contup in self.container_copy_paths:
-            con, path, sizelimit, tailit, tags = contup
+            con, path, sizelimit, tailit, tags, runas = contup
             self._log_info(f"collecting '{path}' from container '{con}'")
 
             arcdest = f"sos_containers/{con}/{path.lstrip('/')}"
@@ -3180,15 +3215,21 @@ class Plugin():
 
             cpcmd = rt.get_copy_command(
                 con, path, dest, sizelimit=sizelimit if tailit else None
-            )
-            cpret = self.exec_cmd(cpcmd, timeout=10)
+            ) if runas is None else rt.fmt_container_cmd(con, f"cat {path}",
+                                                         False)
+            cpret = self.exec_cmd(cpcmd, timeout=10, runas=runas)
 
             if cpret['status'] == 0:
-                if tailit:
+                if tailit or runas is not None:
                     # current runtimes convert files sent to stdout to tar
                     # archives, with no way to control that
                     self.archive.add_string(cpret['output'], arcdest)
                 self._add_container_file_to_manifest(con, path, arcdest, tags)
+                self.copied_files.append({
+                    'srcpath': path,
+                    'dstpath': arcdest,
+                    'symlink': "no"
+                })
             else:
                 self._log_info(f"error copying '{path}' from container "
                                f"'{con}': {cpret['output']}")
@@ -3427,7 +3468,7 @@ class Plugin():
         if verify_cmd:
             self.add_cmd_output(verify_cmd)
 
-    def container_path_exists(self, path, container):
+    def container_path_exists(self, path, container, runas=None):
         """Check if a path exists inside a container before
         collecting a dir listing
 
@@ -3441,7 +3482,8 @@ class Plugin():
         :returns:       True if the path exists in the container, else False
         :rtype:         ``bool``
         """
-        return self.exec_cmd(f"test -e {path}", container=container)
+        return self.exec_cmd(f"test -e {path}", container=container,
+                             runas=runas)
 
     def path_exists(self, path):
         """Helper to call the sos.utilities wrapper that allows the
diff --git a/sos/report/plugins/aap_containerized.py b/sos/report/plugins/aap_containerized.py
index c33b209..7baa5fb 100644
--- a/sos/report/plugins/aap_containerized.py
+++ b/sos/report/plugins/aap_containerized.py
@@ -42,9 +42,23 @@ class AAPContainerized(Plugin, RedHatPlugin):
         # Check if username is passed as argument
         username = self.get_option("username")
         if not username:
-            self._log_error("Username is mandatory to collect "
-                            "AAP containerized setup logs")
-            return
+            self._log_warn("AAP username is missing, use '-k "
+                           "aap_containerized.username=<user>' to set it")
+            ps = self.exec_cmd("ps aux")
+            if ps["status"] == 0:
+                podman_users = set()
+                for line in ps["output"].splitlines():
+                    if ("/usr/bin/podman" in line) and \
+                       ("/.local/share/containers/storage/" in line):
+                        user, _ = line.split(maxsplit=1)
+                        podman_users.add(user)
+                if len(podman_users) == 1:
+                    username = podman_users.pop()
+                    self._log_warn(f"AAP username detected as '{username}'")
+                else:
+                    self._log_error("Unable to determine AAP username, "
+                                    "terminating plugin.")
+                    return
 
         # Grab aap installation directory under user's home
         if not self.get_option("directory"):
@@ -97,16 +111,63 @@ class AAPContainerized(Plugin, RedHatPlugin):
         # Collect AAP container names
         aap_containers = self._get_aap_container_names(username)
 
-        # Copy podman container log files in plugin sub directory
-        # under aap_containers_log
+        # Copy podman container log and inspect files
+        # into their respective sub directories
         for container in aap_containers:
-            log_file = f"{container}.log"
             self.add_cmd_output(
                     f"su - {username} -c 'podman logs {container}'",
-                    suggest_filename=f"{log_file}",
-                    subdir="aap_containers_log"
+                    suggest_filename=f"{container}.log",
+                    subdir="aap_container_logs"
+            )
+            self.add_cmd_output(
+                    f"su - {username} -c 'podman inspect {container}'",
+                    suggest_filename=container,
+                    subdir="podman_inspect_logs"
             )
 
+        # command outputs from various containers
+        # the su command is needed because mimicking it via runas leads to
+        # stuck command execution
+        pod_cmds = {
+            "automation-controller-task": [
+                "awx-manage check_license --data",
+                "awx-manage list_instances",
+            ],
+            "automation-gateway": [
+                "automation-gateway-service status",
+                "aap-gateway-manage print_settings",
+                "aap-gateway-manage authenticators",
+                "aap-gateway-manage showmigrations",
+                "aap-gateway-manage list_services",
+                "aap-gateway-manage feature_flags --list",
+                "aap-gateway-manage --version",
+            ],
+            "automation-controller-web": [
+                "awx-manage showmigrations",
+                "awx-manage list_instances",
+                "awx-manage run_dispatcher --status",
+                "awx-manage run_callback_receiver --status",
+                "awx-manage check_license --data",
+                "awx-manage run_wsrelay --status",
+            ],
+            "automation-eda-api": [
+                "aap-eda-manage --version",
+                "aap-eda-manage showmigrations",
+            ],
+            "receptor": [
+                "receptorctl status",
+                "receptorclt work list",
+            ],
+        }
+        for pod, cmds in pod_cmds.items():
+            if pod in aap_containers:
+                for cmd in cmds:
+                    fname = self._mangle_command(cmd)
+                    self.add_cmd_output(f"su - {username} -c 'podman exec -it"
+                                        f"  {pod} bash -c \"{cmd}\"'",
+                                        suggest_filename=fname,
+                                        subdir=pod)
+
     # Function to fetch podman container names
     def _get_aap_container_names(self, username):
         try:
@@ -126,8 +187,8 @@ class AAPContainerized(Plugin, RedHatPlugin):
                 'dumb-init -- /usr/bin/supervisord',
                 'dumb-init -- /usr/bin/launch_awx_web.sh',
                 'dumb-init -- /usr/bin/launch_awx_task.sh',
-                'pulpcore-content --name pulp-content --bind',
                 'dumb-init -- aap-eda-manage',
+                'pulpcore-content --name pulp-content --bind 127.0.0.1',
             ]
 
         ps_output = self.exec_cmd("ps --noheaders -eo args")
@@ -137,3 +198,20 @@ class AAPContainerized(Plugin, RedHatPlugin):
                 if process in ps_output['output']:
                     return True
         return False
+
+    def postproc(self):
+        # Mask PASSWORD from print_settings command
+        jreg = r'((["\']?PASSWORD["\']?\s*[:=]\s*)[rb]?["\'])(.*?)(["\'])'
+        self.do_cmd_output_sub(
+            "aap-gateway-manage print_settings",
+            jreg,
+            r'\1**********\4')
+
+        # Mask SECRET_KEY from print_settings command
+        jreg = r'((SECRET_KEY\s*=\s*)([rb]?["\']))(.*?)(["\'])'
+        self.do_cmd_output_sub(
+            "aap-gateway-manage print_settings",
+            jreg,
+            r'\1**********\5')
+
+# vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/aap_controller.py b/sos/report/plugins/aap_controller.py
index 62a52a3..afb2508 100644
--- a/sos/report/plugins/aap_controller.py
+++ b/sos/report/plugins/aap_controller.py
@@ -10,6 +10,7 @@
 # See the LICENSE file in the source distribution for further information.
 
 from sos.report.plugins import Plugin, RedHatPlugin
+from sos.utilities import sos_parse_version
 
 
 class AAPControllerPlugin(Plugin, RedHatPlugin):
@@ -22,7 +23,6 @@ class AAPControllerPlugin(Plugin, RedHatPlugin):
                 'automation-controller-ui',
                 'automation-controller')
     commands = ('awx-manage',)
-    services = ('automation-controller',)
 
     def setup(self):
         self.add_copy_spec([
@@ -44,13 +44,12 @@ class AAPControllerPlugin(Plugin, RedHatPlugin):
         ])
 
         self.add_cmd_output([
-            "awx-manage --version",
+            "automation-controller-service status",
+            "awx-manage showmigrations",
             "awx-manage list_instances",
             "awx-manage run_dispatcher --status",
             "awx-manage run_callback_receiver --status",
             "awx-manage check_license --data",
-            "awx-manage run_wsbroadcast --status",
-            "awx-manage run_wsrelay --status",
             "supervisorctl status",
             "/var/lib/awx/venv/awx/bin/pip freeze",
             "/var/lib/awx/venv/awx/bin/pip freeze -l",
@@ -59,6 +58,17 @@ class AAPControllerPlugin(Plugin, RedHatPlugin):
             "umask -p",
         ])
 
+        # run_wsbroadcast is replaced with run_wsrelay in AAP 2.4 and above
+        awx_version = self.collect_cmd_output('awx-manage --version')
+        if awx_version['status'] == 0:
+            if (
+                sos_parse_version(awx_version['output'].strip()) >
+                sos_parse_version('4.4.99')
+            ):
+                self.add_cmd_output("awx-manage run_wsrelay --status")
+            else:
+                self.add_cmd_output("awx-manage run_wsbroadcast --status")
+
         self.add_dir_listing([
             '/var/lib/awx',
             '/var/lib/awx/venv',
@@ -68,7 +78,7 @@ class AAPControllerPlugin(Plugin, RedHatPlugin):
 
     def postproc(self):
         # remove database password
-        jreg = r"(\s*\'PASSWORD\'\s*:(\s))(?:\"){1,}(.+)(?:\"){1,}"
+        jreg = r"(\s*'PASSWORD'\s*:\s*)('.*')"
         repl = r"\1********"
         self.do_path_regex_sub("/etc/tower/conf.d/postgres.py", jreg, repl)
 
@@ -87,5 +97,9 @@ class AAPControllerPlugin(Plugin, RedHatPlugin):
         repl = r"\1********"
         self.do_path_regex_sub("/etc/tower/conf.d/channels.py", jreg, repl)
 
+        # remove secret key
+        jreg = r"(\s*'SECRET_KEY'\s*:\s*)(\".*\")"
+        repl = r"\1********"
+        self.do_path_regex_sub("/etc/tower/conf.d/gateway.py", jreg, repl)
 
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/aap_eda.py b/sos/report/plugins/aap_eda.py
index 7da276e..7bfd822 100644
--- a/sos/report/plugins/aap_eda.py
+++ b/sos/report/plugins/aap_eda.py
@@ -1,4 +1,5 @@
 # Copyright (c) 2025 Rudnei Bertol Jr <[e-mail]>
+# Copyright (c) 2025 Nagoor Shaik <[e-mail]>
 
 # This file is part of the sos project: https://github.com/sosreport/sos
 #
@@ -9,6 +10,7 @@
 # See the LICENSE file in the source distribution for further information.
 
 from sos.report.plugins import Plugin, RedHatPlugin
+from sos.utilities import sos_parse_version
 
 
 class AAPEDAControllerPlugin(Plugin, RedHatPlugin):
@@ -19,6 +21,12 @@ class AAPEDAControllerPlugin(Plugin, RedHatPlugin):
                 'automation-eda-controller-server')
 
     def setup(self):
+
+        pkg_name = 'automation-eda-controller'
+        pkg = self.policy.package_manager.pkg_by_name(f'{pkg_name}')
+        if pkg is not None:
+            self.eda_pkg_ver = '.'.join(pkg['version'])
+
         if self.get_option("all_logs"):
             self.add_copy_spec([
                 "/etc/ansible-automation-platform/",
@@ -40,19 +48,54 @@ class AAPEDAControllerPlugin(Plugin, RedHatPlugin):
             "/etc/ansible-automation-platform/eda/server.key",
         ])
 
-        self.add_cmd_output("aap-eda-manage --version")
+        self.add_cmd_output([
+            "aap-eda-manage --version",
+            "aap-eda-manage showmigrations",
+        ])
+
         self.add_dir_listing([
             "/etc/ansible-automation-platform/",
             "/var/log/ansible-automation-platform/",
         ], recursive=True)
 
-        self.add_cmd_output("su - eda -c 'export'",
-                            suggest_filename="eda_export")
+        self.add_cmd_output("su - eda -c 'env'",
+                            suggest_filename="eda_environment")
+
+        pkg_name = 'automation-eda-controller'
+        pkg = self.policy.package_manager.pkg_by_name(f'{pkg_name}')
+
+        # EDA version in 2.5 release starts with 1.1.0 version
+        eda_pkg_ver = getattr(self, 'eda_pkg_ver', '0.0.0')
+        if sos_parse_version(eda_pkg_ver) > sos_parse_version('1.0.99'):
+            self.add_cmd_output([
+                "automation-eda-controller-service status",
+                "automation-eda-controller-event-stream-service status",
+            ])
+        else:
+            # systemd service status which starts with "automation-eda"
+            result = self.exec_cmd(
+                'systemctl list-units --type=service \
+                --no-legend automation-eda*'
+            )
+            if result['status'] == 0:
+                for svc in result['output'].splitlines():
+                    eda_svc = svc.split()
+                    if not eda_svc:
+                        continue
+                    self.add_service_status(eda_svc[0])
 
     def postproc(self):
-        self.do_path_regex_sub(
-            "/etc/ansible-automation-platform/eda/environment",
-            r"(EDA_SECRET_KEY|EDA_DB_PASSWORD)(\s*)(=|:)(\s*)(.*)",
-            r'\1\2\3\4********')
+        # EDA Version in AAP 2.4 uses environment file to store configuration
+        eda_pkg_ver = getattr(self, 'eda_pkg_ver', '0.0.0')
+        if sos_parse_version(eda_pkg_ver) < sos_parse_version('1.0.99'):
+            file_path = "/etc/ansible-automation-platform/eda/environment"
+            regex = r"(EDA_SECRET_KEY|EDA_DB_PASSWORD)(\s*)(=|:)(\s*)(.*)"
+            replacement = r'\1\2\3\4********'
+        # EDA version in AAP 2.5 and above use yaml file for configuration
+        else:
+            file_path = "/etc/ansible-automation-platform/eda/settings.yaml"
+            regex = r"(\s*)(PASSWORD|MQ_USER_PASSWORD|SECRET_KEY)(:\s*)(.*$)"
+            replacement = r'\1\2\3********'
 
+        self.do_path_regex_sub(file_path, regex, replacement)
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/aap_gateway.py b/sos/report/plugins/aap_gateway.py
index 206a341..ea95531 100644
--- a/sos/report/plugins/aap_gateway.py
+++ b/sos/report/plugins/aap_gateway.py
@@ -1,4 +1,5 @@
 # Copyright (c) 2024 Lucas Benedito <[e-mail]>
+# Copyright (c) 2025 Nagoor Shaik <[e-mail]>
 
 # This file is part of the sos project: https://github.com/sosreport/sos
 #
@@ -35,17 +36,39 @@ class AAPGatewayPlugin(Plugin, RedHatPlugin):
             "/etc/ansible-automation-platform/gateway/*.cert",
         ])
 
-        self.add_cmd_output("aap-gateway-manage list_services")
+        self.add_cmd_output([
+            "automation-gateway-service status",
+            "aap-gateway-manage print_settings",
+            "aap-gateway-manage authenticators",
+            "aap-gateway-manage showmigrations",
+            "aap-gateway-manage list_services",
+            "aap-gateway-manage feature_flags --list",
+            "aap-gateway-manage --version",
+        ])
         self.add_dir_listing("/etc/ansible-automation-platform/",
                              recursive=True)
 
     def postproc(self):
         # remove database password
-        jreg = r"(DATABASE_PASSWORD)(\s*)(=|:)(\s*)(.*)"
-        repl = r"\1\2\3\4********"
+        jreg = r"(\s*'PASSWORD'\s*:\s*)('.*')"
+        repl = r"\1********"
         self.do_path_regex_sub(
             "/etc/ansible-automation-platform/gateway/settings.py",
             jreg,
             repl)
 
+        # Mask PASSWORD from print_settings command
+        jreg = r'((["\']?PASSWORD["\']?\s*[:=]\s*)[rb]?["\'])(.*?)(["\'])'
+        self.do_cmd_output_sub(
+            "aap-gateway-manage print_settings",
+            jreg,
+            r'\1**********\4')
+
+        # Mask SECRET_KEY from print_settings command
+        jreg = r'((SECRET_KEY\s*=\s*)([rb]?["\']))(.*?)(["\'])'
+        self.do_cmd_output_sub(
+            "aap-gateway-manage print_settings",
+            jreg,
+            r'\1**********\5')
+
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/aap_hub.py b/sos/report/plugins/aap_hub.py
index f10b984..3c3986c 100644
--- a/sos/report/plugins/aap_hub.py
+++ b/sos/report/plugins/aap_hub.py
@@ -26,7 +26,27 @@ class AAPAutomationHub(Plugin, RedHatPlugin):
             "/var/log/ansible-automation-platform/hub/pulpcore-content.log*",
             "/var/log/nginx/automationhub.access.log*",
             "/var/log/nginx/automationhub.error.log*",
+        ])
+
+        # systemd service status which starts with "pulpcore"
+        result = self.exec_cmd(
+            'systemctl list-units --type=service --no-legend pulpcore*'
+        )
+        if result['status'] == 0:
+            for svc in result['output'].splitlines():
+                pulpcore_svc = svc.split()
+                if not pulpcore_svc:
+                    continue
+                self.add_service_status(pulpcore_svc[0])
+
+        self.add_service_status([
+                "nginx",
+                "redis"
+        ])
 
+        self.add_forbidden_path([
+            "/etc/ansible-automation-platform/redis/server.crt",
+            "/etc/ansible-automation-platform/redis/server.key",
         ])
 
         self.add_dir_listing([
diff --git a/sos/report/plugins/apt.py b/sos/report/plugins/apt.py
index 464cfb9..c018074 100644
--- a/sos/report/plugins/apt.py
+++ b/sos/report/plugins/apt.py
@@ -32,7 +32,8 @@ class Apt(Plugin, DebianPlugin, UbuntuPlugin):
             "apt-get check",
             "apt-config dump",
             "apt-cache stats",
-            "apt-cache policy"
+            "apt-cache policy",
+            "apt-mark showhold"
         ])
         dpkg_result = self.exec_cmd(
             "dpkg-query -W -f='${binary:Package}\t${status}\n'"
diff --git a/sos/report/plugins/aws.py b/sos/report/plugins/aws.py
new file mode 100644
index 0000000..ba819be
--- /dev/null
+++ b/sos/report/plugins/aws.py
@@ -0,0 +1,81 @@
+# Copyright (C) 2025, Javier Blanco <[e-mail]>
+
+# This file is part of the sos project: https://github.com/sosreport/sos
+#
+# This copyrighted material is made available to anyone wishing to use,
+# modify, copy, or redistribute it subject to the terms and conditions of
+# version 2 of the GNU General Public License.
+#
+# See the LICENSE file in the source distribution for further information.
+
+from sos.report.plugins import Plugin, IndependentPlugin
+
+
+class Aws(Plugin, IndependentPlugin):
+
+    short_desc = 'AWS EC2 instance metadata'
+
+    plugin_name = 'aws'
+    profiles = ('virt',)
+
+    def _is_ec2(self):
+        try:
+            with open('/sys/devices/virtual/dmi/id/sys_vendor',
+                      encoding='utf-8') as f:
+                return 'Amazon' in f.read()
+        except FileNotFoundError:
+            return False
+
+    # Called by sos to determine if the plugin will run
+    def check_enabled(self):
+        return self._is_ec2()
+
+    def setup(self):
+        if not self._is_ec2():
+            self.soslog.info(
+                "Not an EC2 instance; skipping AWS metadata collection")
+            return
+
+        # Using IMDSv2 if possible, if not, going IMDSv1
+        # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
+
+        # Try to get an IMDSv2 token
+        token_url = 'http://169.254.169.254/latest/api/token'
+        token_cmd = f'curl -sS -X PUT -H \
+            X-aws-ec2-metadata-token-ttl-seconds:21600 {token_url}'
+
+        try:
+            token = self.exec_cmd(token_cmd, timeout=1)['output']
+        except Exception:
+            token = ''
+
+        # Add header only if token retrieval succeeded
+        token_header = ''
+
+        if token:
+            token_header = f'-H X-aws-ec2-metadata-token:{token}'
+
+        # List of metadata paths we want to get
+        metadata_paths = [
+                'hostname',
+                'instance-id',
+                'instance-life-cycle',
+                'instance-type',
+                'placement/availability-zone-id',
+                ]
+
+        base_url = 'http://169.254.169.254/latest/meta-data/'
+
+        # Loop on the metadata paths
+        for path in metadata_paths:
+            meta_url = base_url + path
+            safe_name = path.replace('/', '_')
+            self.add_cmd_output(
+                    f'curl -sS {token_header} {meta_url}',
+                    suggest_filename=f'aws_metadata_{safe_name}.txt'
+            )
+
+        # Those metadata entries do not include any sensitive information.
+        # No need to mask any data.
+
+# vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/azure.py b/sos/report/plugins/azure.py
index 585d74a..3ead906 100644
--- a/sos/report/plugins/azure.py
+++ b/sos/report/plugins/azure.py
@@ -43,7 +43,7 @@ class Azure(Plugin, UbuntuPlugin):
         self.add_cmd_output((
             'curl -s -H Metadata:true --noproxy "*" '
             '"http://169.254.169.254/metadata/instance/compute?'
-            'api-version=2021-01-01&format=json"'
+            'api-version=2023-07-01&format=json"'
         ), suggest_filename='instance_metadata.json')
 
 
diff --git a/sos/report/plugins/block.py b/sos/report/plugins/block.py
index 7c564bd..3872f44 100644
--- a/sos/report/plugins/block.py
+++ b/sos/report/plugins/block.py
@@ -26,6 +26,7 @@ class Block(Plugin, IndependentPlugin):
         })
 
         self.add_dir_listing('/dev', tags=['ls_dev'], recursive=True)
+        self.add_dir_listing('/dev/', recursive=True, extra_opts='n')
         self.add_dir_listing('/sys/block', recursive=True)
 
         self.add_cmd_output("blkid -c /dev/null", tags="blkid")
@@ -40,6 +41,7 @@ class Block(Plugin, IndependentPlugin):
 
         # legacy location for non-/run distributions
         self.add_copy_spec([
+            "/dev/disk/by-dname/",
             "/etc/blkid.tab",
             "/run/blkid/blkid.tab",
             "/proc/partitions",
@@ -69,4 +71,6 @@ class Block(Plugin, IndependentPlugin):
                     self.add_cmd_output(f'cryptsetup luksDump /dev/{dev}')
                     self.add_cmd_output(f'clevis luks list -d /dev/{dev}')
 
+        self.add_copy_spec("/etc/crypttab")
+
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/boom.py b/sos/report/plugins/boom.py
index a872d1b..e3a27dd 100644
--- a/sos/report/plugins/boom.py
+++ b/sos/report/plugins/boom.py
@@ -25,6 +25,9 @@ class Boom(Plugin, RedHatPlugin):
     )
 
     def setup(self):
+        # Skip collecting cached boot images
+        self.add_forbidden_path("/boot/boom/cache/*.img")
+
         self.add_copy_spec([
             "/boot/boom",
             "/boot/loader/entries",
@@ -34,7 +37,8 @@ class Boom(Plugin, RedHatPlugin):
 
         self.add_cmd_output([
             "boom list -VV",
-            "boom profile list -VV"
+            "boom cache list -VV",
+            "boom profile list -VV",
         ])
 
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/boot.py b/sos/report/plugins/boot.py
index f3c93d1..8f72a0a 100644
--- a/sos/report/plugins/boot.py
+++ b/sos/report/plugins/boot.py
@@ -56,5 +56,7 @@ class Boot(Plugin, IndependentPlugin):
                 self.add_cmd_output(f"lsinitrd {image}", priority=100)
                 self.add_cmd_output(f"lsinitramfs -l {image}", priority=100)
 
+        # Capture Open Virtual Machine Firmware information
+        self.add_copy_spec("/sys/firmware/efi/ovmf_debug_log")
 
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/candlepin.py b/sos/report/plugins/candlepin.py
index 174cf16..3c655f2 100644
--- a/sos/report/plugins/candlepin.py
+++ b/sos/report/plugins/candlepin.py
@@ -21,6 +21,7 @@ class Candlepin(Plugin, RedHatPlugin):
     packages = ('candlepin',)
 
     dbhost = None
+    dbport = None
     dbpasswd = None
     env = None
 
@@ -31,6 +32,7 @@ class Candlepin(Plugin, RedHatPlugin):
         # and for DB password, search for
         # org.quartz.dataSource.myDS.password=..
         self.dbhost = "localhost"
+        self.dbport = 5432
         self.dbpasswd = ""
         cfg_file = "/etc/candlepin/candlepin.conf"
         try:
@@ -41,10 +43,11 @@ class Candlepin(Plugin, RedHatPlugin):
                 if not line or line[0] == '#':
                     continue
                 if match(r"^\s*org.quartz.dataSource.myDS.URL=\S+", line):
-                    self.dbhost = line.split('=')[1]
-                    # separate hostname from value like
+                    # separate hostname and port from the jdbc url
                     # jdbc:postgresql://localhost:5432/candlepin
-                    self.dbhost = self.dbhost.split('/')[2].split(':')[0]
+                    jdbcurl = line.split('=')[1].split('/')[2].split(':')
+                    self.dbhost = jdbcurl[0]
+                    self.dbport = jdbcurl[1]
                 if match(r"^\s*org.quartz.dataSource.myDS.password=\S+", line):
                     self.dbpasswd = line.split('=')[1]
         except (IOError, IndexError):
@@ -122,9 +125,9 @@ class Candlepin(Plugin, RedHatPlugin):
         a large amount of quoting in sos logs referencing the command being run
         """
         csvformat = "-A -F , -X" if csv else ""
-        _dbcmd = "psql --no-password -h %s -p 5432 -U candlepin \
+        _dbcmd = "psql --no-password -h %s -p %s -U candlepin \
                   -d candlepin %s -c %s"
-        return _dbcmd % (self.dbhost, csvformat, quote(query))
+        return _dbcmd % (self.dbhost, self.dbport, csvformat, quote(query))
 
     def postproc(self):
         reg = r"(((.*)(pass|token|secret)(.*))=)(.*)"
diff --git a/sos/report/plugins/ceph_mon.py b/sos/report/plugins/ceph_mon.py
index dadb96e..89ab12c 100644
--- a/sos/report/plugins/ceph_mon.py
+++ b/sos/report/plugins/ceph_mon.py
@@ -175,10 +175,11 @@ class CephMON(Plugin, RedHatPlugin, UbuntuPlugin):
         self.add_cmd_output("ceph osd tree --format json-pretty",
                             subdir="json_output",
                             tags="ceph_osd_tree")
-        self.add_cmd_output(
-            [f"ceph tell mon.{mid} mon_status" for mid in self.get_ceph_ids()],
-            subdir="json_output",
-        )
+        for mid in self.get_ceph_ids():
+            self.add_cmd_output([
+                f"ceph tell mon.{mid} mon_status",
+                f"ceph tell mon.{mid} sessions",
+            ], subdir="json_output")
 
         self.add_cmd_output([f"ceph {cmd}" for cmd in ceph_cmds])
 
diff --git a/sos/report/plugins/charmed_mysql.py b/sos/report/plugins/charmed_mysql.py
index dd31121..acc414c 100644
--- a/sos/report/plugins/charmed_mysql.py
+++ b/sos/report/plugins/charmed_mysql.py
@@ -7,27 +7,67 @@
 # See the LICENSE file in the source distribution for further information.#
 
 import os
+import tempfile
 
 from sos.report.plugins import Plugin, PluginOpt, UbuntuPlugin
+from sos.utilities import is_executable
 
 
 class CharmedMySQL(Plugin, UbuntuPlugin):
     """
     The Charmed MySQL plugin is used to collect MySQL configuration and logs
-    from the Charmed MySQL snap package. It also collects MySQL Router
-    and MySQL Shell configuration and logs where available,
-    journal logs for the snap, and snap info.
+    from the Charmed MySQL snap package or K8s deployment.
+    It also collects MySQL Router and MySQL Shell configuration and logs
+    where available, journal logs for the snap, and snap info.
 
     If the `dumpdbs` option is set to `True`, the plugin will also try and
     collect the names of the databases that the user has access to. The
     `mysql` user is used by default, but that can be set using the `dbuser`
     option. When using the `dumpdbs` option, you must then provide the
-    password for the user using the `dbpass` option.
+    password for the user using the `dbpass` option or the `MYSQL_PWD`
+    environment variable.
     """
 
     short_desc = "Charmed MySQL"
     plugin_name = "charmed_mysql"
-    packages = ("charmed-mysql",)
+
+    mysql_queries = [
+        # Get databases user has access to
+        "show databases;",
+
+        # Get unit operations from MySQL to see, for example,
+        # if a unit is stuck on joining the cluster
+        "select * from mysql.juju_units_operations;",
+
+        # Get the cluster group replication status
+        ("select * from performance_schema.replication_group_members "
+            "order by MEMBER_HOST;"),
+
+        # Get connection stats
+        "show global status like \"%conne%\";",
+
+        # Get errors per client and host
+        # Useful for problens like an app disconnectting randomly
+        "select * from performance_schema.host_cache;",
+
+        # Get InnoDB status for any deadlocks, etc.
+        "show ENGINE InnoDB STATUS;",
+    ]
+
+    snap_package = "charmed-mysql"
+    snap_path_common = "/var/snap/charmed-mysql/common"
+    snap_path_current = "/var/snap/charmed-mysql/current"
+
+    kube_cmd = "kubectl"
+    selector = "app.kubernetes.io/name=mysql-k8s"
+
+    conf_paths = {
+        "MYSQL_CONF": "/etc/mysql",
+        "MYSQL_LOGS": "/var/log/mysql",
+        "MYSQL_ROUTER_CONF": "/etc/mysqlrouter",
+        "MYSQL_ROUTER_LOGS": "/var/log/mysqlrouter",
+        "MYSQL_SHELL_LOGS": "/var/log/mysqlsh",
+    }
 
     option_list = [
         PluginOpt(
@@ -42,103 +82,213 @@ class CharmedMySQL(Plugin, UbuntuPlugin):
             "dumpdbs", default=False, val_type=bool,
             desc="Get name of all databases"
         ),
+        PluginOpt(
+            "logs_since", default="48h", val_type=str,
+            desc="How far back to fetch logs with kubectl --since, K8s only"
+        ),
     ]
 
-    def setup(self):
-        # Set default paths for snap
-        snap_path_common = "/var/snap/charmed-mysql/common"
-        snap_path_current = "/var/snap/charmed-mysql/current"
-
-        # Check if deployment is in a Kubernetes cluster
-        k8s_deploy = any("KUBERNETES" in key for key in os.environ)
-
-        # If in a Kubernetes cluster, set the snap paths to "None" as
-        # MySQL configuration does not exist in snap paths
-        if k8s_deploy:
-            snap_path_common = ""
-            snap_path_current = ""
-
-        # Set the configuration paths
-        conf_paths = {
-            "MYSQL_CONF": f"{snap_path_current}/etc/mysql",
-            "MYSQL_LOGS": f"{snap_path_common}/var/log/mysql",
-            "MYSQL_ROUTER_CONF": f"{snap_path_current}/etc/mysqlrouter",
-            "MYSQL_ROUTER_LOGS": f"{snap_path_common}/var/log/mysqlrouter",
-            "MYSQL_SHELL_LOGS": f"{snap_path_common}/var/log/mysqlsh",
-        }
+    def _get_db_credentials(self):
+        db_user = self.get_option("dbuser")
+        db_pass = self.get_option("dbpass")
 
+        if "MYSQL_PWD" in os.environ and not db_pass:
+            self.soslog.info(
+                "MYSQL_PWD present: Using MYSQL_PWD environment variable, "
+                "user did not provide password."
+            )
+            db_pass = os.environ["MYSQL_PWD"]
+        elif not db_pass:
+            self.soslog.warning(
+                "dumpdbs_error: option is set, but username and password "
+                "are not provided"
+            )
+            return None, None
+
+        return db_user, db_pass
+
+    def _determine_namespaces(self):
+        namespaces = self.exec_cmd(
+            f"{self.kube_cmd} get pods -A -l {self.selector} "
+            "-o jsonpath='{.items[*].metadata.namespace}'"
+        )
+        if namespaces['status'] == 0:
+            return list(set(namespaces['output'].strip().split()))
+        return []
+
+    def _get_pod_names(self, namespace):
+        pods = self.exec_cmd(
+            f"{self.kube_cmd} -n {namespace} get pods -l {self.selector} "
+            "-o jsonpath='{.items[*].metadata.name}'"
+        )
+        if pods['status'] == 0:
+            return pods['output'].strip().split()
+        return []
+
+    def _collect_per_namespace(self, namespace, logs_since):
+        kube_cmd = f"{self.kube_cmd} -n {namespace}"
+
+        # Describe the resources
+        self.add_cmd_output([
+            f"{kube_cmd} get all -l {self.selector} -o wide",
+            f"{kube_cmd} describe pods -l {self.selector}",
+        ])
+
+        # Get pod logs
+        self.add_cmd_output(
+            f"{kube_cmd} logs -l {self.selector} --since={logs_since} "
+            "--all-containers=true --prefix --all-pods"
+        )
+
+        mysql_cont = "mysql"
+        pods = self._get_pod_names(namespace)
+
+        # Get the config and logs from each pod
+        dump_files_path = self.get_cmd_output_path()
+        for name, path in self.conf_paths.items():
+            for pod in pods:
+                os.makedirs(f"{dump_files_path}/{pod}/{name}", exist_ok=True)
+                copy_cmd = (
+                    f"{kube_cmd} cp -c {mysql_cont} {pod}:{path} "
+                    f"{dump_files_path}/{pod}/{name}"
+                )
+                self.exec_cmd(copy_cmd)
+
+        self.add_forbidden_path([
+            f"{dump_files_path}/*/MYSQL_CONF/*.pem",
+            f"{dump_files_path}/*/MYSQL_CONF/*.key",
+        ])
+
+        # If dumpdbs is set, then get all databases
+        if self.get_option("dumpdbs"):
+            db_user, db_pass = self._get_db_credentials()
+            if not db_user or not db_pass:
+                return
+
+            opts = f"-h 127.0.0.1 -u{db_user}"
+            sql_cmd = f"mysql {opts} -e"
+            queries = " ".join(
+                query.replace('\"', '\\\"')
+                for query in self.mysql_queries
+            )
+
+            with tempfile.TemporaryDirectory() as tmpdir:
+                pwd_file = "mysql_pwd"
+                pwd_path = tmpdir + "/" + pwd_file
+
+                with open(pwd_path, "w", encoding="utf8") as f:
+                    f.write(db_pass)
+
+                for pod in pods:
+                    mkdir_cmd = (
+                        f"{kube_cmd} exec -c {mysql_cont} {pod} -- "
+                        f"mkdir -p {tmpdir}"
+                    )
+                    self.exec_cmd(mkdir_cmd)
+
+                    copy_cmd = (
+                        f"{kube_cmd} cp -c {mysql_cont} "
+                        f"{pwd_path} {pod}:{pwd_path}"
+                    )
+                    self.exec_cmd(copy_cmd)
+
+                    queries_cmd = (
+                        f"{kube_cmd} exec -c {mysql_cont} {pod} -- "
+                        f"sh -lc 'MYSQL_PWD=$(cat {pwd_path}) "
+                        f"{sql_cmd} \"{queries}\"' "
+                        f"&& rm -rf {tmpdir}"
+                    )
+                    self.add_cmd_output(
+                        queries_cmd,
+                        suggest_filename=f"{pod}_dbs.txt",
+                    )
+
+    def _join_conf_path(self, base, *parts):
+        stripped_parts = [p.lstrip(os.path.sep) for p in parts]
+        return os.path.join(base, *stripped_parts)
+
+    def _process_k8s(self):
+        logs_since = self.get_option("logs_since")
+        namespaces = self._determine_namespaces()
+        for namespace in namespaces:
+            self._collect_per_namespace(namespace, logs_since)
+
+    def _process_snap(self):
         # Ignore private keys
         self.add_forbidden_path([
-            f"{conf_paths['MYSQL_CONF']}/*.pem",
-            f"{conf_paths['MYSQL_CONF']}/*.key",
+            self._join_conf_path(
+                self.snap_path_current,
+                self.conf_paths["MYSQL_CONF"],
+                "*.pem"
+            ),
+            self._join_conf_path(
+                self.snap_path_current,
+                self.conf_paths["MYSQL_CONF"],
+                "*.key"
+            ),
         ])
 
         # Include the files we want to get
         self.add_copy_spec([
-            conf_paths["MYSQL_CONF"],
-            conf_paths["MYSQL_LOGS"],
-            conf_paths["MYSQL_ROUTER_CONF"],
-            conf_paths["MYSQL_ROUTER_LOGS"],
-            conf_paths["MYSQL_SHELL_LOGS"],
+            self._join_conf_path(
+                self.snap_path_current,
+                self.conf_paths["MYSQL_CONF"]
+            ),
+            self._join_conf_path(
+                self.snap_path_common,
+                self.conf_paths["MYSQL_LOGS"]
+            ),
+            self._join_conf_path(
+                self.snap_path_current,
+                self.conf_paths["MYSQL_ROUTER_CONF"]
+            ),
+            self._join_conf_path(
+                self.snap_path_common,
+                self.conf_paths["MYSQL_ROUTER_LOGS"]
+            ),
+            self._join_conf_path(
+                self.snap_path_common,
+                self.conf_paths["MYSQL_SHELL_LOGS"]
+            ),
         ])
 
-        # Only applicable if not in a Kubernetes cluster
-        # as `snap info` and `journalctl` are not available
-        # in the Kubernetes container
-        if not k8s_deploy:
-            # Get snap logs
-            self.add_journal("snap.charmed-mysql.*")
+        # Get snap logs
+        self.add_journal("snap.charmed-mysql.*")
 
-            # Get snap info
-            self.add_cmd_output("snap info charmed-mysql")
+        # Get snap info
+        self.add_cmd_output("snap info charmed-mysql")
 
         # If dumpdbs is set, then get all databases
         if self.get_option("dumpdbs"):
-
-            db_user = self.get_option("dbuser")
-            db_pass = self.get_option("dbpass")
-
-            # Check password is not already an environment variable
-            # and user did not supply a password
-            if "MYSQL_PWD" in os.environ and not db_pass:
-                self.soslog.info(
-                    "MYSQL_PWD present: Using MYSQL_PWD environment variable, "
-                    "user did not provide password."
-                )
-                db_pass = os.environ["MYSQL_PWD"]
-            elif not db_pass:  # Environment variable not set and no password
-                self.soslog.warning(
-                    "dumpdbs_error: option is set, but username and password "
-                    "are not provided"
-                )
+            db_user, db_pass = self._get_db_credentials()
+            if not db_user or not db_pass:
                 return
 
             mysql_env = {"MYSQL_PWD": db_pass}
             opts = f"-h 127.0.0.1 -u{db_user}"
             sql_cmd = f"mysql {opts} -e"
-            queries = [
-                # Get databases user has access to
-                "'show databases;'",
 
-                # Get unit operations from MySQL to see, for example,
-                # if a unit is stuck on joining the cluster
-                "'select * from mysql.juju_units_operations;'",
+            self.add_cmd_output(
+                [f"{sql_cmd} '{query}'" for query in self.mysql_queries],
+                env=mysql_env,
+            )
 
-                # Get the cluster group replication status
-                ("'select * from performance_schema.replication_group_members "
-                    "order by MEMBER_HOST;'"),
+    def check_enabled(self):
+        # Check for snap package
+        if self.is_installed(self.snap_package):
+            return True
 
-                # Get connection stats
-                "'show global status like \"%conne%\";'",
+        # Check for kubectl and pods
+        return (
+            is_executable(self.kube_cmd, self.sysroot) and
+            bool(self._determine_namespaces())
+        )
 
-                # Get errors per client and host
-                # Useful for problens like an app disconnectting randomly
-                "'select * from performance_schema.host_cache;'"
-            ]
+    def setup(self):
+        if self.is_installed(self.snap_package):
+            self._process_snap()
 
-            self.add_cmd_output(
-                [f"{sql_cmd} {query}" for query in queries],
-                env=mysql_env
-            )
+        if is_executable(self.kube_cmd, self.sysroot):
+            self._process_k8s()
 
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/dnf.py b/sos/report/plugins/dnf.py
index 6922495..d79d58c 100644
--- a/sos/report/plugins/dnf.py
+++ b/sos/report/plugins/dnf.py
@@ -78,8 +78,10 @@ class DNFPlugin(Plugin, RedHatPlugin):
         self.add_cmd_output([
             "dnf --version",
             "dnf list extras",
+            "dnf updateinfo info security",
+            "dnf updateinfo list --available",
             "package-cleanup --dupes",
-            "package-cleanup --problems"
+            "package-cleanup --problems",
         ])
 
         self.add_cmd_output("dnf list installed",
diff --git a/sos/report/plugins/drbd.py b/sos/report/plugins/drbd.py
index ecd6817..4e2758d 100644
--- a/sos/report/plugins/drbd.py
+++ b/sos/report/plugins/drbd.py
@@ -7,27 +7,74 @@
 # See the LICENSE file in the source distribution for further information.
 
 from sos.report.plugins import Plugin, RedHatPlugin, UbuntuPlugin
+from sos.utilities import find
 
 
-class DRDB(Plugin, RedHatPlugin, UbuntuPlugin):
+class DRBD(Plugin, RedHatPlugin, UbuntuPlugin):
 
     short_desc = 'Distributed Replicated Block Device (DRBD)'
 
     plugin_name = 'drbd'
     profiles = ('storage',)
-    packages = ('drbd*-utils',)
+    commands = ('drbdsetup',)
+
+    # In case of kernel bugs, drbdsetup may hang indefinitely.
+    # Set a shorter than default timeout.
+    cmd_timeout = 60
+
+    def add_drbd_thread_stacks(self):
+        stacks = ""
+        for pid_file in find("*_pid", "/sys/kernel/debug/drbd/resources/"):
+            with open(pid_file, 'r', encoding='utf-8') as f:
+                pid = f.read().strip()
+            stacks += f"--- {pid_file}: {pid} ---\n"
+            if pid.isdigit():
+                try:
+                    sfn = f"/proc/{pid}/stack"
+                    with open(sfn, 'r', encoding='utf-8') as sf:
+                        stacks += sf.read()
+                except Exception as e:
+                    stacks += f"Could not read /proc/{pid}/stack: {e}\n"
+            stacks += "\n"
+
+        self.add_string_as_file(stacks, "drbd_thread_stacks")
 
     def setup(self):
         self.add_cmd_output([
-            "drbd-overview",
-            "drbdadm dump-xml",
-            "drbdsetup status all",
+            "drbdadm dump",
+            "drbdadm -d -vvv adjust all",
+            "drbdsetup status -vs all",
             "drbdsetup show all"
         ])
+        self.add_drbd_thread_stacks()
+        for kmod in find("drbd*.ko*", "/lib/modules"):
+            self.add_cmd_output([
+                f"modinfo {kmod}",
+            ], suggest_filename=f"modinfo_{kmod.replace('/', '_')}")
         self.add_copy_spec([
             "/etc/drbd.conf",
             "/etc/drbd.d/*",
-            "/proc/drbd"
+            "/proc/drbd",
+            "/sys/kernel/debug/drbd/*",
+            "/var/lib/drbd/*",
+            "/var/lib/drbd-support/*",
+            "/var/lib/linstor.d/*"
         ])
 
+    def postproc(self):
+        # Scrub nodehash from /var/lib/drbd-support/registration.json
+        nodehash_re = r'("nodehash"\s*:\s*")[a-zA-Z0-9]+"'
+        repl = r'\1********"'
+        self.do_path_regex_sub(
+            '/var/lib/drbd-support/registration.json',
+            nodehash_re, repl
+        )
+
+        # Scrub shared secret from *.{conf,res} files and command outputs
+        secret_re = r'(shared-secret\s+\"?).[^\"]+(\"?\s*;)'
+        repl = r'\1********\2'
+        self.do_path_regex_sub(r'.*\.(conf|res)', secret_re, repl)
+        self.do_cmd_output_sub("drbdadm dump", secret_re, repl)
+        self.do_cmd_output_sub("drbdsetup show all", secret_re, repl)
+
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/firewalld.py b/sos/report/plugins/firewalld.py
index 0d218d7..2f2b1d9 100644
--- a/sos/report/plugins/firewalld.py
+++ b/sos/report/plugins/firewalld.py
@@ -47,6 +47,8 @@ class FirewallD(Plugin, RedHatPlugin):
             "firewall-cmd --get-log-denied",
             "firewall-cmd --list-all-zones",
             "firewall-cmd --permanent --list-all-zones",
+            "firewall-cmd --list-all-policies",
+            "firewall-cmd --permanent --list-all-policies",
             "firewall-cmd --permanent --direct --get-all-chains",
             "firewall-cmd --permanent --direct --get-all-rules",
             "firewall-cmd --permanent --direct --get-all-passthroughs",
diff --git a/sos/report/plugins/foreman.py b/sos/report/plugins/foreman.py
index 1d00d59..bdb2d4a 100644
--- a/sos/report/plugins/foreman.py
+++ b/sos/report/plugins/foreman.py
@@ -25,6 +25,7 @@ class Foreman(Plugin):
     packages = ('foreman',)
     apachepkg = None
     dbhost = "localhost"
+    dbport = 5432
     dbpasswd = ""
     env = {"PGPASSWORD": ""}
     option_list = [
@@ -33,7 +34,9 @@ class Foreman(Plugin):
         PluginOpt('proxyfeatures', default=False,
                   desc='collect features of smart proxies'),
         PluginOpt('puma-gc', default=False,
-                  desc='collect Puma GC stats')
+                  desc='collect Puma GC stats'),
+        PluginOpt('cvfilters', default=False,
+                  desc='collect content view filters definition')
     ]
     pumactl = 'pumactl %s -S /usr/share/foreman/tmp/puma.state'
 
@@ -56,6 +59,8 @@ class Foreman(Plugin):
                     continue
                 if production_scope and match(r"\s+host:\s+\S+", line):
                     self.dbhost = line.split()[1]
+                if production_scope and match(r"\s+port:\s+\S+", line):
+                    self.dbport = line.split()[1]
                 if production_scope and match(r"\s+password:\s+\S+", line):
                     self.dbpasswd = line.split()[1]
                 # if line starts with a text, it is a different scope
@@ -184,6 +189,8 @@ class Foreman(Plugin):
                             env=self.env)
         self.collect_foreman_db()
         self.collect_proxies()
+        if self.get_option('cvfilters'):
+            self.collect_cv_filters()
 
     def collect_foreman_db(self):
         # pylint: disable=too-many-locals
@@ -240,6 +247,16 @@ class Foreman(Plugin):
             'LIMIT 100'
         )
 
+        smartcmd = (
+            "SELECT sp.id, sp.name, sp.url, sp.download_policy, "
+            "STRING_AGG(f.name, ', ') AS features "
+            "FROM smart_proxies AS sp "
+            "INNER JOIN smart_proxy_features AS spf "
+            "ON sp.id = spf.smart_proxy_id "
+            "INNER JOIN features AS f ON spf.feature_id = f.id "
+            "GROUP BY sp.id"
+        )
+
         # Populate this dict with DB queries that should be saved directly as
         # postgres formats them. The key will be the filename in the foreman
         # plugin directory, with the value being the DB query to run
@@ -255,8 +272,7 @@ class Foreman(Plugin):
             'audits_table_count': 'select count(*) from audits',
             'logs_table_count': 'select count(*) from logs',
             'fact_names_prefixes': factnamescmd,
-            'smart_proxies': 'select name,url,download_policy ' +
-                             'from smart_proxies'
+            'smart_proxies': smartcmd
         }
 
         # Same as above, but tasks should be in CSV output
@@ -305,6 +321,58 @@ class Foreman(Plugin):
                                         subdir='smart_proxies_features',
                                         timeout=10)
 
+    def collect_cv_filters(self):
+        """ Collect content view filters definition if requested """
+        cv_filters_cmd = (
+            "select f.id, f.name, f.type, f.content_view_id, "
+            "cv.name as content_view_name, f.description "
+            "from katello_content_view_filters as f "
+            "inner join katello_content_views as cv "
+            "on f.content_view_id = cv.id"
+        )
+        cv_pkg_rules_cmd = (
+            "select id, content_view_filter_id, name, min_version, "
+            "max_version from katello_content_view_package_filter_rules"
+        )
+        cv_group_rules_cmd = (
+            "select id, content_view_filter_id, name, uuid "
+            "from katello_content_view_package_group_filter_rules"
+        )
+        cv_errata_rules_cmd = (
+            "select id, content_view_filter_id, errata_id, start_date, "
+            "end_date, types from "
+            "katello_content_view_erratum_filter_rules"
+        )
+        cv_module_rules_cmd = (
+            "select * from "
+            "katello_content_view_module_stream_filter_rules"
+        )
+        cv_docker_rules_cmd = (
+            "select id, content_view_filter_id, name "
+            "from katello_content_view_docker_filter_rules"
+        )
+        cv_deb_rules_cmd = (
+            "select id, content_view_filter_id, name, version, "
+            "min_version, max_version "
+            "from katello_content_view_deb_filter_rules"
+        )
+
+        filter_tables = {
+            'katello_cv_filters': cv_filters_cmd,
+            'katello_cv_package_rules': cv_pkg_rules_cmd,
+            'katello_cv_group_rules': cv_group_rules_cmd,
+            'katello_cv_errata_rules': cv_errata_rules_cmd,
+            'katello_cv_module_rules': cv_module_rules_cmd,
+            'katello_cv_docker_rules': cv_docker_rules_cmd,
+            'katello_cv_deb_rules': cv_deb_rules_cmd
+        }
+
+        for table, query in filter_tables.items():
+            _cmd = self.build_query_cmd(query)
+            self.add_cmd_output(_cmd, suggest_filename=table,
+                                subdir='content_view_filters',
+                                timeout=600, sizelimit=100, env=self.env)
+
     def build_query_cmd(self, query, csv=False, binary="psql"):
         """
         Builds the command needed to invoke the pgsql query as the postgres
@@ -316,8 +384,8 @@ class Foreman(Plugin):
         if csv:
             query = f"COPY ({query}) TO STDOUT " \
                     "WITH (FORMAT 'csv', DELIMITER ',', HEADER)"
-        _dbcmd = "%s --no-password -h %s -p 5432 -U foreman -d foreman -c %s"
-        return _dbcmd % (binary, self.dbhost, quote(query))
+        _dbcmd = "%s --no-password -h %s -p %s -U foreman -d foreman -c %s"
+        return _dbcmd % (binary, self.dbhost, self.dbport, quote(query))
 
     def postproc(self):
         self.do_path_regex_sub(
diff --git a/sos/report/plugins/foreman_installer.py b/sos/report/plugins/foreman_installer.py
index 73d95b3..f55cde2 100644
--- a/sos/report/plugins/foreman_installer.py
+++ b/sos/report/plugins/foreman_installer.py
@@ -57,8 +57,8 @@ class ForemanInstaller(Plugin, DebianPlugin, UbuntuPlugin):
         # also hide passwords in yet different formats
         self.do_path_regex_sub(
             install_logs,
-            r"((\.|_|-)password(=\'|=|\", \"))(\w*)",
-            r"\1********")
+            r"password(\", \"|=|\" value: \"|\": \")(.*?)(\", \".*|\"]]|\"|$)",
+            r"password\1********\3")
         self.do_path_regex_sub(
             "/var/log/foreman-installer/foreman-proxy*",
             r"(\s*proxy_password\s=) (.*)",
diff --git a/sos/report/plugins/gcp.py b/sos/report/plugins/gcp.py
index fb040bc..24b5032 100644
--- a/sos/report/plugins/gcp.py
+++ b/sos/report/plugins/gcp.py
@@ -6,7 +6,6 @@
 #
 # See the LICENSE file in the source distribution for further information.
 import json
-from http.client import HTTPResponse
 from typing import Any
 from urllib import request
 from urllib.error import URLError
@@ -27,32 +26,24 @@ class GCP(Plugin, IndependentPlugin):
                        "Metadata server.")
     ]
 
-    METADATA_ROOT = "http://metadata.google.internal/computeMetadata/v1/"
+    PRODUCT_PATH = "/sys/devices/virtual/dmi/id/product_name"
+
     METADATA_QUERY = "http://metadata.google.internal/computeMetadata/v1/" \
                      "?recursive=true"
     REDACTED = "[--REDACTED--]"
     metadata = None
 
-    # A line we will be looking for in the dmesg output. If it's there,
-    # that means we're running on a Google Cloud Compute instance.
-    GOOGLE_DMI = "DMI: Google Google Compute Engine/Google " \
-                 "Compute Engine, BIOS Google"
-
     def check_enabled(self):
         """
-        Checks if this plugin should be executed at all. In this case, it
-        will check the `dmesg` command output to see if the system is
-        running on a Google Cloud Compute instance.
+        Checks if this plugin should be executed based on the presence of
+        GCE entry in sysfs.
         """
-        dmesg = self.exec_cmd("dmesg")
-        if dmesg['status'] != 0:
-            return False
-        return self.GOOGLE_DMI in dmesg['output']
+        with open(self.PRODUCT_PATH, encoding='utf-8') as sys_file:
+            return "Google Compute Engine" in sys_file.read()
 
     def setup(self):
         """
         Collect the following info:
-         * Metadata from the Metadata server
          * `gcloud auth list` output
          * Any google services output from journal
         """
@@ -64,7 +55,7 @@ class GCP(Plugin, IndependentPlugin):
         self.add_journal(units="google*", tags=['gcp'])
 
     def collect(self):
-        # Get and store Metadata
+        # Collect Metadata from the server
         with self.collection_file('metadata.json', tags=['gcp']) as mfile:
             try:
                 self.metadata = self.get_metadata()
@@ -78,12 +69,10 @@ class GCP(Plugin, IndependentPlugin):
         Retrieves metadata from the Metadata Server and transforms it into a
         dictionary object.
         """
-        response = self._query_address(self.METADATA_QUERY)
-        response_body = response.read().decode()
+        response_body = self._query_address(self.METADATA_QUERY)
         return json.loads(response_body)
 
-    @staticmethod
-    def _query_address(url: str) -> HTTPResponse:
+    def _query_address(self, url: str) -> str:
         """
         Query the given url address with headers required by Google Metadata
         Server.
@@ -96,7 +85,7 @@ class GCP(Plugin, IndependentPlugin):
                         f"Failed to communicate with Metadata Server "
                         f"(code: {response.code}): " +
                         response.read().decode())
-                return response
+                return response.read().decode()
         except URLError as err:
             raise RuntimeError(
                 "Failed to communicate with Metadata Server: " + str(err)) \
diff --git a/sos/report/plugins/insights.py b/sos/report/plugins/insights.py
index be6a8b2..c010ba5 100644
--- a/sos/report/plugins/insights.py
+++ b/sos/report/plugins/insights.py
@@ -51,6 +51,8 @@ class RedHatInsights(Plugin, RedHatPlugin):
             "insights-client --test-connection --net-debug",
             timeout=30
         )
+        self.add_cmd_output("insights-client --version")
+        self.add_cmd_output("insights-client --status", timeout=30)
 
         self.add_dir_listing(["/etc/rhsm", "/sys/kernel", "/var/lib/sss"],
                              recursive=True)
@@ -64,5 +66,6 @@ class RedHatInsights(Plugin, RedHatPlugin):
             self.do_file_sub(
                 conf, r'(proxy[\t\ ]*=.*)(:)(.*)(@.*)', r'\1\2********\4'
             )
+        self.do_paths_http_sub(["/var/log/insights-client/*"])
 
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/juju.py b/sos/report/plugins/juju.py
index e6a52bf..031573e 100644
--- a/sos/report/plugins/juju.py
+++ b/sos/report/plugins/juju.py
@@ -218,6 +218,11 @@ class Juju(Plugin, UbuntuPlugin):
         keys_regex = fr"(^\s*({'|'.join(protect_keys)})\s*:\s*)(.*)"
         sub_regex = r"\1*********"
         self.do_path_regex_sub(agents_path, keys_regex, sub_regex)
+
+        # Redact keys from Nova compute logs
+        self.do_path_regex_sub("/var/log/juju/unit-nova-compute-(.*).log(.*)",
+                               r"auth\(key=(.*)\)", r"auth(key=******)")
+
         # Redact certificates
         self.do_file_private_sub(agents_path)
         self.do_cmd_private_sub('juju controllers')
diff --git a/sos/report/plugins/kdump.py b/sos/report/plugins/kdump.py
index 5192e4e..a4b74ed 100644
--- a/sos/report/plugins/kdump.py
+++ b/sos/report/plugins/kdump.py
@@ -7,8 +7,8 @@
 # See the LICENSE file in the source distribution for further information.
 
 import platform
-from sos.report.plugins import Plugin, PluginOpt, RedHatPlugin, DebianPlugin, \
-    UbuntuPlugin, CosPlugin, AzurePlugin
+from sos.report.plugins import (Plugin, PluginOpt, RedHatPlugin, DebianPlugin,
+                                UbuntuPlugin, CosPlugin, AzurePlugin)
 
 
 class KDump(Plugin):
@@ -25,6 +25,7 @@ class KDump(Plugin):
             "/proc/sys/kernel/panic",
             "/proc/sys/kernel/panic_on_oops",
             "/sys/kernel/kexec_loaded",
+            "/sys/kernel/kexec",
             "/sys/kernel/fadump",
             "/sys/kernel/fadump_enabled",
             "/sys/kernel/fadump_registered",
@@ -102,12 +103,36 @@ class RedHatKDump(KDump, RedHatPlugin):
         if self.get_option("get-vm-core"):
             self.add_copy_spec(f"{path}/*/vmcore", sizelimit=2048, maxage=24)
 
+        # collect status via kdumpctl
+        self.add_cmd_output([
+            "kdumpctl status",
+            "kdumpctl estimate",
+        ])
+
 
 class DebianKDump(KDump, DebianPlugin, UbuntuPlugin):
 
     files = ('/etc/default/kdump-tools',)
     packages = ('kdump-tools',)
 
+    option_list = [
+        PluginOpt("get-vm-core", default=False, val_type=bool,
+                  desc="collect memory dumps")
+    ]
+
+    def read_kdump_conffile(self):
+        """ Parse /etc/default/kdump-tools """
+        path = "/var/crash"
+
+        kdump = '/etc/default/kdump-tools'
+        with open(kdump, 'r', encoding='UTF-8') as file:
+            for line in file:
+                line = line.strip()
+                if line.startswith("KDUMP_COREDIR"):
+                    path = line.split('=')[1].strip('"')
+
+        return path
+
     def setup(self):
         super().setup()
 
@@ -121,6 +146,24 @@ class DebianKDump(KDump, DebianPlugin, UbuntuPlugin):
             "/etc/default/kdump-tools"
         ])
 
+        try:
+            path = self.read_kdump_conffile()
+        except Exception:  # pylint: disable=broad-except
+            # set default path of coredir
+            path = "/var/crash"
+
+        self.add_dir_listing(path, recursive=True)
+        self.add_copy_spec([
+            f"{path}/kexec_cmd",
+            f"{path}/kdump_lock",
+            f"{path}/*/dmesg*",
+        ])
+        self.add_copy_spec(f"{path}/linux-image-*", sizelimit=2048, maxage=24)
+
+        # collect the latest dump created in the last 24hrs <= 2GB
+        if self.get_option("get-vm-core"):
+            self.add_copy_spec(f"{path}/*/dump*", sizelimit=2048, maxage=24)
+
 
 class CosKDump(KDump, CosPlugin):
 
diff --git a/sos/report/plugins/logs.py b/sos/report/plugins/logs.py
index 7f5ab6e..ebe43c9 100644
--- a/sos/report/plugins/logs.py
+++ b/sos/report/plugins/logs.py
@@ -56,7 +56,7 @@ class LogsBase(Plugin):
         ])
 
         self.add_cmd_output("journalctl --disk-usage")
-        self.add_dir_listing('/var/log', recursive=True)
+        self.add_dir_listing('/var/log', recursive=True, extra_opts='s')
 
         # collect journal logs if:
         # - there is some data present, either persistent or runtime only
diff --git a/sos/report/plugins/loki.py b/sos/report/plugins/loki.py
new file mode 100644
index 0000000..ab2a0ec
--- /dev/null
+++ b/sos/report/plugins/loki.py
@@ -0,0 +1,189 @@
+# Copyright (C) 2025 Canonical Ltd.,
+#                    Mateusz Kulewicz <[e-mail]>
+
+# This file is part of the sos project: https://github.com/sosreport/sos
+#
+# This copyrighted material is made available to anyone wishing to use,
+# modify, copy, or redistribute it subject to the terms and conditions of
+# version 2 of the GNU General Public License.
+#
+# See the LICENSE file in the source distribution for further information.
+
+from typing import Optional
+from datetime import datetime, timedelta, timezone
+from json import JSONDecodeError, dumps, loads
+from sos.report.plugins import Plugin, IndependentPlugin, PluginOpt
+
+
+class Loki(Plugin, IndependentPlugin):
+    """
+    Collects logs and configuration from Loki.
+
+    This plugin interacts with the Loki API to fetch logs based on specified
+    labels and provides options for pagination and label detection.
+    It also collects relevant configuration files and masks sensitive
+    information. It works with both charmed and non-charmed Loki.
+    To fetch internal Loki logs, run it from the Loki container.
+    You can also run it from another machine and fetch only logs from
+    Loki API, by providing the following parameters:
+        `-k loki.collect-logs=true -k loki.endpoint=LOKI_URL`
+
+    Usage:
+        sos report -o loki -k loki.collect-logs=true \
+            -k loki.labels=severity:charm -k loki.detect-labels=true \
+            -k loki.paginate=true -k loki.endpoint=LOKI_URL
+    """
+
+    short_desc = 'Loki service'
+    plugin_name = 'loki'
+    profiles = ('services', )
+    LOKI_QUERY_LIMIT = 5000
+    MAX_PAGINATION_ITERATIONS = 100
+
+    packages = ('loki', )
+
+    option_list = [
+        PluginOpt('collect-logs', default=False,
+                  desc='collect logs from Loki API'),
+        PluginOpt('detect-labels', default=False,
+                  desc=('fetch logs for all available labels. '
+                        'May result in multiple files with the same logs')),
+        PluginOpt('paginate', default=False,
+                  desc='fetch all available logs from Loki API.'),
+        PluginOpt('labels', default='', val_type=str,
+                  desc='colon-delimited list of labels to fetch logs from'),
+        PluginOpt('endpoint', default='http://localhost:3100', val_type=str,
+                  desc=('loki endpoint to fetch logs from. '
+                        'Defaults to http://localhost:3100.')),
+    ]
+
+    def query_command(self, endpoint, label, start: Optional[datetime],
+                      end: Optional[datetime]):
+        if not end:
+            end = datetime.now(timezone.utc)
+        if not start:
+            start = end - timedelta(days=1)
+
+        start_formatted = start.strftime("%Y-%m-%dT%H:%M:%S.%fZ")
+        end_formatted = end.strftime("%Y-%m-%dT%H:%M:%S.%fZ")
+
+        command = (
+            f"curl -G -s '{endpoint}/loki/api/v1/query_range' "
+            f"--data-urlencode 'query={{{label}=~\".+\"}}' "
+            f"--data-urlencode 'start={start_formatted}' "
+            f"--data-urlencode 'end={end_formatted}' "
+            f"--data-urlencode 'limit={Loki.LOKI_QUERY_LIMIT}' "
+        )
+        return command
+
+    def get_logs(self, endpoint, label, start: Optional[datetime],
+                 end: Optional[datetime]):
+        output = self.exec_cmd(self.query_command(endpoint, label, start, end))
+        try:
+            return loads(output["output"])
+        except JSONDecodeError:
+            # if an error is returned from Loki API, the output will be str
+            self._log_warn((f"An error was returned from Loki API on label "
+                            f"{label}. "
+                            f"Error message stored, not querying further."))
+            return output["output"]
+
+    def get_earliest_log_timestamp(self, logs):
+        log_streams = logs["data"]["result"]
+        # use now as a comparison
+        earliest_log = int(datetime.now().timestamp()*1_000_000_000)
+        for stream in log_streams:
+            for log in stream["values"]:
+                timestamp = int(log[0])
+                earliest_log = min(earliest_log, timestamp)
+        return earliest_log
+
+    def get_logs_for_label(self, endpoint, label, paginate):
+        logs = self.get_logs(endpoint, label, None, None)
+        with self.collection_file(f'{label}.log') as logfile:
+            logfile.write(dumps(logs, indent=2))
+        if isinstance(logs, str):
+            # don't paginate if error was returned
+            return
+
+        if paginate:
+            earliest_log = self.get_earliest_log_timestamp(logs)
+            previous_earliest_log = int(
+                datetime.now().timestamp()*1_000_000_000
+            )
+            iterations_count = 0
+            while iterations_count < Loki.MAX_PAGINATION_ITERATIONS and \
+                    earliest_log < previous_earliest_log:
+                log_timestamp = datetime.fromtimestamp(
+                                    earliest_log / 1_000_000_000)
+                new_logs = self.get_logs(endpoint, label, None, log_timestamp)
+                with self.collection_file(f'{label}.log.{iterations_count}') \
+                        as logfile:
+                    logfile.write(dumps(new_logs, indent=2))
+                if isinstance(new_logs, str):
+                    # don't paginate further if error was returned
+                    return
+                previous_earliest_log = earliest_log
+                earliest_log = \
+                    self.get_earliest_log_timestamp(new_logs)
+                # exit at most after 100 pages to avoid infinite loops
+                iterations_count += 1
+
+    def setup(self):
+        els_config_file = self.path_join("/etc/loki/*.yaml")
+        self.add_copy_spec(els_config_file)
+
+        # charms using cos-coordinated-workers have their config elsewhere
+        coordinated_workers_config_file = self.path_join("/etc/worker/*.yaml")
+        self.add_copy_spec(coordinated_workers_config_file)
+
+        self.add_copy_spec("/var/log/loki/*")
+        self.add_cmd_output("pebble logs loki -n 10000")
+
+        if self.get_option("collect-logs"):
+            endpoint = self.get_option("endpoint") or "http://localhost:3100"
+            self.labels = []
+            if labels_option := self.get_option("labels"):
+                if isinstance(labels_option, str) and labels_option:
+                    self.labels.extend(labels_option.split(":"))
+
+            if self.get_option("detect-labels"):
+                labels_cmd = self.collect_cmd_output(
+                    f"curl -G -s '{endpoint}/loki/api/v1/labels'"
+                )
+                labels_json = loads(labels_cmd["output"])
+                self.labels.extend(labels_json["data"])
+
+    def collect(self):
+        endpoint = self.get_option("endpoint") or "http://localhost:3100"
+        for label in self.labels:
+            paginate = self.get_option("paginate")
+            self.get_logs_for_label(endpoint, label, paginate)
+
+    def postproc(self):
+        protect_keys = [
+            "access_key_id",
+            "secret_access_key",
+        ]
+        loki_files = [
+            "/etc/loki/loki-local-config.yaml",
+            "/etc/loki/config.yaml",
+            "/etc/loki/local-config.yaml",
+            "/etc/loki/loki.yaml",
+            "/etc/worker/config.yaml",
+        ]
+
+        match_exp_multil = fr"({'|'.join(protect_keys)})\s*(:|=)(\S*\n.*?\\n)"
+        match_exp = fr"({'|'.join(protect_keys)})\s*(:|=)\s*[a-zA-Z0-9]*"
+
+        for file in loki_files:
+            self.do_file_sub(
+                file, match_exp_multil,
+                r"\1\2*********"
+            )
+            self.do_file_sub(
+                file, match_exp,
+                r"\1\2*********"
+            )
+
+# vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/lustre.py b/sos/report/plugins/lustre.py
index 1f19584..afaa264 100644
--- a/sos/report/plugins/lustre.py
+++ b/sos/report/plugins/lustre.py
@@ -49,6 +49,9 @@ class Lustre(Plugin, RedHatPlugin):
             ["version", "health_check", "debug"]
         )
 
+        # copy lnet settings if present
+        self.add_copy_spec("/etc/lnet.conf")
+
         # Client Specific
         self.add_cmd_output([
             "lfs df",
diff --git a/sos/report/plugins/md.py b/sos/report/plugins/md.py
index d49d8d9..b3ea95c 100644
--- a/sos/report/plugins/md.py
+++ b/sos/report/plugins/md.py
@@ -15,6 +15,7 @@ class Md(Plugin, IndependentPlugin):
 
     plugin_name = 'md'
     profiles = ('storage',)
+    packages = ('mdadm',)
 
     def setup(self):
         self.add_cmd_output("mdadm -D /dev/md*")
diff --git a/sos/report/plugins/microk8s.py b/sos/report/plugins/microk8s.py
index 72ef87a..183c3ea 100644
--- a/sos/report/plugins/microk8s.py
+++ b/sos/report/plugins/microk8s.py
@@ -42,9 +42,10 @@ class Microk8s(Plugin, UbuntuPlugin):
             'status',
             'version'
         ]
-        self.add_copy_spec(
-            "/var/snap/microk8s/current/credentials/client.config"
-        )
+        self.add_copy_spec([
+            "/var/snap/microk8s/current/args/*",
+            "/var/snap/microk8s/current/credentials/client.config",
+        ])
 
         self.add_cmd_output([
             f"{self.microk8s_cmd} {subcmd}" for subcmd in microk8s_subcmds
diff --git a/sos/report/plugins/networking.py b/sos/report/plugins/networking.py
index c831efc..51ab815 100644
--- a/sos/report/plugins/networking.py
+++ b/sos/report/plugins/networking.py
@@ -62,6 +62,7 @@ class Networking(Plugin):
             "/etc/network*",
             "/etc/nsswitch.conf",
             "/etc/resolv.conf",
+            "/etc/gai.conf",
             "/etc/xinetd.conf",
             "/etc/xinetd.d",
             "/etc/yp.conf",
@@ -71,6 +72,7 @@ class Networking(Plugin):
             "/sys/class/net/*/statistics/",
             "/etc/nmstate/",
             "/var/lib/lldpad/",
+            "/etc/services",
         ])
 
         self.add_forbidden_path([
diff --git a/sos/report/plugins/networkmanager.py b/sos/report/plugins/networkmanager.py
index f9853fc..06b2b10 100644
--- a/sos/report/plugins/networkmanager.py
+++ b/sos/report/plugins/networkmanager.py
@@ -22,6 +22,8 @@ class NetworkManager(Plugin, RedHatPlugin, UbuntuPlugin):
             "/etc/NetworkManager/system-connections/",
             "/usr/lib/NetworkManager/system-connections/",
             "/run/NetworkManager/system-connections/",
+            "/var/run/NetworkManager/system-connections/",
+            "/var/run/NetworkManager/backups/",
         ]
 
         self.add_copy_spec(self.system_connection_files)
@@ -33,8 +35,13 @@ class NetworkManager(Plugin, RedHatPlugin, UbuntuPlugin):
             "/usr/lib/NetworkManager/conf.d",
             "/run/NetworkManager/conf.d",
             "/var/lib/NetworkManager/NetworkManager-intern.conf",
+            "/var/run/NetworkManager",
         ])
 
+        self.add_forbidden_path(
+            "/var/run/NetworkManager/secret_key"
+        )
+
         self.add_journal(units="NetworkManager")
 
         self.add_cmd_output("NetworkManager --print-config")
diff --git a/sos/report/plugins/opensearch.py b/sos/report/plugins/opensearch.py
new file mode 100644
index 0000000..c079449
--- /dev/null
+++ b/sos/report/plugins/opensearch.py
@@ -0,0 +1,66 @@
+# Copyright (C) 2025 Henry AlOudaimy <[e-mail]>
+#
+# This file is part of the sos project: https://github.com/sosreport/sos
+#
+# This copyrighted material is made available to anyone wishing to use,
+# modify, copy, or redistribute it subject to the terms and conditions of
+# version 2 of the GNU General Public License.
+#
+# See the LICENSE file in the source distribution for further information.
+
+import re
+from sos.report.plugins import Plugin, IndependentPlugin
+
+
+class OpenSearch(Plugin, IndependentPlugin):
+
+    short_desc = 'OpenSearch service'
+    plugin_name = 'opensearch'
+    profiles = ('services', )
+
+    packages = ('opensearch',)
+    services = ('opensearch',)
+
+    def get_hostname_port(self, opensearch_config_file):
+        """ Get hostname and port number """
+        hostname = "localhost"
+        port = "9200"
+        try:
+            with open(opensearch_config_file, encoding='UTF-8') as fread:
+                for line in fread:
+                    network_host = re.search(r'(^network.host):(.*)', line)
+                    network_port = re.search(r'(^http.port):(.*)', line)
+                    if network_host and len(network_host.groups()) == 2:
+                        hostname = network_host.groups()[-1].strip()
+                        hostname = re.sub(r'"|\'', '', hostname)
+                        continue
+                    if network_port and len(network_port.groups()) == 2:
+                        port = network_port.groups()[-1].strip()
+        except Exception as err:  # pylint: disable=broad-except
+            self._log_info(f"Failed to parse {opensearch_config_file}: {err}")
+        return hostname, port
+
+    def setup(self):
+        opensearch_config_file = self.path_join(
+            "/etc/opensearch/opensearch.yml"
+        )
+        self.add_copy_spec(opensearch_config_file)
+
+        if self.get_option("all_logs"):
+            self.add_copy_spec("/var/log/opensearch/*")
+        else:
+            self.add_copy_spec("/var/log/opensearch/*.log")
+
+        host, port = self.get_hostname_port(opensearch_config_file)
+        endpoint = host + ":" + port
+        self.add_cmd_output([
+                f"curl -X GET '{endpoint}/_cluster/settings?pretty'",
+                f"curl -X GET '{endpoint}/_cluster/health?pretty'",
+                f"curl -X GET '{endpoint}/_cluster/stats?pretty'",
+                f"curl -X GET '{endpoint}/_cat/nodes?v'",
+                f"curl -X GET '{endpoint}/_cat/indices'",
+                f"curl -X GET '{endpoint}/_cat/shards'",
+                f"curl -X GET '{endpoint}/_cat/aliases'",
+        ])
+
+# vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/openshift_ovn.py b/sos/report/plugins/openshift_ovn.py
index cb48057..f8f8e66 100644
--- a/sos/report/plugins/openshift_ovn.py
+++ b/sos/report/plugins/openshift_ovn.py
@@ -1,5 +1,4 @@
 # Copyright (C) 2021 Nadia Pinaeva <[e-mail]>
-
 # This file is part of the sos project: https://github.com/sosreport/sos
 #
 # This copyrighted material is made available to anyone wishing to use,
@@ -8,6 +7,7 @@
 #
 # See the LICENSE file in the source distribution for further information.
 
+import glob
 from sos.report.plugins import Plugin, RedHatPlugin
 
 
@@ -18,9 +18,11 @@ class OpenshiftOVN(Plugin, RedHatPlugin):
     plugin_name = "openshift_ovn"
     containers = ('ovnkube-master', 'ovnkube-node', 'ovn-ipsec',
                   'ovnkube-controller')
+    runtime = 'crio'
     profiles = ('openshift',)
 
     def setup(self):
+
         all_logs = self.get_option("all_logs")
 
         self.add_copy_spec([
@@ -50,21 +52,29 @@ class OpenshiftOVN(Plugin, RedHatPlugin):
             'cluster/status OVN_Northbound',
             'ovn-appctl -t /var/run/ovn/ovnsb_db.ctl ' +
             'cluster/status OVN_Southbound'],
-            container='ovnkube-master')
-        self.add_cmd_output([
-            'ovs-appctl -t /var/run/ovn/ovn-controller.*.ctl ' +
-            'ct-zone-list'],
-            container='ovnkube-node')
-        self.add_cmd_output([
-            'ovs-appctl -t /var/run/ovn/ovn-controller.*.ctl ' +
-            'ct-zone-list'],
-            container='ovnkube-controller')
+            container='ovnkube-master',
+            runtime='crio')
+        # We need to determine the actual file name to send
+        # to the command
+        files = glob.glob("/var/run/ovn/ovn-controller.*.ctl")
+        for file in files:
+            self.add_cmd_output([
+                f"ovs-appctl -t {file} ct-zone-list"],
+                container='ovnkube-node',
+                runtime='crio')
+            self.add_cmd_output([
+                f"ovs-appctl -t {file} ct-zone-list"],
+                container='ovnkube-controller',
+                runtime='crio')
         # Collect ovs ct-zone-list directly on host for interconnect setup.
-        self.add_cmd_output([
-            'ovs-appctl -t /var/run/ovn-ic/ovn-controller.*.ctl ' +
-            'ct-zone-list'])
+        files = glob.glob("/var/run/ovn-ic/ovn-controller.*.ctl")
+        for file in files:
+            self.add_cmd_output([
+                f"ovs-appctl -t {file} ct-zone-list"],
+                runtime='crio')
         self.add_cmd_output([
             'ovs-appctl -t ovs-monitor-ipsec tunnels/show',
             'ipsec status',
             'certutil -L -d sql:/etc/ipsec.d'],
-            container='ovn-ipsec')
+            container='ovn-ipsec',
+            runtime='crio')
diff --git a/sos/report/plugins/openstack_aodh.py b/sos/report/plugins/openstack_aodh.py
index f558cd1..a7ba5cb 100644
--- a/sos/report/plugins/openstack_aodh.py
+++ b/sos/report/plugins/openstack_aodh.py
@@ -75,9 +75,8 @@ class OpenStackAodh(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "admin_password", "connection_password", "host_password",
-            "os_password", "password", "qpid_password", "rabbit_password",
-            "memcache_secret_key"
+            ".*_key",
+            "(.*_)?password",
         ]
         connection_keys = ["connection", "backend_url", "transport_url"]
 
diff --git a/sos/report/plugins/openstack_ceilometer.py b/sos/report/plugins/openstack_ceilometer.py
index c763ce1..833f74c 100644
--- a/sos/report/plugins/openstack_ceilometer.py
+++ b/sos/report/plugins/openstack_ceilometer.py
@@ -52,12 +52,15 @@ class OpenStackCeilometer(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "admin_password", "connection_password", "host_password",
-            "memcache_secret_key", "os_password", "password", "qpid_password",
-            "rabbit_password", "readonly_user_password", "secret_key",
-            "ssl_key_password", "telemetry_secret", "metering_secret"
+            ".*_key",
+            ".*_pass(wd|word)?",
+            ".*_secret",
+            "password",
+        ]
+        connection_keys = [
+            ".*_urls?",
+            "connection",
         ]
-        connection_keys = ["connection", "backend_url", "transport_url"]
 
         join_con_keys = "|".join(connection_keys)
 
diff --git a/sos/report/plugins/openstack_cinder.py b/sos/report/plugins/openstack_cinder.py
index 26ac024..4c5a092 100644
--- a/sos/report/plugins/openstack_cinder.py
+++ b/sos/report/plugins/openstack_cinder.py
@@ -143,16 +143,10 @@ class OpenStackCinder(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "admin_password", "backup_tsm_password", "chap_password",
-            "nas_password", "cisco_fc_fabric_password", "coraid_password",
-            "eqlx_chap_password", "fc_fabric_password",
-            "hitachi_auth_password", "hitachi_horcm_password",
-            "hp3par_password", "hplefthand_password", "memcache_secret_key",
-            "netapp_password", "netapp_sa_password", "nexenta_password",
-            "password", "qpid_password", "rabbit_password", "san_password",
-            "ssl_key_password", "vmware_host_password", "zadara_password",
-            "zfssa_initiator_password", "hmac_keys", "zfssa_target_password",
-            "os_privileged_user_password", "transport_url"
+            ".*_pass(wd|word)?",
+            ".*_keys?",
+            "password",
+            "transport_url",
         ]
         connection_keys = ["connection"]
 
diff --git a/sos/report/plugins/openstack_designate.py b/sos/report/plugins/openstack_designate.py
index a152c5a..5814100 100644
--- a/sos/report/plugins/openstack_designate.py
+++ b/sos/report/plugins/openstack_designate.py
@@ -85,9 +85,11 @@ class OpenStackDesignate(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "password", "connection", "transport_url", "admin_password",
-            "ssl_key_password", "ssl_client_key_password",
-            "memcache_secret_key"
+            ".*_key",
+            ".*_pass(wd|word)?",
+            "password",
+            "connection",
+            "transport_url",
         ]
         regexp = fr"(^\s*({'|'.join(protect_keys)})\s*=\s*)(.*)"
 
diff --git a/sos/report/plugins/openstack_glance.py b/sos/report/plugins/openstack_glance.py
index 9b80857..70530eb 100644
--- a/sos/report/plugins/openstack_glance.py
+++ b/sos/report/plugins/openstack_glance.py
@@ -98,10 +98,10 @@ class OpenStackGlance(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "admin_password", "password", "qpid_password", "rabbit_password",
-            "s3_store_secret_key", "ssl_key_password",
-            "vmware_server_password", "transport_url",
-            "memcache_secret_key"
+            ".*_key",
+            ".*_pass(wd|word)?",
+            "password",
+            "transport_url",
         ]
         connection_keys = ["connection"]
 
diff --git a/sos/report/plugins/openstack_heat.py b/sos/report/plugins/openstack_heat.py
index 32069a4..e1fffc7 100644
--- a/sos/report/plugins/openstack_heat.py
+++ b/sos/report/plugins/openstack_heat.py
@@ -117,9 +117,10 @@ class OpenStackHeat(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "admin_password", "memcache_secret_key", "password",
-            "qpid_password", "rabbit_password", "stack_domain_admin_password",
-            "transport_url", "auth_encryption_key",
+            ".*_key",
+            ".*_pass(wd|word)?",
+            "password",
+            "transport_url",
         ]
         connection_keys = ["connection"]
 
diff --git a/sos/report/plugins/openstack_instack.py b/sos/report/plugins/openstack_instack.py
index 01b839e..a62036c 100644
--- a/sos/report/plugins/openstack_instack.py
+++ b/sos/report/plugins/openstack_instack.py
@@ -21,13 +21,18 @@ NON_CONTAINERIZED_DEPLOY = [
         '/home/stack/undercloud.conf'
 ]
 CONTAINERIZED_DEPLOY = [
-        '/var/log/heat-launcher/',
+        '/etc/puppet/hieradata/',
+        '/etc/rhosp-release',
+        '/home/stack/*-deploy',
+        '/home/stack/.tripleo/history',
         '/home/stack/ansible.log',
         '/home/stack/config-download/',
         '/home/stack/install-undercloud.log',
+        '/home/stack/overcloud_install.log',
         '/home/stack/undercloud-install-*.tar.bzip2',
-        '/home/stack/.tripleo/history',
+        '/home/stack/undercloud.conf',
         '/var/lib/tripleo-config/',
+        '/var/log/heat-launcher/',
         '/var/log/tripleo-container-image-prepare.log',
 ]
 UNDERCLOUD_CONF_PATH = '/home/stack/undercloud.conf'
@@ -119,22 +124,9 @@ class OpenStackInstack(Plugin):
         # do_file_sub is case insensitive, so protected_keys can be lowercase
         # only
         protected_keys = [
-            "os_password",
-            "undercloud_admin_password",
-            "undercloud_ceilometer_metering_secret",
-            "undercloud_ceilometer_password",
-            "undercloud_ceilometer_snmpd_password",
-            "undercloud_db_password",
-            "undercloud_glance_password",
-            "undercloud_heat_password",
-            "undercloud_heat_stack_domain_admin_password",
-            "undercloud_horizon_secret_key",
-            "undercloud_ironic_password",
-            "undercloud_neutron_password",
-            "undercloud_nova_password",
-            "undercloud_rabbit_password",
-            "undercloud_swift_password",
-            "undercloud_tuskar_password",
+            ".*_password",
+            ".*_secret",
+            ".*_key",
         ]
         regexp = fr"(({'|'.join(protected_keys)})=)(.*)"
         self.do_file_sub("/home/stack/.instack/install-undercloud.log",
@@ -149,6 +141,10 @@ class OpenStackInstack(Plugin):
                          r'(password=)\w+',
                          r'\1*********')
 
+        self.do_file_sub('/home/stack/overcloud_install.log',
+                         r'(Found key: \\".*password.*\\" value: )(\\".+?\\")',
+                         r'\1\\"*********\\"')
+
 
 class RedHatRDOManager(OpenStackInstack, RedHatPlugin):
 
diff --git a/sos/report/plugins/openstack_ironic.py b/sos/report/plugins/openstack_ironic.py
index b63e240..7f9a366 100644
--- a/sos/report/plugins/openstack_ironic.py
+++ b/sos/report/plugins/openstack_ironic.py
@@ -142,9 +142,10 @@ class OpenStackIronic(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "dns_passkey", "memcache_secret_key", "rabbit_password",
-            "password", "qpid_password", "admin_password", "ssl_key_password",
-            "os_password", "transport_url"
+            ".*_(pass)?key",
+            ".*_pass(wd|word)?",
+            "password",
+            "transport_url",
         ]
         connection_keys = ["connection", "sql_connection"]
 
diff --git a/sos/report/plugins/openstack_keystone.py b/sos/report/plugins/openstack_keystone.py
index 220a037..52da44e 100644
--- a/sos/report/plugins/openstack_keystone.py
+++ b/sos/report/plugins/openstack_keystone.py
@@ -98,9 +98,9 @@ class OpenStackKeystone(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "password", "qpid_password", "rabbit_password", "ssl_key_password",
-            "ldap_dns_password", "neutron_admin_password", "host_password",
-            "admin_password", "admin_token", "ca_password", "transport_url",
+            "(.*_)?password",
+            "admin_token",
+            "transport_url",
             "OIDCClientSecret",
         ]
         connection_keys = ["connection"]
diff --git a/sos/report/plugins/openstack_neutron.py b/sos/report/plugins/openstack_neutron.py
index 678b985..788afdc 100644
--- a/sos/report/plugins/openstack_neutron.py
+++ b/sos/report/plugins/openstack_neutron.py
@@ -123,14 +123,9 @@ class OpenStackNeutron(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "rabbit_password", "qpid_password", "nova_admin_password",
-            "xenapi_connection_password", "password", "server_auth",
-            "admin_password", "metadata_proxy_shared_secret", "eapi_password",
-            "crd_password", "primary_l3_host_password", "serverauth",
-            "ucsm_password", "ha_vrrp_auth_password", "ssl_key_password",
-            "nsx_password", "vcenter_password", "edge_appliance_password",
-            "tenant_admin_password", "apic_password", "transport_url",
-            "memcache_secret_key"
+            "(.*_)?(key|password|secret)",
+            "server_?auth",
+            "transport_url",
         ]
         connection_keys = ["connection"]
 
diff --git a/sos/report/plugins/openstack_nova.py b/sos/report/plugins/openstack_nova.py
index 728aed1..1124862 100644
--- a/sos/report/plugins/openstack_nova.py
+++ b/sos/report/plugins/openstack_nova.py
@@ -29,6 +29,7 @@ class OpenStackNova(Plugin):
     var_puppet_gen = "/var/lib/config-data/puppet-generated/nova"
     service_name = "openstack-nova-api.service"
     apachepkg = None
+    postproc_dirs = ["/etc/nova/",]
 
     def setup(self):
 
@@ -141,24 +142,23 @@ class OpenStackNova(Plugin):
         self.add_copy_spec(specs)
 
     def apply_regex_sub(self, regexp, subst):
-        """ Apply regex substitution """
-        self.do_path_regex_sub("/etc/nova/*", regexp, subst)
-        for npath in ['', '_libvirt', '_metadata', '_placement']:
-            self.do_path_regex_sub(
-                f"{self.var_puppet_gen}{npath}/etc/nova/*",
-                regexp, subst)
+        """ Apply regex substitution to all sensitive dirs """
+        for _dir in self.postproc_dirs:
+            self.do_path_regex_sub(f"{_dir}/*", regexp, subst)
+            for npath in ['', '_libvirt', '_metadata', '_placement']:
+                self.do_path_regex_sub(
+                    f"{self.var_puppet_gen}{npath}{_dir}/*",
+                    regexp, subst)
 
     def postproc(self):
         protect_keys = [
-            "ldap_dns_password", "neutron_admin_password", "rabbit_password",
-            "qpid_password", "powervm_mgr_passwd", "virtual_power_host_pass",
-            "xenapi_connection_password", "password", "host_password",
-            "vnc_password", "admin_password", "connection_password",
-            "memcache_secret_key", "s3_secret_key",
-            "metadata_proxy_shared_secret", "fixed_key", "transport_url",
-            "rbd_secret_uuid"
+            ".*_key",
+            ".*_pass(wd|word)?",
+            "password",
+            "metadata_proxy_shared_secret",
+            "rbd_secret_uuid",
         ]
-        connection_keys = ["connection", "sql_connection"]
+        connection_keys = ["connection", "sql_connection", "transport_url"]
 
         join_con_keys = "|".join(connection_keys)
 
@@ -214,6 +214,7 @@ class RedHatNova(OpenStackNova, RedHatPlugin):
     apachepkg = "httpd"
     nova = False
     packages = ('openstack-selinux',)
+    postproc_dirs = ["/etc/nova/", "/var/lib/openstack/config/nova"]
 
     def setup(self):
         super().setup()
diff --git a/sos/report/plugins/openstack_sahara.py b/sos/report/plugins/openstack_sahara.py
index eeb5c97..f14eb0b 100644
--- a/sos/report/plugins/openstack_sahara.py
+++ b/sos/report/plugins/openstack_sahara.py
@@ -46,9 +46,9 @@ class OpenStackSahara(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "admin_password", "memcache_secret_key", "password",
-            "qpid_password", "rabbit_password", "ssl_key_password",
-            "xenapi_connection_password", "transport_url"
+            "(.*_)?password",
+            "memcache_secret_key",
+            "transport_url",
         ]
         connection_keys = ["connection"]
 
diff --git a/sos/report/plugins/openstack_swift.py b/sos/report/plugins/openstack_swift.py
index 9f3e2ef..22ee068 100644
--- a/sos/report/plugins/openstack_swift.py
+++ b/sos/report/plugins/openstack_swift.py
@@ -55,10 +55,9 @@ class OpenStackSwift(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "ldap_dns_password", "neutron_admin_password", "rabbit_password",
-            "qpid_password", "powervm_mgr_passwd", "virtual_power_host_pass",
-            "xenapi_connection_password", "password", "host_password",
-            "vnc_password", "admin_password", "transport_url"
+            ".*_pass(wd|word)?",
+            "password",
+            "transport_url",
         ]
         connection_keys = ["connection", "sql_connection"]
 
diff --git a/sos/report/plugins/openstack_trove.py b/sos/report/plugins/openstack_trove.py
index 4eb7a95..d97209e 100644
--- a/sos/report/plugins/openstack_trove.py
+++ b/sos/report/plugins/openstack_trove.py
@@ -45,9 +45,10 @@ class OpenStackTrove(Plugin):
 
     def postproc(self):
         protect_keys = [
-            "default_password_length", "notifier_queue_password",
-            "rabbit_password", "replication_password", "admin_password",
-            "dns_passkey", "transport_url", "memcache_secret_key"
+            ".*_(password|key)",
+            "default_password_length",
+            "dns_passkey",
+            "transport_url",
         ]
         connection_keys = ["connection"]
 
diff --git a/sos/report/plugins/podman.py b/sos/report/plugins/podman.py
index 5269933..973ba0a 100644
--- a/sos/report/plugins/podman.py
+++ b/sos/report/plugins/podman.py
@@ -64,7 +64,8 @@ class Podman(Plugin, RedHatPlugin, UbuntuPlugin):
             'ps -a',
             'stats --no-stream --all',
             'version',
-            'volume ls'
+            'volume ls',
+            'system df -v',
         ]
 
         self.add_cmd_output([f"podman {s}" for s in subcmds])
diff --git a/sos/report/plugins/powerpc.py b/sos/report/plugins/powerpc.py
index cb216ee..5c888d0 100644
--- a/sos/report/plugins/powerpc.py
+++ b/sos/report/plugins/powerpc.py
@@ -93,7 +93,9 @@ class PowerPC(Plugin, IndependentPlugin):
                 f"ctsnap -xrunrpttr -d {ctsnap_path}",
                 "lsdevinfo",
                 "lsslot",
-                "amsstat"
+                "amsstat",
+                "lsslot -c phb",
+                "lsslot -c pci",
             ])
 
             # Due to the lack of options in invscout for generating log files
diff --git a/sos/report/plugins/pulpcore.py b/sos/report/plugins/pulpcore.py
index d4afc91..4b126e7 100644
--- a/sos/report/plugins/pulpcore.py
+++ b/sos/report/plugins/pulpcore.py
@@ -32,6 +32,7 @@ class PulpCore(Plugin, IndependentPlugin):
     staticroot = "/var/lib/pulp/assets"
     uploaddir = "/var/lib/pulp/media/upload"
     env = {"PGPASSWORD": dbpasswd}
+    settings_file = "/etc/pulp/settings.py"
 
     def parse_settings_config(self):
         """ Parse pulp settings """
@@ -47,7 +48,7 @@ class PulpCore(Plugin, IndependentPlugin):
             return val
 
         try:
-            with open("/etc/pulp/settings.py", 'r', encoding='UTF-8') as file:
+            with open(self.settings_file, 'r', encoding='UTF-8') as file:
                 # split the lines to "one option per line" format
                 for line in file.read() \
                         .replace(',', ',\n').replace('{', '{\n') \
@@ -87,23 +88,36 @@ class PulpCore(Plugin, IndependentPlugin):
         self.env = {"PGPASSWORD": self.dbpasswd}
 
     def setup(self):
+        self.runas = self.in_container = None
+        rhui_podman_ps = self.exec_cmd("podman ps --filter name=rhui5-rhua",
+                                       runas="rhui")
+        if rhui_podman_ps['status'] == 0:
+            lines = rhui_podman_ps['output'].splitlines()
+            if len(lines) > 1:  # we know there is a container of given name
+                self.runas = 'rhui'
+                self.in_container = 'rhui5-rhua'
+                self.settings_file = '/var/lib/rhui/config/pulp/settings.py'
         self.parse_settings_config()
 
         self.add_copy_spec([
             "/etc/pulp/settings.py",
             "/etc/pki/pulp/*"
-        ])
+        ], runas=self.runas, container=self.in_container)
+
         # skip collecting certificate keys
         self.add_forbidden_path("/etc/pki/pulp/**/*.key")
 
         self.add_cmd_output("curl -ks https://localhost/pulp/api/v3/status/",
-                            suggest_filename="pulp_status")
+                            suggest_filename="pulp_status", runas=self.runas,
+                            container=self.in_container)
         dynaconf_env = {"LC_ALL": "en_US.UTF-8",
                         "PULP_SETTINGS": "/etc/pulp/settings.py",
                         "DJANGO_SETTINGS_MODULE": "pulpcore.app.settings"}
-        self.add_cmd_output("dynaconf list", env=dynaconf_env)
+        self.add_cmd_output("dynaconf list", env=dynaconf_env,
+                            runas=self.runas, container=self.in_container)
         for _dir in [self.staticroot, self.uploaddir]:
-            self.add_dir_listing(_dir)
+            self.add_dir_listing(_dir, runas=self.runas,
+                                 container=self.in_container)
 
         task_days = self.get_option('task-days')
         for table in ['core_task', 'core_taskgroup',
@@ -113,13 +127,17 @@ class PulpCore(Plugin, IndependentPlugin):
                       "AND table_schema = 'public' AND column_name NOT IN"
                       " ('args', 'kwargs', 'enc_args', 'enc_kwargs'))"
                       " TO STDOUT;")
-            col_out = self.exec_cmd(self.build_query_cmd(_query), env=self.env)
+            col_out = self.exec_cmd(self.build_query_cmd(_query, csv=False),
+                                    env=self.env,
+                                    runas=self.runas,
+                                    container=self.in_container)
             columns = col_out['output'] if col_out['status'] == 0 else '*'
             _query = (f"select {columns} from {table} where pulp_last_updated"
                       f"> NOW() - interval '{task_days} days' order by"
                       " pulp_last_updated")
-            _cmd = self.build_query_cmd(_query)
-            self.add_cmd_output(_cmd, env=self.env, suggest_filename=table)
+            _cmd = self.build_query_cmd(_query, csv=True)
+            self.add_cmd_output(_cmd, env=self.env, suggest_filename=table,
+                                runas=self.runas, container=self.in_container)
 
         # collect tables sizes, ordered
         _cmd = self.build_query_cmd(
@@ -135,10 +153,12 @@ class PulpCore(Plugin, IndependentPlugin):
             "pg_total_relation_size(reltoastrelid) AS toast_bytes "
             "FROM pg_class c LEFT JOIN pg_namespace n ON "
             "n.oid = c.relnamespace WHERE relkind = 'r') a) a order by "
-            "total_bytes DESC"
+            "total_bytes DESC",
+            csv=False
         )
         self.add_cmd_output(_cmd, suggest_filename='pulpcore_db_tables_sizes',
-                            env=self.env)
+                            env=self.env, runas=self.runas,
+                            container=self.in_container)
 
     def build_query_cmd(self, query, csv=False):
         """
@@ -150,7 +170,7 @@ class PulpCore(Plugin, IndependentPlugin):
         """
         if csv:
             query = f"COPY ({query}) TO STDOUT " \
-                    "WITH (FORMAT 'csv', DELIMITER ',', HEADER)"
+                    "WITH (FORMAT 'csv', DELIMITER ';', HEADER)"
         _dbcmd = "psql --no-password -h %s -p %s -U %s -d %s -c %s"
         return _dbcmd % (self.dbhost, self.dbport,
                          self.dbuser, self.dbname, quote(query))
diff --git a/sos/report/plugins/pxe.py b/sos/report/plugins/pxe.py
deleted file mode 100644
index 3468d1d..0000000
--- a/sos/report/plugins/pxe.py
+++ /dev/null
@@ -1,50 +0,0 @@
-# This file is part of the sos project: https://github.com/sosreport/sos
-#
-# This copyrighted material is made available to anyone wishing to use,
-# modify, copy, or redistribute it subject to the terms and conditions of
-# version 2 of the GNU General Public License.
-#
-# See the LICENSE file in the source distribution for further information.
-
-from sos.report.plugins import (Plugin, RedHatPlugin, DebianPlugin,
-                                UbuntuPlugin, PluginOpt)
-
-
-class Pxe(Plugin):
-
-    short_desc = 'PXE service'
-    plugin_name = "pxe"
-    profiles = ('sysmgmt', 'network')
-    option_list = [
-        PluginOpt('tftpboot', default=False,
-                  desc='collect content from tftpboot path')
-    ]
-
-
-class RedHatPxe(Pxe, RedHatPlugin):
-
-    files = ('/usr/sbin/pxeos',)
-    packages = ('system-config-netboot-cmd',)
-
-    def setup(self):
-        super().setup()
-        self.add_cmd_output("/usr/sbin/pxeos -l")
-        self.add_copy_spec("/etc/dhcpd.conf")
-        if self.get_option("tftpboot"):
-            self.add_copy_spec("/tftpboot")
-
-
-class DebianPxe(Pxe, DebianPlugin, UbuntuPlugin):
-
-    packages = ('tftpd-hpa',)
-
-    def setup(self):
-        super().setup()
-        self.add_copy_spec([
-            "/etc/dhcp/dhcpd.conf",
-            "/etc/default/tftpd-hpa"
-        ])
-        if self.get_option("tftpboot"):
-            self.add_copy_spec("/var/lib/tftpboot")
-
-# vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/release.py b/sos/report/plugins/release.py
index 8c8a91a..fd32096 100644
--- a/sos/report/plugins/release.py
+++ b/sos/report/plugins/release.py
@@ -6,8 +6,8 @@
 #
 # See the LICENSE file in the source distribution for further information.
 
-from sos.report.plugins import Plugin, RedHatPlugin, \
-    DebianPlugin, UbuntuPlugin, CosPlugin
+from sos.report.plugins import (Plugin, RedHatPlugin, DebianPlugin,
+                                UbuntuPlugin, CosPlugin)
 
 
 class Release(Plugin, UbuntuPlugin, CosPlugin):
diff --git a/sos/report/plugins/rhc.py b/sos/report/plugins/rhc.py
index 67f5167..2ecf9e4 100644
--- a/sos/report/plugins/rhc.py
+++ b/sos/report/plugins/rhc.py
@@ -8,7 +8,7 @@
 #
 # See the LICENSE file in the source distribution for further information.
 
-from sos.report.plugins import Plugin, RedHatPlugin
+from sos.report.plugins import Plugin, RedHatPlugin, SoSPredicate
 
 
 class Rhc(Plugin, RedHatPlugin):
@@ -30,9 +30,10 @@ class Rhc(Plugin, RedHatPlugin):
             "/var/log/rhc-worker-playbook",
         ])
 
-        self.add_cmd_output([
+        self.add_cmd_output(
             "rhc status",
-        ])
+            pred=SoSPredicate(self, services=["rhsm"])
+        )
 
     def postproc(self):
         # hide workers/foreman_rh_cloud.toml FORWARDER_PASSWORD
diff --git a/sos/report/plugins/rhui_containerized.py b/sos/report/plugins/rhui_containerized.py
new file mode 100644
index 0000000..6059106
--- /dev/null
+++ b/sos/report/plugins/rhui_containerized.py
@@ -0,0 +1,85 @@
+# Copyright (C) 2025 Red Hat, Inc., Pavel Moravec <[e-mail]>
+
+# This file is part of the sos project: https://github.com/sosreport/sos
+#
+# This copyrighted material is made available to anyone wishing to use,
+# modify, copy, or redistribute it subject to the terms and conditions of
+# version 2 of the GNU General Public License.
+#
+# See the LICENSE file in the source distribution for further information.
+
+import fnmatch
+from sos.report.plugins import Plugin, RedHatPlugin
+
+
+class RhuiContainer(Plugin, RedHatPlugin):
+
+    short_desc = 'Red Hat Update Infrastructure in Containers'
+
+    plugin_name = "rhui_containerized"
+    services = ("rhui_rhua", )
+    files = ("/var/lib/rhui/config/rhua/rhui-tools.conf", )
+
+    def setup(self):
+        self.add_copy_spec([
+            "/var/lib/rhui/config/rhua/rhui-tools.conf",
+            "/var/lib/rhui/config/rhua/registered_subscriptions.conf",
+            "/var/lib/rhui/pki/*",
+            "/var/lib/rhui/cache/*",
+            "/var/lib/rhui/root/.rhui/*",
+            "/var/lib/rhui/log/*",
+        ])
+        # skip collecting certificate keys
+        self.add_forbidden_path("/var/lib/rhui/pki/**/*.key")
+
+        # call rhui-manager commands with 1m timeout and
+        # with an env. variable ensuring that "RHUI Username:"
+        # even unanswered prompt gets collected
+        # TODO: is the timeout and env applicable?
+        rhui_cont_exe = "podman exec rhui5-rhua rhui-manager --noninteractive"
+        for subcmd in ["status", "cert info"]:
+            suggest_fname = f"rhui-manager_{subcmd.replace(' ', '_')}"
+            self.add_cmd_output(f"{rhui_cont_exe} {subcmd}",
+                                runas="rhui",
+                                runat="/var/lib/rhui",
+                                suggest_filename=suggest_fname)
+
+        self.add_dir_listing('/var/lib/rhui/remote_share', recursive=True)
+
+        # collect postgres diagnostics data
+        # ideally, postgresql plugin would do so but that would need bigger
+        # changes to the plugin redundantly affecting its execution on
+        # non-RHUI systems
+        pghome = '/var/lib/pgsql'
+        self.add_cmd_output(f"du -sh {pghome}", container='rhui5-rhua',
+                            runas='rhui')
+        # Copy PostgreSQL log and config files.
+        # we must first find all their names, since `stat` inside add_copy_spec
+        # does not treat globs at all
+        podman_find = self.exec_cmd("podman exec rhui5-rhua find "
+                                    f"{pghome}/data", runas="rhui")
+        if podman_find['status'] == 0:
+            allfiles = podman_find['output'].splitlines()
+            logfiles = fnmatch.filter(allfiles, '*.log')
+            configs = fnmatch.filter(allfiles, '*.conf')
+            self.add_copy_spec(logfiles, container='rhui5-rhua', runas='rhui')
+            self.add_copy_spec(configs, container='rhui5-rhua', runas='rhui')
+        # copy PG_VERSION and postmaster.opts
+        for file in ["PG_VERSION", "postmaster.opts"]:
+            self.add_copy_spec(f"{pghome}/data/{file}",
+                               container='rhui5-rhua', runas='rhui')
+
+    def postproc(self):
+        # hide registry_password value in rhui-tools.conf
+        self.do_path_regex_sub("/var/lib/rhui/config/rhua/rhui-tools.conf",
+                               r"(.+_pass(word|):)\s*(.+)",
+                               r"\1 ********")
+        # obfuscate two cookies for login session
+        for cookie in ["csrftoken", "sessionid"]:
+            self.do_path_regex_sub(
+                r"/var/lib/rhui/root/\.rhui/.*/cookies.txt",
+                fr"({cookie}\s+)(\S+)",
+                r"\1********")
+
+
+# vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/saltmaster.py b/sos/report/plugins/saltmaster.py
index 6edd3fb..110a609 100644
--- a/sos/report/plugins/saltmaster.py
+++ b/sos/report/plugins/saltmaster.py
@@ -21,6 +21,8 @@ class SaltMaster(Plugin, IndependentPlugin):
     packages = ('salt-master', 'salt-api',)
 
     def setup(self):
+        self.collected_pillar_roots = []
+
         if self.get_option("all_logs"):
             self.add_copy_spec("/var/log/salt")
         else:
@@ -61,11 +63,22 @@ class SaltMaster(Plugin, IndependentPlugin):
                     cfg_pillar_roots = []
                 all_pillar_roots.extend(cfg_pillar_roots)
 
+        self.collected_pillar_roots = all_pillar_roots
         self.add_copy_spec(all_pillar_roots)
 
     def postproc(self):
-        regexp = r'(^\s+.*(pass|secret|(?<![A-z])key(?![A-z])).*:\ ).+$'
+        regexp = (
+            r'(^\s*.*(pass|secret|(?<![A-z])key(?![A-z])|'
+            r'api_?key|encryption_?key).*:\ ).+'
+        )
         subst = r'\1******'
+
         self.do_path_regex_sub("/etc/salt/*", regexp, subst)
 
+        for pillar_root in self.collected_pillar_roots:
+            normalized_root = pillar_root if pillar_root.endswith('/') else (
+                f"{pillar_root}/"
+            )
+            self.do_path_regex_sub(f"{normalized_root}*", regexp, subst)
+
 # vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/scsi.py b/sos/report/plugins/scsi.py
index 1680d20..4e27d8c 100644
--- a/sos/report/plugins/scsi.py
+++ b/sos/report/plugins/scsi.py
@@ -60,6 +60,7 @@ class Scsi(Plugin, IndependentPlugin):
             "lsscsi -s",
             "lsscsi -L",
             "lsscsi -iw",
+            "lsscsi -t",
         ])
 
         scsi_hosts = glob("/sys/class/scsi_host/*")
diff --git a/sos/report/plugins/snapm.py b/sos/report/plugins/snapm.py
new file mode 100644
index 0000000..2c327b0
--- /dev/null
+++ b/sos/report/plugins/snapm.py
@@ -0,0 +1,38 @@
+# Copyright (C) 2025 Red Hat, Inc., Bryn M. Reeves <[e-mail]>
+# This file is part of the sos project: https://github.com/sosreport/sos
+#
+# This copyrighted material is made available to anyone wishing to use,
+# modify, copy, or redistribute it subject to the terms and conditions of
+# version 2 of the GNU General Public License.
+#
+# See the LICENSE file in the source distribution for further information.
+
+from sos.report.plugins import Plugin, RedHatPlugin
+
+
+class Snapm(Plugin, RedHatPlugin):
+
+    short_desc = 'Snapsot manager'
+
+    plugin_name = 'snapm'
+    profiles = ('boot', 'system', 'storage')
+
+    packages = (
+        'python3-snapm',
+        'snapm',
+    )
+
+    def setup(self):
+        self.add_copy_spec([
+            "/etc/snapm",
+        ])
+
+        self.add_cmd_output([
+            "snapm snapset list",
+            "snapm snapshot list",
+            "snapm plugin list",
+            "snapm schedule list",
+            "snapm -vv --debug=all snapset show",
+        ])
+
+# vim: set et ts=4 sw=4 :
diff --git a/sos/report/plugins/spyre.py b/sos/report/plugins/spyre.py
new file mode 100644
index 0000000..a681eeb
--- /dev/null
+++ b/sos/report/plugins/spyre.py
@@ -0,0 +1,97 @@
+# This file is part of the sos project: https://github.com/sosreport/sos
+#
+# This copyrighted material is made available to anyone wishing to use,
+# modify, copy, or redistribute it subject to the terms and conditions of
+# version 2 of the GNU General Public License.
+#
+# See the LICENSE file in the source distribution for further information.
+#
+# This plugin enables collection of logs for system with IBM Spyre card
+
+from sos.report.plugins import Plugin, IndependentPlugin
+
+
+class Spyre(Plugin, IndependentPlugin):
+    """Spyre chip is IBM’s AI accelerator, designed to handle AI inferencing
+    and workloads.
+
+    The Spyre plugin collects data about the Spyre card’s VFIO device node
+    tree, configuration files, and more.
+    """
+
+    short_desc = 'IBM Spyre Accelerator Information'
+    plugin_name = 'spyre'
+    architectures = ('ppc.*',)
+
+    @staticmethod
+    def get_ibm_spyre_devices(lspci_output):
+        """Extract PCI domain, bus, device, function for devices that match:
+        - Vendor ID = 0x1014 (IBM)
+        - Device ID = 0x06a7 or 0x06a8
+
+        Parameters
+        ----------
+        lspci_out : str
+        The output string from `lspci -n`.
+
+        Returns
+        -------
+        list of tuples
+        A list of (domain, bus, device, function) tuples for each matching
+        card.
+        """
+
+        spyre_cards = []
+
+        if not lspci_output:
+            return None
+
+        for line in lspci_output.splitlines():
+            if not line.strip():
+                continue
+
+            try:
+                pci_addr, _class, ids, _rest = line.split(maxsplit=3)
+                vendor, device = ids.lower().split(":")
+            except ValueError:
+                continue
+
+            if vendor == "1014" and device in ("06a7", "06a8"):
+                if pci_addr.count(":") == 1:
+                    pci_addr = "0000:" + pci_addr
+                try:
+                    domain, bus, dev_func = pci_addr.split(":")
+                    pci_device, function = dev_func.split(".")
+                except ValueError:
+                    continue
+
+                spyre_cards.append((domain, bus, pci_device, function))
+
+        return spyre_cards
+
+    def setup(self):
+
+        lspci = self.exec_cmd("lspci -n")
+        if lspci['status'] != 0:
+            return
+
+        spyre_cards = self.get_ibm_spyre_devices(lspci['output'])
+
+        # Nothing to collect if spyre card is not found
+        if not spyre_cards: