diff --git a/.agents/AGENTS.md b/.agents/AGENTS.md new file mode 100644 index 00000000..10cd4d92 --- /dev/null +++ b/.agents/AGENTS.md @@ -0,0 +1,24 @@ +## Release Notes Formatting Rules + +When adding new server release notes (under `doc-server/docs/releases/server/`): + +1. **Frontmatter Invariants**: + - Set `sidebar_position: -` where `` corresponds to the version hierarchy (e.g., `-110` for `1.1.0`, `-100` for `1.0.0`, `-99` for `0.99.0`). This ensures proper sorting in Docusaurus. + +2. **Bullet Points**: + - Always use `-` instead of `*` for list items. + +3. **Entry Cleaning**: + - Remove GitHub usernames and pull request URLs (e.g. strip `by @username in https://github...` from the end of each line). + - Normalize prefixes: remove scopes like `(infra)` or `(security)` from the tag prefix (e.g. simplify `fix(infra):` to `fix:`). + - Capitalize the first letter of the description. + +4. **Categorization & Sorting**: + - Group entries into the standard categories: `Troubleshoot`, `Notifications`, `Tickets`, `Workflow`, `Cloud`, `AI`, `Integrations`. + - Within each category, sort features (`feat:`) first, followed by fixes (`fix:`). + +5. **Exclusions**: + - Omit internal developer chores, infrastructure/CI updates, test suites, back-merges, and package dependency bumps. + +6. **Index Updates**: + - Link the new release page at the top of the "Recent Releases" list on the release index page (`doc-server/docs/releases/server/index.md`). diff --git a/doc-server/docs/FAQ.md b/doc-server/docs/FAQ.md index 9bcc52e0..cffe6b51 100644 --- a/doc-server/docs/FAQ.md +++ b/doc-server/docs/FAQ.md @@ -1,5 +1,5 @@ --- -sidebar_position: 4 +sidebar_position: 100 --- # FAQ @@ -17,6 +17,16 @@ sidebar_position: 4 - TensorFlow for recommendations for replicas - AWS Bedrock using LLAMA (optional) for AI-based recommendations on logs/errors +### What are the hard dependencies for the NudgeBee Server? +- **PostgreSQL**: Hard requirement. Stores cluster configurations, user metadata, alert rules, and workflow states. Queries and services fail without it. +- **RabbitMQ**: Hard requirement. Powers internal message queues between backend services and workers. Consumers will not bootstrap without it. +- **Redis**: Optional. Falls back to in-memory caching if omitted. + +### Is the NudgeBee Agent mandatory if I already connected a cloud account? +- **Cloud Account Connection** provides inventory discovery across your AWS/Azure/GCP resources and auto-detects existing Kubernetes clusters. +- **The Agent** is required inside each cluster to collect real-time workload metrics, stream pod logs, capture eBPF network telemetry, and perform automated AI root cause analysis. +- For full AI troubleshooting and cost optimizations on a cluster, installing the Agent is required. + ### What are the pre-conditions(software/hardware) for installing NudgeBee on my cluster? #### For Agent: diff --git a/doc-server/docs/features/Cloud/AWS.md b/doc-server/docs/features/Cloud/AWS.md index 42e1bc31..fef7673f 100644 --- a/doc-server/docs/features/Cloud/AWS.md +++ b/doc-server/docs/features/Cloud/AWS.md @@ -73,25 +73,60 @@ StackSets deploy only to **member** accounts, not the management account itself. --- -## CloudWatch Alarms Permissions - -NudgeBee collects existing CloudWatch alarms from your AWS account and can create new alarms based on recommendations. - -### Permissions Included in CloudFormation Template - -The CloudFormation template includes: - -**Read permissions** (via `ReadOnlyAccess` managed policy): -``` -cloudwatch:DescribeAlarms -cloudwatch:DescribeAlarmsForMetric +## Least-Privilege IAM Policy (Manual Role Creation) + +If you prefer to create a custom IAM role manually instead of using the managed CloudFormation template, attach the following least-privilege policy document to your cross-account role: + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "NudgeBeeCloudWatchDiscovery", + "Effect": "Allow", + "Action": [ + "cloudwatch:DescribeAlarms", + "cloudwatch:DescribeAlarmsForMetric", + "cloudwatch:GetMetricData", + "cloudwatch:ListMetrics" + ], + "Resource": "*" + }, + { + "Sid": "NudgeBeeEKSDiscovery", + "Effect": "Allow", + "Action": [ + "eks:DescribeCluster", + "eks:ListClusters" + ], + "Resource": "*" + }, + { + "Sid": "NudgeBeeCostAndUsageDiscovery", + "Effect": "Allow", + "Action": [ + "cur:DescribeReportDefinitions", + "ce:GetCostAndUsage", + "ce:GetCostForecast", + "ce:GetDimensionValues" + ], + "Resource": "*" + }, + { + "Sid": "NudgeBeeCURS3Access", + "Effect": "Allow", + "Action": [ + "s3:GetBucketLocation", + "s3:ListBucket", + "s3:GetObject" + ], + "Resource": [ + "arn:aws:s3:::", + "arn:aws:s3:::/*" + ] + } + ] +} ``` -**Write permissions** (included when the account is connected in **Standard** access mode): -``` -cloudwatch:PutMetricAlarm -``` - -These permissions allow NudgeBee to both monitor existing alarms and create new ones for your resources. - diff --git a/doc-server/docs/features/optimizations.md b/doc-server/docs/features/optimizations.md index ac2b8c9a..c7c79b07 100644 --- a/doc-server/docs/features/optimizations.md +++ b/doc-server/docs/features/optimizations.md @@ -13,7 +13,50 @@ NudgeBee's **FinOps AI-Assistant** continuously analyzes your Kubernetes workloa To automatically apply optimization recommendations without manual approval, configure [Autopilot Auto-Optimize](../autopilot/auto_optimize/). To have NudgeBee raise pull requests with the recommended changes, connect a [GitHub](../integrations/Code%20Repository/GitHub/github-integration.md) or [GitLab](../integrations/Code%20Repository/GitLab/gitlab-integration.md) repository. ::: -![NudgeBee Optimize summary showing potential monthly savings, prioritized right-sizing recommendations, and a per-account cost and health overview](./img/optimize-overview.png) +--- + +## Right-Sizing Calculation Methodology + +NudgeBee uses deterministic statistical analysis over historical Prometheus metrics to calculate safe resource recommendations: + +| Recommendation Type | Observation Window | Sizing Metric | Strategy & Risk Profile | +|---|---|---|---| +| **CPU Limits** | Past 14 Days | Max P99 + 20% Headroom | **Low Risk** — Prevents CPU throttling during unexpected traffic spikes. | +| **CPU Requests** | Past 14 Days | P95 Utilization | **Low Risk** — Maximizes bin-packing efficiency across worker nodes. | +| **Memory Limits** | Past 7 Days | Peak Utilization + 15% Buffer | **Zero OOM Tolerance** — Prevents kernel OOM-killer termination of stateful pods. | +| **Memory Requests** | Past 7 Days | Peak Utilization | **Low Risk** — Eliminates idle reserved memory overhead. | +| **Unattached Volumes** | Past 30 Days | 0 Read/Write IOPS | **Zero Impact** — Flags unmounted, detached PVCs/EBS volumes for safe removal. | + +### Pricing Engine + +Cost figures are calculated using: +- **In-Cluster OpenCost Engine**: Accurately accounts for node instance types, storage classes, and shared namespace allocations. +- **Cloud Provider Pricing APIs**: Real-time integration with AWS Pricing API, GCP Cloud Billing, and Azure Retail Rates. +- **Custom Discount Rates**: Support for enterprise discount agreements (EDP/MCA) and reserved instance commitments. + +--- + +## GitOps & Automated Pull Request Workflow + +Instead of applying manual `kubectl` patches, NudgeBee enables infrastructure-as-code teams to review and merge recommendations via GitOps pull requests: + +```mermaid +graph LR + O[FinOps Recommendation] --> G[NudgeBee Git Engine] + G --> B[Create Branch & Commit Diff] + B --> PR[Open Pull Request in GitHub / GitLab] + PR --> CI[CI / ArgoCD / Flux Deployment] +``` + +### How to Raise Automated PRs + +1. Connect your repository under **Admin $\rightarrow$ Integrations $\rightarrow$ Code Repositories** ([GitHub](../integrations/Code%20Repository/GitHub/github-integration.md) or [GitLab](../integrations/Code%20Repository/GitLab/gitlab-integration.md)). +2. Navigate to **Optimizations $\rightarrow$ Workload Right-Sizing**. +3. Select the target deployment or StatefulSet. +4. Click **Create Pull Request**. +5. NudgeBee creates a new branch, updates the Helm `values.yaml` or Terraform manifest with the recommended CPU/memory requests and limits, and opens a Pull Request with a clear rationale table for your engineering team to review. + +--- ### Watch a Walkthrough diff --git a/doc-server/docs/features/security.md b/doc-server/docs/features/security.md index ecae5140..cac49dd3 100644 --- a/doc-server/docs/features/security.md +++ b/doc-server/docs/features/security.md @@ -20,6 +20,30 @@ NudgeBee does not store passwords. All authentication is handled through SSO pro ## Authorization - Currently, NudgeBee supports tenant level authorization with 2 roles(admin, readonly) +## Kubernetes Agent RBAC & Least-Privilege Permissions + +For security compliance teams reviewing the in-cluster agent deployment, the NudgeBee agent requests read-only Kubernetes `ClusterRole` permissions by default: + +| API Group | Resources | Verb Permissions | Purpose | +|---|---|---|---| +| `""` (Core) | `pods`, `nodes`, `namespaces`, `services`, `endpoints`, `events`, `persistentvolumes`, `persistentvolumeclaims` | `get`, `list`, `watch` | Topology mapping, resource health, and incident triage. | +| `apps` | `deployments`, `statefulsets`, `daemonsets`, `replicasets` | `get`, `list`, `watch` | Workload configuration and right-sizing analysis. | +| `batch` | `jobs`, `cronjobs` | `get`, `list`, `watch` | Batch workload failure detection. | +| `networking.k8s.io` | `ingresses`, `networkpolicies` | `get`, `list`, `watch` | Traffic routing and network topology mapping. | +| `autoscaling` | `horizontalpodautoscalers` | `get`, `list`, `watch` | HPA scaling tracking. | + +:::note No Secret Data Access +The agent **never reads Secret data contents** (`get` or `list` on `secrets` is excluded from default ClusterRole bindings). +::: + +## Network Security & Firewall Rules + +| Traffic Flow | Direction | Protocol / Port | Destination | Purpose | +|---|---|---|---|---| +| **Agent to Server** | Outbound | TCP `443` (WSS / HTTPS) | `app.nudgebee.com` or self-hosted Ingress | Streaming metrics, events, and telemetry. | +| **Agent to Cloud Pricing** | Outbound | TCP `443` (HTTPS) | AWS, GCP, Azure pricing endpoints | OpenCost pricing calculations. | +| **Server to In-Cluster Relay** | Inbound / Internal | TCP `8080` (Internal ClusterIP) | `relay-server.nudgebee.svc` | Real-time agent relay communication. | + ## Audit - User operations are tracked and can be viewed on the UI. diff --git a/doc-server/docs/features/troubleshooting/index.md b/doc-server/docs/features/troubleshooting/index.md index e7edf4f7..0448ad11 100644 --- a/doc-server/docs/features/troubleshooting/index.md +++ b/doc-server/docs/features/troubleshooting/index.md @@ -16,10 +16,70 @@ NudgeBee's troubleshooting dashboard gives you a real-time view of events, error - **Attach event playbooks** — Run evidence-collection actions (logs, metrics, custom SQL, kubectl, cloud CLI, SSH, …) automatically on each event so the LLM has the data it needs. See [Playbook Catalog](./playbook-catalog.md). - **Understand the split between playbooks and workflows** — Playbooks gather evidence for the LLM; [workflows](../workflow-builder/index.md) post-process the resulting event (triage, ticketing, remediation). See [Event Playbooks vs Workflows](./event-playbooks-vs-workflows.md). -:::info -**Prerequisites**: To use troubleshooting features, you need at least one [Kubernetes cluster connected](../../installation/agent/installation/) and an [observability source integrated](../../integrations/Observability/). For AI-powered analysis, an [LLM connection](../../integrations/LLM/) is also needed. +:::info Prerequisites +To use troubleshooting features, you need at least one [Kubernetes cluster connected](../../installation/agent/installation/) and an [observability source integrated](../../integrations/Observability/). For AI-powered analysis, an [LLM connection](../../integrations/LLM/) is also needed. ::: +--- + +## How NuBi Investigates Incidents + +NuBi does not simply summarize alerts — it performs multi-hop reasoning over the **Semantic Knowledge Graph (SKG)** to find the true root cause: + +```mermaid +graph LR + E[Kubernetes Event
CrashLoopBackOff] --> T[1. Topology Traversal
Pod → Deployment → Node → Ingress] + T --> L[2. Evidence Gathering
Pod Logs + Exit Code + Events] + L --> G[3. Knowledge Graph Linkage
Correlate ConfigMaps / Secrets / Commits] + G --> R[4. Root Cause Hypothesis
Missing API Secret in Namespace] + R --> A[5. Remediation Plan
kubectl create secret ...] +``` + +1. **Topology Traversal**: Navigates from the failing entity upstream and downstream across Kubernetes objects, namespaces, and cloud dependencies. +2. **Evidence Collection**: Queries Prometheus metrics for resource spikes, fetches pod stdout/stderr logs around the timestamp, and inspects recent Kubernetes events. +3. **Change & Config Correlation**: Cross-references recent CI/CD deployments, git commits, ConfigMap changes, and Secret references. +4. **Causality Synthesis**: Forms a structured 5-Whys explanation backed by exact timestamps, log snippets, and trace IDs. + +--- + +## Execution Guardrails & Human-in-the-Loop + +NudgeBee is designed with strict enterprise safety controls: + +- **Default Mode (Human-in-the-Loop)**: NuBi produces diagnostic conclusions and generates exact remediation commands (e.g. `kubectl patch`, rollback commands, or secret creations). NuBi **never runs destructive commands automatically** without explicit human one-click approval in the UI or Slack. +- **Autopilot Mode (Policy-Gated)**: If you enable [Autopilot](../autopilot/autopilot.md), safe non-destructive operations (such as pod restarts, vertical right-sizing, or node drains) can be executed automatically according to rules and schedules you define. +- **Audit Logging**: Every action proposed, approved, or executed is logged with user attribution for compliance. + +--- + +## Sample Incident Walkthrough: CrashLoopBackOff + +Here is an end-to-end example of NuBi diagnosing an outage caused by a missing database secret: + +``` +[Incident Alert] Pod auth-service-78d49fb99-x7k2q is CrashLoopBackOff in namespace production +``` + +#### 1. Evidence Collected by NuBi +- **K8s Event**: `Warning BackOff Back-off 5m0s restarting failed container auth-app` +- **Pod Container Log**: `FATAL: Failed to read DB_PASSWORD from environment variable: Secret "auth-db-secret" not found` +- **Recent Change**: Helm upgrade `auth-service` release `v2.4.1` deployed 4 minutes ago with a new secret key reference. + +#### 2. NuBi's Reasoning Output +> **Root Cause**: The `auth-service` deployment was upgraded to `v2.4.1` which introduced a reference to Secret `auth-db-secret`, but the secret was not created in the `production` namespace prior to deployment. +> +> **Recommended Fix**: +> ```bash +> kubectl create secret generic auth-db-secret \ +> --from-literal=DB_PASSWORD="" \ +> -n production +> ``` + +#### 3. Action +Click **Apply Fix** in the UI to create the secret, or click **Create Jira Ticket** to assign it to the on-call team with the full investigation payload attached. + +--- + ### Watch a Walkthrough
@@ -30,3 +90,4 @@ NudgeBee's troubleshooting dashboard gives you a real-time view of events, error - **[Alerting](./alerting.md)** — Configure custom alerting rules and attach playbook actions for auto-triage. - **[Playbook Catalog](./playbook-catalog.md)** — Full reference of every event-playbook action and its parameters, including custom data-collection (proxy DB query, cloud CLI, SSH, kubectl). - **[Templating & Best Practices](./templating.md)** — Use gonja (Jinja-style) templates in action parameters, with patterns for labels, outputs, conditionals, and `for_each` loops. + diff --git a/doc-server/docs/features/workflow-builder/index.md b/doc-server/docs/features/workflow-builder/index.md index 03f95935..7db6eeb5 100644 --- a/doc-server/docs/features/workflow-builder/index.md +++ b/doc-server/docs/features/workflow-builder/index.md @@ -191,28 +191,47 @@ You can make tasks run conditionally or branch your workflow using special task 3. Connect different downstream tasks to each case branch 4. Conditional connections appear as colored, thicker lines with a condition label -### Using Template Expressions +### Using Template Expressions & Variables -Template expressions let you use dynamic values in task parameters. They use the `{{ }}` syntax. +Template expressions allow you to dynamically pass data between workflow steps, evaluate conditional branching, and reference global configurations. They use double curly braces `{{ }}`. -**Common patterns:** +#### Variable Reference Cheatsheet -| Expression | Description | -|-----------|-------------| -| `{{ Task.output.value }}` | Reference an output from a previous task | -| `{{ Configs.key_name }}` | Reference a shared configuration value | -| `{{ variable == "value" }}` | Conditional expression for branching or filtering | -| `{{ event.source == "my-source" }}` | Filter expression for event triggers | +| Expression Syntax | Scope | Description & Example | +|---|---|---| +| `{{ steps..output }}` | Task Output | Full JSON output of a completed prior task. | +| `{{ steps.fetch_logs.output.log_lines }}` | Nested Field | Extract a specific field or array from a previous task's output. | +| `{{ event.source }}` | Event Trigger | Originating event source (e.g. `prometheus`, `kubernetes`, `aws_eventbridge`). | +| `{{ event.payload.cluster }}` | Event Payload | Name of the cluster where the event was detected. | +| `{{ event.payload.namespace }}` | Event Payload | Kubernetes namespace of the affected entity. | +| `{{ Configs. }}` | Global Config | Value of a shared secret or global constant (e.g. `{{ Configs.slack_channel_alerts }}`). | +| `{{ input. }}` | Manual Input | User-supplied parameter from a manual run modal. | -**Where you can use them:** -- Any text or textarea field in task parameters -- Conditional execution fields -- Event filter expressions -- Output parameter definitions +--- + +## Cookbook: 3 Ready-to-Use Workflow Blueprints + +Below are 3 popular workflow patterns you can import or assemble in minutes: + +### 1. Automated Node Drain on Spot Termination Notice +**Trigger**: Event (`source == "aws_eventbridge"`, `detail-type == "EC2 Spot Instance Interruption Warning"`) +- **Step 1 (`Kubectl`)**: Taint node: `kubectl cordon {{ event.payload.instance_id }}` +- **Step 2 (`Kubectl`)**: Safely evict workloads: `kubectl drain {{ event.payload.instance_id }} --ignore-daemonsets --delete-emptydir-data --grace-period=120` +- **Step 3 (`IM Notification`)**: Send Slack message: `⚠️ Node {{ event.payload.instance_id }} drained ahead of spot termination.` -**How to insert them:** -- Type the expression directly using `{{ }}` syntax -- Or drag an output field from the **Previous tasks outputs** panel in the task configuration sidebar +### 2. Slack Alert Enrichment with Pod Logs & RCA +**Trigger**: Event (`source == "prometheus"`, `severity == "critical"`) +- **Step 1 (`Query Logs`)**: Fetch last 100 log lines from the crashing pod: `{{ event.payload.pod_name }}` +- **Step 2 (`LLM Investigation`)**: Feed logs and events into NuBi for automated diagnosis: `Investigate root cause for {{ steps.query_logs.output.logs }}` +- **Step 3 (`IM Notification`)**: Post an interactive Slack card with the pod status, root cause summary, and one-click remediation button. + +### 3. Automated Cleanup of Orphaned PVs & Stale Namespaces +**Trigger**: Schedule (Cron: `0 2 * * 0` — every Sunday at 2 AM) +- **Step 1 (`Kubectl`)**: List unattached PersistentVolumes in `Released` state: `kubectl get pv -o json` +- **Step 2 (`Manual Approval`)**: Send summary to SRE team with approval button before deletion. +- **Step 3 (`Kubectl`)**: Delete approved released PVs and reclaim cloud storage costs. + +--- ## Managing Workflows diff --git a/doc-server/docs/index.md b/doc-server/docs/index.md index 68b44925..291e1265 100644 --- a/doc-server/docs/index.md +++ b/doc-server/docs/index.md @@ -18,6 +18,47 @@ The **Community** edition is free, Apache 2.0 licensed, and fully functional — --- +--- + +## Get Started in 3 Steps: Fork in the Road + +Choose your path to get up and running: + +
+
+

⚡ Option A: Cloud SaaS (5 mins)

+

Zero infrastructure to manage. Evaluated and ready instantly.

+
    +
  1. Sign up at app.nudgebee.com.
    2. +
  2. Install the Agent on your cluster (or connect your cloud account).
    3. +
  3. Connect Slack and start exploring AI insights.
    4. +
+
+
+

🛡️ Option B: Self-Hosted / On-Prem

+

Complete data isolation inside your own Kubernetes environment.

+
    +
  1. Deploy NudgeBee Server on your Kubernetes cluster via Helm.
    2. +
  2. Configure your BYOM LLM provider (or local Ollama/vLLM).
    3. +
  3. Install the Agent on monitored clusters.
    4. +
+
+
+ +--- + +## Core Concepts & Glossary + +| Term | Definition | Role in Platform | +|---|---|---| +| **NuBi** | **SRE AI Agent** | Interacts in natural language via UI or Slack/Teams, investigates incidents, pulls traces/logs, and performs root cause analysis. | +| **NudgeBee Agent** | **In-Cluster Collector** | Lightweight DaemonSet & runner deployed inside monitored Kubernetes clusters to stream metrics, events, and eBPF network telemetry. | +| **NudgeBee Server** | **Control Plane** | Hosts the web dashboard, API, Semantic Knowledge Graph, database, and workflow orchestration engine. | +| **Semantic Knowledge Graph (SKG)** | **Relational Dependency Map** | Live topological graph correlating pods, nodes, cloud services, metrics, traces, git commits, and tickets. | +| **Autopilot** | **Automated Operations** | Policy-gated automated right-sizing and self-healing runbooks with configurable human approval checkpoints. | + +--- + ## Deployment Models NudgeBee is available in two deployment models — and self-hosted comes in two **editions** (free Community and licensed Enterprise — see [Editions](./editions.md)). Choose what fits your organization's requirements: @@ -42,23 +83,17 @@ NudgeBee has two components, both packaged as Helm charts that deploy natively o | **[NudgeBee Server](./installation/server/index.md)** | The control plane — hosts the UI, Semantic Knowledge Graph, AI agents, and workflow engine. | **Self-hosted users only.** Cloud SaaS users skip this — NudgeBee hosts it for you. | | **[NudgeBee Agent](./installation/agent/installation/index.md)** | Lightweight collector that runs inside each cluster you want to monitor. Collects workload data and sends it to the server. | **Everyone** — both SaaS and self-hosted users. | -:::info -**Self-hosted users**: You need a dedicated Kubernetes cluster (or namespace) to run the NudgeBee Server before connecting your monitored clusters. See the [Server Installation Guide](./installation/server/) for requirements — typically a 2-node cluster with 16 GB RAM and 4 cores per node is sufficient for up to 400 monitored nodes. +:::info Infrastructure Prerequisite +**Self-hosted users**: You need a dedicated Kubernetes cluster (or namespace) to run the NudgeBee Server before connecting your monitored clusters. Sizing typically requires a 2-node cluster with 16 GB RAM and 4 cores per node. If you do not have Kubernetes clusters to run the server on, choose **Cloud SaaS**. ::: -Once the server is running (or you have signed up for SaaS), there are two ways to connect your monitored infrastructure — both take just a few minutes: - -### Option 1: Connect a Cloud Account — Fastest Way to Start +### Connecting Your Infrastructure -Connect your cloud account ([AWS](./features/Cloud/AWS.md), [Azure](./features/Cloud/Azure.md), or [GCP](./features/Cloud/GCP.md)) and NudgeBee automatically discovers all Kubernetes clusters mapped to that account. You get immediate visibility across your entire cloud infrastructure — no need to install anything on individual clusters upfront. +Once the server is running (or you have signed up for SaaS), connect your infrastructure: -### Option 2: Install the Agent Directly on a Cluster +- **1. Connect a Cloud Account (Broad Inventory & Cluster Discovery)**: Connecting [AWS](./features/Cloud/AWS.md), [Azure](./features/Cloud/Azure.md), or [GCP](./features/Cloud/GCP.md) automatically discovers cloud resources, managed Kubernetes clusters, load balancers, and billing data across your accounts. +- **2. Install the Agent (Deep Telemetry & Real-Time AI RCA)**: To enable deep workload monitoring, pod log analysis, distributed tracing, and live AI debugging on specific clusters, install the [NudgeBee Agent](./installation/agent/installation/index.md) inside each target cluster. -Install the [NudgeBee Agent](./installation/agent/installation/index.md) directly into each Kubernetes cluster you want to monitor. The agent is a lightweight Helm chart that takes about 5 minutes to deploy. It collects detailed workload data and sends it to the NudgeBee server for deep monitoring, cost analysis, and AI-powered troubleshooting. - -:::tip -**Not sure which to pick?** If you have multiple clusters across cloud accounts, start with the cloud account connection for instant discovery. You can always install agents on specific clusters later for deeper monitoring and automation capabilities. -::: --- diff --git a/doc-server/docs/installation/agent/installation/index.md b/doc-server/docs/installation/agent/installation/index.md index fd9cf37a..c64300ef 100644 --- a/doc-server/docs/installation/agent/installation/index.md +++ b/doc-server/docs/installation/agent/installation/index.md @@ -1,10 +1,15 @@ ---- -sidebar_position: 1 ---- +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; # Agent Installation -Install the NudgeBee Agent on each Kubernetes cluster you want to monitor. The agent collects workload data, performance metrics, cost information, and security insights, and sends them to the NudgeBee server — feeding the Semantic Knowledge Graph that powers NudgeBee's AI troubleshooting, optimization recommendations, and automation. +Install the NudgeBee Agent on each Kubernetes cluster you want to monitor. The agent runs as a lightweight collector DaemonSet and controller within your cluster. It gathers live workload telemetry, resource utilization, events, logs, and distributed traces, streaming them to the NudgeBee Server to build the **Semantic Knowledge Graph** for real-time AI troubleshooting and cost optimizations. + +:::note[Do I need the Agent?] +- **Connecting a Cloud Account** (AWS/Azure/GCP) provides high-level cloud inventory and cluster auto-discovery without installing software upfront. +- **Installing the Agent** inside the cluster is **required for deep in-cluster telemetry**, live pod logs, kernel-level eBPF network metrics, OpenCost pricing analysis, and automated AI incident RCA. +- Both **Cloud SaaS** and **Self-Hosted** deployments install the exact same agent into monitored clusters. +::: :::tip **Estimated time**: 5–10 minutes per cluster using the quick install script, or 10–15 minutes for manual Helm installation. @@ -40,34 +45,18 @@ Install the NudgeBee Agent on each Kubernetes cluster you want to monitor. The a | **Kubernetes cluster** | v1.27 or newer | The cluster you want to monitor | | **Helm** | v3.x installed and configured | [Install Helm](https://helm.sh/) if you don't have it | | **Linux Kernel** | v4.2 or newer on all nodes | Required for eBPF-based network metrics collection | -| **NudgeBee Auth Key** | Generated from the NudgeBee UI | See [Step 1](#step-1-generate-your-auth-key) below | -| **Registry access** | Outbound access to `nudgebee.github.io` (public Helm repo) and `ghcr.io/nudgebee` (public agent images) | Air-gapped clusters can mirror the images to their own registry and override `runner.image.repository` / `nodeAgent.image.repository` | -| **Prometheus** | A running Prometheus instance in the cluster | If you don't have one, the install script can set it up for you | - -:::tip -**Already have Prometheus running?** You just need its URL (e.g., `http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090`). If you don't have Prometheus, don't worry — the quick install script or the manual steps below will install it for you. -::: +| **NudgeBee Auth Key** | Generated from the NudgeBee UI | Go to **Kubernetes** $\rightarrow$ **Connect Cluster** | +| **Registry access** | Outbound access to `nudgebee.github.io` (Helm repo) and `ghcr.io/nudgebee` (agent images) | Air-gapped clusters can mirror images internally | +| **Prometheus** | A running Prometheus instance in the cluster | If omitted, the installer can deploy a bundled instance | ### Resource Footprint -The agent is lightweight. Here is what it uses on a cluster with up to 100 nodes: +The agent components are designed to be low overhead: -| Component | Typical Usage | Upper Limit | Notes | -|---|---|---|---| -| **Node Agent** | 100 MiB RAM, 0.1 CPU | 1 GiB RAM, 0.5 CPU | Runs on each node (DaemonSet) | -| **Runner** | 500 MiB RAM, 0.1 CPU | 2 GiB RAM, 0.5 CPU | Central controller — one per cluster | -| **Event Watcher** | 200 MiB RAM, 0.1 CPU | 1 GiB RAM, 0.5 CPU | Monitors K8s events | -| **Tracing** (optional) | 1 GiB RAM, 0.1 CPU | 2 GiB RAM, 0.5 CPU | Requires 50 GiB PVC | - -:::info -**Prometheus and logging** are not included in the table above — their resource usage depends on your existing setup. If the installer sets up Prometheus for you, expect an additional 1–2 GiB RAM. -::: - -### Network - -- **Outbound to NudgeBee** — WebSocket and HTTP to the NudgeBee server (cloud or self-hosted) for data delivery. -- **Outbound to cloud pricing APIs** — AWS, Azure, GCP endpoints for cost data (used by OpenCost). -- **Internal cluster access** — The agent uses Kubernetes RBAC to read workload and event data. All required roles are automatically created by the Helm chart ([see RBAC definition](https://raw.githubusercontent.com/nudgebee/k8s-agent/main/charts/nudgebee-agent/templates/runner-service-account.yaml)). +| Component | Sizing Breakdown | Notes | +|---|---|---| +| **Agent Core (without Prometheus)** | **~3 GB RAM, 2 CPU cores** | Includes Runner, Node Agent DaemonSet, Event Watcher, OpenCost | +| **Agent with Bundled Observability** | **~6 GB RAM, 3 CPU cores** | Includes Prometheus, Alertmanager, and Kube-State-Metrics | --- @@ -76,23 +65,19 @@ The agent is lightweight. Here is what it uses on a cluster with up to 100 nodes ### Step 1: Generate Your Auth Key 1. Log in to [app.nudgebee.com](https://app.nudgebee.com) (or your self-hosted NudgeBee UI). -2. Go to **Kubernetes** → **Connect Cluster**. -3. Enter a name for your cluster and click **Connect**. -4. Copy the **Auth Key** that is generated. +2. Navigate to **Kubernetes** $\rightarrow$ **Connect Cluster** in the left sidebar. +3. Enter a friendly name for your cluster and click **Connect**. +4. Copy the generated **Auth Key** (``). -:::caution -Keep your Auth Key secure — it authenticates the agent with the NudgeBee server. Do not commit it to version control. Use Kubernetes secrets or a secrets manager in production. +:::caution Blast Radius of Auth Key +Your Auth Key authorizes your agent to send data to your NudgeBee control plane. Store it securely in a secret manager or Kubernetes Secret — never commit it in cleartext. ::: ### Step 2: Choose Your Installation Method -Pick one of the two methods below. The quick install script is the fastest option — it detects your environment and handles dependencies automatically. - ---- - #### Option A: Quick Install Script (Recommended) -The fastest way to get the agent running. The script detects your environment, installs Prometheus if needed, and deploys the agent — all in one step. +The automated script detects your cluster environment, sets up Prometheus if not already present, and deploys the agent with optimal defaults: ```bash wget https://raw.githubusercontent.com/nudgebee/k8s-agent/refs/heads/prod/installation.sh @@ -100,77 +85,126 @@ chmod +x installation.sh ./installation.sh -a ``` -Replace `` with the auth key you copied in Step 1. - -That's it — the script handles everything else. Skip to [Verify the Installation](#3-verify-the-installation). - --- -#### Option B: Manual Helm Installation +#### Option B: Manual Helm Installation by Environment -Use this method if you need more control over the installation, want to customize Helm values, or are in a restricted environment where you can't run external scripts. +Select your Kubernetes environment below for tailored Helm installation commands: -**B1. Install Prometheus** (skip if you already have Prometheus running) + + ```bash +# 1. Add NudgeBee Helm repository +helm repo add nudgebee-agent https://nudgebee.github.io/k8s-agent/ +helm repo update + +# 2. Install Prometheus (skip if already running in cluster) helm upgrade --install nudgebee-prometheus prometheus-community/kube-prometheus-stack \ --namespace nudgebee-agent --create-namespace \ --set nodeExporter.enabled=true \ - --set pushgateway.enabled=false \ --set alertmanager.enabled=true \ --set kubeStateMetrics.enabled=true \ -f https://raw.githubusercontent.com/nudgebee/k8s-agent/main/extra-scrape-config.yaml + +# 3. Deploy NudgeBee Agent +helm upgrade --install nudgebee-agent nudgebee-agent/nudgebee-agent \ + --namespace nudgebee-agent --create-namespace \ + --set runner.nudgebee.auth_secret_key="" \ + --set globalConfig.prometheus_url="http://nudgebee-prometheus-kube-prometheus-prometheus.nudgebee-agent.svc:9090" \ + --set opencost.opencost.prometheus.external.url="http://nudgebee-prometheus-kube-prometheus-prometheus.nudgebee-agent.svc:9090" ``` -**B2. Add the NudgeBee Helm repo** + + ```bash +# 1. Add NudgeBee Helm repository helm repo add nudgebee-agent https://nudgebee.github.io/k8s-agent/ helm repo update -``` -**B3. Install the agent** +# 2. Deploy NudgeBee Agent (with GCP Cloud Billing API key for OpenCost) +helm upgrade --install nudgebee-agent nudgebee-agent/nudgebee-agent \ + --namespace nudgebee-agent --create-namespace \ + --set runner.nudgebee.auth_secret_key="" \ + --set globalConfig.prometheus_url="http://nudgebee-prometheus-kube-prometheus-prometheus.nudgebee-agent.svc:9090" \ + --set opencost.opencost.prometheus.external.url="http://nudgebee-prometheus-kube-prometheus-prometheus.nudgebee-agent.svc:9090" \ + --set opencost.opencost.exporter.cloudProviderApiKey="" +``` -For **Cloud SaaS** users: + + ```bash +# 1. Add NudgeBee Helm repository +helm repo add nudgebee-agent https://nudgebee.github.io/k8s-agent/ +helm repo update + +# 2. Deploy NudgeBee Agent (Azure Monitor integration enabled) helm upgrade --install nudgebee-agent nudgebee-agent/nudgebee-agent \ --namespace nudgebee-agent --create-namespace \ --set runner.nudgebee.auth_secret_key="" \ - --set globalConfig.prometheus_url="" \ - --set opencost.opencost.prometheus.external.url="" + --set nodeAgent.enabled=true \ + --set nodeAgent.podmonitor.enabled=true \ + --set nodeAgent.podmonitor.azuremanaged=true ``` -Replace: -- `` — the auth key from Step 1 -- `` — your Prometheus endpoint (e.g., `http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090`) + + + +```bash +# 1. Add NudgeBee Helm repository +helm repo add nudgebee-agent https://nudgebee.github.io/k8s-agent/ +helm repo update -For **self-hosted** users, see the [Self-Hosted Configuration](#4-for-self-hosted-nudgebee) section below — you need additional settings to point the agent to your own server. +# 2. Deploy NudgeBee Agent with minimal local footprint +helm upgrade --install nudgebee-agent nudgebee-agent/nudgebee-agent \ + --namespace nudgebee-agent --create-namespace \ + --set runner.nudgebee.auth_secret_key="" \ + --set nodeAgent.resources.requests.cpu="50m" \ + --set nodeAgent.resources.requests.memory="64Mi" +``` + + + --- -## 3. Verify the Installation +## 3. Verify the Installation (Checklist) {#3-verify-the-installation} -After installation, check that the agent pods are running: +After running the install command, verify that the agent is communicating with the server: +### 1. Verify Pod Readiness ```bash kubectl get pods -n nudgebee-agent ``` +**Expected Output:** +- `nudgebee-runner-*`: `1/1 Running` +- `nudgebee-node-agent-*` (DaemonSet): `1/1 Running` on every worker node +- `nudgebee-event-watcher-*`: `1/1 Running` -All pods should show `Running` status within 1–2 minutes. - -Then confirm your cluster appears in NudgeBee: +### 2. Inspect Agent Connection Logs +```bash +kubectl logs -n nudgebee-agent -l app=nudgebee-runner --tail=50 +``` +Look for log confirmation: `Connected to NudgeBee Relay successfully` and `Registration acknowledged`. -1. Open the NudgeBee UI ([app.nudgebee.com](https://app.nudgebee.com) or your self-hosted URL). +### 3. Check the NudgeBee Dashboard +1. Open [app.nudgebee.com](https://app.nudgebee.com) or your self-hosted dashboard. 2. Navigate to **Kubernetes**. -3. Your cluster should appear within 2–3 minutes, and workload data starts populating shortly after. +3. Your cluster should display with a **Connected** badge, and nodes and workload pods will start populating within 2 minutes. + +--- + +## Troubleshooting Common Errors + +| Error Symptom | Cause | Resolution | +|---|---|---| +| **`401 Unauthorized / Invalid API Key`** | Incorrect or revoked Auth Key | Verify the key from **Kubernetes $\rightarrow$ Connect Cluster** and re-run `helm upgrade` with `--set runner.nudgebee.auth_secret_key=""`. | +| **`WebSocket Dial Timeout / EOF`** | Outbound firewall blocking WebSocket | Ensure the cluster network allows outbound TCP traffic to port 443 (for SaaS `app.nudgebee.com` or your Ingress `relay.`). | +| **`CRD / Webhook timeout error`** | Prometheus operator CRDs not yet established | Re-run the `helm upgrade` command. Helm will resume once the CRDs finish registering. | +| **`Prometheus connection refused / empty metrics`** | Wrong Prometheus service URL | Ensure `globalConfig.prometheus_url` points to an accessible Prometheus service DNS (e.g. `http://..svc:9090`). | -:::tip -**Expected outcome**: You should see your cluster name in the Kubernetes section, with nodes, workloads, and pods populating automatically. If the cluster does not appear after 5 minutes, check the agent pod logs: -```bash -kubectl logs -n nudgebee-agent -l app=nudgebee-runner -``` -::: --- diff --git a/doc-server/docs/installation/agent/release/index.md b/doc-server/docs/installation/agent/release/index.md deleted file mode 100644 index 8a99006e..00000000 --- a/doc-server/docs/installation/agent/release/index.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -sidebar_position: 1 ---- - -# Agent Releases - -The NudgeBee Agent is a crucial component that collects data from your Kubernetes clusters and sends it back to the NudgeBee server for analysis, optimization, and troubleshooting. Keeping your agents up-to-date is essential to ensure you're getting the most accurate data and benefit from the latest features, bug fixes, and security enhancements. - -## Where to Find Agent Releases - -The official releases for the NudgeBee Agent are published on GitHub: [https://github.com/nudgebee/k8s-agent/releases](https://github.com/nudgebee/k8s-agent/releases) \ No newline at end of file diff --git a/doc-server/docs/installation/index.md b/doc-server/docs/installation/index.md index 875bee35..827aa1c5 100644 --- a/doc-server/docs/installation/index.md +++ b/doc-server/docs/installation/index.md @@ -3,12 +3,37 @@ sidebar_position: 1 sidebar_label: Installation Overview --- -# Installation Guide +# Choose Your Deployment Model -Follow these guides to install and configure NudgeBee components in your environment. +Before you install, select the deployment model that matches your organization's requirements: -## Components +- **Cloud SaaS** — NudgeBee hosts and manages the server control plane for you. You only install the **NudgeBee Agent** on each Kubernetes cluster you want monitored (or connect a cloud account for instant discovery). Generate your auth key in the UI and go straight to [Agent Installation](./agent/installation/index.md). +- **Self-Hosted** — You run the **NudgeBee Server** inside your own Kubernetes cluster, giving you full data ownership and air-gapped support. Deploy the [Server](./server/index.md) first, then install the [Agent](./agent/installation/index.md) on each monitored cluster. + +:::info Scope & Infrastructure Prerequisites +**Kubernetes-Specialized**: NudgeBee monitors Kubernetes workloads. +- **Have Kubernetes clusters to monitor?** Choose either Cloud SaaS or Self-Hosted. +- **No Kubernetes clusters at all?** The self-hosted server requires a Kubernetes cluster (v1.27+) to run on. If you do not have Kubernetes infrastructure, self-hosting is not an option — use **Cloud SaaS**, and add clusters when you are ready to monitor them. +::: + +--- + +## Decision Matrix + +Use the table below to determine the exact path for your setup: + +| Your Situation | Recommended Model | Where to Go | +|---|---|---| +| **Want fastest start & zero infra management** | **Cloud SaaS** | [Agent Installation](./agent/installation/index.md) (or [Cloud Account Discovery](../features/Cloud/index.md)) | +| **Strict data residency / air-gapped environment** | **Self-Hosted** | [Server Installation](./server/index.md) $\rightarrow$ then [Agent Installation](./agent/installation/index.md) | +| **Evaluating free open-source edition** | **Self-Hosted (Community)** | [Server Installation](./server/index.md) (select Community edition) | +| **No Kubernetes clusters yet** | **Cloud SaaS** | Sign up at [app.nudgebee.com](https://app.nudgebee.com) — add clusters when ready | + +--- + +## Installation Components + +* **[Server Installation](./server/index.md)** — *(Self-hosted only)* Deploy the central control plane, Semantic Knowledge Graph, and workflow engine to your Kubernetes cluster. +* **[K8s Agent Installation](./agent/installation/index.md)** — *(Everyone)* Install the lightweight collector DaemonSet and runner into each Kubernetes cluster you want to monitor. +* **[Proxy Agent](./proxy-agent/index.md)** — *(Optional)* Deploy secure proxy connectivity to private datasources, isolated databases, or internal endpoints. -* [Server](./server/index.md) — Deploy the central control plane for analysis and management. -* [K8s Agent](./agent/index.md) — Install the agent in your Kubernetes cluster to collect telemetry. -* [Proxy Agent](./proxy-agent/index.md) — Configure the proxy agent for secure connectivity to your datasources. diff --git a/doc-server/docs/installation/server/index.md b/doc-server/docs/installation/server/index.md index 81f6e9d5..927386cd 100644 --- a/doc-server/docs/installation/server/index.md +++ b/doc-server/docs/installation/server/index.md @@ -8,16 +8,18 @@ import TabItem from '@theme/TabItem'; # Server Installation -The NudgeBee Server is the central component of the NudgeBee platform. It receives data from NudgeBee Agents, performs analysis, and handles user authentication and integrates with external services. This is required for self-hosted deployments only. +The NudgeBee Server is the central control plane of the NudgeBee platform. It hosts the web UI, Semantic Knowledge Graph, AI agent orchestrator, and workflow execution engine. It receives data from NudgeBee Agents across your clusters and integrates with identity providers and observability tools. -:::note -**Cloud SaaS users**: You do not need to install the server. It is fully managed for you at [app.nudgebee.com](https://app.nudgebee.com). Skip to the [Agent Installation](../agent/installation/index.md). +:::note[Self-Hosted Only] +**Cloud SaaS users**: You do not need to install the server. It is fully managed for you at [app.nudgebee.com](https://app.nudgebee.com). Skip directly to [Agent Installation](../agent/installation/index.md). + +**Infrastructure Scope**: The self-hosted NudgeBee Server requires its own Kubernetes cluster (or dedicated namespace) on Kubernetes v1.27+. If you do not operate Kubernetes infrastructure, use Cloud SaaS. ::: :::tip[Choosing an edition] The self-hosted server comes in two editions (see [Editions](../../editions.md) for the full comparison): -- **Community** — free and open source, fully functional. Images are pulled from the public `ghcr.io/nudgebee` registry. **No license key required.** OAuth SSO (Google, Okta, OneLogin, Azure AD / B2C, Auth0), magic-link email, and credentials login are all included. +- **Community** — free and open source (Apache 2.0), fully functional. Images are pulled from the public `ghcr.io/nudgebee` registry. **No license key required.** OAuth SSO (Google, Okta, OneLogin, Azure AD / B2C, Auth0), magic-link email, and credentials login are all included. - **Enterprise** — adds **SAML 2.0** SSO, NudgeBee's managed models (`nb-llm`, `nb-slm`), and commercial support. Images are pulled from `registry.nudgebee.com` and require a license key. The installation steps below use tabs — pick your edition in each step. @@ -39,53 +41,60 @@ The installation steps below use tabs — pick your edition in each step. ## 1. Before You Begin -Make sure you have the following ready before starting the installation. +### Components & Why They Exist -### Required +The NudgeBee server relies on core backend services. You can run them bundled inside the Helm chart (simplest for quick starts) or point NudgeBee to your own externally-managed instances (recommended for high availability and production compliance). -| Requirement | Details | Notes | -|---|---|---| -| **Kubernetes cluster** | v1.27 or newer, minimum 2 nodes | Each node: 16 GB RAM, 4 cores, 100 GB SSD | -| **Helm** | v3.x installed and configured | [Install Helm](https://helm.sh/) if you don't have it | -| **Registry access** | Cluster must be able to pull images: `ghcr.io/nudgebee` (Community) or `registry.nudgebee.com` (Enterprise) | Or mirror the images to your internal registry for air-gapped environments | -| **NudgeBee License Key** | **Enterprise only.** Not needed for the Community edition. | Enterprise customers receive a license key; community users skip this. | -| **Persistent Volume** | 200 GB available (100 GB if you use an external Postgres) | Required for database and application state | +| Component | Required? | What It Does & Why It's Needed | Bring Your Own (BYO)? | +|---|---|---|---| +| **PostgreSQL** | **Required** | Primary datastore — stores cluster workloads, workflow states, alert rules, user metadata, and configuration. **Queries and backend services fail immediately without it.** | **Yes** (e.g. AWS RDS, Azure Database for PG, Cloud SQL) | +| **RabbitMQ** | **Required** | Message bus connecting internal backend workers. **The backend will not bootstrap its event and triage consumers without it.** | **Yes** (e.g. Amazon MQ or self-managed cluster) | +| **Redis** | **Optional** | Caching layer for session state and fast query caching. **Falls back to in-memory cache if omitted** (fine for trials, Redis recommended for production). | **Yes** (e.g. AWS ElastiCache, Azure Redis) | +| **Qdrant** | **Conditional** | Vector database for Semantic Knowledge Graph embeddings and RAG retrieval. Needed when AI troubleshooting is enabled. | **Yes** (Bundled subchart or external Qdrant) | +| **Temporal** | **Conditional** | Durable execution engine for long-running runbooks, workflows, and automated remediations. | **Yes** (Bundled subchart or external Temporal cluster) | -:::info -**How much does the server actually use?** All NudgeBee server components together consume approximately 12 GB RAM and 4 CPU cores. This includes the bundled Postgres, RabbitMQ, Redis, Temporal, and Qdrant subcharts (ClickHouse is off by default and only needed for trace/log analytics). If you manage these dependencies externally, the footprint drops to around 8 GB RAM and 2 CPU cores. The 2-node recommendation provides headroom for reliability. +:::important Hard Dependencies +**PostgreSQL and RabbitMQ are mandatory hard dependencies** — the server will not start without them. By default, the Helm chart deploys bundled instances of both. ::: -### Optional but Recommended +### System & Sizing Requirements -These are not required to get NudgeBee running, but they improve the production experience. You can add all of these after installation. - -| Component | What it enables | Default without it | -|---|---|---| -| **SSL / DNS / Ingress** | Public URL access, Slack apps, webhook triggers, magic link login | Access via `kubectl port-forward` only | -| **External Postgres** | Use your own managed database for easier backup and scaling | NudgeBee bundles its own Postgres automatically | -| **Email (SMTP)** | Daily summary reports and magic link authentication | Users log in via SSO or admin invite only | -| **LLM provider** | AI-powered troubleshooting, NuBi agent, automated runbooks | Configure after installation — see [LLM Integrations](../../integrations/LLM/index.md) | +| Requirement | Minimum (Bundled Dependencies) | Minimum (External DBs) | Notes | +|---|---|---|---| +| **Kubernetes Cluster** | v1.27 or newer, minimum 2 nodes | v1.27 or newer, minimum 2 nodes | Sized for up to 400 monitored nodes | +| **Compute & Memory** | **12 GB RAM, 4 CPU cores** | **8 GB RAM, 2 CPU cores** | Bundled footprint includes PG, RabbitMQ, Redis, Qdrant, Temporal | +| **Persistent Storage** | 200 GB SSD storage | 100 GB SSD storage | Required for database and application state PVCs | +| **Helm** | v3.x installed and configured | v3.x installed and configured | [Install Helm](https://helm.sh/) | +| **Registry Access** | `ghcr.io/nudgebee` (Community) or `registry.nudgebee.com` (Enterprise) | Same | Air-gapped environments can mirror images internally | +| **NudgeBee License Key** | Enterprise only | Enterprise only | Community edition does not require a key | -### Network Requirements +### Network Requirements & Decision Rationale -Your cluster needs the following network access for the installation and normal operation: +Your cluster needs the following network access. Understanding why each rule exists helps you configure firewalls with least privilege: -- **Outbound to the container registry** — `ghcr.io/nudgebee` (Community) or `registry.nudgebee.com` (Enterprise) — to pull Docker images during installation. -- **Internal DNS resolution** — pods must be able to resolve the `BASE_URL` you configure (used for authentication). -- **Outbound to external services** (if you use them) — Slack, Jira, MS Teams, GitHub, OpenAI, etc. require outbound connectivity from the NudgeBee server. -- **Inbound from external services** (optional) — if you use bidirectional integrations like Slack apps, Slack needs to reach your NudgeBee server's public URL. +- **Outbound to Container Registry** (`ghcr.io/nudgebee` or `registry.nudgebee.com` on port 443): **Required during install/upgrade** to pull container images. *What breaks if blocked:* Pods get stuck in `ImagePullBackOff`. +- **Internal Cluster DNS Resolution**: **Required for internal service communication**. The server pods must be able to resolve `BASE_URL` and internal service endpoints. *What breaks if blocked:* Auth callback loops and service-to-service communication failures. +- **Outbound to Integrations** (Slack, Jira, Teams, GitHub, OpenAI / Cloud APIs on port 443): **Required only for enabled integrations**. *What breaks if blocked:* Alert notifications, auto-PRs, or AI analysis queries will fail to dispatch. +- **Inbound Access** (Port 80/443 via Ingress or port-forward): **Required for user web UI access, webhook triggers, and agent telemetry reception**. -:::tip -**Starting simple?** You can skip Ingress, SSL, and external services for now. The minimal installation works with just outbound registry access and internal DNS. Add public access and integrations later. +:::tip Start Simple with Port-Forwarding +**Why skip Ingress initially?** For local evaluation, testing, or sandboxes, you can run NudgeBee entirely with `kubectl port-forward` without provisioning DNS records, public IPs, or SSL certificates. Add Ingress when transitioning to team use. ::: --- ## 2. Install NudgeBee -The installation is three steps: select your edition (and, for Enterprise, log in to the Helm registry), create a values file, and run the Helm install. +The installation follows three steps: select your edition, configure `values.yaml`, and run `helm upgrade --install`. + +### Step 1: Select Your Edition & Registry Login -### Step 1: Select Your Edition +:::caution[Protecting Your License & Auth Credentials] +**Keep your license / auth key secret.** This key authenticates your cluster to the NudgeBee registry and allows agents to report into your control plane. Treat it like a root password: +- Store it in a secret manager (AWS Secrets Manager, Vault) or a Kubernetes Secret. +- Never commit it to version control or paste it in shared channels. +- Avoid passing it as an inline CLI flag to prevent it from saving in your shell history (e.g. use `read -s NUDGEBEE_LICENSE_KEY` or environment files). +::: @@ -102,12 +111,14 @@ export NUDGEBEE_CHART=oci://ghcr.io/nudgebee/charts/nudgebee Log in to the NudgeBee Helm registry with your license key, then set the chart location: ```shell -helm registry login registry.nudgebee.com --username nudgebee --password $NUDGEBEE_LICENSE_KEY +# Prompt for key securely to avoid saving to shell history +read -s -p "Enter NudgeBee License Key: " NUDGEBEE_LICENSE_KEY +echo + +helm registry login registry.nudgebee.com --username nudgebee --password "$NUDGEBEE_LICENSE_KEY" export NUDGEBEE_CHART=oci://registry.nudgebee.com/nudgebee ``` -Replace `$NUDGEBEE_LICENSE_KEY` with your actual license key. - @@ -194,7 +205,7 @@ helm upgrade nudgebee $NUDGEBEE_CHART \ --kube-context $KUBE_CONTEXT ``` -To install a specific version, add `--version $CHART_VERSION` to the command. See the [Server Releases](./release/) page for available versions. +To install a specific version, add `--version $CHART_VERSION` to the command. See the [Server Releases](../../releases/server/) page for available versions. :::tip **This minimal setup gets NudgeBee running with port-forwarding.** You can add Ingress, SSL, external Postgres, and other configurations later without reinstalling — just update your `values.yaml` and run `helm upgrade` again. @@ -202,17 +213,46 @@ To install a specific version, add `--version $CHART_VERSION` to the command. Se --- -## 3. Verify the Installation +## 3. Verify the Installation (What Success Looks Like) + +After the Helm install completes, perform these checks to confirm your server is operating properly: -After the Helm install completes, check that all pods are running: +### 1. Check Pod Status + +Run `kubectl get pods` in the `nudgebee` namespace: ```shell kubectl get pods -n nudgebee ``` -All pods should show `Running` or `Completed` status. This typically takes 2–3 minutes after the Helm command finishes. +**Expected Pod State:** -:::caution +| Pod Name Pattern | Ready State | Status | Role | +|---|---|---|---| +| `nudgebee-app-*` | `1/1` | `Running` | Main UI and GraphQL/REST API | +| `nudgebee-k8s-collector-*` | `1/1` | `Running` | Telemetry receiver for agents | +| `nudgebee-relay-server-*` | `1/1` | `Running` | WebSocket agent relay server | +| `nudgebee-postgresql-0` | `1/1` | `Running` | Core database (if bundled) | +| `nudgebee-rabbitmq-0` | `1/1` | `Running` | Event message bus (if bundled) | +| `nudgebee-schema-migration-*` | `0/1` | `Completed` | Post-install database migration job | + +All active pods should show `1/1` `Running`, and migration jobs should show `Completed`. This typically takes 2–3 minutes after the Helm command finishes. + +### 2. Verify HTTP Connectivity + +Test that the web application responds on its port: + +```shell +# Port-forward the app in the background or in a separate terminal: +kubectl port-forward svc/app 3000:80 -n nudgebee & + +# Verify HTTP 200 / login page response: +curl -I http://localhost:3000 +``` + +You should receive an `HTTP/1.1 200 OK` (or `307 Temporary Redirect` to `/auth/signin`). + +:::caution Troubleshooting Installation Failures **If pods are stuck in `Pending`, `CrashLoopBackOff`, or `Error`**, see the [Troubleshooting](#troubleshooting-installation-failures) section below. ::: @@ -230,8 +270,7 @@ kubectl port-forward svc/app 3000:80 -n nudgebee --kube-context $KUBE_CONTEXT Then open [http://localhost:3000](http://localhost:3000) in your browser. You should see the NudgeBee login page. - -Log in with the admin email address you configured during installation (for Enterprise, this is the email associated with your NudgeBee license). The password is auto-generated during installation and stored in a Kubernetes secret. +Log in with the admin email address configured during installation (for Enterprise, this is the email associated with your NudgeBee license). The initial password is auto-generated during installation and stored in a Kubernetes secret. Retrieve the password by decoding the secret: @@ -239,12 +278,13 @@ Retrieve the password by decoding the secret: kubectl get secret nudgebee -n nudgebee \ -o jsonpath='{.data.NEXTAUTH_DUMMY_CREDS_PASSWORD}' \ --kube-context $KUBE_CONTEXT | base64 -d +echo ``` Use the decoded password along with the admin email to sign in. -:::caution -**Security**: The dummy credentials provider is intended for initial setup and onboarding. For production environments, it is recommended to configure a proper authentication provider (SSO, LDAP, etc.) and disable dummy credentials. See [Authentication Integrations](../../integrations/Authentication/) for details. +:::caution Production Security +**The dummy credentials provider is intended for initial evaluation only.** For production environments, configure a proper identity provider (SSO, SAML, or LDAP) and disable dummy credentials. See [Authentication Integrations](../../integrations/Authentication/) for details. ::: :::info @@ -396,6 +436,24 @@ If your organization manages Kubernetes secrets through an external tool (Vault, * **`clickhouse.auth.existingSecret`** — Same usage for ClickHouse. * **`rabbitmq.auth.existingPasswordSecret`**, **`existingErlangSecret`** — Same usage for RabbitMQ. +### Externalizing Dependencies (Bring-Your-Own Databases) + +While bundled subcharts are convenient for proofs-of-concept, **running externally managed databases is strongly recommended for production**: + +- **High Availability & Failover**: Managed databases (e.g. AWS Aurora PostgreSQL, Azure Database for PostgreSQL, Google Cloud SQL) provide multi-AZ failover and automated maintenance. +- **Backups & Point-in-Time Recovery**: Leverage cloud-native automated snapshots, retention policies, and disaster recovery without managing Kubernetes persistent volumes. +- **Decoupled Lifecycle**: Upgrade and scale your datastores independently of NudgeBee Helm chart upgrades. + +To use an external PostgreSQL database, disable the bundled chart and supply your database connection string in `values.yaml`: + +```yaml +postgresql: + enabled: false + +nudgebee_secret: + APP_DATABASE_URL: "postgresql://:@:5432/?sslmode=require" +``` + ### Additional Configuration References - **[All Configuration Options](./secret_configs.md)** — Detailed reference for all environment variables and secrets. @@ -403,10 +461,11 @@ If your organization manages Kubernetes secrets through an external tool (Vault, --- -## Troubleshooting Installation Failures +## 7. Troubleshooting Installation Failures {#troubleshooting-installation-failures} ### Most Common Issue: Migration Job Timeout + The most common reason for installation failures or timeouts is the **post-installation migration job** not completing. This usually happens because dependent services (like the database) were not fully ready when Helm triggered the migration. **Fix — re-run Helm upgrade:** @@ -452,7 +511,7 @@ kubectl get events -n nudgebee --sort-by=.lastTimestamp --- -## Uninstall NudgeBee +## 8. Uninstall NudgeBee To completely remove NudgeBee from your cluster: diff --git a/doc-server/docs/installation/server/secret_configs.md b/doc-server/docs/installation/server/secret_configs.md index 73d218e8..528c5e8c 100644 --- a/doc-server/docs/installation/server/secret_configs.md +++ b/doc-server/docs/installation/server/secret_configs.md @@ -32,12 +32,27 @@ Configuration related to the NudgeBee license. Only relevant for the **Enterpris ## General Configuration +:::warning[Critical Security Notice: Production Secret Overrides] +**Do NOT use default or fallback keys in production environments.** +The Helm chart includes placeholder default keys for quick sandboxes and local evaluation. Using shared default keys in production is a severe security vulnerability: anyone with knowledge of the default keys could forge authentication tokens or decrypt stored database credentials. + +Always generate unique, cryptographically random keys for production deployments: +```shell +# Generate 32-byte hex encryption key: +openssl rand -hex 32 + +# Generate RSA keypair for JWT signing: +openssl genrsa -out jwt_private.pem 2048 +openssl rsa -in jwt_private.pem -pubout -out jwt_public.pem +``` +::: + - **`BASE_URL`**: The base URL for the NudgeBee application, default `http://localhost:3000`. **Required.** - **`NUDGEBEE_ENCRYPTION_KEY`**: 32-byte hex key that encrypts integration credentials and other at-rest secrets in the database. **Required** — the chart fails install if this is empty or left as `__REPLACE__`. Generate once with `openssl rand -hex 32` and store securely in your secret manager. **Losing this key makes previously-encrypted DB rows unreadable**, so treat it like a database master password. -- **`NEXTAUTH_SECRET`**: Encryption key used for encoding NextAuth session cookies. **Auto-generated** by the Helm chart on a fresh install (using the lookup-or-generate pattern) and reused on upgrade — you don't need to set it manually. **GitOps users** running offline-render (Argo CD, Flux) must set it explicitly, because `lookup` returns empty during offline render. -- **`ACTION_API_SERVER_TOKEN`**: Auth token between internal services. Same auto-generation behavior as `NEXTAUTH_SECRET` — GitOps users must set explicitly. -- **`JWT_PUBLIC_KEY`**: Public key for JWT Auth Tokens. Optional — Helm chart includes a default. -- **`JWT_PRIVATE_KEY`**: Private key for JWT Auth Tokens. Optional — Helm chart includes a default. +- **`NEXTAUTH_SECRET`**: Encryption key used for encoding NextAuth session cookies. **Auto-generated** by the Helm chart on a fresh install (using the lookup-or-generate pattern) and reused on upgrade. **Required to set explicitly in GitOps / offline-render workflows** (Argo CD, Flux). +- **`ACTION_API_SERVER_TOKEN`**: Auth token between internal services. Auto-generated by Helm chart; **Required to set explicitly in GitOps workflows**. +- **`JWT_PRIVATE_KEY`**: RSA private key used for signing JWT auth tokens. **Optional for local trial only; REQUIRED to override with your own private key in production.** +- **`JWT_PUBLIC_KEY`**: Corresponding RSA public key for JWT verification. **Optional for local trial only; REQUIRED to override in production.** - **`LICENSE_PUBLIC_KEY`**: RSA public key for verifying the `NUDGEBEE_LICENSE` JWT. **Empty in the Community edition** — `getLicenseDetails()` short-circuits to `licenseType=free`. Only set for Enterprise installs. diff --git a/doc-server/docs/integrations/LLM/index.md b/doc-server/docs/integrations/LLM/index.md index 5bf82ddb..90743086 100644 --- a/doc-server/docs/integrations/LLM/index.md +++ b/doc-server/docs/integrations/LLM/index.md @@ -21,6 +21,38 @@ NudgeBee supports BYOM (Bring Your Own Model) with three categories of LLM provi | **Self-Hosted / Open Source** | [Ollama](./Ollama/), [HuggingFace](./HuggingFace/), [AWS SageMaker](./Aws/sagemaker.md) | Organizations requiring data privacy, air-gapped environments, or custom-trained models. | | **NudgeBee Models** | Pre-trained NudgeBee AI models (nb-llm, nb-slm) | Enterprise/Cloud users who want optimized, purpose-built models for Cloud Ops. | +### BYOM Configuration Matrix & Helm Values Snippets + +To configure your own LLM provider on a self-hosted NudgeBee deployment, set the appropriate provider flags under `nudgebee_secret` in your `values.yaml`: + +#### 1. Self-Hosted Ollama / vLLM (Private VPC / Air-Gapped) +```yaml +nudgebee_secret: + LLM_PROVIDER: "ollama" # or "vllm" + OLLAMA_BASE_URL: "http://ollama.ai-infra.svc.cluster.local:11434" + OLLAMA_MODEL: "llama3.1:8b" + EMBEDDING_MODEL: "nomic-embed-text" +``` + +#### 2. AWS Bedrock (Claude 3.5 / Llama 3) +```yaml +nudgebee_secret: + LLM_PROVIDER: "bedrock" + AWS_DEFAULT_REGION: "us-east-1" + AWS_BEDROCK_MODEL_ID: "anthropic.claude-3-5-sonnet-20241022-v2:0" + # In EKS, IRSA is recommended; otherwise pass access keys: + # AWS_ACCESS_KEY_ID: "" + # AWS_SECRET_ACCESS_KEY: "" +``` + +#### 3. OpenAI / Azure OpenAI +```yaml +nudgebee_secret: + LLM_PROVIDER: "openai" + OPENAI_API_KEY: "" + OPENAI_MODEL: "gpt-4o" +``` + --- ## Supported LLM Providers diff --git a/doc-server/docs/releases/_category_.json b/doc-server/docs/releases/_category_.json new file mode 100644 index 00000000..e76e7398 --- /dev/null +++ b/doc-server/docs/releases/_category_.json @@ -0,0 +1 @@ +{"label": "Releases", "position": 5} diff --git a/doc-server/docs/releases/index.md b/doc-server/docs/releases/index.md new file mode 100644 index 00000000..6dd17999 --- /dev/null +++ b/doc-server/docs/releases/index.md @@ -0,0 +1,18 @@ +--- +sidebar_position: 1 +sidebar_label: Overview +--- + +# Releases & Changelog + +Welcome to the NudgeBee releases and changelog directory. Here you will find version histories, newly shipped features, bug fixes, and security patches across the NudgeBee platform. + +## Release Categories + +- **[Server Releases](./server/)** — Changelogs and release notes for the NudgeBee Server control plane (v1.5.0, v1.4.0, ...). +- **[K8s Agent Releases](./k8s-agent.md)** — In-cluster DaemonSet & Runner releases and Helm charts for Kubernetes clusters ([k8s-agent](https://github.com/nudgebee/k8s-agent)). +- **[Proxy Agent Releases](./proxy-agent.md)** — Standalone system service binary releases and updates for Linux and Windows hosts ([forager](https://github.com/nudgebee/forager)). + +:::tip Subscribing to Updates +Follow the [NudgeBee GitHub repository](https://github.com/nudgebee/nudgebee/releases) and join our [Discord community](https://discord.gg/C5d27ceTEv) to receive real-time notifications for new version releases. +::: diff --git a/doc-server/docs/releases/k8s-agent.md b/doc-server/docs/releases/k8s-agent.md new file mode 100644 index 00000000..e32ad74f --- /dev/null +++ b/doc-server/docs/releases/k8s-agent.md @@ -0,0 +1,20 @@ +--- +sidebar_position: 2 +sidebar_label: K8s Agent Releases +--- + +# K8s Agent Releases + +The **NudgeBee K8s Agent** runs inside your Kubernetes clusters as a central Runner deployment and node-level DaemonSet. It collects workload metrics, events, pod logs, and eBPF network telemetry, streaming them securely to the NudgeBee Server. + +## Release Channels & Repositories + +- **GitHub Repository**: [https://github.com/nudgebee/k8s-agent](https://github.com/nudgebee/k8s-agent) +- **Official Releases & Changelogs**: [https://github.com/nudgebee/k8s-agent/releases](https://github.com/nudgebee/k8s-agent/releases) +- **Helm Chart Registry**: `https://nudgebee.github.io/k8s-agent/` + +## Installation & Upgrade + +- **Installation Guide**: [Deploy K8s Agent across EKS, GKE, AKS, and Local Clusters](../installation/agent/installation/index.md) +- **Helm Values Reference**: [Full Chart Configuration Reference](../installation/agent/installation/helm_values.md) +- **Upgrade Guide**: [Upgrading Existing K8s Agents](../installation/agent/installation/upgrade.md) diff --git a/doc-server/docs/releases/proxy-agent.md b/doc-server/docs/releases/proxy-agent.md new file mode 100644 index 00000000..389651a4 --- /dev/null +++ b/doc-server/docs/releases/proxy-agent.md @@ -0,0 +1,24 @@ +--- +sidebar_position: 3 +sidebar_label: Proxy Agent Releases +--- + +# Proxy Agent Releases + +The **NudgeBee Proxy Agent (`forager`)** is a host-level telemetry agent designed for standalone Linux and Windows virtual machines, physical servers, and edge compute nodes. It runs as a system service (`systemd` or Windows Service) to capture system performance, running processes, open network connections, and host logs. + +## Release Channels & Repositories + +- **GitHub Repository**: [https://github.com/nudgebee/forager](https://github.com/nudgebee/forager) +- **Official Releases & Binaries**: [https://github.com/nudgebee/forager/releases](https://github.com/nudgebee/forager/releases) + +## Supported Operating Systems + +- **Linux**: Ubuntu (20.04+), Debian (11+), RHEL / CentOS (8+), Amazon Linux 2 / 2023, Rocky Linux +- **Windows**: Windows Server 2016, 2019, 2022, Windows 10/11 + +## Installation & Upgrade + +- **Quick Start Guide**: [Deploy Proxy Agent on Linux and Windows](../installation/proxy-agent/quick-start.md) +- **Upgrade Guide**: [Upgrading Existing Proxy Agents](../installation/proxy-agent/upgrade.md) +- **Troubleshooting**: [Proxy Agent Diagnostics & Logs](../installation/proxy-agent/troubleshooting.md) diff --git a/doc-server/docs/installation/server/release/1.0.0.md b/doc-server/docs/releases/server/1.0.0.md similarity index 100% rename from doc-server/docs/installation/server/release/1.0.0.md rename to doc-server/docs/releases/server/1.0.0.md diff --git a/doc-server/docs/installation/server/release/1.1.0.md b/doc-server/docs/releases/server/1.1.0.md similarity index 100% rename from doc-server/docs/installation/server/release/1.1.0.md rename to doc-server/docs/releases/server/1.1.0.md diff --git a/doc-server/docs/installation/server/release/1.2.0.md b/doc-server/docs/releases/server/1.2.0.md similarity index 100% rename from doc-server/docs/installation/server/release/1.2.0.md rename to doc-server/docs/releases/server/1.2.0.md diff --git a/doc-server/docs/installation/server/release/1.3.0.md b/doc-server/docs/releases/server/1.3.0.md similarity index 100% rename from doc-server/docs/installation/server/release/1.3.0.md rename to doc-server/docs/releases/server/1.3.0.md diff --git a/doc-server/docs/installation/server/release/1.4.0.md b/doc-server/docs/releases/server/1.4.0.md similarity index 100% rename from doc-server/docs/installation/server/release/1.4.0.md rename to doc-server/docs/releases/server/1.4.0.md diff --git a/doc-server/docs/installation/server/release/1.5.0.md b/doc-server/docs/releases/server/1.5.0.md similarity index 100% rename from doc-server/docs/installation/server/release/1.5.0.md rename to doc-server/docs/releases/server/1.5.0.md diff --git a/doc-server/docs/releases/server/_category_.json b/doc-server/docs/releases/server/_category_.json new file mode 100644 index 00000000..dd29c97d --- /dev/null +++ b/doc-server/docs/releases/server/_category_.json @@ -0,0 +1 @@ +{"label": "Server Releases", "position": 1} diff --git a/doc-server/docs/installation/server/release/archive/0.10.0.md b/doc-server/docs/releases/server/archive/0.10.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.10.0.md rename to doc-server/docs/releases/server/archive/0.10.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.11.0.md b/doc-server/docs/releases/server/archive/0.11.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.11.0.md rename to doc-server/docs/releases/server/archive/0.11.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.11.1.md b/doc-server/docs/releases/server/archive/0.11.1.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.11.1.md rename to doc-server/docs/releases/server/archive/0.11.1.md diff --git a/doc-server/docs/installation/server/release/archive/0.12.0.md b/doc-server/docs/releases/server/archive/0.12.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.12.0.md rename to doc-server/docs/releases/server/archive/0.12.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.12.1.md b/doc-server/docs/releases/server/archive/0.12.1.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.12.1.md rename to doc-server/docs/releases/server/archive/0.12.1.md diff --git a/doc-server/docs/installation/server/release/archive/0.13.0.md b/doc-server/docs/releases/server/archive/0.13.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.13.0.md rename to doc-server/docs/releases/server/archive/0.13.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.14.0.md b/doc-server/docs/releases/server/archive/0.14.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.14.0.md rename to doc-server/docs/releases/server/archive/0.14.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.15.0.md b/doc-server/docs/releases/server/archive/0.15.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.15.0.md rename to doc-server/docs/releases/server/archive/0.15.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.16.0.md b/doc-server/docs/releases/server/archive/0.16.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.16.0.md rename to doc-server/docs/releases/server/archive/0.16.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.17.0.md b/doc-server/docs/releases/server/archive/0.17.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.17.0.md rename to doc-server/docs/releases/server/archive/0.17.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.18.0.md b/doc-server/docs/releases/server/archive/0.18.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.18.0.md rename to doc-server/docs/releases/server/archive/0.18.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.19.0.md b/doc-server/docs/releases/server/archive/0.19.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.19.0.md rename to doc-server/docs/releases/server/archive/0.19.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.20.0.md b/doc-server/docs/releases/server/archive/0.20.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.20.0.md rename to doc-server/docs/releases/server/archive/0.20.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.21.0.md b/doc-server/docs/releases/server/archive/0.21.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.21.0.md rename to doc-server/docs/releases/server/archive/0.21.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.22.0.md b/doc-server/docs/releases/server/archive/0.22.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.22.0.md rename to doc-server/docs/releases/server/archive/0.22.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.23.0.md b/doc-server/docs/releases/server/archive/0.23.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.23.0.md rename to doc-server/docs/releases/server/archive/0.23.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.24.0.md b/doc-server/docs/releases/server/archive/0.24.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.24.0.md rename to doc-server/docs/releases/server/archive/0.24.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.25.0.md b/doc-server/docs/releases/server/archive/0.25.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.25.0.md rename to doc-server/docs/releases/server/archive/0.25.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.26.0.md b/doc-server/docs/releases/server/archive/0.26.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.26.0.md rename to doc-server/docs/releases/server/archive/0.26.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.27.0.md b/doc-server/docs/releases/server/archive/0.27.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.27.0.md rename to doc-server/docs/releases/server/archive/0.27.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.28.0.md b/doc-server/docs/releases/server/archive/0.28.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.28.0.md rename to doc-server/docs/releases/server/archive/0.28.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.29.0.md b/doc-server/docs/releases/server/archive/0.29.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.29.0.md rename to doc-server/docs/releases/server/archive/0.29.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.30.0.md b/doc-server/docs/releases/server/archive/0.30.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.30.0.md rename to doc-server/docs/releases/server/archive/0.30.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.31.0.md b/doc-server/docs/releases/server/archive/0.31.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.31.0.md rename to doc-server/docs/releases/server/archive/0.31.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.32.0.md b/doc-server/docs/releases/server/archive/0.32.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.32.0.md rename to doc-server/docs/releases/server/archive/0.32.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.33.0.md b/doc-server/docs/releases/server/archive/0.33.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.33.0.md rename to doc-server/docs/releases/server/archive/0.33.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.34.0.md b/doc-server/docs/releases/server/archive/0.34.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.34.0.md rename to doc-server/docs/releases/server/archive/0.34.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.35.0.md b/doc-server/docs/releases/server/archive/0.35.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.35.0.md rename to doc-server/docs/releases/server/archive/0.35.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.36.0.md b/doc-server/docs/releases/server/archive/0.36.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.36.0.md rename to doc-server/docs/releases/server/archive/0.36.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.37.0.md b/doc-server/docs/releases/server/archive/0.37.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.37.0.md rename to doc-server/docs/releases/server/archive/0.37.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.38.0.md b/doc-server/docs/releases/server/archive/0.38.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.38.0.md rename to doc-server/docs/releases/server/archive/0.38.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.39.0.md b/doc-server/docs/releases/server/archive/0.39.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.39.0.md rename to doc-server/docs/releases/server/archive/0.39.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.40.0.md b/doc-server/docs/releases/server/archive/0.40.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.40.0.md rename to doc-server/docs/releases/server/archive/0.40.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.41.0.md b/doc-server/docs/releases/server/archive/0.41.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.41.0.md rename to doc-server/docs/releases/server/archive/0.41.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.42.0.md b/doc-server/docs/releases/server/archive/0.42.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.42.0.md rename to doc-server/docs/releases/server/archive/0.42.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.43.0.md b/doc-server/docs/releases/server/archive/0.43.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.43.0.md rename to doc-server/docs/releases/server/archive/0.43.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.44.0.md b/doc-server/docs/releases/server/archive/0.44.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.44.0.md rename to doc-server/docs/releases/server/archive/0.44.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.45.0.md b/doc-server/docs/releases/server/archive/0.45.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.45.0.md rename to doc-server/docs/releases/server/archive/0.45.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.46.0.md b/doc-server/docs/releases/server/archive/0.46.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.46.0.md rename to doc-server/docs/releases/server/archive/0.46.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.47.0.md b/doc-server/docs/releases/server/archive/0.47.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.47.0.md rename to doc-server/docs/releases/server/archive/0.47.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.48.0.md b/doc-server/docs/releases/server/archive/0.48.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.48.0.md rename to doc-server/docs/releases/server/archive/0.48.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.49.0.md b/doc-server/docs/releases/server/archive/0.49.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.49.0.md rename to doc-server/docs/releases/server/archive/0.49.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.50.0.md b/doc-server/docs/releases/server/archive/0.50.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.50.0.md rename to doc-server/docs/releases/server/archive/0.50.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.51.0.md b/doc-server/docs/releases/server/archive/0.51.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.51.0.md rename to doc-server/docs/releases/server/archive/0.51.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.52.0.md b/doc-server/docs/releases/server/archive/0.52.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.52.0.md rename to doc-server/docs/releases/server/archive/0.52.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.53.0.md b/doc-server/docs/releases/server/archive/0.53.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.53.0.md rename to doc-server/docs/releases/server/archive/0.53.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.54.0.md b/doc-server/docs/releases/server/archive/0.54.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.54.0.md rename to doc-server/docs/releases/server/archive/0.54.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.55.0.md b/doc-server/docs/releases/server/archive/0.55.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.55.0.md rename to doc-server/docs/releases/server/archive/0.55.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.56.0.md b/doc-server/docs/releases/server/archive/0.56.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.56.0.md rename to doc-server/docs/releases/server/archive/0.56.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.57.0.md b/doc-server/docs/releases/server/archive/0.57.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.57.0.md rename to doc-server/docs/releases/server/archive/0.57.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.58.0.md b/doc-server/docs/releases/server/archive/0.58.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.58.0.md rename to doc-server/docs/releases/server/archive/0.58.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.59.0.md b/doc-server/docs/releases/server/archive/0.59.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.59.0.md rename to doc-server/docs/releases/server/archive/0.59.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.60.0.md b/doc-server/docs/releases/server/archive/0.60.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.60.0.md rename to doc-server/docs/releases/server/archive/0.60.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.61.0.md b/doc-server/docs/releases/server/archive/0.61.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.61.0.md rename to doc-server/docs/releases/server/archive/0.61.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.62.0.md b/doc-server/docs/releases/server/archive/0.62.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.62.0.md rename to doc-server/docs/releases/server/archive/0.62.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.63.0.md b/doc-server/docs/releases/server/archive/0.63.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.63.0.md rename to doc-server/docs/releases/server/archive/0.63.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.64.0.md b/doc-server/docs/releases/server/archive/0.64.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.64.0.md rename to doc-server/docs/releases/server/archive/0.64.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.65.0.md b/doc-server/docs/releases/server/archive/0.65.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.65.0.md rename to doc-server/docs/releases/server/archive/0.65.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.66.0.md b/doc-server/docs/releases/server/archive/0.66.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.66.0.md rename to doc-server/docs/releases/server/archive/0.66.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.67.0.md b/doc-server/docs/releases/server/archive/0.67.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.67.0.md rename to doc-server/docs/releases/server/archive/0.67.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.68.0.md b/doc-server/docs/releases/server/archive/0.68.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.68.0.md rename to doc-server/docs/releases/server/archive/0.68.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.69.0.md b/doc-server/docs/releases/server/archive/0.69.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.69.0.md rename to doc-server/docs/releases/server/archive/0.69.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.70.0.md b/doc-server/docs/releases/server/archive/0.70.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.70.0.md rename to doc-server/docs/releases/server/archive/0.70.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.71.0.md b/doc-server/docs/releases/server/archive/0.71.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.71.0.md rename to doc-server/docs/releases/server/archive/0.71.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.72.0.md b/doc-server/docs/releases/server/archive/0.72.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.72.0.md rename to doc-server/docs/releases/server/archive/0.72.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.73.0.md b/doc-server/docs/releases/server/archive/0.73.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.73.0.md rename to doc-server/docs/releases/server/archive/0.73.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.74.0.md b/doc-server/docs/releases/server/archive/0.74.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.74.0.md rename to doc-server/docs/releases/server/archive/0.74.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.75.0.md b/doc-server/docs/releases/server/archive/0.75.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.75.0.md rename to doc-server/docs/releases/server/archive/0.75.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.76.0.md b/doc-server/docs/releases/server/archive/0.76.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.76.0.md rename to doc-server/docs/releases/server/archive/0.76.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.77.0.md b/doc-server/docs/releases/server/archive/0.77.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.77.0.md rename to doc-server/docs/releases/server/archive/0.77.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.78.0.md b/doc-server/docs/releases/server/archive/0.78.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.78.0.md rename to doc-server/docs/releases/server/archive/0.78.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.79.0.md b/doc-server/docs/releases/server/archive/0.79.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.79.0.md rename to doc-server/docs/releases/server/archive/0.79.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.80.0.md b/doc-server/docs/releases/server/archive/0.80.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.80.0.md rename to doc-server/docs/releases/server/archive/0.80.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.81.0.md b/doc-server/docs/releases/server/archive/0.81.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.81.0.md rename to doc-server/docs/releases/server/archive/0.81.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.82.0.md b/doc-server/docs/releases/server/archive/0.82.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.82.0.md rename to doc-server/docs/releases/server/archive/0.82.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.83.0.md b/doc-server/docs/releases/server/archive/0.83.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.83.0.md rename to doc-server/docs/releases/server/archive/0.83.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.84.0.md b/doc-server/docs/releases/server/archive/0.84.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.84.0.md rename to doc-server/docs/releases/server/archive/0.84.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.85.0.md b/doc-server/docs/releases/server/archive/0.85.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.85.0.md rename to doc-server/docs/releases/server/archive/0.85.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.86.0.md b/doc-server/docs/releases/server/archive/0.86.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.86.0.md rename to doc-server/docs/releases/server/archive/0.86.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.87.0.md b/doc-server/docs/releases/server/archive/0.87.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.87.0.md rename to doc-server/docs/releases/server/archive/0.87.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.88.0.md b/doc-server/docs/releases/server/archive/0.88.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.88.0.md rename to doc-server/docs/releases/server/archive/0.88.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.89.0.md b/doc-server/docs/releases/server/archive/0.89.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.89.0.md rename to doc-server/docs/releases/server/archive/0.89.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.9.0.md b/doc-server/docs/releases/server/archive/0.9.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.9.0.md rename to doc-server/docs/releases/server/archive/0.9.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.90.0.md b/doc-server/docs/releases/server/archive/0.90.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.90.0.md rename to doc-server/docs/releases/server/archive/0.90.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.91.0.md b/doc-server/docs/releases/server/archive/0.91.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.91.0.md rename to doc-server/docs/releases/server/archive/0.91.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.92.0.md b/doc-server/docs/releases/server/archive/0.92.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.92.0.md rename to doc-server/docs/releases/server/archive/0.92.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.93.0.md b/doc-server/docs/releases/server/archive/0.93.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.93.0.md rename to doc-server/docs/releases/server/archive/0.93.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.94.0.md b/doc-server/docs/releases/server/archive/0.94.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.94.0.md rename to doc-server/docs/releases/server/archive/0.94.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.95.0.md b/doc-server/docs/releases/server/archive/0.95.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.95.0.md rename to doc-server/docs/releases/server/archive/0.95.0.md diff --git a/doc-server/docs/installation/server/release/archive/0.96.0.md b/doc-server/docs/releases/server/archive/0.96.0.md similarity index 100% rename from doc-server/docs/installation/server/release/archive/0.96.0.md rename to doc-server/docs/releases/server/archive/0.96.0.md diff --git a/doc-server/docs/installation/server/release/0.97.0.md b/doc-server/docs/releases/server/archive/0.97.0.md similarity index 100% rename from doc-server/docs/installation/server/release/0.97.0.md rename to doc-server/docs/releases/server/archive/0.97.0.md diff --git a/doc-server/docs/installation/server/release/0.98.0.md b/doc-server/docs/releases/server/archive/0.98.0.md similarity index 100% rename from doc-server/docs/installation/server/release/0.98.0.md rename to doc-server/docs/releases/server/archive/0.98.0.md diff --git a/doc-server/docs/installation/server/release/0.99.0.md b/doc-server/docs/releases/server/archive/0.99.0.md similarity index 100% rename from doc-server/docs/installation/server/release/0.99.0.md rename to doc-server/docs/releases/server/archive/0.99.0.md diff --git a/doc-server/docs/releases/server/archive/_category_.json b/doc-server/docs/releases/server/archive/_category_.json new file mode 100644 index 00000000..58adb01c --- /dev/null +++ b/doc-server/docs/releases/server/archive/_category_.json @@ -0,0 +1 @@ +{"label": "Archive (pre-1.0)", "position": 100, "collapsed": true} diff --git a/doc-server/docs/installation/server/release/index.md b/doc-server/docs/releases/server/index.md similarity index 83% rename from doc-server/docs/installation/server/release/index.md rename to doc-server/docs/releases/server/index.md index 7760f761..076d691e 100644 --- a/doc-server/docs/installation/server/release/index.md +++ b/doc-server/docs/releases/server/index.md @@ -16,6 +16,3 @@ Here's a list of recent NudgeBee server releases, starting with the most recent: * **v1.2.0** - [View Release Notes](./1.2.0) * **v1.1.0** - [View Release Notes](./1.1.0) * **v1.0.0** - [View Release Notes](./1.0.0) -* **v0.99.0** - [View Release Notes](./0.99.0) -* **v0.98.0** - [View Release Notes](./0.98.0) -* **v0.97.0** - [View Release Notes](./0.97.0) diff --git a/doc-server/docs/telemetry.md b/doc-server/docs/telemetry.md index e8c7676c..3ae30022 100644 --- a/doc-server/docs/telemetry.md +++ b/doc-server/docs/telemetry.md @@ -14,6 +14,40 @@ to opt out of, because nothing is collected. Your operational data — metrics, logs, traces, events, and the Semantic Knowledge Graph built from them — stays within your own infrastructure. +## Zero-Telemetry & Data Isolation Architecture + +```mermaid +graph TB + subgraph Your Kubernetes Cluster + PODS[Application Pods & Workloads] + SECRETS[Kubernetes Secrets & DB Rows] + AGENT[NudgeBee In-Cluster Agent] + PROM[In-Cluster Prometheus & Loki] + end + + subgraph Data Boundaries + LOCAL[STAYS 100% IN-CLUSTER
• Database Row Data & Payloads
• Application Secrets & Tokens
• Raw Customer Data] + STREAM[PROCESSED IN CONTROL PLANE
• Aggregated Resource Metrics
• Anonymized Error Names
• Event Timestamps & Topology] + end + + PODS -.-> LOCAL + SECRETS -.-> LOCAL + AGENT --> PROM + AGENT --> STREAM +``` + +### Data Boundary Classification + +| Data Category | Where It Stays | Is It Sent to External LLMs? | +|---|---|---| +| **Database Row Data & Payloads** | **100% In-Cluster** | **No** — Never accessed or transmitted. | +| **Kubernetes Secrets & Certificates** | **100% In-Cluster** | **No** — Metadata names may be inspected; secret values are never read. | +| **Pod Logs & Traces** | **In-Cluster Observability** | **Sanitized Only** — Only selected log snippets during an active incident triage prompt. | +| **Resource Metrics (CPU/RAM/Disk)** | NudgeBee Server | **No** — Evaluated via deterministic statistical algorithms for right-sizing. | +| **Topology & Dependency Graph** | NudgeBee Server | **No** — Stored in local PostgreSQL / Qdrant instance. | + +--- + ## Where your data goes NudgeBee only makes outbound connections to the services **you explicitly @@ -26,11 +60,8 @@ configure**: | **Integrations you connect** | When you use them | Slack, Jira, GitHub, observability backends, etc. — only the integrations you set up, only to their endpoints. | | **Cloud provider pricing APIs** | For cost analysis | AWS / Azure / GCP public pricing endpoints, used by cost optimization. | -:::info -**Air-gapped deployments**: Because there is no telemetry, the Community and -Enterprise editions run fully offline once images are mirrored to an internal -registry and you use a self-hosted LLM. See the -[Server Installation Guide](./installation/server/index.md) for mirroring guidance. +:::info Air-gapped Deployments +Because there is no telemetry, the Community and Enterprise editions run fully offline once images are mirrored to an internal registry and you use a self-hosted LLM (e.g. Ollama or vLLM). See the [Server Installation Guide](./installation/server/index.md) for mirroring guidance. ::: ## NudgeBee Cloud (SaaS)