On-prem: Initial docs for embedded cluster install#288
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
Warning Review limit reached
More reviews will be available in 52 minutes and 52 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR adds comprehensive on-premises deployment documentation for BloodHound Enterprise, including an overview, architecture guide, system requirements, and step-by-step installation instructions. It also introduces a reusable interactive Checklist React component for client-side state persistence. ChangesOn-Premises Deployment Documentation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jeff-matthews
added
the
on-prem
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
docs/on-premises/embedded-cluster/install.mdx (1)
271-271: TODO: Expand preflight check failure guidance.This comment indicates missing documentation for common preflight check failures and resolutions. Addressing this would improve the user experience for troubleshooting blocked installations.
Would you like me to draft content covering common preflight failures (disk latency, missing ports, connectivity issues) and their resolutions?
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/on-premises/embedded-cluster/install.mdx` at line 271, Expand the TODO in the preflight checks section of docs/on-premises/embedded-cluster/install.mdx by replacing the placeholder comment with concrete guidance: add a short list of common failures (high disk latency, insufficient disk space, blocked/missing ports, DNS/resolver failures, time skew, node resource constraints, and network connectivity issues), for each include a brief cause, specific diagnostic commands (e.g., iostat/lsblk/df for disk, ss/netstat for ports, dig/host/ping for DNS/connectivity, ntp/chrony checks for time), and concise remediation steps (tuning IO, freeing space, opening ports, fixing DNS, syncing time, increasing resources), plus links or notes about log locations and where to find additional troubleshooting help; update the surrounding paragraph headings to ensure the new content is discoverable in the preflight checks section.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/on-premises/embedded-cluster/install.mdx`:
- Line 333: Update the sentence that reads "kubectl command line tool" to use
the compound adjective form "kubectl command-line tool" so the phrase is
hyphenated correctly; locate the sentence containing the string "kubectl command
line tool" in the install.mdx content and replace it with "kubectl command-line
tool".
In `@docs/on-premises/embedded-cluster/overview.mdx`:
- Around line 45-47: Fix the two typos in the installation steps table: change
the phrase "Use the a web-based installer." (step 2) to "Use the web-based
installer." and change "Install SharpHound and or AzureHound as Windows
services." (step 4) to "Install SharpHound and/or AzureHound as Windows
services." so wording is correct and consistent.
In `@docs/on-premises/overview.mdx`:
- Around line 41-48: Update the "KOTS" row in the Deployment options table to
indicate it's not covered in this docs set by appending a short note such as
"coming soon / not covered in this guide" to the Best fit or Key tradeoffs cell
for the KOTS row (the row containing the symbol "KOTS"); keep the rest of the
table unchanged so readers know the guide only provides embedded-cluster
instructions and won't find KOTS installation details here.
In `@docs/snippets/components/checklist.jsx`:
- Around line 1-4: The Checklist component is missing React imports causing
runtime ReferenceErrors; import React plus the hooks and utilities used
(specifically bring in React and named imports useState and useEffect) and
ensure you reference React.Children and React.isValidElement (or import
isValidElement directly) so the Checklist function, which uses useState,
useEffect, React.Children and React.isValidElement, has the required imports at
the top of the file.
- Around line 9-11: Wrap the JSON.parse call inside a try/catch so malformed
localStorage data won’t crash the component: when handling the saved variable in
the conditional that currently does const parsed = JSON.parse(saved);
setItems(parsed); catch JSON.parse errors and fallback to a safe default (e.g.,
[] or existing initial items) and optionally clear the corrupted localStorage
key or log a warning; update the branch in the component where saved is read and
setItems is called to use this guarded parse logic.
---
Nitpick comments:
In `@docs/on-premises/embedded-cluster/install.mdx`:
- Line 271: Expand the TODO in the preflight checks section of
docs/on-premises/embedded-cluster/install.mdx by replacing the placeholder
comment with concrete guidance: add a short list of common failures (high disk
latency, insufficient disk space, blocked/missing ports, DNS/resolver failures,
time skew, node resource constraints, and network connectivity issues), for each
include a brief cause, specific diagnostic commands (e.g., iostat/lsblk/df for
disk, ss/netstat for ports, dig/host/ping for DNS/connectivity, ntp/chrony
checks for time), and concise remediation steps (tuning IO, freeing space,
opening ports, fixing DNS, syncing time, increasing resources), plus links or
notes about log locations and where to find additional troubleshooting help;
update the surrounding paragraph headings to ensure the new content is
discoverable in the preflight checks section.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a9b7acce-09e3-4299-b70a-34954f7d7cf4
⛔ Files ignored due to path filters (10)
docs/images/on-premises/install-instructions.pngis excluded by!**/*.pngdocs/images/on-premises/install-options.pngis excluded by!**/*.pngdocs/images/on-premises/installer-app-access.pngis excluded by!**/*.pngdocs/images/on-premises/installer-certificates.pngis excluded by!**/*.pngdocs/images/on-premises/installer-database-config.pngis excluded by!**/*.pngdocs/images/on-premises/installer-domain-config.pngis excluded by!**/*.pngdocs/images/on-premises/installer-preflight-checks.pngis excluded by!**/*.pngdocs/images/on-premises/installer-setup.pngis excluded by!**/*.pngdocs/images/on-premises/installer-success.pngis excluded by!**/*.pngdocs/images/on-premises/online-instances.pngis excluded by!**/*.png
📒 Files selected for processing (7)
docs/docs.jsondocs/on-premises/architecture.mdxdocs/on-premises/embedded-cluster/install.mdxdocs/on-premises/embedded-cluster/overview.mdxdocs/on-premises/embedded-cluster/system-requirements.mdxdocs/on-premises/overview.mdxdocs/snippets/components/checklist.jsx
StephenHinck
left a comment
StephenHinck
left a comment
There was a problem hiding this comment.
Lots of comments, but I haven't run through the steps to confirm accuracy.
| sudo ./bloodhound-enterprise shell | ||
| ``` | ||
|
|
||
| 1. Print the initial admin password from the `bloodhound` deployment's logs: |
There was a problem hiding this comment.
We could also show customers how to set this default password from the config to make this step simpler.
There was a problem hiding this comment.
I didn't know that was an option. I don't see anything on the portal or in the archive of installation assets that points to a config for the web-based installation method.
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/on-premises/install.mdx (1)
27-27: ⚡ Quick winRestrict Installation Wizard ingress scope in the checklist item.
Line 27 should explicitly say to limit TCP
30080to admin source IPs/subnets, not broadly open it, to avoid unnecessary exposure of the setup interface.Suggested doc tweak
-- Open inbound TCP `443` (users and collectors) and `30080` (Installation Wizard) +- Open inbound TCP `443` (users and collectors) and `30080` (Installation Wizard, restricted to admin source IPs/subnets)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/on-premises/install.mdx` at line 27, Update the checklist line that currently reads "Open inbound TCP `443` (users and collectors) and `30080` (Installation Wizard)" to explicitly restrict TCP `30080` to only admin source IPs/subnets (not broadly open); mention the Installation Wizard and port `30080` by name and instruct readers to limit ingress to specific admin CIDRs or VPN/ bastion hosts for secure access while keeping TCP `443` open for users and collectors.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/on-premises/install.mdx`:
- Line 27: Update the checklist line that currently reads "Open inbound TCP
`443` (users and collectors) and `30080` (Installation Wizard)" to explicitly
restrict TCP `30080` to only admin source IPs/subnets (not broadly open);
mention the Installation Wizard and port `30080` by name and instruct readers to
limit ingress to specific admin CIDRs or VPN/ bastion hosts for secure access
while keeping TCP `443` open for users and collectors.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 26b50ca1-8c1b-4f39-a1ea-7f5e4d791ce3
📒 Files selected for processing (5)
docs/docs.jsondocs/on-premises/architecture.mdxdocs/on-premises/install.mdxdocs/on-premises/overview.mdxdocs/on-premises/system-requirements.mdx
✅ Files skipped from review due to trivial changes (1)
- docs/on-premises/architecture.mdx
2 participants
Purpose
This pull request (PR) adds the first round of customer-facing docs for on-premises BloodHound Enterprise deployments.
Note
You may need to scroll down to the bottom of the sidebar on staging to see it.
Staging
https://specterops-on-prem-install.mintlify.app/on-premises/overview
Scope
It focuses exclusively on the embedded cluster deployment/install option.
Summary by CodeRabbit
Documentation
New Features