Enhance roles, permissions, and agent installation documentation

astro.config.mjs

@@ -78,8 +78,7 @@ export default defineConfig({
       // KloudMate RUM. `init` runs from `onload` so the bundle is fully executed
       // before it is called; the rolling /v2/ path picks up SDK patches without an
       // edit here. Session recording is off, so this collects page performance and
-      // errors only. The `km-rum-ready` event lets UserNav.astro attach the
-      // signed-in user's userId/userEmail even though this bundle loads async.
+      // errors only.
       head: [
         {
           tag: 'script',
@@ -95,7 +94,7 @@ export default defineConfig({
     version: '',
     sampleRate: 1.0,
     sessionRecorder: { enabled: false },
-  }); document.dispatchEvent(new Event('km-rum-ready'))`,
+  })`,
           },
         },
       ],

src/components/UserNav.astro

@@ -1,113 +1,14 @@
 ---
 /**
- * Account button for the header: "Log in" by default, "Go to Dashboard" when a
- * KloudMate session exists.
+ * Account button for the header: a link to the app's root. The app sends a
+ * returning user on to the region they last used, a signed-out user to
+ * sign-in, and a signed-in user to their dashboard.
  *
- * The docs share the platform's HTTP-only session cookie (scoped to
- * `.kloudmate.com`), so `GET https://api.<domain>/users/me` with credentials
- * resolves the signed-in user without any auth flow here. The API's CORS
- * allowlist already reflects any `*.<domain>` origin with credentials.
- * The same result is attached to RUM spans as `userId` / `userEmail`, which is
- * what the RUM sessions UI reads (anonymous sessions otherwise).
- *
- * Off-domain (localhost, previews) there is no shared cookie, so the script
- * skips the network call and keeps the static logged-out default.
+ * The docs don't call the API: it answers the web app's origin only.
  */
 ---
 
-<a class="user-cta" data-user-cta href="https://app.kloudmate.com/login">Log in</a>
-
-<script>
-  const CACHE_KEY = 'km-docs-user';
-  // Per-tab cache so plain page navigation doesn't refetch /users/me.
-  const RESULT_TTL = 15 * 60 * 1000;
-  const ERROR_TTL = 5 * 60 * 1000;
-
-  // The API and app live on the docs' own parent domain. No match means no
-  // shared cookie, so don't call the API at all.
-  const parentDomain = ['kloudmate.com', 'kloudmate.dev'].find(
-    (domain) => location.hostname === domain || location.hostname.endsWith(`.${domain}`)
-  );
-  const appOrigin = `https://app.${parentDomain ?? 'kloudmate.com'}`;
-
-  function readCache() {
-    try {
-      const cached = JSON.parse(sessionStorage.getItem(CACHE_KEY) ?? '');
-      if (cached && Date.now() - cached.t < (cached.err ? ERROR_TTL : RESULT_TTL)) {
-        return cached;
-      }
-    } catch {
-      // Absent or malformed cache: fall through to a fresh fetch.
-    }
-    return null;
-  }
-
-  async function fetchUser() {
-    let user = null;
-    let err = false;
-    try {
-      const res = await fetch(`https://api.${parentDomain}/users/me`, {
-        credentials: 'include',
-      });
-      if (res.ok) {
-        const profile = await res.json();
-        if (profile?.id) {
-          user = { id: profile.id, name: profile.name ?? '', email: profile.email ?? '' };
-        }
-      } else if (res.status !== 401 && res.status !== 403) {
-        // 401/403 definitively means logged out; anything else may be transient,
-        // so cache it for a shorter time.
-        err = true;
-      }
-    } catch {
-      err = true;
-    }
-    try {
-      sessionStorage.setItem(CACHE_KEY, JSON.stringify({ t: Date.now(), user, err }));
-    } catch {
-      // Storage full or blocked: skip caching, the next page just refetches.
-    }
-    return user;
-  }
-
-  function render(user) {
-    const cta = document.querySelector<HTMLAnchorElement>('[data-user-cta]');
-    if (!cta) return;
-    if (user) {
-      cta.textContent = 'Go to Dashboard';
-      cta.href = `${appOrigin}/`;
-    } else {
-      cta.textContent = 'Log in';
-      cta.href = `${appOrigin}/login`;
-    }
-  }
-
-  // The RUM bundle loads async from the CDN, so it may not exist yet when the
-  // user resolves. `km-rum-ready` is dispatched by the init snippet in
-  // astro.config.mjs right after KloudMateRum.init(). setUser maps id/email to
-  // the userId/userEmail span attributes the RUM sessions UI reads.
-  function tagRum(user) {
-    if (!user) return;
-    const apply = () =>
-      (window as any).KloudMateRum?.setUser({ id: user.id, email: user.email });
-    if ((window as any).KloudMateRum) {
-      apply();
-    } else {
-      document.addEventListener('km-rum-ready', apply, { once: true });
-    }
-  }
-
-  const cached = readCache();
-  if (cached) {
-    render(cached.user);
-    tagRum(cached.user);
-  } else if (parentDomain) {
-    fetchUser().then((user) => {
-      render(user);
-      tagRum(user);
-    });
-  }
-</script>
+<a class="user-cta" href="https://app.kloudmate.com/">Log in</a>
 
 <style>
   .user-cta {

src/content/docs/docs/aws-integration/account-setup.mdx

@@ -37,7 +37,7 @@ Each account on the **Data Sources** page has an **Edit** button.
 Click **Edit** to open **Edit Account Details**. It shows the account's AWS account ID and external ID.
 
 - To update the account, change the **AWS Account Name** or paste the **Role ARN**, then click **Update**. If you don't have a role yet, **Click here to add KloudMate CloudFormation stack to AWS** opens the stack in AWS.
-- To remove the account, click **Delete account**. You need the **Owner** role, and the account's data is deleted permanently. See [Remove an AWS Account](../../platform/settings/deleting-your-aws-account-from-kloudmate/) to also remove the stack from AWS.
+- To remove the account, click **Delete account**. You need the **Admin** role, and the account's data is deleted permanently. See [Remove an AWS Account](../../platform/settings/deleting-your-aws-account-from-kloudmate/) to also remove the stack from AWS.
 
 ![The Edit Account Details screen, with the AWS account ID, external ID, account name, Role ARN field, Update button, and Delete account section.](../images/aws-account-setup-edit-details.png)
 

src/content/docs/docs/incident-management/integrations/integrating-with-kloudmate-alerts.mdx

@@ -19,7 +19,7 @@ The **Routing Rule** on this page is an [Alerts routing rule](../../../alerts/ro
 ## Prerequisites
 
 - An [IM service](../../services/) you want incidents to open against.
-- The **Developer** role (you need it to create channels and routing rules).
+- The **Admin** role. You need it to create the channel. A **Developer** can create the routing rule but not the channel.
 
 ## Step 1 — Create a KloudMate Incidents channel
 

src/content/docs/docs/incident-management/status-pages/branding-and-custom-domain.mdx

@@ -38,7 +38,7 @@ This works the moment you publish — no DNS setup required. Use it as-is, or mo
 
 ## Custom domain
 
-A custom domain serves the page from a subdomain of your own — for example `status.example.com`. Custom domains are a paid feature, and only an **organization owner** can set one up.
+A custom domain serves the page from a subdomain of your own, for example `status.example.com`. Custom domains are a paid feature, and you need the **Admin** role to set one up.
 
 <Steps>
 1. In **Settings**, open the custom domain panel and enter your **subdomain** (for example `status.example.com`). It has to be a subdomain — an apex domain like `example.com` isn't supported.

src/content/docs/docs/infrastructure/inventory.mdx

@@ -69,7 +69,7 @@ When a resource has its own page elsewhere in KloudMate, a button takes you ther
 
 ## When Inventory is empty
 
-If Inventory shows **No resources yet**, nothing has reported to the workspace. [Install the KloudMate agent](../../kloudmate-agent/) to list your hosts, Kubernetes objects, and services, or [connect an AWS account](../../aws-integration/account-setup/) to list its resources. An organization **Owner** can start either one from the empty page with **Install the agent** or **Connect AWS account**.
+If Inventory shows **No resources yet**, nothing has reported to the workspace. [Install the KloudMate agent](../../kloudmate-agent/) to list your hosts, Kubernetes objects, and services, or [connect an AWS account](../../aws-integration/account-setup/) to list its resources. With the **Admin** role, you can start either one from the empty page with **Install the agent** or **Connect AWS account**.
 
 ## Related
 

src/content/docs/docs/issues/index.mdx

@@ -126,8 +126,8 @@ Click **Explore Error Patterns** to find recurring error patterns across your se
 
 ## User permissions
 
-- **Owner and Developer**: resolve and ignore issues, one at a time or in bulk, assign issues, create Jira tickets, and comment.
-- **Viewer**: assign issues and comment, but not resolve or ignore them.
+- **Admin and Developer**: resolve and ignore issues, one at a time or in bulk, assign issues, create Jira tickets, and comment.
+- **Viewer**: comment on and watch issues, but not resolve, ignore, or assign them.
 
 ## Related Resources
 

src/content/docs/docs/kloudmate-agent/auto-instrumentation/dotnet.mdx

@@ -55,6 +55,11 @@ An ASP.NET Core application pool must be set to "No Managed Code" for the profil
 
 On Linux, the agent instruments .NET through the same CLR profiler, loaded through the `CORECLR_*` and `DOTNET_STARTUP_HOOKS` variables in a systemd startup config, then restarts the service. This is less common than .NET on Windows. .NET under PM2 isn't handled automatically; run a .NET service under systemd to instrument it.
 
+The profiler can't load on every Linux host, because it needs a recent glibc:
+
+- **RHEL and CentOS 7 aren't supported.** See [RHEL and CentOS 7](../../installation/linux-agent/#rhel-and-centos-7).
+- **On arm64, the profiler needs glibc 2.35 or later,** so it doesn't load on arm64 RHEL 9 or Amazon Linux 2023.
+
 ## On Kubernetes
 
 Choose **SDK** for the workload and the agent adds the OpenTelemetry Operator annotation `instrumentation.opentelemetry.io/inject-dotnet`. The Operator injects the profiler, and that workload's pods roll to pick it up.

src/content/docs/docs/kloudmate-agent/installation/linux-agent.mdx

@@ -7,7 +7,7 @@ sidebar:
 
 Install the **KloudMate Agent** on a Linux machine.
 
-**Supported Platforms:** Debian/Ubuntu, RHEL/CentOS.
+**Supported Platforms:** Debian/Ubuntu, RHEL/CentOS 7 and later. RHEL and CentOS 7 have [some limits](#rhel-and-centos-7).
 
 If your outbound traffic is restricted, see [Before you start](../before-you-start/) for the URLs and permissions to allow first.
 
@@ -94,6 +94,17 @@ PHP containers get the **SDK** option without a redeploy: the agent injects the
 
 For monitoring containers, a Linux service and a Docker-mode agent are equivalent. Choose between them by how you want to run the agent, not by what they can see. See [Docker mode vs the Linux agent](../../platform-notes/docker/#docker-mode-vs-the-linux-agent).
 
+## RHEL and CentOS 7
+
+RHEL and CentOS 7 need agent version **2.8.1 or later**. Earlier packages fail to install there with a `GLIBC` dependency error.
+
+Host metrics and logs work as usual. The older kernel and glibc on these systems limit the rest:
+
+- **eBPF monitoring isn't available.** It needs kernel 4.14 or later, and these systems run 3.10. The agent skips it and keeps collecting metrics and logs.
+- **.NET auto-instrumentation isn't supported.** The profiler needs a newer glibc, and the .NET versions it supports don't run on these systems. Your .NET applications keep running, without traces from the agent.
+- **PHP 8.2 and later uses the trace extension** instead of the native OpenTelemetry extension, which needs a newer glibc. The agent downloads the trace extension when you turn on instrumentation, so the host needs outbound HTTPS to `github.com` at that point.
+- **Python auto-instrumentation needs Python 3.10 to 3.14,** so it doesn't cover the Python that ships with these systems.
+
 ## Configuration and next checks
 
 New agents start in **managed mode**, with a default of host metrics and eBPF monitoring. You review and change what is collected from the web interface, without editing files on the host. See the [configuration model](../../concepts/config-model/).

src/content/docs/docs/kloudmate-agent/installation/windows-agent.mdx

@@ -54,6 +54,30 @@ View all collected data in these KloudMate sections:
 
 ## Install Agent
 
+Install the agent with one PowerShell command. If you'd rather click through the installer, see [Install with the wizard](#install-with-the-wizard).
+
+**Step 1:** On the Windows host, open PowerShell as Administrator. The install stops with an error if PowerShell isn't elevated.
+
+**Step 2:** Run the install command:
+
+```powershell
+irm https://cdn.kloudmate.com/scripts/install_windows.ps1 | iex
+```
+
+**Step 3:** Enter your API key and collector endpoint when asked. You'll find your key under **Settings → Agents & Pipelines → Add Agent → Windows**. Press Enter at the endpoint prompt to use `https://otel.kloudmate.com:4318`.
+
+The script downloads the latest installer, verifies its checksum, and installs the agent in the background, so no wizard opens. It then checks that the `kmagent` service is running and connected to KloudMate. If the agent can't connect, for example because of a wrong API key, the script shows you the error.
+
+To skip the prompts, set your key and endpoint first:
+
+```powershell
+$env:KM_API_KEY="YOUR_API_KEY"; $env:KM_COLLECTOR_ENDPOINT="https://otel.kloudmate.com:4318"; irm https://cdn.kloudmate.com/scripts/install_windows.ps1 | iex
+```
+
+On a host that's already configured, the script keeps the existing configuration and ignores `KM_API_KEY`.
+
+### Install with the wizard
+
 **Step 1:** Navigate to the **Settings → Agents & Pipelines** section in your KloudMate account.
 
 **Step 2:** Click **Add Agent**, select **Windows**, and click **Continue**. On the **API key** step, click **Create backend key**, or select **Use existing key** and paste your backend ingest key. Then click **Continue**.

src/content/docs/docs/kloudmate-agent/management.mdx

@@ -50,6 +50,7 @@ Open the actions menu (⋮) for an agent to manage it:
 
 - **Configure:** Opens the agent's Configuration page, with tabs for **APM**, **Databases**, **Logs**, **Processes**, **Runbook Scripts**, and **Collector Config**. Updates apply automatically wherever the agent is installed.
 - **Restart agent:** Restart the agent when needed.
+- **Uninstall:** Uninstall the agent from its host.
 - **Delete:** Remove the agent from the **Agents & Pipelines** page and clear all of its configuration.
 
 :::caution
@@ -71,7 +72,7 @@ To undo a managed change, turn the toggle back. There is no separate history or
 
 ### Runbook Scripts
 
-The **Runbook Scripts** tab decides whether a [workflow](../../workflows/) can run commands on this host with the [Run Command on Host](../../workflows/actions/#run-command-on-host) step. Scripts are off until someone with the **Developer** role turns on **Allow runbook scripts on this host**. The agent picks up the change within a minute. Only Linux host agents have this setting.
+The **Runbook Scripts** tab decides whether a [workflow](../../workflows/) can run commands on this host with the [Run Command on Host](../../workflows/actions/#run-command-on-host) step. Scripts are off until someone with the **Admin** role turns on **Allow runbook scripts on this host**. The agent picks up the change within a minute. Only Linux host agents have this setting.
 
 ![The Runbook Scripts tab with Allow runbook scripts on this host turned on](./images/agent-runbook-scripts-tab.png)
 

src/content/docs/docs/kloudmate-agent/upgrade.mdx

@@ -27,6 +27,8 @@ On Kubernetes, Helm rolls the release back if the new pods don't become ready. O
 
 :::note
 One-click upgrade needs agent version **2.5.0 or later**. Upgrade an older agent [manually](#upgrade-manually) once, and later releases can then be applied from the dashboard.
+
+On RHEL or CentOS 7.8 and older, an agent older than 2.8.1 also needs one manual upgrade, because its one-click upgrade can't start on that version of systemd.
 :::
 
 ### When the Upgrade button is disabled
@@ -74,7 +76,15 @@ Your existing `/etc/kmagent/agent.yaml` is kept as it is, including any settings
 
 ### Windows
 
-Download the latest installer from **Settings → Agents & Pipelines → Add Agent → Windows** and run it from an elevated (Administrator) PowerShell prompt:
+Run this in PowerShell as Administrator, and press Enter at the API key prompt to keep your existing configuration:
+
+```powershell
+irm https://cdn.kloudmate.com/scripts/install_windows.ps1 | iex
+```
+
+Your existing `C:\ProgramData\kmagent\agent.yaml` is kept, including any settings you've added by hand. The account-specific command you copy from KloudMate keeps it too, and doesn't ask for a key. If you type a new key at the prompt, the file is replaced with that key and endpoint, and your hand-added settings are lost.
+
+To upgrade with the installer instead, download the latest one from **Settings → Agents & Pipelines → Add Agent → Windows** and run it from an elevated (Administrator) PowerShell prompt:
 
 ```powershell
 .\kmagent-setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART

src/content/docs/docs/kloudmate-assistant/mcp-server.mdx

@@ -170,7 +170,7 @@ Use a Personal API Key for scripts, and for clients that can't sign in with OAut
 | `Authorization` | `Bearer YOUR_API_KEY` |
 | `x-workspace-id` | `YOUR_WORKSPACE_ID` |
 
-To create a key, open **API keys** from the account menu (top-right) and click **Create Key**. Copy the key when it's shown, because it's shown only once. Any signed-in user can create one, and you don't need the **Developer** role. See [API Keys](../../platform/settings/api-keys/#personal-api-keys) for details.
+To create a key, open **API keys** from the account menu (top-right) and click **Create Key**. Copy the key when it's shown, because it's shown only once. Anyone can create one, whatever their role. See [API Keys](../../platform/settings/api-keys/#personal-api-keys) for details.
 
 A personal key works for every workspace you belong to in your organization, so the `x-workspace-id` header picks the workspace each request reads. Find the workspace ID in the workspace's URL in the KloudMate app.