From d73ffdf93a2fc5a3c7410d59f405f2aa2c311be1 Mon Sep 17 00:00:00 2001 From: Johannes Fleck Date: Wed, 28 Oct 2026 14:48:23 +0100 Subject: [PATCH] feat(docs): first draft --- docs/antora.yml | 7 + docs/modules/ROOT/nav.adoc | 13 + docs/modules/ROOT/pages/getting-started.adoc | 51 ++++ docs/modules/ROOT/pages/index.adoc | 26 ++ .../pages/installation/authentication.adoc | 30 +++ .../ROOT/pages/installation/database.adoc | 23 ++ .../modules/ROOT/pages/installation/helm.adoc | 68 +++++ .../ROOT/pages/installation/monitoring.adoc | 10 + .../modules/ROOT/pages/modules/bookmarks.adoc | 30 +++ docs/modules/ROOT/pages/modules/storage.adoc | 54 ++++ docs/modules/ROOT/pages/modules/trino.adoc | 45 ++++ .../reference/environment-variables.adoc | 243 ++++++++++++++++++ 12 files changed, 600 insertions(+) create mode 100644 docs/antora.yml create mode 100644 docs/modules/ROOT/nav.adoc create mode 100644 docs/modules/ROOT/pages/getting-started.adoc create mode 100644 docs/modules/ROOT/pages/index.adoc create mode 100644 docs/modules/ROOT/pages/installation/authentication.adoc create mode 100644 docs/modules/ROOT/pages/installation/database.adoc create mode 100644 docs/modules/ROOT/pages/installation/helm.adoc create mode 100644 docs/modules/ROOT/pages/installation/monitoring.adoc create mode 100644 docs/modules/ROOT/pages/modules/bookmarks.adoc create mode 100644 docs/modules/ROOT/pages/modules/storage.adoc create mode 100644 docs/modules/ROOT/pages/modules/trino.adoc create mode 100644 docs/modules/ROOT/pages/reference/environment-variables.adoc diff --git a/docs/antora.yml b/docs/antora.yml new file mode 100644 index 00000000..e3bd4dfb --- /dev/null +++ b/docs/antora.yml @@ -0,0 +1,7 @@ +--- +name: cockpit +title: Stackable Cockpit +# Only the main branch is published, so there is a single version (like stackablectl). +version: "nightly" +nav: + - modules/ROOT/nav.adoc diff --git a/docs/modules/ROOT/nav.adoc b/docs/modules/ROOT/nav.adoc new file mode 100644 index 00000000..b1e17b16 --- /dev/null +++ b/docs/modules/ROOT/nav.adoc @@ -0,0 +1,13 @@ +* xref:index.adoc[] +* xref:getting-started.adoc[] +* Installation +** xref:installation/helm.adoc[] +** xref:installation/database.adoc[] +** xref:installation/authentication.adoc[] +** xref:installation/monitoring.adoc[] +* Modules +** xref:modules/trino.adoc[] +** xref:modules/storage.adoc[] +** xref:modules/bookmarks.adoc[] +* Reference +** xref:reference/environment-variables.adoc[] diff --git a/docs/modules/ROOT/pages/getting-started.adoc b/docs/modules/ROOT/pages/getting-started.adoc new file mode 100644 index 00000000..d7b52ca1 --- /dev/null +++ b/docs/modules/ROOT/pages/getting-started.adoc @@ -0,0 +1,51 @@ += Getting started +:description: Install Stackable Cockpit on Kubernetes with Helm, connect it to an OIDC provider, PostgreSQL and Trino, and run your first SQL query. + +This guide installs Cockpit with Helm and runs a first Trino query. +You need an existing PostgreSQL database, an OIDC client for Cockpit and a Trino cluster. + +// TODO: Replace the local chart path once the chart is published. + +Create a Secret with the database password and the OIDC client secret: + +[source,console] +---- +$ kubectl create secret generic cockpit \ + --from-literal=database-password='' \ + --from-literal=oidc-client-secret='' +---- + +Create a values file `cockpit-values.yaml`: + +[source,yaml] +---- +origin: https://cockpit.example.com # <1> +auth: + baseUrl: https://cockpit.example.com + oidc: + discoveryUrl: https://keycloak.example.com/realms/sdp/.well-known/openid-configuration + clientId: cockpit + clientSecret: + secretKeyRef: + name: cockpit +database: + host: postgresql + password: + secretKeyRef: + name: cockpit +trino: + url: https://trino-coordinator:8443 + tls: + secretClass: tls # <2> +---- +<1> The URL users open in the browser. It must use HTTPS, see xref:installation/helm.adoc#_ingress_and_reverse_proxy[Ingress and reverse proxy]. +<2> The SecretClass that provides the CA certificate of Trino. + +Install the chart: + +[source,console] +---- +$ helm install cockpit ./deploy/helm/cockpit --values cockpit-values.yaml +---- + +Open the URL in a browser, log in, select *Trino* in the sidebar and run a query such as `SELECT * FROM system.runtime.nodes`. diff --git a/docs/modules/ROOT/pages/index.adoc b/docs/modules/ROOT/pages/index.adoc new file mode 100644 index 00000000..48a13a47 --- /dev/null +++ b/docs/modules/ROOT/pages/index.adoc @@ -0,0 +1,26 @@ += Stackable Cockpit +:description: Stackable Cockpit is a web UI for the Stackable Data Platform with a Trino SQL editor, an S3 storage browser and a dashboard with bookmarks. +:github: https://github.com/stackabletech/cockpit/ + +[.link-bar] +* {github}[GitHub {external-link-icon}^] + +Stackable Cockpit is a web UI for the Stackable Data Platform (SDP). +Users log in once through OpenID Connect (OIDC) and work with the platform's services from a single place. + +== Getting started + +Follow the xref:getting-started.adoc[] guide to install Cockpit with Helm and run your first Trino query. + +== Modules + +Cockpit consists of modules, and more are added over time: + +* xref:modules/trino.adoc[Trino]: a SQL editor with code completion and a schema browser. +* xref:modules/storage.adoc[Storage]: a file browser for S3-compatible object storage. +* xref:modules/bookmarks.adoc[Bookmarks]: links to frequently used tools on the dashboard. + +== Architecture + +Cockpit is a Node.js server that connects to Trino and S3 on behalf of the logged-in user. +It stores users, sessions, bookmarks and storage connections in PostgreSQL. diff --git a/docs/modules/ROOT/pages/installation/authentication.adoc b/docs/modules/ROOT/pages/installation/authentication.adoc new file mode 100644 index 00000000..efff77ee --- /dev/null +++ b/docs/modules/ROOT/pages/installation/authentication.adoc @@ -0,0 +1,30 @@ += Authentication +:description: Configure login to Stackable Cockpit with any OpenID Connect provider, such as Keycloak, including callback URL, scopes and session secret. + +Users log in to Cockpit through an OpenID Connect (OIDC) provider, for example Keycloak. +Register a confidential client for Cockpit with the redirect URI `/api/auth/oauth2/callback/oidc`. + +[source,yaml] +---- +auth: + baseUrl: https://cockpit.example.com # <1> + oidc: + discoveryUrl: https://keycloak.example.com/realms/sdp/.well-known/openid-configuration + clientId: cockpit + clientSecret: + secretKeyRef: + name: cockpit + key: oidc-client-secret + extraScopes: [] # <2> +sessionSecret: + secretKeyRef: + name: "" # <3> +---- +<1> The URL users open in the browser. +<2> Scopes requested in addition to `openid`, `profile` and `email`. +<3> The secret that signs session cookies. The chart generates one if empty. + +The OIDC claim that becomes the Trino user is configured in the xref:modules/trino.adoc#_user_identity[Trino module]. + +WARNING: With `auth.oidc.enabled: false`, Cockpit has no login and all visitors share one anonymous user. +Use this only for local testing. diff --git a/docs/modules/ROOT/pages/installation/database.adoc b/docs/modules/ROOT/pages/installation/database.adoc new file mode 100644 index 00000000..37bbb887 --- /dev/null +++ b/docs/modules/ROOT/pages/installation/database.adoc @@ -0,0 +1,23 @@ += Database +:description: Connect Stackable Cockpit to PostgreSQL, which stores users, sessions, bookmarks and storage connections, and configure TLS for the connection. + +Cockpit requires a PostgreSQL database for users, sessions, bookmarks and storage connections. +It creates and migrates its tables on startup. + +[source,yaml] +---- +database: + host: postgresql + port: 5432 + name: cockpit + user: cockpit + password: + secretKeyRef: + name: cockpit + key: database-password + tls: + mode: verify-full # <1> + secretClass: tls # <2> +---- +<1> `verify-full` (default), `require` (encrypt without verification) or `disable`. +<2> Provides the CA certificate of PostgreSQL. Alternatively set `caCert` to a mounted file. Both require `verify-full`. diff --git a/docs/modules/ROOT/pages/installation/helm.adoc b/docs/modules/ROOT/pages/installation/helm.adoc new file mode 100644 index 00000000..00596114 --- /dev/null +++ b/docs/modules/ROOT/pages/installation/helm.adoc @@ -0,0 +1,68 @@ += Helm chart +:description: Install Stackable Cockpit with its Helm chart and configure ingress, reverse proxy headers, CA certificates and the scratch volume. + +The Helm chart in `deploy/helm/cockpit` deploys Cockpit. +It does not deploy PostgreSQL, the OIDC provider or Trino. +The chart README lists all values. + +// TODO: Link the chart README and Helm repository once published. + +== Ingress and reverse proxy + +IMPORTANT: Cockpit must be served over HTTPS, because session cookies and credentials such as S3 keys pass through the browser connection. +Cockpit itself serves plain HTTP, so terminate TLS at the Ingress or reverse proxy and use `https://` URLs for `origin` and `auth.baseUrl`. + +The chart creates a ClusterIP Service on port 3000 and can create an Ingress with the `ingress` values. +Set `origin` to the URL users open in the browser. +Behind a reverse proxy, also set the forwarded headers Cockpit trusts: + +[source,yaml] +---- +origin: https://cockpit.example.com +proxy: + protocolHeader: x-forwarded-proto + hostHeader: x-forwarded-host +---- + +== CA certificates + +For backends with a private CA, set either a SecretClass or the path of a mounted CA file: + +[source,yaml] +---- +trino: + tls: + secretClass: tls # <1> +database: + tls: + caCert: /stackable/database-ca/ca.crt # <2> +extraVolumes: + - name: database-ca + secret: + secretName: database-ca +extraVolumeMounts: + - name: database-ca + mountPath: /stackable/database-ca + readOnly: true +---- +<1> The Secret Operator mounts the CA certificate of the SecretClass. +<2> A CA file mounted from a Secret. + +The same options exist under `storage.tls` for S3 endpoints. + +== Additional environment variables + +To set xref:reference/environment-variables.adoc[environment variables] directly, use `extraEnv` or `extraEnvFrom`: + +[source,yaml] +---- +extraEnv: + - name: LOG_LEVEL + value: debug +---- + +== Replicas + +Cockpit keeps running queries in memory, so keep `replicaCount` at `1`. + +// TODO: Remove once query state is shared between replicas. diff --git a/docs/modules/ROOT/pages/installation/monitoring.adoc b/docs/modules/ROOT/pages/installation/monitoring.adoc new file mode 100644 index 00000000..f368df55 --- /dev/null +++ b/docs/modules/ROOT/pages/installation/monitoring.adoc @@ -0,0 +1,10 @@ += Monitoring +:description: Stackable Cockpit exposes Prometheus metrics at /metrics and a health endpoint at /healthz, and writes structured JSON logs. + +Cockpit exposes Prometheus metrics at `/metrics` on port 3000, without authentication. +They include HTTP request durations, Trino query counts and storage operation metrics. + +The chart's liveness, readiness and startup probes use `/healthz`. + +Cockpit writes JSON logs to stdout. +Set the log level with `logging.level`; the default is `info`. diff --git a/docs/modules/ROOT/pages/modules/bookmarks.adoc b/docs/modules/ROOT/pages/modules/bookmarks.adoc new file mode 100644 index 00000000..7d6c4988 --- /dev/null +++ b/docs/modules/ROOT/pages/modules/bookmarks.adoc @@ -0,0 +1,30 @@ += Bookmarks +:description: The dashboard of Stackable Cockpit shows bookmarks to the web UIs of the platform's services, set up by each user or globally by the administrator. + +The dashboard and the sidebar show bookmarks to frequently used tools, such as the web UIs of the platform's services. +Each user can add up to 25 bookmarks of their own. +Pinned bookmarks appear under _Favourites_ at the top of the sidebar. + +== Global bookmarks + +Global bookmarks are shown to every user, before their own bookmarks. +Users cannot change them. + +[source,yaml] +---- +features: + bookmarks: + global: + - productId: superset # <1> + name: Dashboards # <2> + url: https://superset.example.com # <3> + environment: prod # <4> + pinned: true # <5> +---- +<1> One of `trino`, `superset`, `airflow`, `nifi`, `druid`, `opensearch`, `hdfs`, `hbase`, `spark` or `custom`. It selects the icon; unknown values are shown as `custom`. +<2> Up to 40 characters. +<3> An HTTP or HTTPS URL. +<4> Optional. A label shown on the bookmark, up to 100 characters. +<5> Optional. Shows the bookmark under _Favourites_. Defaults to `false`. + +Cockpit does not start if an entry is invalid. diff --git a/docs/modules/ROOT/pages/modules/storage.adoc b/docs/modules/ROOT/pages/modules/storage.adoc new file mode 100644 index 00000000..fd057e61 --- /dev/null +++ b/docs/modules/ROOT/pages/modules/storage.adoc @@ -0,0 +1,54 @@ += Storage +:description: The storage module of Stackable Cockpit is a file browser for S3-compatible object storage with previews, uploads, downloads and file editing. + +The storage module is a file browser for S3-compatible object storage. +Users browse buckets, upload and download files, preview common formats such as CSV, Parquet, images, PDFs and archives, and edit text files. + +The module is disabled by default: + +[source,yaml] +---- +features: + storage: + enabled: true +storage: + encryptionKey: + secretKeyRef: + name: cockpit + key: storage-encryption-key # <1> + tls: + secretClass: tls # <2> +---- +<1> A 64-character hex string, for example from `openssl rand -hex 32`. +<2> Optional. Provides the CA certificate of the S3 endpoints. Alternatively set `caCert` to a mounted file. + +Each user adds their own S3 connections in the UI. +Cockpit stores them in the database, with the credentials encrypted by the encryption key. +If the key changes or is lost, the stored credentials can no longer be read. + +The CA certificate in `storage.tls` replaces the system trust store, so endpoints with publicly trusted certificates fail while it is set. + +== File operations + +Cut, copy, paste, rename and drag-and-drop move are disabled by default, because they can cause many S3 requests: + +[source,yaml] +---- +features: + storage: + transfer: true +---- + +== Limits + +Preview sizes, upload and transfer concurrency, the archive cache and the download history retention are set under `storage`, see the xref:reference/environment-variables.adoc#_storage[reference]: + +[source,yaml] +---- +storage: + filePreviewRows: 500 + maxEditableFileSize: 10485760 # <1> +config: + bodySizeLimit: 12M +---- +<1> `config.bodySizeLimit` must be at least this large, otherwise saving large files fails. diff --git a/docs/modules/ROOT/pages/modules/trino.adoc b/docs/modules/ROOT/pages/modules/trino.adoc new file mode 100644 index 00000000..c0e9679a --- /dev/null +++ b/docs/modules/ROOT/pages/modules/trino.adoc @@ -0,0 +1,45 @@ += Trino +:description: The Trino module of Stackable Cockpit is a SQL editor with code completion and a schema browser that runs queries as the logged-in user. + +The Trino module is a SQL editor for xref:home:trino:index.adoc[Trino] with syntax highlighting, code completion and a schema browser. + +== Connection + +Set `trino.url` to connect all users to one Trino cluster: + +[source,yaml] +---- +trino: + url: https://trino-coordinator:8443 # <1> + publicUrl: https://trino.example.com # <2> + auth: + type: basic # <3> + username: cockpit + password: + secretKeyRef: + name: cockpit + key: trino-auth-password + tls: + secretClass: tls # <4> +---- +<1> The coordinator as Cockpit reaches it. +<2> Optional. The URL for links to the Trino web UI, defaults to `url`. +<3> `none` (default) or `basic`. +<4> Provides the CA certificate of Trino. Alternatively set `caCert` to a mounted file, or `insecure: true` to skip verification. + +Without `trino.url`, each user enters a connection in the UI. +These connections are kept in memory and are lost when Cockpit restarts. + +== User identity + +Cockpit sends queries with the logged-in user as `X-Trino-User`, so Trino applies its access control to that user. +The user is taken from the OIDC claim `trino.userImpersonation.userClaim` (default `preferred_username`), and updated on every login. +If the claim is missing, Cockpit uses `preferred_username`, then the email address. +With basic authentication, Trino must allow the Cockpit user to impersonate other users. + +Set `trino.userImpersonation.enabled: false` to run all queries as `trino.auth.username` instead. + +== Settings + +* `features.trino.completion.enabled` turns code completion on or off (default `true`). +* `trino.queryTtl` sets how long, in seconds, finished queries of an unused editor tab are kept (default `1800`). diff --git a/docs/modules/ROOT/pages/reference/environment-variables.adoc b/docs/modules/ROOT/pages/reference/environment-variables.adoc new file mode 100644 index 00000000..9480b5b8 --- /dev/null +++ b/docs/modules/ROOT/pages/reference/environment-variables.adoc @@ -0,0 +1,243 @@ += Environment variables +:description: Reference of all environment variables that configure Stackable Cockpit, with their defaults, grouped by server, authentication, Trino and storage. + +The Helm chart sets these variables from its values. +Set them directly only when you run Cockpit without the chart. +Cockpit does not start if a value is invalid, and the error names every invalid variable. + +// TODO: Generate this page from the code so it cannot drift. + +== Server + +[cols="2,1,3"] +|=== +|Variable |Default |Description + +|`ORIGIN` +| +|The URL users open in the browser. Requests from other origins are rejected. + +|`PROTOCOL_HEADER`, `HOST_HEADER` +| +|Forwarded headers trusted behind a reverse proxy, for example `x-forwarded-proto` and `x-forwarded-host`. + +|`BODY_SIZE_LIMIT` +|`6M` +|Maximum request body size. + +|`LOG_LEVEL` +|`info` +|`trace`, `debug`, `info`, `warn` or `error`. +|=== + +== Database + +[cols="2,1,3"] +|=== +|Variable |Default |Description + +|`DATABASE_HOST` +|`localhost` +|PostgreSQL host. + +|`DATABASE_PORT` +|`31432` +|PostgreSQL port. + +|`DATABASE_NAME` +|`cockpit` +|Database name. + +|`DATABASE_USER` +|`cockpit` +|Database user. + +|`DATABASE_PASSWORD` +| +|Database password. Required. + +|`DATABASE_TLS_MODE` +|`verify-full` in production, otherwise `disable` +|`verify-full`, `require` or `disable`. + +|`DATABASE_TLS_CA_CERT` +| +|Path to the CA certificate of PostgreSQL. Requires `verify-full`. +|=== + +== Authentication + +[cols="2,1,3"] +|=== +|Variable |Default |Description + +|`STACKABLE_COCKPIT_BASE_URL` +| +|The URL users open in the browser, used for the OIDC callback. + +|`STACKABLE_COCKPIT_SESSION_SECRET` +| +|Secret that signs session cookies. + +|`STACKABLE_COCKPIT_OIDC_DISCOVERY_URL` +| +|The `.well-known/openid-configuration` URL of the OIDC provider. Login is disabled unless this, the client ID and the client secret are set. + +|`STACKABLE_COCKPIT_OIDC_CLIENT_ID` +| +|OIDC client ID. + +|`STACKABLE_COCKPIT_OIDC_CLIENT_SECRET` +| +|OIDC client secret. + +|`STACKABLE_COCKPIT_OIDC_EXTRA_SCOPES` +| +|Scopes requested in addition to `openid`, `profile` and `email`, separated by commas or spaces. +|=== + +== Trino + +[cols="2,1,3"] +|=== +|Variable |Default |Description + +|`STACKABLE_COCKPIT_TRINO_URL` +| +|Trino coordinator URL for all users. Without it, users enter a connection in the UI. + +|`STACKABLE_COCKPIT_TRINO_PUBLIC_URL` +|`STACKABLE_COCKPIT_TRINO_URL` +|URL for links to the Trino web UI. + +|`STACKABLE_COCKPIT_TRINO_AUTH_TYPE` +|`none` +|`none` or `basic`. + +|`STACKABLE_COCKPIT_TRINO_AUTH_USERNAME` +| +|User for basic authentication. + +|`STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD` +| +|Password for basic authentication. + +|`STACKABLE_COCKPIT_TRINO_TLS_CA_CERT` +| +|Path to the CA certificate of Trino. + +|`STACKABLE_COCKPIT_TRINO_TLS_INSECURE` +|`false` +|Skip TLS certificate verification. + +|`STACKABLE_COCKPIT_TRINO_USER_IMPERSONATION` +|`true` +|Send queries as the logged-in user. + +|`STACKABLE_COCKPIT_TRINO_USER_CLAIM` +|`preferred_username` +|OIDC claim used as the Trino user. + +|`STACKABLE_COCKPIT_COMPLETION_ENABLED` +|`true` +|SQL code completion. + +|`STACKABLE_COCKPIT_QUERY_TTL` +|`1800` +|Seconds that finished queries of an unused editor tab are kept. +|=== + +== Storage + +[cols="2,1,3"] +|=== +|Variable |Default |Description + +|`STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED` +|`false` +|Enables the storage module. + +|`STORAGE_ENCRYPTION_KEY` +| +|64-character hex key that encrypts stored S3 credentials. Required when the storage module is enabled. + +|`STACKABLE_COCKPIT_STORAGE_TLS_CA_CERT` +| +|Path to the CA certificate of the S3 endpoints. Replaces the system trust store. + +|`PUBLIC_STACKABLE_COCKPIT_STORAGE_TRANSFER_ENABLED` +|`false` +|Cut, copy, paste, rename and drag-and-drop move. + +|`PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES` +|`25,50,100` +|Page sizes of paginated lists. + +|`PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE` +|Smallest page size +|Default page size. Must be one of the page sizes. + +|`PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES` +|`15` +|Recently visited locations kept in the browser. + +|`PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY` +|`3` +|Parallel requests during uploads. + +|`PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE` +|`5242880` +|Largest file in bytes that can be edited. `BODY_SIZE_LIMIT` must be at least this large. + +|`STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES` +|`262144` +|Bytes fetched for text, TSV and JSON previews. + +|`STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES` +|`5242880` +|Bytes fetched for image previews. + +|`STACKABLE_COCKPIT_PDF_PREVIEW_BYTES` +|`26214400` +|Bytes fetched for PDF previews. + +|`STACKABLE_COCKPIT_FILE_PREVIEW_ROWS` +|`250` +|Rows in tabular previews. + +|`STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS` +|`50` +|Columns in tabular previews. + +|`STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES` +|`gzip-no_offset` +|Parquet codecs that are not previewed. The suffix `-no_offset` blocks only files without an offset index. + +|`STACKABLE_COCKPIT_ARCHIVE_PREVIEW_MAX_MB` +|`100` +|Largest archive in MB that is previewed. + +|`STACKABLE_COCKPIT_ARCHIVE_CACHE_MAX_MB` +|`512` +|Size in MB of the archive cache in `/tmp`. At least twice the archive preview limit. + +|`STACKABLE_COCKPIT_STORAGE_TRANSFER_CONCURRENCY` +|`8` +|Objects copied in parallel within one copy, move or rename. + +|`STACKABLE_COCKPIT_DOWNLOAD_HISTORY_RETENTION_DAYS` +|`30` +|Days the download history is kept, from 1 to 3650. +|=== + +== Bookmarks + +[cols="2,1,3"] +|=== +|Variable |Default |Description + +|`STACKABLE_COCKPIT_GLOBAL_BOOKMARKS` +| +|JSON array of bookmarks shown to every user, see xref:modules/bookmarks.adoc#_global_bookmarks[Global bookmarks]. +Example: `[{"productId":"superset","name":"Dashboards","url":"https://superset.example.com"}]`. +|===