[{"data":1,"prerenderedAt":1152},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fcontainer-registries":3,"docs-nav":929},{"id":4,"title":5,"body":6,"description":920,"extension":921,"meta":922,"navigation":924,"path":925,"seo":926,"stem":927,"__hash__":928},"docs\u002Fdocs\u002Fcontainer-registries.md","Container registries",{"type":7,"value":8,"toc":906},"minimark",[9,13,27,35,43,48,51,87,98,105,166,181,185,286,293,312,319,322,416,421,447,453,468,471,474,522,537,541,552,555,569,572,576,591,595,600,619,636,639,643,648,661,690,700,714,718,726,852,858,879,892,896,902],[10,11,5],"h1",{"id":12},"container-registries",[14,15,16,20,21,26],"p",{},[17,18,19],"strong",{},"Administration → Container registries"," lists the image registries the\n",[22,23,25],"a",{"href":24},"\u002Fdocs\u002Fcontainer-node","Container node"," may take images from. An administrator defines each one: its address, how Tabularia\ntrusts its certificate, the credentials, and the repositories whose images may run. The\npeople who write flows then pick an image of an allowed repository; they never type a\nregistry address or a password.",[14,28,29,30,34],{},"A registry is not one of the folder ",[22,31,33],{"href":32},"\u002Fdocs\u002Fconnections","connections"," to databases,\nbuckets and servers: it is granted to groups and users rather than placed in a folder, it\nis tested from the gateway, and its images are downloaded by the cluster's nodes, not by\nTabularia's workers.",[14,36,37,38,42],{},"It is a Kubernetes feature, like ",[22,39,41],{"href":40},"\u002Fdocs\u002Fscripting","Python and R in flows",": the containers\nrun as Kubernetes Jobs.",[44,45,47],"h2",{"id":46},"turning-it-on","Turning it on",[14,49,50],{},"In the chart's values:",[52,53,58],"pre",{"className":54,"code":55,"language":56,"meta":57,"style":57},"language-yaml shiki shiki-themes github-dark-dimmed github-light","containers:\n  enabled: true\n","yaml","",[59,60,61,74],"code",{"__ignoreMap":57},[62,63,66,70],"span",{"class":64,"line":65},"line",1,[62,67,69],{"class":68},"shb1k","containers",[62,71,73],{"class":72},"ssh_m",":\n",[62,75,77,80,83],{"class":64,"line":76},2,[62,78,79],{"class":68},"  enabled",[62,81,82],{"class":72},": ",[62,84,86],{"class":85},"swcJU","true\n",[14,88,89,90,93,94,97],{},"or ",[59,91,92],{},"CONTAINERS__ENABLED=true"," for the gateway. Without it (on Docker Compose, for\ninstance) the section, the palette's ",[17,95,96],{},"Container"," and the Container nodes of a flow\nbrought from a cluster are greyed out, with the reason; nothing is saved here, and such\na flow is saved as it is.",[14,99,100,101,104],{},"The chart then creates two namespaces, both at the Pod Security ",[59,102,103],{},"baseline"," level (root\nis allowed inside a container, as most existing images need; privileges and host access\nare not):",[106,107,108,124],"table",{},[109,110,111],"thead",{},[112,113,114,118,121],"tr",{},[115,116,117],"th",{},"Value",[115,119,120],{},"Default",[115,122,123],{},"What runs there",[125,126,127,143],"tbody",{},[112,128,129,135,140],{},[130,131,132],"td",{},[59,133,134],{},"containers.namespace",[130,136,137],{},[59,138,139],{},"\u003Crelease namespace>-containers",[130,141,142],{},"the Container nodes of the flows' runs",[112,144,145,150,155],{},[130,146,147],{},[59,148,149],{},"containers.trialNamespace",[130,151,152],{},[59,153,154],{},"\u003Crelease namespace>-containers-dev",[130,156,157,158,161,162,165],{},"the editor's trials and ",[17,159,160],{},"Try in the cluster",", under a ResourceQuota (",[59,163,164],{},"containers.trialQuota",")",[14,167,168,169,172,173,176,177,180],{},"The gateway's and the orchestrator's service accounts (",[59,170,171],{},"…-scaler",", ",[59,174,175],{},"…-orchestrator",")\nget a Role in each: Jobs, their Pods, logs and events, and Secrets (the pull Secrets\nbelow). If your namespaces are created by someone else, ",[59,178,179],{},"containers.createNamespaces: false",": the chart still adds the Roles, the trials' ResourceQuota and the network policy\nof the users' code.",[44,182,184],{"id":183},"a-registry","A registry",[106,186,187,196],{},[109,188,189],{},[112,190,191,194],{},[115,192,193],{},"Field",[115,195],{},[125,197,198,208,233,243,253,266,276],{},[112,199,200,205],{},[130,201,202],{},[17,203,204],{},"Name",[130,206,207],{},"how flows and the audit call it",[112,209,210,215],{},[130,211,212],{},[17,213,214],{},"Address",[130,216,217,218,172,221,172,224,172,227,172,230],{},"a host name with its port if any: ",[59,219,220],{},"docker.io",[59,222,223],{},"ghcr.io",[59,225,226],{},"registry.gitlab.com",[59,228,229],{},"rg.fr-par.scw.cloud",[59,231,232],{},"registry.acme.internal:5000",[112,234,235,240],{},[130,236,237],{},[17,238,239],{},"Protocol",[130,241,242],{},"HTTPS, or HTTP for a registry inside your network",[112,244,245,250],{},[130,246,247],{},[17,248,249],{},"Certificate",[130,251,252],{},"how HTTPS is checked (below)",[112,254,255,263],{},[130,256,257,172,260],{},[17,258,259],{},"User",[17,261,262],{},"Password or token",[130,264,265],{},"read access is enough; empty for a registry that serves anonymously",[112,267,268,273],{},[130,269,270],{},[17,271,272],{},"Allowed repositories",[130,274,275],{},"which images may run (below)",[112,277,278,283],{},[130,279,280],{},[17,281,282],{},"Usable in flows",[130,284,285],{},"off keeps the registry, and its images can no longer be chosen",[14,287,288],{},[289,290],"img",{"alt":291,"src":292},"The New registry form: name Acme registry, address registry.acme.internal:5000, HTTPS with a company authority and its certificate pasted, a user and a hidden password, the allowed repositories analytics\u002F*, and access given to the group Data team","\u002Fmedia\u002Fguide\u002Fcontainers\u002Fregistry-new-dialog.png",[14,294,295],{},[296,297,298,299,303,304,307,308,311],"em",{},"A new registry, the one of ",[22,300,302],{"href":301},"#example-the-company-registry","the example below",": a company authority with its certificate, a user and a password, the repositories under ",[59,305,306],{},"analytics\u002F",", and the group ",[59,309,310],{},"Data team"," allowed to use them.",[14,313,314,315,318],{},"The password or token is encrypted with the installation's key and never shown again:\nleave the field empty to keep it, or ",[17,316,317],{},"Remove the password"," to reach the registry\nanonymously.",[14,320,321],{},"Credentials for the usual registries:",[106,323,324,335],{},[109,325,326],{},[112,327,328,331,333],{},[115,329,330],{},"Registry",[115,332,259],{},[115,334,262],{},[125,336,337,350,366,382,398],{},[112,338,339,344,347],{},[130,340,341,342,165],{},"Docker Hub (",[59,343,220],{},[130,345,346],{},"your Docker ID",[130,348,349],{},"an access token, read-only",[112,351,352,357,360],{},[130,353,354,355,165],{},"GitHub (",[59,356,223],{},[130,358,359],{},"your GitHub user",[130,361,362,363],{},"a token with ",[59,364,365],{},"read:packages",[112,367,368,373,376],{},[130,369,370,371,165],{},"GitLab (",[59,372,226],{},[130,374,375],{},"the deploy token's user",[130,377,378,379],{},"a deploy token with ",[59,380,381],{},"read_registry",[112,383,384,390,395],{},[130,385,386,387,165],{},"Scaleway (",[59,388,389],{},"rg.\u003Cregion>.scw.cloud",[130,391,392],{},[59,393,394],{},"nologin",[130,396,397],{},"a secret key whose rights include the registry",[112,399,400,403,413],{},[130,401,402],{},"Harbor",[130,404,405,406,409,410,165],{},"a robot account with ",[296,407,408],{},"Pull"," on the project (",[59,411,412],{},"robot$project+name",[130,414,415],{},"its secret",[417,418,420],"h3",{"id":419},"the-certificate","The certificate",[422,423,424,431,441],"ul",{},[425,426,427,430],"li",{},[17,428,429],{},"Public authorities",": the registry's certificate is signed by an authority every\nsystem trusts. Docker Hub, GHCR, GitLab and the cloud registries are.",[425,432,433,436,437,440],{},[17,434,435],{},"Company authority",": your company signs its own certificates. Paste the\nauthority's certificate, in PEM (",[59,438,439],{},"-----BEGIN CERTIFICATE-----"," …). It is public: the\nobservers see it too.",[425,442,443,446],{},[17,444,445],{},"Not checked",": Tabularia does not check who answers. Anyone between Tabularia and\nthe registry could pose as it: for a test registry only. The choice is recorded in the\naudit, like every change of the registry.",[14,448,449,452],{},[17,450,451],{},"HTTP"," has no certificate: images and credentials travel unencrypted, so keep it for a\nregistry inside your network.",[14,454,455,458,459,462,463,467],{},[17,456,457],{},"The nodes download the images, not Tabularia."," With a company authority or HTTP, the\ncluster's nodes must trust the registry too, as for any image of the cluster: the\nauthority installed on the nodes (a node image, or a DaemonSet that writes it into\ncontainerd's ",[59,460,461],{},"certs.d","), or the registry allowed over HTTP there. The\n",[22,464,466],{"href":465},"\u002Fdocs\u002Fdeploy\u002Fkind#3-nodes-that-trust-the-authority","kind guide"," shows how a node is set up.",[417,469,272],{"id":470},"allowed-repositories",[14,472,473],{},"One per line:",[106,475,476,486],{},[109,477,478],{},[112,479,480,483],{},[115,481,482],{},"Line",[115,484,485],{},"Allows",[125,487,488,498,512],{},[112,489,490,495],{},[130,491,492],{},[59,493,494],{},"team\u002Fforecast",[130,496,497],{},"that repository only",[112,499,500,505],{},[130,501,502],{},[59,503,504],{},"team\u002F*",[130,506,507,508,511],{},"every repository under ",[59,509,510],{},"team\u002F",", at any depth",[112,513,514,519],{},[130,515,516],{},[59,517,518],{},"*",[130,520,521],{},"the whole registry",[14,523,524,525,528,529,532,533,536],{},"On Docker Hub an official image has no prefix: ",[59,526,527],{},"python"," is saved as ",[59,530,531],{},"library\u002Fpython",".\nImages of a repository that is not listed cannot be chosen, nor read: ",[17,534,535],{},"Tags of a\nrepository"," answers only for allowed ones.",[417,538,540],{"id":539},"who-can-use-it","Who can use it",[14,542,543,544,547,548,551],{},"Access to a registry is given here, by an administrator, to ",[17,545,546],{},"groups"," and to single\n",[17,549,550],{},"users",", and to nothing else: a registry is not tied to folders. For each group or\nuser you may also list the repositories they may use, with the same patterns as above;\nleft empty, they may use all the repositories the registry allows. Administrators use\nevery registry.",[14,553,554],{},"Someone with access sees the registry in the flow editor, with only the repositories\ngranted to them, and can put its images in a Container node of a flow they may edit.\nSomeone without:",[422,556,557,560,566],{},[425,558,559],{},"does not see the registry, nor its repositories or tags;",[425,561,562,565],{},[17,563,564],{},"cannot open a flow that uses it",", nor one whose image is outside what they were\ngranted. The flow is still listed in Explore, in Flows and in the search, greyed out\nwith a lock: it is not a link and has no actions, and hovering it says which registry or image is missing and\nthat an administrator can grant it. Reached by its address, the editor says the same\nin place of the canvas. Its versions, a copy, a run,\na schedule and adding it to a group of flows are refused the same way;",[425,567,568],{},"cannot add a Container node of that registry to a flow.",[14,570,571],{},"A registry that is deleted blocks nobody any more: its Container nodes simply cannot run.",[417,573,575],{"id":574},"variables","Variables",[14,577,578,579,582,583,586,587,590],{},"What every container of the registry finds in its environment, as for the scripting\nenvironments: a secret one is encrypted and never shown again. Names are in capitals,\ndigits and ",[59,580,581],{},"_","; those starting with ",[59,584,585],{},"TABULARIA_"," or ",[59,588,589],{},"AWS_"," are set by Tabularia.",[44,592,594],{"id":593},"test","Test",[14,596,597,599],{},[17,598,594],{}," (it saves first) checks, from the gateway:",[601,602,603,606,609,616],"ol",{},[425,604,605],{},"that the address answers as a registry;",[425,607,608],{},"that the certificate is the one expected;",[425,610,611,612,615],{},"that the credentials are accepted, the way the registry asks: a token from its\nauthentication service (Docker Hub, GHCR, GitLab, Harbor, Scaleway) or a user and a\npassword (a registry with ",[59,613,614],{},"htpasswd",");",[425,617,618],{},"with an allowed repository named in full, that it can be read: it shows a few of its\ntags.",[14,620,621,622,625,626,625,629,625,632,635],{},"The result stays on the registry, and the list shows whether each one works. A failure\nsays which part to fix: ",[296,623,624],{},"The registry's certificate is not signed by a public\nauthority: choose «Company authority»","; ",[296,627,628],{},"The registry answers in plain HTTP: choose\nHTTP",[296,630,631],{},"The registry refused the user and the password",[296,633,634],{},"team\u002Fforecast is not in the\nregistry, or not visible with these credentials",".",[14,637,638],{},"The gateway never connects to the cloud metadata addresses, whatever a registry's name\nresolves to. Private addresses are fine: company registries usually are.",[44,640,642],{"id":641},"in-the-cluster","In the cluster",[14,644,645,647],{},[17,646,594],{}," speaks from the gateway; the images are downloaded by the cluster's nodes,\nwhich may not trust the same certificates nor reach the same addresses.",[14,649,650,652,653,656,657,660],{},[17,651,160],{}," checks the nodes: give an allowed repository and a tag (or a\ndigest). Tabularia resolves the tag to its digest, then starts a Pod in the trials'\nnamespace with that image and a command that does not exist: the node downloads the\nimage and then fails to start it, so ",[17,654,655],{},"nothing of the image runs",". The Pod is removed at\nonce. The answer is either ",[296,658,659],{},"The cluster can download it",", with the digest, or what went\nwrong, in the words of a run:",[422,662,663,671,677],{},[425,664,665,668,669,615],{},[296,666,667],{},"the nodes do not trust the registry's certificate",": the authority must be installed\non the nodes (",[22,670,466],{"href":465},[425,672,673,676],{},[296,674,675],{},"the nodes reach the registry in HTTPS but it answers in HTTP",": the registry must be\nallowed over HTTP on the nodes;",[425,678,679,172,682,685,686,689],{},[296,680,681],{},"the registry refused the credentials",[296,683,684],{},"the image is no longer there",", or that no\nnode downloaded it in time (",[59,687,688],{},"CONTAINERS__PULL_CHECK_SECONDS",", 300 s by default: a large\nimage, or a busy cluster).",[14,691,692,693,696,697,699],{},"The check answers within 270 s, under the ingress' 300 s\n(",[59,694,695],{},"nginx.ingress.kubernetes.io\u002Fproxy-read-timeout","). A node still downloading a large\nimage then is said to be, and its Pod is left to finish the download (for up to\n",[59,698,688],{},"): the next try finds the image on that node.",[14,701,702,705,706,709,710,713],{},[17,703,704],{},"Pull Secrets."," A registry with credentials has a Secret\n",[59,707,708],{},"tabularia-registry-\u003Cid>"," (type ",[59,711,712],{},"kubernetes.io\u002Fdockerconfigjson",") in the containers'\nnamespaces, written by Tabularia right before a Pod needs it, from the credentials as\nthey are then: a changed or removed password never lingers there. A registry without\ncredentials has none, and a deleted registry's goes with it. Do not edit them by hand:\nthe next run writes them again.",[44,715,717],{"id":716},"example-the-company-registry","Example: the company registry",[14,719,720,721,723,724,635],{},"Your company runs a Harbor at ",[59,722,232],{},", with a certificate signed by\nits own authority, and the data team pushes its images under ",[59,725,306],{},[601,727,728,742,796,812,818,835],{},[425,729,730,731,733,734,737,738,741],{},"In Harbor, create a robot account with ",[296,732,408],{}," on the project ",[59,735,736],{},"analytics",", and keep its\nname (",[59,739,740],{},"robot$analytics+tabularia",") and its secret.",[425,743,744,73,747],{},[17,745,746],{},"Administration → Container registries → New registry",[422,748,749,762,780,789],{},[425,750,751,753,754,756,757,172,759,761],{},[17,752,204],{}," «Acme registry», ",[17,755,214],{}," ",[59,758,232],{},[17,760,239],{},"\nHTTPS;",[425,763,764,756,766,768,769,772,773,775,776,779],{},[17,765,249],{},[17,767,435],{},", and in ",[17,770,771],{},"Authority's certificate (PEM)"," the\ncertificate of the company's authority, from ",[59,774,439],{}," to\n",[59,777,778],{},"-----END CERTIFICATE-----",";",[425,781,782,756,784,172,786,788],{},[17,783,259],{},[59,785,740],{},[17,787,262],{}," its secret;",[425,790,791,756,793,635],{},[17,792,272],{},[59,794,795],{},"analytics\u002F*",[425,797,798,799,801,802,805,806,809,810,635],{},"Under ",[17,800,540],{},", choose ",[17,803,804],{},"Group",", the data team's group, and ",[17,807,808],{},"Give access",".\nLeave its repositories empty: it may use everything under ",[59,811,306],{},[425,813,814,817],{},[17,815,816],{},"Save and test",". The answer is «The registry answers.», with a few tags when an\nallowed repository is named in full; a failure says which part to fix.",[425,819,798,820,172,823,826,827,830,831,834],{},[17,821,822],{},"Tags of a repository",[59,824,825],{},"analytics\u002Fdemand-forecast"," → ",[17,828,829],{},"Show the tags"," lists\nwhat the Container node will offer, ",[59,832,833],{},"1.4.0"," among them.",[425,836,798,837,839,840,756,843,845,846,848,849,851],{},[17,838,160],{},", the same repository and ",[17,841,842],{},"Tag or digest",[59,844,833],{}," →\n",[17,847,160],{},". «The cluster can download it.», with the digest, means the\nnodes trust the authority and accept the robot's credentials. If they do not trust it,\ninstall the authority on the nodes first (",[22,850,466],{"href":465},").",[14,853,854],{},[289,855],{"alt":856,"src":857},"The registry's page after the checks: «The registry answers», the tags 1.3.2 and 1.4.0 of analytics\u002Fdemand-forecast, «The cluster can download it» with the image's digest, and two variables, one of them secret","\u002Fmedia\u002Fguide\u002Fcontainers\u002Fregistry-test-and-cluster-check.png",[14,859,860],{},[296,861,862,863,865,866,868,869,871,872,875,876,878],{},"The same registry once saved: ",[17,864,594],{}," answers from the gateway, ",[17,867,822],{}," lists what the Container node will offer, ",[17,870,160],{}," says a node downloaded ",[59,873,874],{},"analytics\u002Fdemand-forecast:1.4.0"," by its digest, and ",[17,877,575],{}," holds one plain and one secret value for every container of the registry.",[14,880,881,882,884,885,887,888,635],{},"From then on, the data team finds ",[17,883,96],{}," in the palette of the flow editor, with\nthe registry and its ",[59,886,306],{}," images: ",[22,889,891],{"href":890},"\u002Fdocs\u002Fcontainer-node#example-a-forecast-step-in-a-flow","a forecast step in a flow",[44,893,895],{"id":894},"audit","Audit",[14,897,898,899,901],{},"Every creation, change, test, deletion and variable is in ",[17,900,895],{},", with who did it.\nThe password, the token and the secret variables never are: only that they were set,\nchanged or removed.",[903,904,905],"style",{},"html pre.shiki code .shb1k, html code.shiki .shb1k{--shiki-default:#8DDB8C;--shiki-light:#22863A}html pre.shiki code .ssh_m, html code.shiki .ssh_m{--shiki-default:#ADBAC7;--shiki-light:#24292E}html pre.shiki code .swcJU, html code.shiki .swcJU{--shiki-default:#6CB6FF;--shiki-light:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":57,"searchDepth":76,"depth":907,"links":908},3,[909,910,916,917,918,919],{"id":46,"depth":76,"text":47},{"id":183,"depth":76,"text":184,"children":911},[912,913,914,915],{"id":419,"depth":907,"text":420},{"id":470,"depth":907,"text":272},{"id":539,"depth":907,"text":540},{"id":574,"depth":907,"text":575},{"id":593,"depth":76,"text":594},{"id":641,"depth":76,"text":642},{"id":716,"depth":76,"text":717},{"id":894,"depth":76,"text":895},"Administration → Container registries lists the image registries the\nContainer node may take images from. An administrator defines each one: its address, how Tabularia\ntrusts its certificate, the credentials, and the repositories whose images may run. The\npeople who write flows then pick an image of an allowed repository; they never type a\nregistry address or a password.","md",{"source":923},"docs\u002Fcontainer-registries.md",true,"\u002Fdocs\u002Fcontainer-registries",{"title":5,"description":920},"docs\u002Fcontainer-registries","9eCYAnARkv8jPCI3Z4b3Kb9iCPEcXAMrqVD3-FV3nbg",[930,949,1003,1035,1063,1092,1118,1144],{"title":931,"icon":932,"intro":933,"items":934},"Getting started","start","Install it on one machine, learn the few ideas everything else is built on, and run a first flow.",[935,937,940,943,946],{"path":936,"title":931},"\u002Fdocs\u002Fgetting-started",{"path":938,"title":939},"\u002Fdocs\u002Fgetting-started-docker-compose","Walkthrough with Docker Compose",{"path":941,"title":942},"\u002Fdocs\u002Fdeploy\u002Fminikube","Try it on your computer (minikube)",{"path":944,"title":945},"\u002Fdocs\u002Fconcepts","Concepts",{"path":947,"title":948},"\u002Fdocs\u002Foverview","Overview (README)",{"title":950,"icon":951,"intro":952,"items":953},"Capabilities","capabilities","What you can build: visual flows, analysis on any step, AI questions, pixel-perfect reports, dashboards, Python, R and SQL scripts, containers and the orchestration that ties them together.",[954,957,960,963,966,969,972,975,977,980,983,985,988,991,994,997,1000],{"path":955,"title":956},"\u002Fdocs\u002Fcapabilities","All capabilities",{"path":958,"title":959},"\u002Fdocs\u002Fcapabilities\u002Fflows","Low-code flows",{"path":961,"title":962},"\u002Fdocs\u002Fcapabilities\u002Fpreview-and-analysis","Preview and analysis",{"path":964,"title":965},"\u002Fdocs\u002Fcapabilities\u002Fask-your-data","Ask your data with AI",{"path":967,"title":968},"\u002Fdocs\u002Fcapabilities\u002Freports","Pixel-perfect reports",{"path":970,"title":971},"\u002Fdocs\u002Fcapabilities\u002Freport-functions","Report functions",{"path":973,"title":974},"\u002Fdocs\u002Fcapabilities\u002Fdashboards","Dashboards",{"path":40,"title":976},"Python and R",{"path":978,"title":979},"\u002Fdocs\u002Fsql-scripts","SQL scripts",{"path":981,"title":982},"\u002Fdocs\u002Fcapabilities\u002Fnotebooks","marimo notebooks as apps",{"path":24,"title":984},"Docker images in flows",{"path":986,"title":987},"\u002Fdocs\u002Fcapabilities\u002Fflow-groups","Flow groups: orchestration",{"path":989,"title":990},"\u002Fdocs\u002Fcapabilities\u002Fscheduling","Scheduling",{"path":992,"title":993},"\u002Fdocs\u002Fpushmail","Pushmail: datasources, reports and dashboards by email",{"path":995,"title":996},"\u002Fdocs\u002Fplaceholders","Dynamic dates",{"path":998,"title":999},"\u002Fdocs\u002Fcapabilities\u002Fengines","Engines",{"path":1001,"title":1002},"\u002Fdocs\u002Fengines\u002Fengine-differences","Engine differences",{"title":1004,"icon":1005,"intro":1006,"items":1007},"Sources","sources","Every way data comes in: files, databases, buckets, SFTP folders, HTTP APIs, SharePoint, Google Sheets, and the results of your own flows.",[1008,1011,1014,1017,1020,1023,1026,1029,1032],{"path":1009,"title":1010},"\u002Fdocs\u002Fsources","All sources",{"path":1012,"title":1013},"\u002Fdocs\u002Fsources\u002Ffiles","Uploaded files",{"path":1015,"title":1016},"\u002Fdocs\u002Fsources\u002Fdatabases","Database tables and queries",{"path":1018,"title":1019},"\u002Fdocs\u002Fs3-datasource","S3 buckets",{"path":1021,"title":1022},"\u002Fdocs\u002Fsftp","SFTP folders",{"path":1024,"title":1025},"\u002Fdocs\u002Fapi-datasource","HTTP APIs",{"path":1027,"title":1028},"\u002Fdocs\u002Fsources\u002Fsharepoint","Excel on SharePoint",{"path":1030,"title":1031},"\u002Fdocs\u002Fsources\u002Fgoogle-sheets","Google Sheets",{"path":1033,"title":1034},"\u002Fdocs\u002Fsources\u002Fflow-outputs","Results of flows and scripts",{"title":1036,"icon":33,"intro":1037,"items":1038},"Connections","The systems Tabularia reads from and writes to, how each connection is set up, and who may use it.",[1039,1041,1044,1047,1050,1052,1053,1055,1056,1059,1060],{"path":32,"title":1040},"All connections",{"path":1042,"title":1043},"\u002Fdocs\u002Fconnections\u002Fdatabases","Databases",{"path":1045,"title":1046},"\u002Fdocs\u002Fsqlserver","Microsoft SQL Server driver",{"path":1048,"title":1049},"\u002Fdocs\u002Fconnections\u002Fs3","S3 and compatible storage",{"path":1021,"title":1051},"SFTP servers",{"path":1024,"title":1025},{"path":1027,"title":1054},"SharePoint",{"path":1030,"title":1031},{"path":1057,"title":1058},"\u002Fdocs\u002Fconnections\u002Fsmtp","SMTP email",{"path":925,"title":5},{"path":1061,"title":1062},"\u002Fdocs\u002Fconnections\u002Fdestinations","Writing data out",{"title":1064,"icon":1065,"intro":1066,"items":1067},"Integrations","integrations","How Tabularia fits your stack: AI providers, the REST API and webhooks, dbt, OpenLineage, single sign-on, SIEM and monitoring.",[1068,1071,1074,1077,1080,1083,1086,1089],{"path":1069,"title":1070},"\u002Fdocs\u002Fintegrations","All integrations",{"path":1072,"title":1073},"\u002Fdocs\u002Fintegrations\u002Fai","AI: where it is used",{"path":1075,"title":1076},"\u002Fdocs\u002Fapi","API, tokens and webhooks",{"path":1078,"title":1079},"\u002Fdocs\u002Fdbt-export","Export to dbt",{"path":1081,"title":1082},"\u002Fdocs\u002Fopenlineage","OpenLineage",{"path":1084,"title":1085},"\u002Fdocs\u002Fsso-keycloak","Single sign-on with Keycloak",{"path":1087,"title":1088},"\u002Fdocs\u002Fsiem-splunk","Audit log to Splunk",{"path":1090,"title":1091},"\u002Fdocs\u002Fintegrations\u002Fmonitoring","Monitoring",{"title":1093,"icon":1094,"intro":1095,"items":1096},"Security & governance","governance","Who may see and do what, what is recorded, and how data quality and personal data are kept in check.",[1097,1100,1103,1106,1109,1112,1115],{"path":1098,"title":1099},"\u002Fdocs\u002Fgovernance","Overview",{"path":1101,"title":1102},"\u002Fdocs\u002Fgovernance\u002Fpermissions","Permissions",{"path":1104,"title":1105},"\u002Fdocs\u002Fgovernance\u002Faudit-log","Audit log",{"path":1107,"title":1108},"\u002Fdocs\u002Fgovernance\u002Fdata-contracts","Data contracts",{"path":1110,"title":1111},"\u002Fdocs\u002Fdesign\u002Fsso-group-mapping","SSO and group mapping",{"path":1113,"title":1114},"\u002Fdocs\u002Fexamples\u002Fkeycloak","Keycloak example on a laptop",{"path":1116,"title":1117},"\u002Fdocs\u002Fengines\u002Fclickhouse-ai-user","A ClickHouse user for the AI assistant",{"title":1119,"icon":1120,"intro":1121,"items":1122},"Install & operate","operate","Run it in production on Kubernetes, configure it, upgrade it and keep it healthy.",[1123,1126,1129,1132,1135,1138,1141],{"path":1124,"title":1125},"\u002Fdocs\u002Fdeploy\u002Fkubernetes","Kubernetes and Helm",{"path":1127,"title":1128},"\u002Fdocs\u002Fdeploy\u002Fkind","A company-like cluster on one computer (kind)",{"path":1130,"title":1131},"\u002Fdocs\u002Fdeploy\u002Fupgrading","Upgrading, backups and restore",{"path":1133,"title":1134},"\u002Fdocs\u002Fdeploy\u002Frelease-checklist","Install and upgrade checklist",{"path":1136,"title":1137},"\u002Fdocs\u002Fconfiguration","Configuration reference",{"path":1139,"title":1140},"\u002Fdocs\u002Fengine-settings","Settings from the panel",{"path":1142,"title":1143},"\u002Fdocs\u002Fdatabase-migrations","Database migrations",{"title":1145,"icon":1146,"intro":1147,"items":1148},"Reference","reference","Release process and the remaining reference pages.",[1149],{"path":1150,"title":1151},"\u002Fdocs\u002Frelease-process","Release process",1793656371989]