cwielenb/CNCF-Dataset huggingface dataset:
Project: The Update Framework (TUF) (Provisioning / Security & Compliance)
File: 1.0.0-ANNOUNCEMENT.md

Python-TUF v1.0.0 is a rewritten stable reference implementation of the TUF specification, which currently includes: a modern low-level [*metadata API*](https://theupdateframework.readthedocs.io/en/latest/api/tuf.api.html) a fully specification-compliant [*updater client*](https://theupdateframework.readthedocs.io/en/latest/api/tuf.ngclient.html), serving as a more robust and yet more flexible stand-in replacement for the legacy client updater For the reasons outlined in [ADR 10](https://github.com/theupdateframework/python-tuf/blob/develop/docs/adr/0010-repository-library-design.md ), this release does not yet include repository tool-like functionality. However, the new metadata API makes it easy to replicate the desired functionality tailored to the specific needs of any given repository (see Migration for details). As discussed in , this release does not include any legacy code, as its maintenance has become infeasible for the python-tuf team. The pre-1.0.0 deprecation strategy from ADR 2 applies as follows: *Bugs reported with tuf versions prior to 1.0.0 will likely not be addressed directly by tufs maintainers. Pull Requests to fix bugs in the last release prior to 1.0.0 will be considered, and merged (subject to normal review processes). Note that there may be delays due to the lack of developer resources for reviewing such pull requests.* Given the clean cut with the legacy reference implementation, we provide the following migration support: detailed code documentation on verbose for client updater usage, and repository-side operations based on the low-level metadata API individual migration support upon targeted migration support initiative for known users
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_backup_create.md

title: kbcli backup create Create a backup for the cluster. ``` kbcli backup create NAME [flags] ``` ``` kbcli backup create mybackup --cluster mycluster kbcli backup create mybackup --cluster mycluster --type snapshot kbcli backup create mybackup --cluster mycluster --policy mypolicy ``` ``` --cluster string Cluster name -h, --help help for create --method string Backup type (default "snapshot") --policy string Backup policy name, this flag will be ignored when backup-type is snapshot ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Backup command.
Project: Buildpacks (App Definition and Development / Application Definition & Image Build)
File: README.md

A simple script that generates the changelog for pack based on a pack version (aka milestone). This script takes a configuration file in the following format: ```yaml labels: <label>: title: <string> description: <string> weight: <number> sections: contributors: title: <string> description: <string> ``` ```yaml name: Generate changelog uses: ./.github/workflows/actions/release-notes id: changelog with: github-token: ${{ secrets.GITHUB_TOKEN }} milestone: <milestone> ``` To run/test locally: ```shell script npm install export GITHUBTOKEN="<GITHUBPAT_TOKEN>" npm run local -- <milestone> <config-path> ``` Notice that a file `changelog.md` is created as well for further inspection. This action is packaged for distribution without vendoring `npm_modules` with use of . When making changes to the action, compile it and commit the changes. ```shell script npm run-script build ```
Project: KICS (Provisioning / Security & Compliance)
File: ee7b93c1-b3f8-4a3b-9588-146d481814f5.md

title: Google Compute Subnetwork with Private Google Access Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ee7b93c1-b3f8-4a3b-9588-146d481814f5 Query name: Google Compute Subnetwork with Private Google Access Disabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: Google Compute Subnetwork should have Private Google Access enabled, which means 'privateipgoogle_access' should be set to true<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "googlecomputesubnetwork" "positive1" { name = "test-subnetwork" ipcidrrange = "10.2.0.0/16" region = "us-central1" network = googlecomputenetwork.custom-test.id secondaryiprange { range_name = "tf-test-secondary-range-update1" ipcidrrange = "192.168.10.0/24" } } resource "googlecomputenetwork" "custom-test" { name = "test-network" autocreatesubnetworks = false } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="10" resource "googlecomputesubnetwork" "positive2" { name = "test-subnetwork" ipcidrrange = "10.2.0.0/16" region = "us-central1" network = googlecomputenetwork.custom-test.id secondaryiprange { range_name = "tf-test-secondary-range-update1" ipcidrrange = "192.168.10.0/24" } privateipgoogle_access = false } resource "googlecomputenetwork" "custom-test" { name = "test-network" autocreatesubnetworks = false } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecomputesubnetwork" "negative1" { name = "test-subnetwork" ipcidrrange = "10.2.0.0/16" region = "us-central1" network = googlecomputenetwork.custom-test.id secondaryiprange { range_name = "tf-test-secondary-range-update1" ipcidrrange = "192.168.10.0/24" } privateipgoogle_access = true } resource "googlecomputenetwork" "custom-test" { name = "test-network" autocreatesubnetworks = false } ```
Project: Vald (App Definition and Development / Database)
File: flush.md

Flush Service is responsible for removing all vectors that are indexed and uncommitted in the `vald-agent`. ```rpc service Flush { rpc Flush(payload.v1.Flush.Request) returns (payload.v1.Info.Index.Count) {} } ``` Flush RPC is the method to remove all vectors. the scheme of `payload.v1.Flush.Request` ```rpc message Flush { message Request { } } ``` Flush.Request empty the scheme of `payload.v1.Info.Index.Count` ```rpc message Object { message InfoIndexCount { uint32 stored = 0; uint32 uncommitted = 0; bool indexing = false; bool saving = false; } } ``` Object.InfoIndexCount | field | type | label | desc. | | :: |: | :- | :- | | stored | uint32 | | count of indices. | | uncommitted | uint32 | | count of uncommitted indices. | | indexing | bool | | the state indicating whether `vald-agent` pods is present in the indexing. | | saving | bool | | the state indicating whether `vald-agent` pods is present in the saving. | | code | desc. | | :--: | :- | | 0 | OK | | 1 | CANCELLED | | 3 | INVALID_ARGUMENT | | 4 | DEADLINE_EXCEEDED | | 5 | NOT_FOUND | | 13 | INTERNAL |
Project: KICS (Provisioning / Security & Compliance)
File: 85ab1c5b-014e-4352-b5f8-d7dea3bb4fd3.md

title: Network Policy Is Not Targeting Any Pod hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 85ab1c5b-014e-4352-b5f8-d7dea3bb4fd3 Query name: Network Policy Is Not Targeting Any Pod Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: Check if any network policy is not targeting any pod.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="22" apiVersion: v1 kind: Pod metadata: name: nopolicy labels: app: easy spec: containers: name: nginx image: nginx:1.14.2 ports: containerPort: 80 apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: app: rarelabel policyTypes: Ingress ingress: from: ipBlock: cidr: 172.17.0.0/16 except: 172.17.1.0/24 namespaceSelector: matchLabels: project: myproject podSelector: matchLabels: role: frontend ports: protocol: TCP port: 6379 egress: to: ipBlock: cidr: 10.0.0.0/24 ports: protocol: TCP port: 5978 apiVersion: v1 kind: Pod metadata: name: partialpolicy labels: app: easy spec: containers: name: nginx image: nginx:1.14.2 ports: containerPort: 80 ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: name: nginx image: nginx:1.14.2 ports: containerPort: 80 apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: app: nginx policyTypes: Ingress Egress ingress: from: ipBlock: cidr: 172.17.0.0/16 except: 172.17.1.0/24 namespaceSelector: matchLabels: project: myproject podSelector: matchLabels: role: frontend ports: protocol: TCP port: 6379 egress: to: ipBlock: cidr: 10.0.0.0/24 ports: protocol: TCP port: 5978 ```
Project: KICS (Provisioning / Security & Compliance)
File: 43a41523-386a-4cb1-becb-42af6b414433.md

title: User With Privilege Escalation By Actions 'iam:SetDefaultPolicyVersion' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 43a41523-386a-4cb1-becb-42af6b414433 Query name: User With Privilege Escalation By Actions 'iam:SetDefaultPolicyVersion' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: User with privilege escalation by actions 'iam:SetDefaultPolicyVersion' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamuser" "cosmic" { name = "cosmic" } resource "awsiamuserpolicy" "testinline_policy" { name = "testinlinepolicy" user = awsiamuser.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:SetDefaultPolicyVersion", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" users = [awsiamuser.cosmic.name] roles = [awsiamrole.role.name] groups = [awsiamgroup.group.name] } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: KICS (Provisioning / Security & Compliance)
File: f5587077-3f57-4370-9b4e-4eb5b1bac85b.md

title: CloudTrail Log Files Not Encrypted With KMS hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f5587077-3f57-4370-9b4e-4eb5b1bac85b Query name: CloudTrail Log Files Not Encrypted With KMS Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Encryption URL: Logs delivered by CloudTrail should be encrypted using KMS to increase security of your CloudTrail<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2" name: no sns topic name community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket s3keyprefix: cloudtrail region: us-east-1 ``` ```yaml title="Negative test num. 1 - yaml file" name: create multi-region trail with validation and tags v2 community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket region: us-east-1 ismultiregion_trail: true enablelogfile_validation: true cloudwatchlogsrolearn: arn:aws:iam::123456789012:role/CloudTrailCloudWatchLogs_Role cloudwatchlogsloggrouparn: arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:* kmskeyid: alias/MyAliasName tags: environment: dev Name: default ```
Project: StarRocks (App Definition and Development / Database)
File: SHOW_ALTER_MATERIALIZED_VIEW.md

displayed_sidebar: "English" Shows the building status of synchronous materialized views. :::tip This operation does not require privileges. ::: ```SQL SHOW ALTER MATERIALIZED VIEW [ { FROM | IN } db_name] ``` Parameters in brackets [] is optional. | Parameter | Required | Description | | - | | | | db_name | no | The name of the database to which the materialized view resides. If this parameter is not specified, the current database is used by default. | | Return | Description | | | | | JobId | The ID of refresh job. | | TableName | The name of the table. | | CreateTime | The time when refresh job is created. | | FinishedTime | The time when refresh job is finished. | | BaseIndexName | The name of the base table. | | RollupIndexName | The name of the materialized view. | | RollupId | The ID of the materialized view rollup. | | TransactionId | The ID of transaction that waits to be executed. | | State | The state of the job. | | Msg | Error message. | | Progress | Progress of the refresh job. | | Timeout | Timeout for the refresh job. | Example 1: building status of synchronous materialized views ```Plain MySQL > SHOW ALTER MATERIALIZED VIEW\G row * JobId: 475991 TableName: lineorder CreateTime: 2022-08-24 19:46:53 FinishedTime: 2022-08-24 19:47:15 BaseIndexName: lineorder RollupIndexName: lomvsync_1 RollupId: 475992 TransactionId: 33067 State: FINISHED Msg: Progress: NULL Timeout: 86400 row * JobId: 477337 TableName: lineorder CreateTime: 2022-08-24 19:47:25 FinishedTime: 2022-08-24 19:47:45 BaseIndexName: lineorder RollupIndexName: lomvsync_2 RollupId: 477338 TransactionId: 33068 State: FINISHED Msg: Progress: NULL Timeout: 86400 2 rows in set (0.00 sec) ```
Project: YugabyteDB (App Definition and Development / Database)
File: txn_set_constraints.md

title: SET CONSTRAINTS statement [YSQL] headerTitle: SET CONSTRAINTS linkTitle: SET CONSTRAINTS summary: SET CONSTRAINTS description: Use the `SET CONSTRAINTS` statement to set the timing of constraint checking within the current transaction. menu: v2.18: identifier: txnsetconstraints parent: statements type: docs Use the `SET CONSTRAINTS` statement to set the timing of constraint checking within the current transaction. {{%ebnf%}} set_constraints {{%/ebnf%}} Attributes in the `SET CONSTRAINTS` statement comply with the behavior defined in the SQL standard, except that it does not apply to `NOT NULL` and `CHECK` constraints. ```sql SET CONSTRAINTS { ALL | *name [ , ... ] } { DEFERRED | IMMEDIATE } ``` Change the mode of all deferrable constraints. Specify one or a list of constraint names. Set constraints to not be checked until transaction commit. Uniqueness and exclusion constraints are checked immediately, unless marked `DEFERRABLE`. Set constraints to take effect retroactively. See also
Project: KICS (Provisioning / Security & Compliance)
File: 78f1ec6f-5659-41ea-bd48-d0a142dce4f2.md

title: Group With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 78f1ec6f-5659-41ea-bd48-d0a142dce4f2 Query name: Group With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Group with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamgroup" "cosmic" { name = "cosmic" } resource "awsiamgrouppolicy" "testinline_policy" { name = "testinlinepolicy" group = awsiamgroup.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:UpdateAssumeRolePolicy", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" groups = [awsiamgroup.cosmic.name] policyarn = awsiam_policy.policy.arn } resource "awsiampolicy" "policy" { name = "test-policy" description = "A test policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "sts:AssumeRole", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Trivy (Provisioning / Security & Compliance)
File: trivy_plugin_list.md

List installed plugin ``` trivy plugin list ``` ``` -h, --help help for list ``` ``` --cache-dir string cache directory (default "/path/to/cache") -c, --config string config path (default "trivy.yaml") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version ``` - Manage plugins
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: CONTRIBUTING.md

Welcome to Kubernetes. We are excited about the prospect of you joining our ! The Kubernetes community abides by the CNCF . Here is an excerpt: As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities. We have full documentation on how to get started contributing here: <! If your repo has certain guidelines for contribution, put them here ahead of the general k8s resources --> Kubernetes projects require that you sign a Contributor License Agreement (CLA) before we can accept your pull requests - Main contributor documentation, or you can just jump directly to the - Common resources for existing developers - We have a diverse set of mentorship programs available that are always looking for volunteers! <! Custom Information - if you're copying this template for the first time you can add custom content here, for example: - Replace `kubernetes-users` with your slack channel string, this will send users directly to your channel. -->
Project: Trivy (Provisioning / Security & Compliance)
File: trivy_version.md

Print the version ``` trivy version [flags] ``` ``` -f, --format string version format (json) -h, --help help for version ``` ``` --cache-dir string cache directory (default "/path/to/cache") -c, --config string config path (default "trivy.yaml") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version ``` - Unified security scanner
Project: ShardingSphere (App Definition and Development / Database)
File: show-deafult-single-table-storage-unit.en.md

+++ title = "SHOW DEFAULT SINGLE TABLE STORAGE UNIT" weight = 2 +++ The `SHOW DEFAULT SINGLE TABLE STORAGE UNIT` syntax is used to query storage units for specified database. {{< tabs >}} {{% tab name="Grammar" %}} ```sql ShowDefaultSingleTableStorageUnit::= 'SHOW' 'DEFAULT' 'SINGLE' 'TABLE' 'STORAGE' 'UNIT' ('FROM' databaseName)? databaseName ::= identifier ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} When `databaseName` is not specified, the default is the currently used `DATABASE`. If `DATABASE` is not used, `No database selected` will be prompted. | Column | Description | |--|-| | storageunitname | Storage unit name | Query storage units for specified database. ```sql SHOW DEFAULT SINGLE TABLE STORAGE UNIT ``` ```sql sql> SHOW DEFAULT SINGLE TABLE STORAGE UNIT; +-+ | storageunitname | +-+ | ds_0 | +-+ 1 row in set (0.01 sec) ``` `SHOW`, `DEFAULT`, `SINGLE`, `TABLE`, `STORAGE`, `UNIT`