cwielenb/CNCF-Dataset huggingface dataset:
Project: Apache Heron (App Definition and Development / Streaming & Messaging)
File: user-manuals-heron-shell.md

id: version-0.20.0-incubating-user-manuals-heron-shell title: Heron Shell sidebar_label: Heron Shell original_id: user-manuals-heron-shell <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> Heron shell helps debugging a heron topology. It is an HTTP server that runs as a separate process in every container. It exposes many utilities through REST APIs. These utilities are described below in more details. The port to connect to heron shell for each container is stored in the physical plan. Heron tracker picks up this port and connects to shell. See the next section for more details. This is probably the most useful utility of shell. Since relative paths to log files are known, these paths are directly embedded in UI through Tracker. This makes the logs available in the browser. The log files start at the end and users can scroll up a page at a time, or download them locally. A container is expected to run in a sandbox directory. All the files under this directory are accessible through shell. This can be used to download the jars or tars for a topology, or browse through, download, or even view the files online. Viewing and downloading log files is one special case of browse. Each instance in the topology runs as a separate JVM process. This allows us to monitor each spout or bolt instance in isolation. To run more sophisticated operations on the process as mentioned in this list below, we need to know the process id of the process running as that instance. This utility runs the `jstack` command on the JVM process that is running an instance. The result is passed back through the REST API which can be viewed directly in the browser. This utility runs `jmap` on the process running one instance to capture a heap dump. Since a heap dump can be huge, the dump file is created on the host that is running the container. This file can be downloaded using the info that is returned as the response to this endpoint. The dumps are also accessible through the "browse" utility. This utility runs `jmap` with `-histo` option, to output the memory histogram for the JVM process of an instance. The resulting histogram is passed back as part of the response, and can be viewed directly in the browser.
Project: Meshery (Provisioning / Automation & Configuration)
File: nirmata-venafi-adapter.md

layout: integration title: Nirmata Venafi Adapter subtitle: Collaborative and visual infrastructure as code for NGINX Service Mesh image: /assets/img/integrations/nirmata-venafi-adapter/icons/color/nirmata-venafi-adapter-color.svg permalink: extensibility/integrations/nirmata-venafi-adapter docURL: https://docs.meshery.io/extensibility/integrations/nirmata-venafi-adapter description: integrations-category: Security & Compliance integrations-subcategory: Security & Compliance registrant: Artifact Hub components: name: image-key colorIcon: assets/img/integrations/nirmata-venafi-adapter/components/image-key/icons/color/image-key-color.svg whiteIcon: assets/img/integrations/nirmata-venafi-adapter/components/image-key/icons/white/image-key-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: KICS (Provisioning / Security & Compliance)
File: 30b88745-eebe-4ecb-a3a9-5cf886e96204.md

title: Role With Privilege Escalation By Actions 'ec2:RunInstances' And 'iam:PassRole' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 30b88745-eebe-4ecb-a3a9-5cf886e96204 Query name: Role With Privilege Escalation By Actions 'ec2:RunInstances' And 'iam:PassRole' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Role with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamrole" "cosmic" { name = "cosmic" } resource "awsiamrolepolicy" "testinline_policy" { name = "testinlinepolicy" role = awsiamrole.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:RunInstances", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" roles = [awsiamrole.cosmic.name] policyarn = awsiam_policy.policy.arn } resource "awsiampolicy" "policy" { name = "test-policy" description = "A test policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:PassRole", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.Arguments.md

/ / Arguments .Arguments The full set of data passed to a command handler | Name | Type | | :-- | :- | | `Options` | | <`Options`\> `Arguments` REPL: argv: `string`[] the result of a whitespace split applied to the `command` string that pays attention to backslash escaping and quotations . argvNoOptions: `string`[] the residual of `argv` without `parsedOptions` . block: `boolean` \| EXPERT MODE: The REPL block in which this command was initiated (rarely used, but useful for more complex UI extensions) command: `string` the raw command string, as given by the user . createErrorStream: `StreamableFactory` Same as createOutputStream, but for stderr createOutputStream: `StreamableFactory` Commands can use this to stream output to the UI, rather than using the normal request-response interaction between the REPL and the command. execOptions: Optional command channel options that one command can use to influence the execution of another. nextBlock: `HTMLElement` EXPERT MODE: The REPL block that will house the subsequent command execution (rarely used, but useful for more complex UI extensions) parsedOptions: `Options` the dash options parsed out in a way that pays attention to n-ary options such as `--option key value` . pipeStages: `Object` pipeline stages, e.g. if command='a b --foo|c', the pipeStages=[['a','b, '--foo'],'c'] | Name | Type | | : | :-- | | `prefix?` | `string` | | `redirect?` | `string` | | `redirector?` | `">"` \| `">>"` \| `"2>&1"` \| `">&"` \| `">>&"` | | `stages` | `string` | . tab: The tab context in which the command was initiated
Project: Chef InSpec (Provisioning / Security & Compliance)
File: bridge.md

+++ title = "bridge resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "bridge" identifier = "inspec/resources/os/bridge.md bridge resource" parent = "inspec/resources/os" +++ Use the `bridge` Chef InSpec audit resource to test basic network bridge properties, such as `name`, if an interface is defined, and the associations for any defined interface. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `bridge` resource block declares the bridge to be tested and what interface it should be associated with: describe bridge('br0') do it { should exist } it { should have_interface 'eth0' } end On Linux platforms, any value in the `/sys/class/net/{interface}/bridge` directory may be tested On the Windows platform, the `Get-NetAdapter` cmdlet is associated with the `Get-NetAdapterBinding` cmdlet and returns the `ComponentID ms_bridge` value as a JSON object The `interfaces` property returns the named interfaces. its('interfaces') { should include('foo') } {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `exist` matcher tests if the network bridge is available: it { should exist } The `have_interface` matcher tests if the named interface is defined for the network bridge: it { should have_interface 'eth0' }
Project: KICS (Provisioning / Security & Compliance)
File: 7307579a-3abb-46ad-9ce5-2a915634d5c8.md

title: PSP With Added Capabilities hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 7307579a-3abb-46ad-9ce5-2a915634d5c8 Query name: PSP With Added Capabilities Platform: Kubernetes Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: PodSecurityPolicy should not have added capabilities<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: '*' volumes: '*' hostNetwork: true hostPorts: min: 0 max: 65535 hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' spec: privileged: true allowPrivilegeEscalation: true volumes: '*' hostNetwork: true hostPorts: min: 0 max: 65535 hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ```
Project: KubeEdge (Provisioning / Automation & Configuration)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at oss-conduct@uber.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at .
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-ref-functions.md

layout: global title: Functions displayTitle: Functions license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Spark SQL provides two function features to meet a wide range of user needs: built-in functions and user-defined functions (UDFs). Built-in functions are commonly used routines that Spark SQL predefines and a complete list of the functions can be found in the API document. UDFs allow users to define their own functions when the systems built-in functions are not enough to perform the desired task. Spark SQL has some categories of frequently-used built-in functions for aggregation, arrays/maps, date/timestamp, and JSON data. This subsection presents the usages and descriptions of these functions. * * * * * * * * * User-Defined Functions (UDFs) are a feature of Spark SQL that allows users to define their own functions when the system's built-in functions are not enough to perform the desired task. To use UDFs in Spark SQL, users must first define the function, then register the function with Spark, and finally call the registered function. The User-Defined Functions can act on a single row or act on multiple rows at once. Spark SQL also supports integration of existing Hive implementations of UDFs, UDAFs and UDTFs. *
Project: Harbor (Provisioning / Container Registry)
File: 3-08-LDAP-define-harbor-admin-by-dn.md

Test 3-08 - Define Harbor Admin By DN (LDAP Mode) ======= To verify that harbor admin can be defined by LDAP group DN User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against an LDAP or AD server. ( auth_mode is set to ldap_auth* .) The user data is stored in an LDAP or AD server. A linux host with Docker CLI installed (Docker client). At least five(5) non-admin users are in Harbor. Create group harborsysadmin in LDAP. Create LDAP user sysadmin in LDAP, and add sysadmin to the member of group harborsysadmin. Login as admin user, Go to Administration -> Configuration -> Authentication, set the configuration: "LDAP Groups With Admin Privilege" with the DN of harborsysadmin. Login in with LDAP user sys_admin. The sys_admin user can have admin privileges, such as change the configuration, add/remove replication policy, manage repositories etc. None
Project: ShardingSphere (App Definition and Development / Database)
File: create-mask-rule.en.md

+++ title = "CREATE MASK RULE" weight = 1 +++ The `CREATE MASK RULE` syntax is used to create a mask rule. {{< tabs >}} {{% tab name="Grammar" %}} ```sql CreateEncryptRule ::= 'CREATE' 'MASK' 'RULE' ifNotExists? maskRuleDefinition (',' maskRuleDefinition)* ifNotExists ::= 'IF' 'NOT' 'EXISTS' maskRuleDefinition ::= ruleName '(' 'COLUMNS' '(' columnDefinition (',' columnDefinition)* ')' ')' columnDefinition ::= '(' 'NAME' '=' columnName ',' maskAlgorithmDefinition ')' maskAlgorithmDefinition ::= 'TYPE' '(' 'NAME' '=' algorithmType (',' propertiesDefinition)? ')' propertiesDefinition ::= 'PROPERTIES' '(' key '=' value (',' key '=' value)* ')' ruleName ::= identifier columnName ::= identifier algorithmType ::= literal key ::= string value ::= literal ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} `algorithmType` specifies the data masking algorithm type. For more details, please refer to ; Duplicate `ruleName` will not be created; `ifNotExists` clause is used for avoid `Duplicate mask rule` error. ```sql CREATE MASK RULE t_mask ( COLUMNS( (NAME=phonenumber,TYPE(NAME='MASKFROMXTO_Y', PROPERTIES("from-x"=1, "to-y"=2, "replace-char"="*"))), (NAME=address,TYPE(NAME='MD5')) )); ``` ```sql CREATE MASK RULE IF NOT EXISTS t_mask ( COLUMNS( (NAME=phonenumber,TYPE(NAME='MASKFROMXTO_Y', PROPERTIES("from-x"=1, "to-y"=2, "replace-char"="*"))), (NAME=address,TYPE(NAME='MD5')) )); ``` `CREATE`, `MASK`, `RULE`, `COLUMNS`, `NAME`, `TYPE`
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-secret.1.md

% podman-secret 1 podman\-secret - Manage podman secrets podman secret subcommand podman secret is a set of subcommands that manage secrets. | Command | Man Page | Description | | - | | | | create | | Create a new secret | | exists | | Check if the given secret exists | | inspect | | Display detailed information on one or more secrets | | ls | | List all available secrets | | rm | | Remove one or more secrets | January 2021, Originally compiled by Ashley Cui <acui@redhat.com>
Project: Hazelcast IMDG (App Definition and Development / Database)
File: 019-memory-management.md

title: 019 - Memory Management description: Provide means to limit memory consumption of certain runtime operations Since: 5.0 The memory management is used for the operations that accumulate a (potentially large) number of records: sort group/aggregate join stateful transform distinct Without means to control memory consumption, these operations could lead to `OutOfMemoryError`s and destabilization of entire cluster. Control very precisely (with byte level granularity) how much memory each operator uses at any given time. All member's operators share a memory pool they acquire from and release to. accurate requires substantial effort to implement and might be tricky to get right might potentially affect performance Control number of records `Processor`s can hold on to. The record might mean different things for different operations - i.e. for sorting it's an individual item, for grouping it's a distinct key. The limit applies to each `Processor` instance separately, hence the effective limit of records accumulated by each cluster member is influenced by the vertex's `localParallelism` and the number of jobs in the cluster. simple and easy to implement effect on performance is negligible not accurate might still lead to `OutOfMemoryError`s due to variable object sizes We've chosen the second option since it's simple. We might reconsider it if it turns out that current solution is not enough. Allow configuring `maxProcessorAccumulatedRecords` for the member: <!--DOCUSAURUSCODETABS--> <!--Java--> ```java public class InstanceConfig { public void setMaxProcessorAccumulatedRecords(long maxProcessorAccumulatedRecords) { checkPositive(maxProcessorAccumulatedRecords, "maxProcessorAccumulatedRecords must be a positive number"); this.maxProcessorAccumulatedRecords = maxProcessorAccumulatedRecords; } } ``` <!--YAML--> ```yaml jet: instance: max-processor-accumulated-records: 1000000000 ``` <!--XML--> ```xml <jet> <max-processor-accumulated-records>1000000000</max-processor-accumulated-records> </jet> ``` <!--ENDDOCUSAURUSCODE_TABS--> as well as for the job: ```java public class JobConfig implements IdentifiedDataSerializable { public JobConfig setMaxProcessorAccumulatedRecords(long maxProcessorAccumulatedRecords) { checkTrue(maxProcessorAccumulatedRecords > 0 || maxProcessorAccumulatedRecords == -1, "maxProcessorAccumulatedRecords must be a positive number or -1"); this.maxProcessorAccumulatedRecords = maxProcessorAccumulatedRecords; return this; } } ``` To not break backward compatibility the default value of `maxProcessorAccumulatedRecords` for `JobConfig` is `-1` and for `InstanceConfig` it is `Long.MAX_VALUE`. `JobConfig`'s value, if set, has precedence over `InstanceConfig`'s one. `maxProcessorAccumulatedRecords` is accessible for `Processor`s via `ProcessorMetaSupplier.Context.maxProcessorAccumulatedRecords()`. `Processor`s track number of accumulated records individually and throw `com.hazelcast.jet.impl.memory.AccumulationLimitExceededException` if limit is exceeded which fails the job.
Project: Teleport (Provisioning / Security & Compliance)
File: documentation.md

name: Documentation about: Report errors or suggest improvements to Teleport's documentation. labels: documentation <!-- List the URL(s) for existing docs this issue relates to. If this is a proposal for a new doc, you can suggest a path and title here. --> <!-- Describe the documentation improvements you wish to see. --> <!-- Briefly describe a test we can carry out. Scope this as narrowly as possible. --> <!-- Please make an effort to find related issues on GitHub and list them here. This makes a big difference in how we prioritize and schedule work. -->
Project: ClickHouse (App Definition and Development / Database)
File: v21.8.8.29-lts.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Fix bug in `clickhouse-keeper-converter` which can lead to incorrect ZooKeeper log deserialization. (). Backported in : Fix invalid constant type conversion when nullable or lowcardinality primary key is used. (). Backported in : Fix waiting for mutation with `mutations_sync=2`. (). Backported in : Fix possible `Table columns structure in ZooKeeper is different from local table structure` exception while recreating or creating new replicas of `ReplicatedMergeTree`, when one of table columns have default expressions with case-insensitive functions. (). Backported in : Fix failed assertion in ReadBufferFromHDFS. Update libhdfs3 library to be able to run in tests in debug. Closes . Closes . (). Backported in : Fix connection timeouts (`sendtimeout`/`receivetimeout`). ().