cwielenb/CNCF-Dataset huggingface dataset:
Project: NATS (App Definition and Development / Streaming & Messaging)
File: DEPENDENCIES.md

This file lists the dependencies used in this repository. | Dependency | License | |-|-| | Go | BSD 3-Clause "New" or "Revised" License | | github.com/nats-io/nats-server/v2 | Apache License 2.0 | | github.com/golang/protobuf v1.4.2 | BSD 3-Clause "New" or "Revised" License | | github.com/nats-io/jwt/v2 v2.5.2 | Apache License 2.0 | | github.com/nats-io/nats.go v1.30.2 | Apache License 2.0 | | github.com/nats-io/nkeys v0.4.5 | Apache License 2.0 | | github.com/nats-io/nuid v1.0.1 | Apache License 2.0 | | golang.org/x/crypto v0.13.0 | BSD 3-Clause "New" or "Revised" License | | golang.org/x/exp v0.0.0-20230905200255-921286631fa9 | BSD 3-Clause "New" or "Revised" License | | golang.org/x/sys v0.12.0 | BSD 3-Clause "New" or "Revised" License | | golang.org/x/time v0.3.0 | BSD 3-Clause "New" or "Revised" License | | google.golang.org/protobuf v1.23.0 | BSD 3-Clause "New" or "Revised" License | | github.com/klauspost/compress/s2 v1.17.0 | BSD 3-Clause "New" or "Revised" License | | github.com/minio/highwayhash v1.0.2 | Apache License 2.0 | | go.uber.org/automaxprocs v1.5.3 | MIT License |
Project: YugabyteDB (App Definition and Development / Database)
File: 08-between.md

title: "BETWEEN" In this exercise we will query the products table and find all the products who have a product\id_ between 10 and 20. ``` SELECT product_id, product_name, quantityperunit FROM products WHERE product_id BETWEEN 10 AND 20 ``` This query should return 11 rows In this exercise we will query the products table and find all the products who have a product\id_ that is not between 10 and 20. ``` SELECT product_id, product_name, quantityperunit FROM products WHERE product_id NOT BETWEEN 10 AND 20 ``` This query should return 66 rows
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-sfn-controller.md

layout: integration title: AWS Step Functions subtitle: Collaborative and visual infrastructure as code for AWS Step Functions image: /assets/img/integrations/aws-sfn-controller/icons/color/aws-sfn-controller-color.svg permalink: extensibility/integrations/aws-sfn-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-sfn-controller description: integrations-category: Serverless integrations-subcategory: Serverless registrant: GitHub components: name: field-export colorIcon: assets/img/integrations/aws-sfn-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-sfn-controller/components/field-export/icons/white/field-export-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-sfn-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-sfn-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: activity colorIcon: assets/img/integrations/aws-sfn-controller/components/activity/icons/color/activity-color.svg whiteIcon: assets/img/integrations/aws-sfn-controller/components/activity/icons/white/activity-white.svg description: name: state-machine colorIcon: assets/img/integrations/aws-sfn-controller/components/state-machine/icons/color/state-machine-color.svg whiteIcon: assets/img/integrations/aws-sfn-controller/components/state-machine/icons/white/state-machine-white.svg description: featureList: [ "Step Functions is based on state machines and tasks.", "Supports Catch and Retry statements", "Examine the state of each step in your workflow to make sure that your application runs in order and as expected" ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: in-toto (Provisioning / Security & Compliance)
File: SECURITY.md

Please report security issues confidentially via GitHub ["Report new vulnerability"](https://github.com/in-toto/in-toto/security/advisories/new) form. Alternatively, you can email reports to torresariass@gmail.com, optionally encrypted with PGP using this key (fingerprint): 903B AB73 640E B6D6 5533 EFF3 468F 122C E816 2295 Please do not use the GitHub issue tracker to submit vulnerability reports. The issue tracker is intended for bug reports and to make feature requests. Major feature requests, such as design changes to the specification, should be proposed via [in-toto Enhancement](https://github.com/in-toto/ITE/blob/master/ITE/1/README.adoc) (ITE).
Project: StarRocks (App Definition and Development / Database)
File: INSTALL_PLUGIN.md

displayed_sidebar: "English" This statement is used to install a plugin. :::tip This operation requires the SYSTEM-level PLUGIN privilege. You can follow the instructions in to grant this privilege. ::: ```sql INSTALL PLUGIN FROM [source] [PROPERTIES ("key"="value", ...)] ``` 3 types of sources are supported: ```plain text An absolute path that directs to a zip file An absolute path that directs to a plugin directory A http or https download link that directs to a zip file ``` PROPERTIES supports setting some configurations of plugins, such as setting the md5sum value of the zip file, etc. Install a plugin from local zip file: ```sql INSTALL PLUGIN FROM "/home/users/starrocks/auditdemo.zip"; ``` Install a plugin from local inpath: ```sql INSTALL PLUGIN FROM "/home/users/starrocks/auditdemo/"; ``` Download and install a plugin: ```sql INSTALL PLUGIN FROM "http://mywebsite.com/plugin.zip"; ``` Download and install a plugin. Meanwhile, set the md5sum value of the zip file: ```sql INSTALL PLUGIN FROM "http://mywebsite.com/plugin.zip" PROPERTIES("md5sum" = "73877f6029216f4314d712086a146570"); ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.12.2.md

RabbitMQ `3.12.2` is a maintenance release in the `3.12.x` . Please refer to the upgrade section from the if upgrading from a version prior to 3.12.0. This release requires Erlang 25 and supports Erlang versions up to `26.0.x`. has more details on Erlang version requirements for RabbitMQ. As of 3.12.0, RabbitMQ requires Erlang 25. Nodes will fail to start on older Erlang releases. Users upgrading from 3.11.x (or older releases) on Erlang 25 to 3.12.x on Erlang 26 (both RabbitMQ and Erlang are upgraded at the same time) must consult the first. Release notes can be found on GitHub at . Free disk space monitor on Windows is now more selective in what errors are logged. GitHub issue: Queue recovery on node restart in certain conditions could run into an exception GitHub issue: `filehandlecache` operations are now safer when handling non-existent keys. GitHub issue: Fixed a potential resource leak in at-least-once dead lettering from quorum queues. GitHub issue: A new command, `rabbitmqctl deactivatefreediskspacemonitoring`, can be used to (temporarily or permanently) disable free disk space monitoring on a node. To re-activate it, use `rabbitmqctl activatefreediskspacemonitoring`. GitHub issue: AMQP 1.0 clients that try to publish in a way that results in the message not being routed anywhere are now notified with a more sensible settlement status. GitHub issue: Prometheus scraping API endpoints now support optional authentication. Contributed by @SimonUnge (AWS). GitHub issue: The plugin now filters out values that are `undefined` or `NaN`, simply excluding them from the API endpoint response. Previously, if a metric was not computed for any reason (e.g. free disk space monitor was disabled on the node), its value could end up being rendered as `undefined` or `NaN`, two values that Prometheus scrapers cannot handle (for numerical types such as gauges). GitHub issue: It was not possible to close a table column selection pane on screens that had little vertical space. Contributed by @Antsthebul. GitHub issue: This is a potentially breaking change*. The plugin will now enforce maximum STOMP frame size. Frames larger than that size will be rejected. The default maximum size is 4 MiB. It can be increased or decreased: ``` ini stomp.maxframesize = 10485760 ``` To reduce it from the default 4 MiB to 2 MiB: ``` ini stomp.maxframesize = 2097152 ``` GitHub issue: Shovel will gracefully stop when its destination (target) does not exist. Such shovels will then be periodically restarted to retry. Contributed by @markus812498 (CloudAMQP). GitHub issue: It is now possible to opt in to deactivate file handle cache use in the plugin: ``` ini webmqtt.usefilehandlecache = false ``` GitHub issue: It is now possible to opt in to deactivate file handle cache use in the plugin: ``` ini webstomp.usefilehandlecache = false ``` GitHub issue: `ra` was upgraded to To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.12.2.tar.xz` instead of the source tarball produced by GitHub.
Project: KICS (Provisioning / Security & Compliance)
File: 0c10d7da-85c4-4d62-b2a8-d6c104f1bd77.md

title: User With Privilege Escalation By Actions 'iam:PutUserPolicy' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0c10d7da-85c4-4d62-b2a8-d6c104f1bd77 Query name: User With Privilege Escalation By Actions 'iam:PutUserPolicy' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: User with privilege escalation by actions 'iam:PutUserPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamuser" "cosmic" { name = "cosmic" } resource "awsiamuserpolicy" "testinline_policy" { name = "testinlinepolicy" user = awsiamuser.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:PutUserPolicy", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" users = [awsiamuser.cosmic.name] roles = [awsiamrole.role.name] groups = [awsiamgroup.group.name] } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Chef Habitat (App Definition and Development / Application Definition & Image Build)
File: VERIFICATION_TESTING.md

All components of habitat are tested when PRs are created. The helper scripts are designed to run against a single component (such as `common`), in an environment that has habitat and rust preinstalled. ``` .expeditor/scripts/verify/runcargotest.sh <component> ``` Parameters: `--test-options` - allows you to pass options such as `--test-threads=1` to the cargo test command. `--features` - allows you to enable specific features when running tests. ``` .expeditor/scripts/verify/runcargotest.ps1 <component> ``` Parameters: `--TestOptions` - allows you to pass options such as `--test-threads=1` to the cargo test command. `--Features` - allows you to enable specific features when running tests. See for a full list of what is run in the CI pipeline, and what parameters are used.
Project: KubeMQ (App Definition and Development / Streaming & Messaging)
File: kubemq_queries_send.md

Queries send messages to a 'queries' channel command Queries send command allow to send messages to 'queries' channel with an option to set query time-out and caching parameters ``` kubemq queries send [flags] ``` ``` kubemq queries send some-channel some-query kubemq queries send some-channel some-body -m some-metadata kubemq queries send some-channel some-body -o 120 ``` ``` -h, --help help for send -m, --metadata string Set metadata body -o, --timeout int Set command timeout (default 30) ``` - Execute Kubemq 'queries'
Project: external-secrets (Provisioning / Security & Compliance)
File: provider-aws-access.md

Note: If you are using Parameter Store replace `service: SecretsManager` with `service: ParameterStore` in all examples below. This is basicially a zero-configuration authentication method that inherits the credentials from the runtime environment using the . You can attach a role to the pod using , or . When no other authentication method is configured in the `Kind=Secretstore` this role is used to make all API calls against AWS Secrets Manager or SSM Parameter Store. Based on the Pod's identity you can do a `sts:assumeRole` before fetching the secrets to limit access to certain keys in your provider. This is optional. ```yaml apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: team-b-store spec: provider: aws: service: SecretsManager region: eu-central-1 role: team-b ``` You can store Access Key ID & Secret Access Key in a `Kind=Secret` and reference it from a SecretStore. ```yaml apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: team-b-store spec: provider: aws: service: SecretsManager region: eu-central-1 role: team-b auth: secretRef: accessKeyIDSecretRef: name: awssm-secret key: access-key secretAccessKeySecretRef: name: awssm-secret key: secret-access-key ``` NOTE: In case of a `ClusterSecretStore`, Be sure to provide `namespace` in `accessKeyIDSecretRef`, `secretAccessKeySecretRef` with the namespaces where the secrets reside. This feature lets you use short-lived service account tokens to authenticate with AWS. You must have enabled - it is by default on EKS. See on how to set up IAM roles for service accounts. The big advantage of this approach is that ESO runs without any credentials. ```yaml apiVersion: v1 kind: ServiceAccount metadata: annotations: eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/team-a name: my-serviceaccount namespace: default ``` Reference the service account from above in the Secret Store: ```yaml apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: secretstore-sample spec: provider: aws: service: SecretsManager region: eu-central-1 auth: jwt: serviceAccountRef: name: my-serviceaccount ``` NOTE: In case of a `ClusterSecretStore`, Be sure to provide `namespace` for `serviceAccountRef` with the namespace where the service account resides. You can define custom AWS endpoints if you want to use regional, vpc or custom endpoints. See List of endpoints for , and . Use the following environment variables to point the controller to your custom endpoints. Note: All resources managed by this controller are affected. | ENV VAR | DESCRIPTION | | | -- | | AWSSECRETSMANAGERENDPOINT | Endpoint for the Secrets Manager Service. The controller uses this endpoint to fetch secrets from AWS Secrets Manager. | | AWSSSMENDPOINT | Endpoint for the AWS Secure Systems Manager. The controller uses this endpoint to fetch secrets from SSM Parameter Store. | | AWSSTSENDPOINT | Endpoint for the Security Token Service. The controller uses this endpoint when creating a session and when doing `assumeRole` or `assumeRoleWithWebIdentity` calls. |
Project: StarRocks (App Definition and Development / Database)
File: st_y.md

displayed_sidebar: "English" If point is of a valid Point type, return the corresponding Y-coordinate value. ```Haskell DOUBLE ST_Y(POINT point) ``` ```Plain Text MySQL > SELECT STY(STPoint(24.7, 56.7)); +-+ | sty(stpoint(24.7, 56.7)) | +-+ | 56.7 | +-+ ``` ST_Y,ST,Y
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_builder_migrate-scripts.md

title: kbcli builder migrate-scripts migrate - a developer tool. ``` kbcli builder migrate-scripts [flags] ``` ``` ``` ``` --configmap string specify the configmap name --force whether overwrite the exists file --helm string specify the helm template dir -h, --help help for migrate-scripts --output string specify the scripts output path --regex string specify the regex for configmap ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - builder command.
Project: StarRocks (App Definition and Development / Database)
File: microseconds_sub.md

displayed_sidebar: "English" Subtracts a time interval from a date value. The time interval is in microseconds. ```Haskell DATETIME microseconds_sub(DATETIME expr1,INT expr2); ``` `expr1`: the time expression. It must be of the DATETIME type. `expr2`: the time interval you want to substract, in microseconds. It must be of the INT type. Returns a value of the DATETIME type. If the input value is of the DATE type, the hour, minute, and seconds parts are processed as `00:00:00`. ```Plain Text select microseconds_sub('2010-11-30 23:50:50', 2); +--+ | microseconds_sub('2010-11-30 23:50:50', 2) | +--+ | 2010-11-30 23:50:49.999998 | +--+ select microseconds_sub('2010-11-30', 2); +--+ | microseconds_sub('2010-11-30', 2) | +--+ | 2010-11-29 23:59:59.999998 | +--+ ```
Project: KICS (Provisioning / Security & Compliance)
File: 9038b526-4c19-4928-bca2-c03d503bdb79.md

title: Shielded VM Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9038b526-4c19-4928-bca2-c03d503bdb79 Query name: Shielded VM Disabled Platform: GoogleDeploymentManager Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Compute instances must be launched with Shielded VM enabled, which means the attribute 'shieldedInstanceConfig' must be defined and its sub attributes 'enableSecureBoot', 'enableVtpm' and 'enableIntegrityMonitoring' must be set to true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4" resources: name: vm-template type: compute.v1.instance properties: zone: us-central1-a machineType: zones/us-central1-a/machineTypes/n1-standard-1 disks: deviceName: boot type: PERSISTENT boot: true autoDelete: true initializeParams: sourceImage: projects/debian-cloud/global/images/family/debian-9 networkInterfaces: network: global/networks/default canIpForward: false ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="17 18" resources: name: vm-template2 type: compute.v1.instance properties: zone: us-central1-a machineType: zones/us-central1-a/machineTypes/n1-standard-1 disks: deviceName: boot type: PERSISTENT boot: true autoDelete: true initializeParams: sourceImage: projects/debian-cloud/global/images/family/debian-9 networkInterfaces: network: global/networks/default canIpForward: false shieldedInstanceConfig: enableSecureBoot: false ``` ```yaml title="Negative test num. 1 - yaml file" resources: name: vm-templatee type: compute.v1.instance properties: zone: us-central1-a machineType: zones/us-central1-a/machineTypes/n1-standard-1 disks: deviceName: boot type: PERSISTENT boot: true autoDelete: true initializeParams: sourceImage: projects/debian-cloud/global/images/family/debian-9 networkInterfaces: network: global/networks/default canIpForward: false shieldedInstanceConfig: enableSecureBoot: true enableVtpm: true enableIntegrityMonitoring: true ```
Project: CloudNativePG (App Definition and Development / Database)
File: applications.md

Applications are supposed to work with the services created by CloudNativePG in the same Kubernetes cluster: `[cluster name]-rw` `[cluster name]-ro` `[cluster name]-r` Those services are entirely managed by the Kubernetes cluster and implement a form of Virtual IP as described in the . !!! Hint It is highly recommended using those services in your applications, and avoiding connecting directly to a specific PostgreSQL instance, as the latter can change during the cluster lifetime. You can use these services in your applications through: DNS resolution environment variables For the credentials to connect to PostgreSQL, you can use the secrets generated by the operator. !!! Seealso "Connection Pooling" Please refer to the for information about how to take advantage of PgBouncer as a connection pooler, and create an access layer between your applications and the PostgreSQL clusters. You can use the Kubernetes DNS service to point to a given server. The Kubernetes DNS service is required by the operator. You can do that by using the name of the service if the application is deployed in the same namespace as the PostgreSQL cluster. In case the PostgreSQL cluster resides in a different namespace, you can use the full qualifier: `service-name.namespace-name`. DNS is the preferred and recommended discovery method. If you deploy your application in the same namespace that contains the PostgreSQL cluster, you can also use environment variables to connect to the database. For example, suppose that your PostgreSQL cluster is called `pg-database`, you can use the following environment variables in your applications: `PGDATABASERSERVICEHOST`: the IP address of the service pointing to all the PostgreSQL instances for read-only workloads `PGDATABASEROSERVICEHOST`: the IP address of the service pointing to all hot-standby replicas of the cluster `PGDATABASERWSERVICEHOST`: the IP address of the service pointing to the primary instance of the cluster The PostgreSQL operator will generate up to two `basic-auth` type secrets for every PostgreSQL cluster it deploys: `[cluster name]-app` (unless you have provided an existing secret through `.spec.bootstrap.initdb.secret.name`) `[cluster name]-superuser` (if `.spec.enableSuperuserAccess` is set to `true` and you have not specified a different secret using `.spec.superuserSecret`) Each secret contain the following: username password hostname to the RW service port number database name a working The `-app` credentials are the ones that should be used by applications connecting to the PostgreSQL cluster, and correspond to the user owning the database. The `-superuser` ones are supposed to be used only for administrative purposes, and correspond to the `postgres` user. Since version 1.21, superuser access over the network is disabled by default.