cwielenb/CNCF-Dataset huggingface dataset:
Project: Veinmind Tools (Provisioning / Security & Compliance)
File: README.en.md

A timing startup script for veinmind-runner image, you can use crontab syntax to configure the regular execution scan target image Make sure to run the Kubernetes service locally ```bash [root@localhost veinmind]# kubectl get pods -n kube-system NAME READY STATUS RESTARTS AGE calico-kube-controllers-6d75fbc96d-2d67s 1/1 Running 0 48m calico-node-47fzd 1/1 Running 0 48m calico-typha-6576ff658-xsbbv 1/1 Running 0 48m ...... ``` Install helm ``` wget https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz tar -zxvf helm-v3.9.0-linux-amd64.tar.gz mv linux-amd64/helm /usr/local/bin/helm ``` ```bash [root@localhost veinmind]# helm The Kubernetes package manager Common actions for Helm: helm search: search for charts helm pull: download a chart to your local directory to view helm install: upload the chart to Kubernetes helm list: list releases of charts ``` Go to the `helm_chart\veinmind` folder: ```bash [root@localhost veinmind]# helm install veinmind . [root@localhost veinmind]# helm uninstall veinmind ``` ```yaml jobs: name: veinmind-runner image: repository: registry.veinmind.tech/veinmind/veinmind-runner tag: latest imagePullPolicy: IfNotPresent schedule: "0 /8 " ### Scan cycle failedJobsHistoryLimit: 1 successfulJobsHistoryLimit: 3 concurrencyPolicy: Allow restartPolicy: OnFailure command: ["/tool/entrypoint.sh"] ### entry point args: "scan image" ### parameters nodeSelector: ### Select the node that needs to execute veinmind according to the label, Select nodes by name via nodeName beta.kubernetes.io/arch: amd64 resources: ### Resource configuration 1000m == 1 CPU,1 CPU unit is equivalent to 1 physical CPU core, or 1 virtual core limits: cpu: 1000m memory: 256Mi requests: cpu: 1000m memory: 256Mi volumes: name: files-mount hostPath: path: / name: sock-path hostPath: path: /var/run/docker.sock volumeMounts: name: files-mount mountPath: /host name: sock-path mountPath: /var/run/docker.sock ``` how to get the labels? ```bash [root@localhost veinmind]# kubectl get nodes --show-labels NAME STATUS ROLES AGE VERSION LABELS 192.168.136.146 Ready control-plane,etcd,master,worker 12h v1.22.10 beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=192.168.136.146,kubernetes.io/os=linux,node-role.kubernetes.io/control-plane=,node-role.kubernetes.io/etcd=,node-role.kubernetes.io/master=,node-role.kubernetes.io/worker=,node.kubernetes.io/exclude-from-external-load-balancers= ``` Please check the log for scan results:
Project: Carvel (App Definition and Development / Application Definition & Image Build)
File: README_AutoScaling.md

The following is a sample Lambda function that receives an Auto Scaling event as an input and logs the EC2 instance ID to CloudWatch Logs. (Note that anything written to stdout or stderr will be logged as CloudWatch Logs events.) ```go import ( "context" "fmt" "github.com/aws/aws-lambda-go/events" "github.com/aws/aws-lambda-go/lambda" ) func handler(ctx context.Context, autoScalingEvent events.AutoScalingEvent) { fmt.Printf("Instance-Id available in event is %s \n", autoScalingEvent.Detail["EC2InstanceId"]) } func main() { lambda.Start(handler) } ```
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_images_pull.md

Pulls images to local docker client for a specific plugin ``` sonobuoy images pull [flags] ``` ``` --context string Context in the kubeconfig to use. --dry-run If true, only print the image operations that would be performed. --e2e-repo string Specify a registry for KUBETESTREPO, overriding registries for test images. --e2e-repo-config string Specify a yaml file acting as KUBETESTREPO_LIST, overriding registries for test images. -h, --help help for pull --kubeconfig Kubeconfig Path to explicit kubeconfig file. --kubernetes-version string Use default E2E image, but override the version. Default is 'auto', which will be set to your cluster's version if detected, erroring otherwise. 'ignore' will try version resolution but ignore errors. 'latest' will find the latest dev image/version upstream. -p, --plugin strings Describe which plugin's images to interact with (Valid plugins are 'e2e', 'systemd-logs'). (default [e2e,systemd-logs]) ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Manage images used in a plugin to facilitate running them in airgapped (or similar) environments. Supported plugins are: 'e2e'
Project: Copa (Provisioning / Security & Compliance)
File: release.md

title: Release Process The release process for Copacetic uses . Once you are ready to cut a new release, checkout the release branch and tag it with the respective version. ``` git checkout <BRANCH NAME> git pull origin <BRANCH NAME> git tag -a <NEW VERSION> -m '<NEW VERSION>' git push origin <NEW VERSION> ``` GoReleaser will create a new release, review and edit it at https://github.com/project-copacetic/copacetic/releases Review the respective copa-action image at: https://github.com/orgs/project-copacetic/packages/container/package/copa-action
Project: KICS (Provisioning / Security & Compliance)
File: 5813ef56-fa94-406a-b35d-977d4a56ff2b.md

title: API Gateway X-Ray Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5813ef56-fa94-406a-b35d-977d4a56ff2b Query name: API Gateway X-Ray Disabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: API Gateway should have X-Ray Tracing enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8 5" resource "awsapigateway_stage" "positive1" { stage_name = "prod" restapiid = awsapigatewayrestapi.test.id deploymentid = awsapigatewaydeployment.test.id xraytracingenabled = false } resource "awsapigateway_stage" "positive2" { stage_name = "prod" restapiid = awsapigatewayrestapi.test.id deploymentid = awsapigatewaydeployment.test.id } ``` ```tf title="Negative test num. 1 - tf file" resource "awsapigateway_stage" "negative1" { stage_name = "prod" restapiid = awsapigatewayrestapi.test.id deploymentid = awsapigatewaydeployment.test.id xraytracingenabled = true } ```
Project: Cloud Custodian (Provisioning / Automation & Configuration)
File: readme.md

"It will shine still brighter when night is about you. May it be a light to you in dark places, when all other lights go out." J.R.R. Tolkein, The Two Towers A collection of tools to provide for infrastructure and operations monitoring within AWS. The goal is to provide a higher degree of visibility into both network and application monitoring with correlation both on a real-time basis or on a historical basis, and also to provide for an application centric view of infrastructure. `zero-metrics` - collection of application or account metrics from cloud watch. `zero-flow` - flow log analysis and enrichment `zero-ipdb` - historical ip database and lightweight cmdb y groups [ ] route tables [ ] network acls [ ] iam users [ ] iam policies [ ] iam roles api authentication data-model diff-patch operations
Project: YugabyteDB (App Definition and Development / Database)
File: data-modeling.md

title: Data modeling strategies linkTitle: Data modeling description: Data modeling strategies for migrating data using YugabyteDB Voyager. menu: preview_yugabyte-voyager: identifier: data-modeling-voyager parent: reference-voyager weight: 101 type: docs Before performing migration from your source database to YugabyteDB, review your sharding strategies. YugabyteDB supports two ways to shard data: HASH and RANGE. HASH is the default, as it is typically better suited for most OLTP applications. For more information, refer to . When exporting a PostgreSQL database, be aware that if you want RANGE sharding, you must call it out in the schema creation. For most workloads, it is recommended to use HASH partitioning because it efficiently partitions the data, and spreads it evenly across all nodes. RANGE sharding can be advantageous for particular use cases, such as time series. When querying data for specific time ranges, using RANGE sharding to split the data into the specific time ranges will help improve the speed and efficiency of the query. Additionally, you can use a combination of HASH and RANGE sharding for your by choosing a HASH value as the , and a RANGE value as the .
Project: NATS (App Definition and Development / Streaming & Messaging)
File: MAINTAINERS.md

Maintainership is on a per project basis. Reference . Derek Collison <derek@nats.io> Ivan Kozlovic <ivan@nats.io> Waldemar Quevedo <wally@nats.io> Oleg Shaldybin <olegsh@google.com> R.I. Pienaar <rip@devco.net>
Project: KICS (Provisioning / Security & Compliance)
File: 525b53be-62ed-4244-b4df-41aecfcb4071.md

title: App Service HTTP2 Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 525b53be-62ed-4244-b4df-41aecfcb4071 Query name: App Service HTTP2 Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: App Service should have 'http2_enabled' enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "azurermappservice" "positive1" { name = "example-app-service" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name appserviceplanid = azurermappserviceplan.example.id app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="17" resource "azurermappservice" "positive2" { name = "example-app-service" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name appserviceplanid = azurermappserviceplan.example.id app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } site_config { dotnetframeworkversion = "v4.0" scm_type = "LocalGit" mintlsversion = 1.2 } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="21" resource "azurermappservice" "positive3" { name = "example-app-service" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name appserviceplanid = azurermappserviceplan.example.id app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } site_config { dotnetframeworkversion = "v4.0" scm_type = "LocalGit" mintlsversion = 1.2 http2_enabled = false } } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermappservice" "negative" { name = "example-app-service" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name appserviceplanid = azurermappserviceplan.example.id app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } site_config { dotnetframeworkversion = "v4.0" scm_type = "LocalGit" mintlsversion = 1.2 http2_enabled = true } } ```
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: traefik-api-gateway.md

title: Traefik API Gateway labels: category: servicemesh layer: gateway blogs: https://medium.com/etermax-technology/api-authorization-with-kubernetes-traefik-and-open-policy-agent-23647fc384a1 code: https://github.com/edgeflare/traefik-opa-proxy The Traefik API Gateway is open-source software that controls API traffic into your application. OPA can be configured as a plugin to implement authorization policies for those APIs.
Project: Stolon (App Definition and Development / Database)
File: initialization.md

The cluster initialization can be done at the first time when the cluster isn't initialized (empty cluster data in the store) or also on an already initialized cluster, dropping it and creating a new one. In this case be careful that the current cluster data will be overwritten and, depending on how you are specifying the cluster specification, the keeper may erase/overwrite their managed postgreg db cluster. You can initialize new stolon cluster with a new postgres db cluster using ``` stolonctl init ``` This is the same as passing a cluster specification with `initMode` set to `new`: ``` stolonctl init '{ "initMode": "new" }' ``` The postgres parameters generated by the `initdb` command will be merged back inside the cluster specification `pgParameters` map. See the related documentation. This can be useful in different cases: To reinitialize your store (for example if you have permanently lost the store). if you want, for whatever reason, to force a new master (with all the possible problems caused by doing this). Given the declarative nature of the cluster specification you cannot force a new master. So, if you have an existing keeper that you want to set as the new master, you have to initialize a new cluster asking that it should be initialized with a specified keeper as the initial master: ``` stolonctl init '{ "initMode": "existing", "existingConfig": { "keeperUID": "keeper01" } }' ``` The existing instance postgres parameters will be merged back inside the cluster specification `pgParameters` map. See the related documentation. You can also provide the `--initial-cluster-spec` option to the `stolon-sentinel` but this will work only when the clusterdata in the store is empty.
Project: Infinispan (App Definition and Development / Database)
File: SECURITY.md

The Infinispan team and community take all security bugs very seriously. You can find our guidelines here regarding our policy and security disclosure. Please report any security issues you find in Infinispan to: security at infinispan.org Due to the sensitive nature of security bugs, the disclosure process is more constrained than a regular bug. We appreciate you following these industry accepted guidelines, which gives time for a proper fix and limit the time window of attack. The following table shows which versions are supported for vulnerability updates. | Version | Supported | | - | | | 15.0.x | :whitecheckmark: | | 14.0.x | :whitecheckmark: | | < 14.0 | :x: |
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: adr009-entity-references.md

id: adrs-adr009 title: 'ADR009: Entity References' description: Architecture Decision Record (ADR) log on Entity References While the spec for the catalog file format is well described in , guidance was not provided as to how one is expected to express references to other entities in the catalog. There was also some confusion on how to reference entities in URLs in the Backstage frontend. Following discussion in , a decision was made. The textual format, as written by humans, to reference entities by name is on the following form, where square brackets denote optionality: ``` <name> ``` That is, it is composed of between one and three parts in this specific order, without any additional encoding, with those exact separator characters. Optionality of `kind` and `namespace` are contextual, and they may or may not have default contextual fallback values. When that format is insufficient or when machine made interchange formats wish to express such relations in a more expressive form, a nested structure on the following form can be used: ```yaml kind: <kind> namespace: <namespace> name: <name> ``` Of these, only `name` is always required. Optionality of `kind` and `namespace` are contextual, and they may or may not have default contextual fallback values. All other possible key values in this structure are reserved for future use. A system or user wanting to express a full entity name that is always valid, shall supply the entire triplet whether using the string form or the compound form. A full description of the format can be found . Where entities are referenced by name in the Backstage frontend, the URL containing the reference shall take the following form: ``` :namespace/:kind/:name ``` All three parts are required under all circumstances. The default value for the `namespace` in the catalog is the string `"default"`, if the entity does not specify one explicitly in `metadata.namespace`. This means that we do not encourage the string form of entity references to be used as a single URL segment, due to the use of URL-unsafe characters leading to possible risk, confusion, and uglier URLs.
Project: ArangoDB (App Definition and Development / Database)
File: source.md

+++ title = "Constexpr domain source" weight = 60 +++ Back in , we declared but did not implement a `.get()` function which returns a constexpr static instance of the domain. We implement this now: {{% snippet "experimentalstatuscode.cpp" "constexpr_source" %}} As this is 100% constexpr, it can be (and is under optimisation) implemented entirely in the mind of the compiler with no run time representation.
Project: Databend (App Definition and Development / Database)
File: protocol.md

The Databend Sharing Protocol is a protocol that allows tenants in a multi-tenant database system to securely share files with each other. The protocol defines a set of API endpoints that can be used to manage file sharing and access control. This endpoint allows a tenant to create a presigned URL for data files in a specified table. ```bash POST /tenant/{tenantid}/{sharename}/table/{table_name}/presign ``` tenant_id : the tenant id who shares the table share_name : the share name table_name : the shared table name | Name | Value | Description | Required | | - | -- | -- |-| | Authorization | Bearer {token} | The token used to authenticate the request. | Yes | | Content-Type | application/json | The content type of the request. | No | ```json [ { "file_name": "file1.txt", "method": "GET" }, { "file_name": "file2.txt", "method": "HEAD" } ] ``` An array of objects representing the files for which presigned URLs should be created. Each object should contain the following properties: file_name*: The name of the file. method: The HTTP method that should be used for the presigned URL. method should be either GET or HEAD*. ```json [ { "presigned_url": "https://s3.example.com/table1/file1.txt?AWSAccessKeyId=ABC123&Expires=1560993041&Signature=def456", "headers": {}, "method": "GET", "path": "/table1/file1.txt" }, { "presigned_url": "https://s3.example.com/table1/file2.txt?AWSAccessKeyId=ABC123&Expires=1560993041&Signature=ghi789", "headers": {}, "method": "HEAD", "path": "/table1/file2.txt" } ] ``` presigned_url*: The presigned URL that can be used to access the file. headers*: An object containing any additional headers that should be included in the request to the presigned URL. method*: The HTTP method that is allowed for the presigned URL. path*: The path of the file relative to the table.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: connectors-go-sdk.md

title: "Connectors - Go SDK" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> Roadmap for connectors developed using Go SDK. Go SDK plans to utilize currently available Java and Python connectors through cross-language transforms feature. KafkaIO via Java - DONE BigQuery via Java - In Progress Beam SQL via Java The Go SDK supports SplittableDoFns for bounded pipelines, so scalable bounded pipelines are possible. The textio package supports and for efficient batch text reads. A general FileIO will be produced to simplify adding new file based connectors.
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_data_insert_mariadb.md

title: Kubectl-Dba Data Insert Mariadb menu: docs_{{ .version }}: identifier: kubectl-dba-data-insert-mariadb name: Kubectl-Dba Data Insert Mariadb parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Insert data to mariadb Use this cmd to insert data into a mariadb database. ``` kubectl-dba data insert mariadb [flags] ``` ``` kubectl dba data insert mariadb -n demo sample-mariadb --rows 1000 ``` ``` -h, --help help for mariadb -r, --rows int number of rows to insert (default 100) ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - Insert random data in a database