cwielenb/CNCF-Dataset huggingface dataset:
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_save.md

title: "Command - devspace save" sidebar_label: devspace save Save configuration ``` ``` ``` -h, --help help for save ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: SPIRE (Provisioning / Key Management)
File: ADOPTERS.md

Known end users with notable contributions to the advancement of the project include: Anthem Bloomberg ByteDance Duke Energy GitHub Netflix Niantic Pinterest Square Twilio Uber Unity Technologies Z Lab Corporation SPIFFE and SPIRE are being used by numerous other companies, both large and small, to build higher layer products and services. The list includes but is not limited to: Amazon Arm Cisco Decipher Technology Studios F5 Networks HashiCorp Hewlett Packard Enterprise Intel Google IBM SAP Tigera TestifySec Transferwise VMware SPIFFE and SPIRE have integrations available with a number of open-source projects. The list includes but is not limited to: Amazon Web Services blogs about using mTLS with SPIFFE/SPIRE in AWS App Mesh on Amazon EKS: <https://aws.amazon.com/blogs/containers/using-mtls-with-spiffe-spire-in-app-mesh-on-eks/> Anthem writes about developing a zero trust framework at Anthem Using SPIFFE and SPIRE: <https://upshotstories.com/stories/developing-a-zero-trust-framework-at-anthem-using-spiffe-and-spire> ARM and VMware showcase hardware backed security for multi-tenancy at the Edge with SPIFFE & PARSEC: <https://www.youtube.com/watch?v=-I_rCKMyY7Y> Bloomberg talks about TPM node attestation with SPIRE: <https://youtu.be/30S0sKRxzjM> Coinbase details Container Technologies part of their stack: <https://blog.coinbase.com/container-technologies-at-coinbase-d4ae118dcb6c> Duke Energy describes securing the Microgrid using SPIFFE and SPIRE with TPMs: <https://www.distributech.com/distributech-international-2022-conference-sessions/achieving-the-promise-of-grid-security-with-openfmb-and-cybersecurity-zero-trust-best-practices> Google announces standardization on SPIFFE across Google Cloud as the unified workload identity platform offered as a managed service: <https://www.youtube.com/watch?v=aaPvEUCXvvw> NGINX/F5 on how NGINX service mesh leverages SPIFFE and SPIRE: <https://youtu.be/plRkDK5xFpM> Styra demonstrates fortifying microservices with SPIRE and OPA: <https://www.youtube.com/watch?v=iQ5ctLQswUc> Square talks about how Square uses SPIFFE and SPIRE to secure communications across hybrid infrastructure services: <https://youtu.be/H5IlmYmEDKk?t=2585> Square describes how they provide mTLS identities to Lambdas using SPIFFE and SPIRE: <https://developer.squareup.com/blog/providing-mtls-identities-to-lambdas/> Tigera demonstrates how Calico, Envoy and SPIRE are used to deliver unified Layer 4 and Layer 7 authorization policies: <https://youtu.be/H5IlmYmEDKk?t=7812> Uber talks about integrating SPIRE with workload schedulers: <https://youtu.be/H5IlmYmEDKk?t=4703> If you would like to add your name to this file, submit a pull request with your change.
Project: KICS (Provisioning / Security & Compliance)
File: b9b7ada8-3868-4a35-854e-6100a2bb863d.md

title: Kubernetes Cluster Without Terway as CNI Network Plugin hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b9b7ada8-3868-4a35-854e-6100a2bb863d Query name: Kubernetes Cluster Without Terway as CNI Network Plugin Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: Kubernetes Cluster should have Terway as CNI Network Plugin to configure network policies<br> ```tf title="Positive test num. 1 - tf file" hl_lines="15" terraform { required_providers { alicloud = { source = "aliyun/alicloud" version = "1.160.0" } } } provider "alicloud" { access_key = "xxxxxx" secret_key = "xxxxxx" } resource "alicloudcskubernetes" "positive1" { worker_number = 4 workervswitchids = ["vsw-id1", "vsw-id1", "vsw-id3"] mastervswitchids = ["vsw-id1", "vsw-id1", "vsw-id3"] masterinstancetypes = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] workerinstancetypes = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="15" terraform { required_providers { alicloud = { source = "aliyun/alicloud" version = "1.160.0" } } } provider "alicloud" { access_key = "xxxxxx" secret_key = "xxxxxx" } resource "alicloudcskubernetes" "positive2" { worker_number = 4 workervswitchids = ["vsw-id1", "vsw-id1", "vsw-id3"] mastervswitchids = ["vsw-id1", "vsw-id1", "vsw-id3"] masterinstancetypes = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] workerinstancetypes = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] addons { config = "" name = "terway-eniip" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="15" terraform { required_providers { alicloud = { source = "aliyun/alicloud" version = "1.160.0" } } } provider "alicloud" { access_key = "xxxxxx" secret_key = "xxxxxx" } resource "alicloudcskubernetes" "positive3" { worker_number = 4 workervswitchids = ["vsw-id1", "vsw-id1", "vsw-id3"] mastervswitchids = ["vsw-id1", "vsw-id1", "vsw-id3"] masterinstancetypes = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] workerinstancetypes = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] podvswitchids = ["id1"] } ``` ```tf title="Negative test num. 1 - tf file" terraform { required_providers { alicloud = { source = "aliyun/alicloud" version = "1.160.0" } } } provider "alicloud" { access_key = "xxxxxx" secret_key = "xxxxxx" } resource "alicloudcskubernetes" "k8s" { worker_number = 4 workervswitchids = ["vsw-id1", "vsw-id1", "vsw-id3"] mastervswitchids = ["vsw-id1", "vsw-id1", "vsw-id3"] masterinstancetypes = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] workerinstancetypes = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] addons { config = "" name = "terway-eniip" } podvswitchids = ["id1"] } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.7.32.md

layout: release date: 2024-03-14 tag: v0.7.32 fix parent child relation with section @codeKraken19 (#10566) delete core comps generated due to incorrect source url @MUzairS15 (#10550) skip schema validation if schema is empty and comp is an annotation @MUzairS15 (#10549) [Fix]: Connections page env assignment bugs @codeKraken19 (#10551) Rearrange Logging Section @yash37158 (#10554) [Docs] Relationships page update @ritiksaxena124 (#10524) Add kubernetes pods tutorial using playground @sangramrath (#10456) Thank you to our contributors for making this release possible: @MUzairS15, @aabidsofi19, @codeKraken19, @leecalcote, @ritiksaxena124, @sangramrath, @sudhanshutech, @vishalvivekm and @yash37158
Project: ClickHouse (App Definition and Development / Database)
File: postgresql.md

slug: /en/interfaces/postgresql sidebar_position: 20 sidebar_label: PostgreSQL Interface ClickHouse supports the PostgreSQL wire protocol, which allows you to use Postgres clients to connect to ClickHouse. In a sense, ClickHouse can pretend to be a PostgreSQL instance - allowing you to connect a PostgreSQL client application to ClickHouse that is not already directly supported by ClickHouse (for example, Amazon Redshift). To enable the PostgreSQL wire protocol, add the setting to your server's configuration file. For example, you could define the port in a new XML file in your `config.d` folder: ```xml <clickhouse> <postgresqlport>9005</postgresqlport> </clickhouse> ``` Startup your ClickHouse server and look for a log message similar to the following that mentions Listening for PostgreSQL compatibility protocol: ```response {} <Information> Application: Listening for PostgreSQL compatibility protocol: 127.0.0.1:9005 ``` The following command demonstrates how to connect the PostgreSQL client `psql` to ClickHouse: ```bash psql -p [port] -h [hostname] -U [username] [database_name] ``` For example: ```bash psql -p 9005 -h 127.0.0.1 -U alice default ``` :::note The `psql` client requires a login with a password, so you will not be able connect using the `default` user with no password. Either assign a password to the `default` user, or login as a different user. ::: The `psql` client prompts for the password: ```response Password for user alice: psql (14.2, server 22.3.1.1) WARNING: psql major version 14, server major version 22. Some psql features might not work. Type "help" for help. default=> ``` And that's it! You now have a PostgreSQL client connected to ClickHouse, and all commands and queries are executed on ClickHouse. :::note The PostgreSQL protocol currently only supports plain-text passwords. ::: If you have SSL/TLS configured on your ClickHouse instance, then `postgresql_port` will use the same settings (the port is shared for both secure and insecure clients). Each client has their own method of how to connect using SSL. The following command demonstrates how to pass in the certificates and key to securely connect `psql` to ClickHouse: ```bash psql "port=9005 host=127.0.0.1 user=alice dbname=default sslcert=/path/to/certificate.pem sslkey=/path/to/key.pem sslrootcert=/path/to/rootcert.pem sslmode=verify-ca" ``` View the for more details on their SSL settings.
Project: ArangoDB (App Definition and Development / Database)
File: explicit_make_error_code_copy_converting_constructor.md

+++ title = "`explicit basicresult(const basicresult<R, S, P> &)`" description = "Explicit converting copy constructor from compatible `basicresult`. Available if `predicate::enablemakeerrorcodecompatibleconversion<R, S, P>` is true. Constexpr, triviality and noexcept propagating." categories = ["constructors", "explicit-constructors", "converting-constructors"] weight = 321 +++ Explicit converting copy constructor from compatible `basicresult`. Calls {{% api "void onresultcopyconstruction(T *, U &&) noexcept" %}} with `this` and the input. Requires: `predicate::enablemakeerrorcodecompatible_conversion<R, S, P>` is true. Complexity: Same as for the copy constructors of the underlying types. Constexpr, triviality and noexcept of underlying operations is propagated. Guarantees: If an exception is thrown during the operation, the object is left in a partially completed state, as per the normal rules for the same operation on a `struct`.
Project: StarRocks (App Definition and Development / Database)
File: ascii.md

displayed_sidebar: "English" This function returns the ascii value of the leftmost character of a given string. ```Haskell INT ascii(VARCHAR str) ``` ```Plain Text MySQL > select ascii('1'); ++ | ascii('1') | ++ | 49 | ++ MySQL > select ascii('234'); +--+ | ascii('234') | +--+ | 50 | +--+ ``` ASCII
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_fault.md

title: kbcli fault Inject faults to pod. ``` -h, --help help for fault ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Delete chaos resources. - IO chaos. - List chaos resources. - Network chaos. - Node chaos. - Pod chaos. - Add memory pressure or CPU load to the system. - Clock skew failure.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_logging_project_exclusions.md

+++ title = "googleloggingproject_exclusions resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleloggingproject_exclusions" identifier = "inspec/resources/gcp/googleloggingprojectexclusions.md googleloggingprojectexclusions resource" parent = "inspec/resources/gcp" +++ A `googleloggingproject_exclusions` is used to test a Google ProjectExclusion resource ```ruby describe googleloggingproject_exclusions(project: 'chef-gcp-inspec') do its('names'){ should include 'inspec-folder-exclusion' } end ``` Properties that can be accessed from the `googleloggingproject_exclusions` resource: See the resource for more information. `projects` : an array of `googleloggingproject_exclusion` project `names` : an array of `googleloggingproject_exclusion` name `descriptions` : an array of `googleloggingproject_exclusion` description `filters` : an array of `googleloggingproject_exclusion` filter `disableds` : an array of `googleloggingproject_exclusion` disabled This resource supports all of the above properties as filter criteria, which can be used with `where` as a block or a method. Ensure the is enabled for the current project.
Project: Pinniped (Provisioning / Key Management)
File: cicd.md

title: Using Pinniped for CI/CD cluster operations description: Using Pinniped for CI/CD cluster operations. cascade: layout: docs menu: docs: name: Use Pinniped for CI/CD weight: 500 parent: howtos This guide shows you how to configure Pinniped so that your CI/CD system of choice can administrate Kubernetes clusters. Pinniped provides user authentication to Kubernetes clusters. It does not provide service-to-service (non-user) authentication. There are many other systems for service-to-service authentication in Kubernetes. If an organization prefers to manage CI/CD access with non-human user accounts in their IDP, Pinniped can provide authentication for those non-human user accounts. Humans can also use the same steps below to log into clusters non-interactively. Note that the guide below assumes that you are using a non-human user account within the IDP of your choice. It is never recommended to use a human's credentials for CI/CD or other automated processes. This how-to guide assumes that you have already configured the following Pinniped server-side components within your Kubernetes cluster(s): Pinniped Supervisor with a working FederationDomain and at least one IdentityProvider (LDAP, AD, or OIDC) The Supervisor installation could be on a completely separate cluster unrelated to your CI/CD Pinniped Concierge on each cluster that needs to be administrated by your CI/CD system It is possible to use the Pinniped CLI to log into any cluster configured with , see . This would not require Concierge to be installed on each cluster. A CI/CD system that meets the following conditions: It can handle secrets safely and provide them to tasks as environment variables It can run shell scripts, or at least invoke binaries (such as `pinniped` and `kubectl`) It can access Pinniped-style kubeconfigs for each cluster A user account (that does not represent a human) within the IDP of your choice This account should be granted the least amount of privileges necessary This account should likely be single-purposed for CI/CD use A CI/CD admin should generate the Pinniped-style kubeconfig for each cluster that needs to be administered by CI/CD and make those kubeconfigs available to CI/CD Be sure to use `pinniped get kubeconfig` with option `--upstream-identity-provider-flow=cli_password` to authenticate non-interactively (without a browser) When using OIDC, the optional CLI-based flow must be enabled by the administrator in the OIDCIdentityProvider configuration before use (see `allowPasswordGrant` in the for more details). A CI/CD admin should make the non-human user account credentials available to CI/CD tasks Each CI/CD task should set the environment variables `PINNIPEDUSERNAME` and `PINNIPEDPASSWORD` for the `kubectl` process to avoid the interactive prompts. The values should be provided from the non-human user account credentials. At this point, your CI/CD has now authenticated into your kubernetes cluster. Be sure to set up the appropriate IDP groups and Kubernetes roles to enable your non-human user account to perform the necessary operations.
Project: CloudNativePG (App Definition and Development / Database)
File: CONTRIBUTING.md

Welcome! We are glad that you want to contribute to our CloudNativePG project! As you get started, you are in the best position to give us feedbacks on areas of our project that we need help with, including: Problems found while setting up the development environment Gaps in our documentation Bugs in our Github actions Promotion of PostgreSQL on Kubernetes with our operator First, though, it is important that you read the [code of conduct](CODEOFCONDUCT.md). The guidelines below are a starting point. We don't want to limit your creativity, passion, and initiative. If you think there's a better way, please feel free to bring it up in a Github discussion, or open a pull request. We're certain there are always better ways to do things, we just need to start some constructive dialogue! We welcome many types of contributions including: New features Builds, CI/CD Bug fixes Issue Triage Answering questions on Slack or Github Discussions Web design Communications / Social Media / Blog Posts Events participation Release management For development contributions, please refer to the separate section called . The best way to reach us with a question when contributing is to drop a line in our , or start a new Github discussion. When raising issues, please specify the following: Setup details as specified in the issue template A scenario where the issue occurred (with details on how to reproduce it) Errors and log messages that are displayed by the involved software Any other detail that might be useful If you are trying to report a vulnerability, please refer to the . We extend a warm welcome to everyone to join any of our meetings. For further details, please visit the page.
Project: KICS (Provisioning / Security & Compliance)
File: 327b0729-4c5c-4c44-8b5c-e476cd9c7290.md

title: DynamoDB Table Point In Time Recovery Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 327b0729-4c5c-4c44-8b5c-e476cd9c7290 Query name: DynamoDB Table Point In Time Recovery Disabled Platform: Pulumi Severity: <span style="color:#5bc0de">Info</span> Category: Best Practices URL: It's considered a best practice to have point in time recovery enabled for DynamoDB Table<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="21 7" name: aws-eks runtime: yaml description: An EKS cluster resources: example: type: aws:dynamodb:Table properties: serverSideEncryption: enabled: true name: aws-eks runtime: yaml description: An EKS cluster resources: example: type: aws:dynamodb:Table properties: serverSideEncryption: enabled: true pointInTimeRecovery: enabled: false ``` ```yaml title="Negative test num. 1 - yaml file" name: aws-eks runtime: yaml description: An EKS cluster resources: example: type: aws:dynamodb:Table properties: serverSideEncryption: enabled: true pointInTimeRecovery: enabled: true ```
Project: ShardingSphere (App Definition and Development / Database)
File: count-readwrite-splitting-rule.en.md

+++ title = "COUNT READWRITE_SPLITTING RULE" weight = 2 +++ The `COUNT READWRITE_SPLITTING RULE` syntax is used to query the number of readwrite-splitting rules for specified database. {{< tabs >}} {{% tab name="Grammar" %}} ```sql CountReadwriteSplittingRule::= 'COUNT' 'READWRITE_SPLITTING' 'RULE' ('FROM' databaseName)? databaseName ::= identifier ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} When `databaseName` is not specified, the default is the currently used `DATABASE`. If `DATABASE` is not used, `No database selected` will be prompted. | Column | Description | |--|-| | rule_name | rule type | | database | the database to which the rule belongs | | count | the number of the rule | Query the number of readwrite-splitting rules for specified database. ```sql COUNT READWRITESPLITTING RULE FROM readwritesplitting_db; ``` ```sql mysql> COUNT READWRITESPLITTING RULE FROM readwritesplitting_db; +++-+ | rule_name | database | count | +++-+ | readwritesplitting | readwritesplitting_db | 1 | +++-+ 1 row in set (0.02 sec) ``` Query the number of readwrite-splitting rules for current database. ```sql COUNT READWRITE_SPLITTING RULE; ``` ```sql mysql> COUNT READWRITE_SPLITTING RULE; +++-+ | rule_name | database | count | +++-+ | readwritesplitting | readwritesplitting_db | 1 | +++-+ 1 row in set (0.00 sec) ``` `COUNT`, `READWRITE_SPLITTING`, `RULE`, `FROM`
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: rdt-class.md

Rdt-class sets the class of service (CLOS or COS) for the container to run in. Based on the Cache Allocation Technology (CAT) feature that is part of Intel's Resource Director Technology (RDT) feature set, all container processes will run within the pre-configured COS, representing a part of the cache. The COS has to be created and configured using a pseudo file system (usually mounted at `/sys/fs/resctrl`) that the resctrl kernel driver provides. Assigning the container to a COS requires root privileges and thus doesn't work in a rootless environment. Currently, the feature is only supported using `runc` as a runtime. See <https://docs.kernel.org/arch/x86/resctrl.html> for more details on creating a COS before a container can be assigned to it.