cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: a597e05a-c065-44e7-9cc8-742f572a504a.md

title: RDS Instance Log Duration Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a597e05a-c065-44e7-9cc8-742f572a504a Query name: RDS Instance Log Duration Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: log_duration parameter should be set to ON for RDS instances<br> ```tf title="Positive test num. 1 - tf file" hl_lines="14" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" },{ name = "log_duration" value = "OFF" }] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="6" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" }] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" } ``` ```tf title="Negative test num. 1 - tf file" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" },{ name = "log_duration" value = "ON" }] } ```
Project: SPIFFE (Provisioning / Key Management)
File: JEYAPPRAGASH_JJ.md

JJ is an industry veteran and is widely recognized as an expert in cloud native security (as evidenced by his previous roles and engagement in the CNCF Security TAG). His understanding of distributed systems, and the AuthN/AuthZ space in particular, never ceases to amaze me. JJ's work involves bringing these technologies together in order to provide cohesive service mesh solutions, which positions him well to see the full picture. This is a critical perspective for SSC success. I believe JJ would be a tremendously powerful force for good, acting upon both SPIFFE and the industry at large, should he accept this nomination and be elected. GitHub Handle: @pragashj Email Address: pragashjj@gmail.com LinkedIn Profile: https://www.linkedin.com/in/pragashjj/ Current Affiliation: Tetrate
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: guidebook-intro.md

title: What is a Guidebook? Welcome to the world of guidebooks. A guidebook is a markdown file, written with a bit of care so that it can be automatically processed into a wizard experience. The wizard guides users through the task. As part of this guidance, the wizard knows how to sequence the sub-tasks, and when a sub-task cannot proceed until the user makes a choice. Some sub-tasks may be expensive or non-indempotent. With a guidebook, it is possible to validate whether sub-tasks are truly needed for any given user in their current context (this laptop versus that laptop; this cluster versus that, etc.). The tool can be used to "vet" that a markdown file is suitable for this kind of treatment. It also can parse the markdown into various models, including a wizard model. Kui then has a UI on top of these models. With this approach, the documentation can also be run through automated tests, ensuring that it works, and continues to do so.
Project: ko (App Definition and Development / Application Definition & Image Build)
File: static-assets.md

`ko` can also bundle static assets into the images it produces. By convention, any contents of a directory named `<importpath>/kodata/` will be bundled into the image, and the path where it's available in the image will be identified by the environment variable `KODATAPATH`. As an example, you can bundle and serve static contents in your image: ``` cmd/ app/ main.go kodata/ favicon.ico index.html ``` Then, in your `main.go`: ```go func main() { http.Handle("/", http.FileServer(http.Dir(os.Getenv("KODATAPATH")))) log.Fatal(http.ListenAndServe(":8080", nil)) } ``` You can simulate `ko`'s behavior outside of the container image by setting the `KODATAPATH` environment variable yourself with `KODATAPATH=cmd/app/kodata/ go run ./cmd/app`. Tip: Symlinks in `kodata` are followed and included as well. For example, you can include Git commit information in your image with `ln -s -r .git/HEAD ./cmd/app/kodata/` Also note that `http.FileServer` will not serve the `Last-Modified` header (or validate `If-Modified-Since` request headers) because `ko` does not embed timestamps by default. This can be supported by manually setting the `KODATADATE_EPOCH` environment variable during build ().
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.9.29.md

RabbitMQ `3.9.29` is a maintenance release in the `3.9.x` release series. This series . Please refer to the Upgrading to 3.9 section from if upgrading from a version prior to 3.9.0. This release requires at least Erlang 24.3, and supports Erlang 25. has more details on Erlang version requirements for RabbitMQ. Erlang 23 support has reached its . Starting with this release, RabbitMQ requires Erlang 24.3 or later versions. Nodes will fail to start on older Erlang releases. Release notes can be found on GitHub at . CLI tools will now report this version as in `rabbitmq-diagnostics status` output. Due to a `$` sign escaping differences between Make and Bazel (the newly adopted build tool), default value of of `userdnpattern` setting was incorrect (had an extra `$`). GitHub issue: None in this release. To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.9.29.tar.xz` instead of the source tarball produced by GitHub.
Project: Artifact Hub (App Definition and Development / Application Definition & Image Build)
File: official-status-request.md

name: Official status request about: Request official status for a repository title: "[OFFICIAL] Your repository or project name" labels: official status request assignees: '' In Artifact Hub, the `official` status means that the publisher owns the software a package primarily focuses on. If we consider the example of a , to obtain the `official` status the publisher should be the owner of the Consul software (HashiCorp in this case), not just the chart. Similarly, a would need to be published by Google to be marked as `official`. In the case of a MySQL operator, only one published by MySQL/Oracle would be considered `official`. The `official` status can be granted at the repository or package level. When it is granted for a repository, all packages available on it will display the `official` badge, so all packages in the repository must be official. If only some of the packages in your repository are official, please list them in the `Official packages` field below. Repository name (in `artifacthub.io`): ... Official packages (leave empty if all packages in the repository are official): ... Project URL: ... Is the publisher a CNCF project? (graduated, incubating or sandbox): ... Source code URL (if available): ... Other relevant URLs: if there are any other urls that can help us with the verification process, please include them here Before applying for this status, please make sure your repository complies with the following requirements: status. [ ] The user requesting the status is the publisher of the repository in Artifact Hub, or belongs to the organization publishing it. [ ] All official packages available in the repository provide a `README.md` file with some documentation that can be displayed on Artifact Hub.
Project: Meshery (Provisioning / Automation & Configuration)
File: MAINTAINERS.md

| Name | GitHub | Affiliation | | -- | -- | -- | | Hussaina Begum | hexxdump | VMware | | Aadhitya Amarendiran | alphaX86 | Citi | | Jerod Culpepper | cpepper96 | SAIC | | Antonette Caldwell | acald-creator | Acquia | | Name | GitHub | Affiliation | | - | - | -- | | Uzair Shaikh | MUzairS15 | Layer5 | | Nikhil Ladha | Nikhil-Ladha | Red Hat | | Antonette Caldwell | acald-creator | Acquia | | Aabid Sofi | aabidsofi19 | Layer5 | | Name | GitHub | Affiliation | | - | - | -- | | Aisuko Li | aisuko | RMIT | | Dhiraj Gedam | dheerajng | Citrix | | Haim Helman | thehh1974 | VMware | | Hussaina Begum | hexxdump | VMware | | Ashish Tiwari | revolyssup | API7 | | Michael Gfeller | mgfeller | Computas AS | | Antonette Caldwell | acald-creator | Acquia | | Xin Huang | gyohuangxin | Intel | | Name | GitHub | Affiliation | | | | -- | | Ashish Tiwari | revolyssup | API7 | | Mario Arriaga | MarioArriaga92 | F5 | | Name | GitHub | Affiliation | | -- | | -- | | Adithya Krishna | adithyaakrishna | Red Hat | | Lee Calcote | leecalcote | Layer5 | | Vishal Vivek | vishalvivekm | Layer5 | | Name | GitHub | Affiliation | | - | -- | -- | | Nikhil Ladha | Nikhil-Ladha | Red Hat | | Aaditya Narayan Subedy | asubedy | Fast Retailing |
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: full-disk-lock.md

title: Full disk lock description: How to configure disk lock when it is about to be full sidebar_position: 2 sidebar_label: Full disk lock The full disk lock function of KubeBlocks ensures the stability and availability of a database. This function triggers a disk lock when the disk usage reaches a set threshold, thereby pausing write operations and only allowing read operations. Such a mechanism prevents a database from being affected by disk space exhaustion. When the space water level of any configured volume exceeds the defined threshold, the instance is locked (read-only). Meanwhile, the system sends a related warning event, including the specific threshold and space usage information of each volume. When the space water level of all configured volumes falls below the defined threshold, the instance is unlocked (read and write). Meanwhile, the system sends a related warning event, including the specific threshold and space usage information of each volume. :::note The full disk lock function currently supports global (ClusterDefinition) enabling or disabling and does not support Cluster dimension control. Dynamically enabling or disabling this function may affect the existing Cluster instances that use this ClusterDefinition and cause them to restart. Please operate with caution. The full disk locking function relies on the read permission (get & list) of the two system resource nodes and nodes/stats. If you create an instance via kbcli, make sure to grant the controller administrative rights to the ClusterRoleBinding. Currently, full disk lock is available for ApeCloud MySQL, PostgreSQL and MongoDB. ::: For MySQL database, the read/write user cannot write to the disk when the disk usage reaches the `highwatermark` value, while the superuser can still write. For PostgreSQL and MongoDB, both the read/write user and the superuser cannot write when the disk usage reaches `highwatermark`. `90` is the default value setting for the high watermark at the component level which means the disk is locked when the disk usage reaches 90%, while `85` is used for the volumes which overwrites the component's threshold value. In the cluster definition, add the following content to enable the full disk lock function. You can set the value according to your need. ```bash volumeProtectionSpec: highWatermark: 90 volumes: highWatermark: 85 name: data ``` :::note The recommended value of `highWatermark` is 90. ::: Delete `volumeProtectionSpec` from the cluster definition file.
Project: KICS (Provisioning / Security & Compliance)
File: dab4ec72-ce2e-4732-b7c3-1757dcce01a1.md

title: Service Account Key File Not Properly Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: dab4ec72-ce2e-4732-b7c3-1757dcce01a1 Query name: Service Account Key File Not Properly Set Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: When using kube-apiserver command, the '--service-account-key-file' flag should be defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: [] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--service-account-key-file=/path/to/file.pem"] restartPolicy: OnFailure ```
Project: ShardingSphere (App Definition and Development / Database)
File: register-storage-unit.en.md

+++ title = "REGISTER STORAGE UNIT" weight = 1 +++ The `REGISTER STORAGE UNIT` syntax is used to register storage unit for the currently selected logical database. {{< tabs >}} {{% tab name="Grammar" %}} ```sql RegisterStorageUnit ::= 'REGISTER' 'STORAGE' 'UNIT' ifNotExists? storageUnitDefinition (',' storageUnitDefinition)* storageUnitDefinition ::= storageUnitName '(' ('HOST' '=' hostName ',' 'PORT' '=' port ',' 'DB' '=' dbName | 'URL' '=' url) ',' 'USER' '=' user (',' 'PASSWORD' '=' password)? (',' propertiesDefinition)?')' ifNotExists ::= 'IF' 'NOT' 'EXISTS' storageUnitName ::= identifier hostname ::= string port ::= int dbName ::= string url ::= string user ::= string password ::= string propertiesDefinition ::= 'PROPERTIES' '(' key '=' value (',' key '=' value)* ')' key ::= string value ::= literal ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} Before register storage units, please confirm that a database has been created in Proxy, and execute the `use` command to successfully select a database; Confirm that the registered storage unit can be connected normally, otherwise it will not be added successfully; `storageUnitName` is case-sensitive; `storageUnitName` needs to be unique within the current database; `storageUnitName` name only allows letters, numbers and `_`, and must start with a letter; `poolProperty` is used to customize connection pool parameters, `key` must be the same as the connection pool parameter name; `ifNotExists` clause is used for avoid `Duplicate storage unit` error. Register storage unit using standard mode ```sql REGISTER STORAGE UNIT ds_0 ( HOST="127.0.0.1", PORT=3306, DB="db_1", USER="root", PASSWORD="root" ); ``` Register storage unit and set connection pool parameters using standard mode ```sql REGISTER STORAGE UNIT ds_0 ( HOST="127.0.0.1", PORT=3306, DB="db_1", USER="root", PASSWORD="root", PROPERTIES("maximumPoolSize"=10) ); ``` Register storage unit and set connection pool parameters using URL patterns ```sql REGISTER STORAGE UNIT ds_0 ( URL="jdbc:mysql://127.0.0.1:3306/db_2?serverTimezone=UTC&useSSL=false", USER="root", PASSWORD="root", PROPERTIES("maximumPoolSize"=10,"idleTimeout"="30000") ); ``` Register storage unit with `ifNotExists` clause ```sql REGISTER STORAGE UNIT IF NOT EXISTS ds_0 ( HOST="127.0.0.1", PORT=3306, DB="db_0", USER="root", PASSWORD="root" ); ``` `REGISTER`, `STORAGE`, `UNIT`, `HOST`, `PORT`, `DB`, `USER`, `PASSWORD`, `PROPERTIES`, `URL`
Project: LinuxKit (Provisioning / Automation & Configuration)
File: 2017-05-15.md

The ninth weekly development report. Feel free to send PRs if you want to add to these reports (or correct them). Welcome everyone, looking forward to your contributions and working with you. Please open issues on GitHub if you need help, or ask on #linuxkit in the . Lots of bug fixes this week as well as the changes discussed below. We finished the (previously partial) switch over to `containerd` after resolving the issues. The next stage of that migration is to use the `containerd` image store, which is in progress. We switched over to use simpler multistage builds for more packages. The `moby` tool added support for a base `tar` output format. All the others are now generated from this. It is just a tarball of the filesystem contents, with the `kernel` and `cmdline` files under `/boot` so they can be extracted by other targets. It is useful for debugging. An `img-gz` target which outputs a compressed disk image suitable for writing to a USB stick or for AWS was also added. The output formats will probably be removed from the config file and reworked as a `moby package` stage soon. An initial set of tests were added. See . These can now be expanded for more detailed testing. We added 4.11 and later 4.11.1 kernel support. There is a new hyper-v socket implementation for the more recent kernels which we are still in the process of testing. There is a new project to work on improving the . There is a new `linuxkit metadata create` command to create metadata in (currently) ISO format see . Some work is in progress on Arm64 builds, with a basic boot having taken place. Also there has been work on building multi arch Docker Hub images via automated builds, which will be the way to make these more manageable, in addition to the kernel config management discussed above. The DockerCon talk and demos recording is now available
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_cluster_describe-account.md

title: kbcli cluster describe-account Describe account roles and related information ``` kbcli cluster describe-account [flags] ``` ``` kbcli cluster describe-account CLUSTERNAME --component COMPNAME --name USERNAME kbcli cluster describe-account CLUSTERNAME --name USERNAME kbcli cluster describe-account --instance INSTANCE --name USERNAME ``` ``` --component string Specify the name of component to be connected. If not specified, pick the first one. -h, --help help for describe-account -i, --instance string Specify the name of instance to be connected. --name string Required user name, please specify it. ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Cluster command.
Project: Harbor (Provisioning / Container Registry)
File: 8-03-Authentication-edit-self-registration.md

Test 8-03 - Update self-registration ======= To verify that an admin user can update self-registration setting. User guide This test requires that a Harbor instance is running and available. A linux host with Docker CLI installed (Docker client). Login UI as admin user. In configuration page, uncheck self registration. Save configuration and logout. In login page, sign up link will disappear. None
Project: YDB (App Definition and Development / Database)
File: items-access.md

For accessing the values inside containers: `Struct<>`, `Tuple<>` and `Variant<>`, use a dot. The set of keys (for the tuple and the corresponding variant indexes) is known at the query compilation time. The key is validated* before beginning the query execution. `List<>` and `Dict<>`, use square brackets. The set of keys (set of indexes for keys) is known only at the query execution time. The key is not validated* before beginning the query execution. If no value is found, an empty value (NULL) is returned. . When using this syntax to access containers within table columns, be sure to specify the full column name, including the table name or table alias separated by a dot (see the first example below). Examples ```yql SELECT t.struct.member, t.tuple.7, t.dict["key"], t.list[7] FROM my_table AS t; ``` ```yql SELECT Sample::ReturnsStruct().member; ```
Project: ClickHouse (App Definition and Development / Database)
File: lazy.md

slug: /en/engines/database-engines/lazy sidebar_label: Lazy sidebar_position: 20 Keeps tables in RAM only `expirationtimein_seconds` seconds after last access. Can be used only with \*Log tables. Its optimized for storing many small \*Log tables, for which there is a long time interval between accesses. CREATE DATABASE testlazy ENGINE = Lazy(expirationtimein_seconds);