cwielenb/CNCF-Dataset huggingface dataset:
Project: YDB (App Definition and Development / Database)
File: interactive-cli.md

After executing `ydb` command without subcommands, the interactive query execution mode will be launched. The console or terminal will be switched to interactive mode. After that, you can enter queries directly into the console or terminal, and when you enter a newline character, the query is considered complete and it starts to execute. The query text can be either a YQL query or a . Also, query history is saved between runs, command autocomplete is available, and there is a search function for query history. General format of the command: ```bash {{ ydb-cli }} [global options...] ``` `global options` . Hotkey | Description | `CTRL + D` | Allows you to exit interactive mode. `Up arrow` | Scrolls through query history toward older queries. `Down arrow` | Scrolls through query history toward newer queries. `TAB` | Autocompletes the entered text to a suitable YQL command. `CTRL + R` | Allows searching for a query in history containing a specified substring. Special commands are CLI-specific commands and are not part of the YQL syntax. They are intended for performing various functions that cannot be accomplished through a YQL query. Command | Description | | `SET param = value` | The `SET` command sets the value of the `param` to `value`. | | `EXPLAIN query-text` | Outputs the query plan for `query-text`. Equivalent to the command . | | `EXPLAIN AST query-text` | Outputs the query plan for `query-text` along with the . Equivalent to the command . | Internal variables determine the behavior of commands and are set using the `SET`. Variable | Description | | `stats` | The statistics collection mode for subsequent queries.<br>Acceptable values:<ul><li>`none` (default): Do not collect.</li><li>`basic`: Collect statistics.</li><li>`full`: Collect statistics and query plan.</li></ul> | Executing a query in the `full` statistics collection mode: ```bash $ ydb ydb> SET stats = full ydb> select * from table1 limit 1 id key value 10 0 "" Statistics: query_phases { duration_us: 14987 table_access { name: "/ru-central1/a1v7bqj3vtf10qjleyow/laebarufb61tguph3g22/table1" reads { rows: 9937 bytes: 248426 } } cputimeus: 2925 affected_shards: 1 } processcputime_us: 3816 totaldurationus: 79530 totalcputime_us: 6741 Full statistics: Query 0: ResultSet Limit (Limit: 1) TotalCpuTimeUs: 175 TotalTasks: 1 TotalInputBytes: 6 TotalInputRows: 1 TotalOutputBytes: 16 TotalDurationMs: 0 TotalOutputRows: 1 <UnionAll> Limit (Limit: 1) TableFullScan (ReadColumns: ["id","key","value"], ReadRanges: ["key (-, +)"], Table: impex_table) Tables: ["table1"] TotalCpuTimeUs: 154 TotalTasks: 1 TotalInputBytes: 0 TotalInputRows: 0 TotalOutputBytes: 16 TotalDurationMs: 0 TotalOutputRows: 1 ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_resourcemanager_project_iam_policy.md

+++ title = "googleresourcemanagerprojectiampolicy resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleresourcemanagerprojectiampolicy" identifier = "inspec/resources/gcp/googleresourcemanagerprojectiampolicy.md googleresourcemanagerprojectiampolicy resource" parent = "inspec/resources/gcp" +++ A `googleresourcemanagerprojectiampolicy` is used to test a Google Project Iam Policy resource ```ruby describe googleresourcemanagerprojectiampolicy(project_id: "projectId") do it { should exist } end googleresourcemanagerprojectiampolicy(project_id: "projectId").bindings.each do |binding| describe binding do its('role') { should eq 'roles/editor'} its('members') { should include 'user:testuser@example.com'} end end ``` Properties that can be accessed from the `googleresourcemanagerprojectiampolicy` resource: `iambindingroles` : The list of roles that exist on the policy. `bindings` : Associates a list of members to a role. `role` : Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. `members` : Specifies the identities requesting access for a Cloud Platform resource. `audit_configs` : Specifies cloud audit logging configuration for this policy. `service` : Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services. `auditlogconfigs` : The configuration for logging of each type of permission. `log_type` : The log type that this config enables. For example, ADMINREAD, DATAWRITE or DATA_READ `exempted_members` : Specifies the identities that do not cause logging for this type of permission. Ensure the is enabled for the current project.
Project: ClickHouse (App Definition and Development / Database)
File: v22.6.3.35-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Fix crash when executing GRANT ALL ON .* with ON CLUSTER. It was broken in https://github.com/ClickHouse/ClickHouse/pull/35767. This closes . (). Backported in : Add `clickhouse-diagnostics` binary to the packages. (). Backported in : Fix incorrect columns order in subqueries of UNION (in case of duplicated columns in subselects may produce incorrect result). (). Backported in : Do not allow recursive usage of OvercommitTracker during logging. Fixes cc @tavplubix @davenger. (). Backported in : Fix incorrect result of distributed queries with `DISTINCT` and `LIMIT`. Fixes . (). Backported in : Fix parts removal (will be left forever if they had not been removed on server shutdown) after incorrect server shutdown. (). Backported in : Fix table creation to avoid replication issues with pre-22.4 replicas. (). Backported in : Now it's possible to start a clickhouse-server and attach/detach tables even for tables with the incorrect values of IPv4/IPv6 representation. Proper fix for issue . (). Backported in : Adapt some more nodes to avoid issues with pre-22.4 replicas. (). Backported in : `rankCorr` function will work correctly if some arguments are NaNs. This closes . (). Backported in : Fix use-after-free for Map combinator that leads to incorrect result. (). Fix test for system table count in diag tool (). Integration tests volume (). Update docker-compose to try get rid of v1 errors (). Fix backports diff ().
Project: SPIRE (Provisioning / Key Management)
File: supported_integrations.md

SPIRE Server and Agent integrate with various software and platforms. The following sections detail the official project support stance for these integrations. Usually this means that we actively test the integration with the listed versions (though not always; sometimes we rely on support declarations of client libraries used by the integrations). If an integration is not represented, it does not mean that the integration is not supported but that there is no official stance. The SPIRE project officially tests integrations against the latest five minor versions of Envoy, starting with v1.13 (the earliest build with the v3 API). Envoy v2 API support is deprecated and as such we only actively test against the last minor version that supports it (v1.16). The SPIRE project currently supports Kubernetes 1.18 through 1.21. Later versions may also work but are not explicitly exercised by integration tests.
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: resource-update.eg.md

`resource-update` policy can allow users to customize the update behavior for selected resources. ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: recreate spec: components: type: k8s-objects name: recreate properties: objects: apiVersion: v1 kind: Secret metadata: name: recreate data: key: dgo= immutable: true policies: type: resource-update name: resource-update properties: rules: selector: resourceTypes: ["Secret"] strategy: recreateFields: ["data.key"] ``` By specifying `recreateFields`, the application will recreate the target resource (Secret here) when the field changes (`data.key` here). If the field is not changed, the application will use the normal update (patch here). ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: recreate spec: components: type: k8s-objects name: recreate properties: objects: apiVersion: v1 kind: ConfigMap metadata: name: recreate data: key: val policies: type: resource-update name: resource-update properties: rules: selector: resourceTypes: ["ConfigMap"] strategy: op: replace ``` By specifying `op` to `replace`, the application will update the given resource (ConfigMap here) by replace. Compared to patch, which leverages three-way merge patch to only modify the fields managed by KubeVela application, "replace" will update the object as a whole and wipe out other fields even if it is not managed by the KubeVela application. It can be seen as an "application-level" ApplyResourceByReplace.
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.ResourceWithMetadata.md

/ / ResourceWithMetadata .ResourceWithMetadata A minimal subset of a kubernetes-like resource specification that identifies a resource | Name | Type | | :-- | :-- | | `Content` | `void` | `ResourceWithMetadata` `Optional` apiVersion: `string` `Optional` content: `Content` `Optional` contentType: `string` `Optional` kind: `string` . `Optional` metadata: `Object` | Name | Type | | :- | :- | | `creationTimestamp?` | `string` | | `generation?` | `string` | | `labels?` | `Record`<`string`, `string`\> | | `name` | `string` | | `namespace?` | `string` | . `Optional` nameHash: `string` `Optional` onclick: `Object` family of onclick handlers | Name | Type | | :-- | :- | | `kind?` | `string` | | `name?` | `string` | | `nameHash?` | `string` | | `namespace?` | `string` | `Optional` presentation: `Optional` prettyName: `string` name hash, e.g. the hash part of auto-generated names, or an openwhisk activation id `Optional` toolbarText: `Optional` version: `string` optional designation of resource version
Project: KusionStack (Provisioning / Automation & Configuration)
File: kusion_init_templates.md

List templates used to initialize a project This command gets the descriptions and definitions of the templates which are used to initialize the project scaffolding. ``` kusion init templates ``` ``` kusion init templates kusion init templates https://github.com/<user>/<repo> --online=true ``` ``` -h, --help help for templates -o, --output string Specify the output format of templates. If specified, only support json for now; if not, template name and description is given ``` ``` --online Use templates from online repository to initialize project, or use locally cached templates --profile string Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex) (default "none") --profile-output string Name of the file to write the profile to (default "profile.pprof") ``` - Initialize the scaffolding for a project
Project: Apache Hadoop (App Definition and Development / Database)
File: RELEASENOTES.3.0.4.md

<! --> These release notes cover new developer and user-facing incompatibilities, important issues, features, and major improvements. | Major | Checkstyle version is not compatible with IDEA's checkstyle plugin* Updated checkstyle to 8.8 and updated maven-checkstyle-plugin to 3.0.0. | Minor | Upgrade Azure Storage Sdk version to 7.0.0 and update corresponding code blocks* WASB: Fix Spark process hang at shutdown due to use of non-daemon threads by updating Azure Storage Java SDK to 7.0 | Major | hdfs mover -p /path times out after 20 min* Mover could have fail after 20+ minutes if a block move was enqueued for this long, between two DataNodes due to an internal constant that was introduced for Balancer, but affected Mover as well. The internal constant can be configured with the dfs.balancer.max-iteration-time parameter after the patch, and affects only the Balancer. Default is 20 minutes. | Major | KMS Accept Queue Size default changed from 500 to 128 in Hadoop 3.x* Restore the KMS accept queue size to 500 in Hadoop 3.x, making it the same as in Hadoop 2.x.
Project: KICS (Provisioning / Security & Compliance)
File: 092bae86-6105-4802-99d2-99cd7e7431f3.md

title: Disk Encryption Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 092bae86-6105-4802-99d2-99cd7e7431f3 Query name: Disk Encryption Disabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: VM disks for critical VMs must be encrypted with Customer Supplied Encryption Keys (CSEK) or with Customer-managed encryption keys (CMEK), which means the attribute 'diskencryptionkey' must be defined and its sub attributes 'rawkey' or 'kmskeyselflink' must also be defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="27 3 15" name: create a disk1 google.cloud.gcpcomputedisk: name: test_object1 size_gb: 50 zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a disk3 google.cloud.gcpcomputedisk: name: test_object3 size_gb: 50 diskencryptionkey: raw_key: zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a disk4 google.cloud.gcpcomputedisk: name: test_object4 size_gb: 50 diskencryptionkey: raw_key: "" zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="17 5" name: create a disk3 google.cloud.gcpcomputedisk: name: test_object3 size_gb: 50 diskencryptionkey: kmskeyname: zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a disk4 google.cloud.gcpcomputedisk: name: test_object4 size_gb: 50 diskencryptionkey: kmskeyname: "" zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: create a disk google.cloud.gcpcomputedisk: name: test_object size_gb: 50 diskencryptionkey: raw_key: SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0= zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present ``` ```yaml title="Negative test num. 2 - yaml file" name: create a disk google.cloud.gcpcomputedisk: name: test_object size_gb: 50 diskencryptionkey: kmskeyname: disk-crypto-key zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present ```
Project: ko (App Definition and Development / Application Definition & Image Build)
File: build-cache.md

Because `ko` just runs `go build` in your normal development environment, it automatically reuses your from previous builds, making iterative development faster. `ko` also avoids pushing blobs to the remote image registry if they're already present, making pushes faster. You can make `ko` even faster by setting the `KOCACHE` environment variable. This tells `ko` to store a local mapping between the `go build` inputs to the image layer that they produce, so `go build` can be skipped entirely if the layer is already present in the image registry.
Project: CyberArk Conjur (Provisioning / Key Management)
File: MIGRATION.md

Migrating data from Conjur Open Source to a Conjur EE appliance is simple using the provided export tools. To create the migration data archive: Open a shell session in the Conjur Open Source container, for example: ```sh-session $ docker-compose exec conjur bash $ docker exec -it conjur bash ``` Run the export command ```sh-session $ conjurctl export -o /var/export Exporting to '/var/export'... Generating key file /var/export/key gpg: directory `/root/.gnupg' created gpg: new configuration file `/root/.gnupg/gpg.conf' created gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run gpg: keyring `/root/.gnupg/pubring.gpg' created Export placed in /var/export/2018-07-23T21-08-19Z.tar.xz.gpg It's encrypted with key in /var/export/key. If you're going to store the export, make sure to store the key file separately. ``` Copy the data archive and encryption key out of the container > NOTE: There will be two files in the export: > - A file called `key`, which contains the encryption key for the archive > - A timestamped file ending with `.tar.xz.gpg`. This is the exported Conjur > data, protected by the key ```sh-session $ docker copy conjur:/var/export ./export ``` These files can now be used to migrate the data into a new Conjur EE appliance.
Project: Trivy (Provisioning / Security & Compliance)
File: trivy_server.md

Server mode ``` trivy server [flags] ``` ``` $ trivy server $ trivy server --listen 0.0.0.0:10000 ``` ``` --cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs") --cache-ttl duration cache TTL when using redis as cache backend --clear-cache clear image caches without scanning --db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2") --download-db-only download/update vulnerability database but don't run a scan --enable-modules strings [EXPERIMENTAL] module names to enable -h, --help help for server --listen string listen address in server mode (default "localhost:4954") --module-dir string specify directory to the wasm modules that will be loaded (default "$HOME/.trivy/modules") --no-progress suppress progress bar --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --redis-ca string redis ca file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend --registry-token string registry token --reset remove all caches and database --skip-db-update skip updating vulnerability database --token string for authentication in client/server mode --token-header string specify a header name for token in client/server mode (default "Trivy-Token") --username strings username. Comma-separated usernames allowed. ``` ``` --cache-dir string cache directory (default "/path/to/cache") -c, --config string config path (default "trivy.yaml") -d, --debug debug mode --generate-default-config write the default config to trivy-default.yaml --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version ``` - Unified security scanner
Project: YugabyteDB (App Definition and Development / Database)
File: alter_policy,alter_policy_rename.grammar.md

```output.ebnf alterpolicy ::= ALTER POLICY name ON tablename [ TO { role_name | PUBLIC | CURRENT_USER | SESSION_USER } [ , ... ] ] [ USING ( using_expression ) ] [ WITH CHECK ( check_expression ) ] alterpolicyrename ::= ALTER POLICY name ON table_name RENAME TO new_name ```
Project: RBAC Manager (Provisioning / Security & Compliance)
File: DESIGN.md

This is the primary entrypoint This package watches all resources that rbac-manager "owns" in order to trigger reconciliation if an outside actor modifies or deletes one of them Here the rbacDefinition is parsed into ServiceAccounts, ClusterRoleBindings, and RoleBindings This package contains the watchers of Namesapces and RbacDefinitions, which are the primary things that can be used to trigger rbac-manager actions. This contains the functions that reconcile Namespaces, ServiceAccounts, ClusterRoleBindings, RoleBindings, and OnwerReferences This contains the types necessary to define the RbacDefinition.
Project: Trivy (Provisioning / Security & Compliance)
File: trivy.md

Unified security scanner Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets ``` trivy [global flags] command [flags] target ``` ``` $ trivy image python:3.4-alpine $ trivy image --input ruby-3.1.tar $ trivy fs . $ trivy server ``` ``` --cache-dir string cache directory (default "/path/to/cache") -c, --config string config path (default "trivy.yaml") -d, --debug debug mode -f, --format string version format (json) --generate-default-config write the default config to trivy-default.yaml -h, --help help for trivy --insecure allow insecure server connections -q, --quiet suppress progress bar and log output --timeout duration timeout (default 5m0s) -v, --version show version ``` - [EXPERIMENTAL] Scan AWS account - Scan config files for misconfigurations - Convert Trivy JSON report into a different format - Scan local filesystem - Scan a container image - [EXPERIMENTAL] Scan kubernetes cluster - Manage modules - Manage plugins - Scan a repository - Scan rootfs - Scan SBOM for vulnerabilities and licenses - Server mode - Print the version - [EXPERIMENTAL] Scan a virtual machine image
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: reverse-dependency.md

If you want to garbage collect resources in the order of reverse dependency, you can add `order: dependency` in the `garbage-collect` policy. Notice that this order policy is only valid for the resources that are created in the components. In the following example, component `test1` depends on `test2`, and `test2` need the output from `test3`. So the order of deployment is: `test3 -> test2 -> test1`. When we add `order: dependency` in `garbage-collect` policy and delete the application, the order of garbage collect is: `test1 -> test2 -> test3`. ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: gc-dependency namespace: default spec: components: name: test1 type: webservice properties: image: crccheck/hello-world port: 8000 dependsOn: "test2" name: test2 type: webservice properties: image: crccheck/hello-world port: 8000 inputs: from: test3-output parameterKey: test name: test3 type: webservice properties: image: crccheck/hello-world port: 8000 outputs: name: test3-output valueFrom: output.metadata.name policies: name: gc-dependency type: garbage-collect properties: order: dependency ```