cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 09bb9e96-8da3-4736-b89a-b36814acca60.md

title: Etcd Peer TLS Certificate Files Not Properly Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 09bb9e96-8da3-4736-b89a-b36814acca60 Query name: Etcd Peer TLS Certificate Files Not Properly Set Platform: Kubernetes Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: When using etcd commands, the '--peer-cert-file' and '--peer-key-file' should be defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="21" apiVersion: apps/v1 kind: Deployment metadata: name: app-etcd-deployment spec: selector: matchLabels: app: app replicas: 1 template: metadata: labels: app: app version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/etcd:v3.2.18 imagePullPolicy: IfNotPresent command: ["etcd"] args: ["--peer-cert-file=/etc/env/file.crt"] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="21" apiVersion: apps/v1 kind: Deployment metadata: name: app-etcd-deployment spec: selector: matchLabels: app: app replicas: 1 template: metadata: labels: app: app version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/etcd:v3.2.18 imagePullPolicy: IfNotPresent command: ["etcd"] args: ["--peer-key-file=/etc/env/file2.key"] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: app-etcd-deployment spec: selector: matchLabels: app: app replicas: 1 template: metadata: labels: app: app version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/etcd:v3.2.18 imagePullPolicy: IfNotPresent command: ["etcd"] args: ["--peer-cert-file=/etc/env/file.crt", "--peer-key-file=/etc/env/file2.key"] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: app-etcd-deployment spec: selector: matchLabels: app: app replicas: 1 template: metadata: labels: app: app version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/etcd:v3.2.18 imagePullPolicy: IfNotPresent command: ["etcd", "--peer-cert-file=/etc/env/file.crt", "--peer-key-file=/etc/env/file2.key"] args: [] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure ```
Project: KICS (Provisioning / Security & Compliance)
File: ed672a9f-fbf0-44d8-a47d-779501b0db05.md

title: IP Aliasing Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ed672a9f-fbf0-44d8-a47d-779501b0db05 Query name: IP Aliasing Disabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Kubernetes Clusters must be created with Alias IP ranges enabled, which means the attribute 'ipallocationpolicy' must be defined and the subattribute 'useipaliases' must be set to 'yes'.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2 50 31" name: create a cluster1 google.cloud.gcpcontainercluster: name: my-cluster1 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a cluster2 google.cloud.gcpcontainercluster: name: my-cluster2 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present ipallocationpolicy: create_subnetwork: no name: create a cluster3 google.cloud.gcpcontainercluster: name: my-cluster3 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present ipallocationpolicy: create_subnetwork: no useipaliases: no ``` ```yaml title="Negative test num. 1 - yaml file" name: create a cluster google.cloud.gcpcontainercluster: name: my-cluster initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present ipallocationpolicy: create_subnetwork: no useipaliases: yes ```
Project: KICS (Provisioning / Security & Compliance)
File: d43366c5-80b0-45de-bbe8-2338f4ab0a83.md

title: GKE Master Authorized Networks Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d43366c5-80b0-45de-bbe8-2338f4ab0a83 Query name: GKE Master Authorized Networks Disabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Master authorized networks must be enabled in GKE clusters<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17 10 22" name: create a cluster google.cloud.gcpcontainercluster: name: my-cluster location: us-central1-a auth_kind: serviceaccount masterauthorizednetworks_config: cidr_blocks: cidr_block: 192.0.2.0/24 enabled: no state: present name: create a second cluster google.cloud.gcpcontainercluster: name: my-second-cluster location: us-central1-a auth_kind: serviceaccount masterauthorizednetworks_config: cidr_blocks: cidr_block: 192.0.2.0/24 state: present name: create a third cluster google.cloud.gcpcontainercluster: name: my-third-cluster location: us-central1-a auth_kind: serviceaccount state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: create a cluster google.cloud.gcpcontainercluster: name: my-cluster initialnodecount: 2 location: us-central1-a auth_kind: serviceaccount masterauthorizednetworks_config: cidr_blocks: cidr_block: 192.0.2.0/24 enabled: yes state: present ```
Project: YDB (App Definition and Development / Database)
File: begin_commit_rollback.md

{% include %} Transactions are a method of grouping one or more database operation into a single unit of work. A transaction may consist of one or several SQL statements and is used to ensure the consistency of data. A transaction guarantees that either all or none of the included SQL statements will be executed. Transactions are managed by the commands `BEGIN`, `COMMIT`, `ROLLBACK`. Transactions are executed within sessions. A session is a single connection to the database, which begins when a client connects to the database and ends upon disconnection. A transaction starts with the `BEGIN` command and ends with the `COMMIT` command (for successful completion) or `ROLLBACK` (to revert). It is not obligatory to specify `BEGIN`, `COMMIT`, and `ROLLBACK` explicitly, they are implied if not specified. If a session is unexpectedly interrupted, then all uncommitted transaction that were initiated in the current session are automatically rolled back. Let's review each of the commands: `BEGIN` initiates a new transaction. After this command is executed, all subsequent database operations are performed within the context of this transaction. `COMMIT` completes the current transaction by applying all of its operations. If all operations within the transaction are successful, the results of these operations are made permanent. The changes become visible to subsequent transactions. `ROLLBACK` reverts the current transaction, canceling all of its operations, if errors occurred during the transaction's execution or if the transaction is being aborted by the application based on its internal logic. When `ROLLBACK` is called, only the changes made within the current transaction are canceled. Changes made by other transactions (even if they were initiated and completed during the execution of the current transaction) remain unaffected. If an error occurs during the execution of a transaction, further operations within that transaction become impossible a `ROLLBACK` must be done since performing a `COMMIT` would return an error. If a session is disconnected during an active transaction a `ROLLBACK` will automatically be executed. For more detailed information about concurrency control (MVCC), refer to . Suppose you need to make changes to different rows in a table for different columns so that the transaction is combined into a single unit of work and has the guarantees of . Such a record may look like this: {% include %} {% include %}
Project: Packer (App Definition and Development / Application Definition & Image Build)
File: feature_requests.md

name: Feature Request about: If you have something you think Packer could improve or add support for. labels: enhancement <! Please keep this note for the community > Please vote on this issue by adding a to the original issue to help the community and maintainers prioritize this request Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request If you are interested in working on this issue or have submitted a pull request, please leave a comment <! Thank you for keeping this note for the community > Please search the existing issues for relevant feature requests, and use the reaction feature (https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to add upvotes to pre-existing requests. A written overview of the feature. Any relevant use-cases that you see. ``` ```
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: topology.eg.md

```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: basic-topology namespace: examples spec: components: name: nginx-basic type: webservice properties: image: nginx policies: name: topology-hangzhou-clusters type: topology properties: clusters: ["hangzhou-1", "hangzhou-2"] ``` ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: label-selector-topology namespace: examples spec: components: name: nginx-label-selector type: webservice properties: image: nginx policies: name: topology-hangzhou-clusters type: topology properties: clusterLabelSelector: region: hangzhou ``` ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: local-ns-topology namespace: examples spec: components: name: nginx-local-ns type: webservice properties: image: nginx policies: name: topology-local type: topology properties: clusters: ["local"] namespace: examples-alternative ```
Project: KICS (Provisioning / Security & Compliance)
File: dec7bc85-d156-4f64-9a33-96ed3d9f3fed.md

title: Serverless Function Without Dead Letter Queue hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: dec7bc85-d156-4f64-9a33-96ed3d9f3fed Query name: Serverless Function Without Dead Letter Queue Platform: ServerlessFW Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Serverless Function should be configured for a Dead Letter Queue(DLQ). A Dead Letter Queue(DLQ) can be set up in 'onError' config parameter<br> ```yml title="Positive test num. 1 - yml file" hl_lines="8" service: service frameworkVersion: '2' provider: name: aws runtime: nodejs12.x functions: hello: handler: handler.hello ``` ```yml title="Negative test num. 1 - yml file" service: service frameworkVersion: '2' provider: name: aws runtime: nodejs12.x functions: hello: handler: handler.hello onError: arn:aws:sns:us-east-1:XXXXXX:test ```
Project: ArangoDB (App Definition and Development / Database)
File: hook_outcome_move_construction.md

+++ title = "`void hookoutcomemove_construction(T *, U &&) noexcept`" description = "(Until v2.2.0) ADL discovered free function hook invoked by the converting move constructors of `basic_outcome`." +++ Removed in Outcome v2.2.0, unless {{% api "BOOSTOUTCOMEENABLELEGACYSUPPORT_FOR" %}} is set to less than `220` to enable emulation. Use {{% api "onoutcomemove_construction(T *, U &&) noexcept" %}} instead in new code. One of the constructor hooks for {{% api "basicoutcome<T, EC, EP, NoValuePolicy>" %}}, generally invoked by the converting move constructors of `basicoutcome` (NOT the standard move constructor). See each constructor's documentation to see which specific hook it invokes. Overridable: By Argument Dependent Lookup. Requires: Nothing. Namespace: `BOOSTOUTCOMEV2_NAMESPACE::hooks` Header: `<boost/outcome/basic_outcome.hpp>`
Project: ORY Hydra (Provisioning / Key Management)
File: VerifiableCredentialResponse.md

Name | Type | Description | Notes | - | - | - CredentialDraft00 | Pointer to string | | [optional] Format | Pointer to string | | [optional] `func NewVerifiableCredentialResponse() *VerifiableCredentialResponse` NewVerifiableCredentialResponse instantiates a new VerifiableCredentialResponse object This constructor will assign default values to properties that have it defined, and makes sure properties required by API are set, but the set of arguments will change when the set of required properties is changed `func NewVerifiableCredentialResponseWithDefaults() *VerifiableCredentialResponse` NewVerifiableCredentialResponseWithDefaults instantiates a new VerifiableCredentialResponse object This constructor will only assign default values to properties that have it defined, but it doesn't guarantee that properties required by API are set `func (o *VerifiableCredentialResponse) GetCredentialDraft00() string` GetCredentialDraft00 returns the CredentialDraft00 field if non-nil, zero value otherwise. `func (o VerifiableCredentialResponse) GetCredentialDraft00Ok() (string, bool)` GetCredentialDraft00Ok returns a tuple with the CredentialDraft00 field if it's non-nil, zero value otherwise and a boolean to check if the value has been set. `func (o *VerifiableCredentialResponse) SetCredentialDraft00(v string)` SetCredentialDraft00 sets CredentialDraft00 field to given value. `func (o *VerifiableCredentialResponse) HasCredentialDraft00() bool` HasCredentialDraft00 returns a boolean if a field has been set. `func (o *VerifiableCredentialResponse) GetFormat() string` GetFormat returns the Format field if non-nil, zero value otherwise. `func (o VerifiableCredentialResponse) GetFormatOk() (string, bool)` GetFormatOk returns a tuple with the Format field if it's non-nil, zero value otherwise and a boolean to check if the value has been set. `func (o *VerifiableCredentialResponse) SetFormat(v string)` SetFormat sets Format field to given value. `func (o *VerifiableCredentialResponse) HasFormat() bool` HasFormat returns a boolean if a field has been set.
Project: CloudARK KubePlus (App Definition and Development / Application Definition & Image Build)
File: RELEASE.md

The `yaml` Project is released on an as-needed basis. The process is as follows: An issue is proposing a new release with a changelog since the last release All must LGTM this release An OWNER runs `git tag -s $VERSION` and inserts the changelog and pushes the tag with `git push $VERSION` The release issue is closed An announcement email is sent to `kubernetes-dev@googlegroups.com` with the subject `[ANNOUNCE] kubernetes-template-project $VERSION is released`
Project: KICS (Provisioning / Security & Compliance)
File: 89143358-cec6-49f5-9392-920c591c669c.md

title: Ram Account Password Policy Not Require At Least one Lowercase Character hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 89143358-cec6-49f5-9392-920c591c669c Query name: Ram Account Password Policy Not Require At Least one Lowercase Character Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Secret Management URL: Ram Account Password Policy should have 'requirelowercasecharacters' set to true<br> ```tf title="Positive test num. 1 - tf file" hl_lines="3" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 5 maxloginattempts = 3 } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = true requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 5 maxloginattempts = 3 } ``` ```tf title="Negative test num. 2 - tf file" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 5 maxloginattempts = 3 } ```
Project: MongoDB (App Definition and Development / Database)
File: memory_management.md

Avoid using bare pointers for dynamically allocated objects. Prefer `std::unique_ptr`, `std::shared_ptr`, or another RAII class such as `BSONObj`. If you assign the output of `new/malloc()` directly to a bare pointer you should document where it gets deleted/freed, who owns it along the way, and how exception safety is ensured.
Project: Harbor (Provisioning / Container Registry)
File: 2-15-LDAP-user-delete-image.md

Test 2-15 - User Delete Images (LDAP Mode) ======= To verify that a non-admin user can delete images in (LDAP mode). User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against an LDAP or AD server. ( auth_mode is set to ldap_auth* .) The user data is stored in an LDAP or AD server. A linux host with Docker CLI installed (Docker client). At least a non-admin user. Same as Test 2-05 except that users are from LDAP/AD. Same as Test 2-05. None
Project: KCL (Provisioning / Automation & Configuration)
File: E1001.md

KCL will report InvalidSyntaxError when KCL has a syntax error. The error code of InvalidSyntaxError is E1001. For example: ``` a, b = 1, 2 # Multiple assign is illegal in KCL syntax ``` The KCL program will cause the following error message. ```kcl,e1001 error[E1001]: InvalidSyntax --> /syntaxerror/general/multipleassign/case0/main.k:1:2 | 1 | a, b = 1, 2 # Multiple assign is illegal in KCL syntax | ^ expected statement | ``` Possible resolution: Check and fix KCL syntax errors based on the KCL Language Standard
Project: ArangoDB (App Definition and Development / Database)
File: implicit_failure_error_exception_move_constructor.md

+++ title = "`basicoutcome(failuretype<EC, EP> &&)`" description = "Implicit error-and-exception-from-failure-type-sugar move constructor. Available if `predicate::enablecompatibleconversion<void, EC, EP, void>` is true. Constexpr, triviality and noexcept propagating." categories = ["constructors", "implicit-constructors", "tagged-constructors"] weight = 537 +++ Implicit error-and-exception-from-failure-type-sugar move constructor used to disambiguate the construction of the error + exception types. Calls {{% api "void onoutcomemoveconstruction(T *, U &&, V &&) noexcept" %}} with `this`, `failuretype<EC> &&` and `failure_type<EP> &&`. Requires: `predicate::enablecompatibleconversion<void, EC, EP, void>` is true. Complexity: Same as for the `errortype` and `exceptiontype` constructors which accept `EC` and `EP`. Constexpr, triviality and noexcept of underlying operations is propagated.
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.7.10.md

layout: release date: 2024-01-10 tag: v0.7.10 chore(deps): Bump follow-redirects from 1.15.3 to 1.15.4 in /install/docker-extension/ui @dependabot (#9909) [Bug] - Fix workspace and environment required field validation @senali-d (#9917) chore(deps): Bump follow-redirects from 1.15.2 to 1.15.4 in /ui @dependabot (#9903) [UI] Fix CASL issues @Yashsharma1911 (#9904) chore(deps): Bump follow-redirects from 1.15.2 to 1.15.4 in /provider-ui @dependabot (#9905) [Enhancement] - Workspace and environments @senali-d (#9890) fix tooltip styling @sudhanshutech (#9906) resolved label cutoff issue @Aniket-76 (#9900) [fix] Some ui fixes in env and workspaces @sudhanshutech (#9896) chore(deps): Bump follow-redirects from 1.15.2 to 1.15.4 in /ui @dependabot (#9903) chore(deps): Bump follow-redirects from 1.15.2 to 1.15.4 in /provider-ui @dependabot (#9905) [Docs] Sitemap with URLs @leecalcote (#9908) feat: build a provider @leecalcote (#9889) [Docs] New Suggested Reading layout @leecalcote (#9891) Thank you to our contributors for making this release possible: @Aniket-76, @Yashsharma1911, @dependabot, @dependabot[bot], @leecalcote, @senali-d and @sudhanshutech
Project: Cadence Workflow (Provisioning / Automation & Configuration)
File: cadenceDevReadme.md

Currently is using to translate sql query. However it only support up to ES V2.x while Cadence is using ES V6.x. Beyond that, Cadence has some specific requirements that not supported by elasticsql yet. Current Cadence query request processing steps are listed below: generate SQL from query use elasticsql to translate SQL to DSL ES V6.x does not support "missing" field, convert "missing" to "bool","must_not","exist" for ExecutionTime query if any complete "range" field for ExecutionTime query by adding {"gt": 0} add domain query key whitelist filtering delete some useless field like "from", "size" modify sorting field (add workflow id as sorting tie breaker) setup search after for pagination ESQL aims at dealing all these addtional processing steps and providing an api to generate DSL in one step for visibility usage in Cadence. ESQL has convert functions specific for cadence usage. Please refer to `cadencesql.go`. Below shows an example. Attention: to use cadence version api, `SetCadence()` must be called at initialzation. go sql := "SELECT colA FROM myTable WHERE colB < 10 AND dateTime = '2015-01-01T02:59:59Z'" domainID := "CadenceSampleDomain" // custom policy that change colName like "col.." to "myCol.." func myKeyFilter(colName string) bool { return strings.HasPrefix(colName, "col") } func myKeyProcess(colName string) (string, error) { return "myCol"+colName[3:], nil } // custom policy that convert formatted time string to unix nano func myValueFilter(colName string) bool { return strings.Contains(colName, "Time") || strings.Contains(colName, "time") } func myValueProcess(timeStr string) (string, error) { // convert formatted time string to unix nano integer parsedTime, _ := time.Parse(defaultDateTimeFormat, timeStr) return fmt.Sprintf("%v", parsedTime.UnixNano()), nil } // with the 2 policies , converted dsl is equivalent to // "SELECT myColA FROM myTable WHERE myColB < 10 AND dateTime = '1561678568048000000' // in which the time is in unix nano format e := NewESql() e.SetCadence() e.ProcessQueryKey(myKeyFilter, myKeyProcess) // set up filtering policy e.ProcessQueryValue(myValueFilter, myValueProcess) // set up process policy dsl, _, err := e.ConvertPrettyCadence(sql, domainID) // convert sql to dsl if err == nil { fmt.Println(dsl) } To setup local testing environment: start cassandra service locally. Please refer to readme. start zookeeper and kafka service locally. Here is a . start elasticsearch and kibana service locally. start a cadence worker by `./bin/helloworld -m worker` under cadence directory. start cadence service locally. Please refer to readme.