cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: changes.md

KICS does not execute scan as default anymore Semantic exit code added based on scan results | flag | Description | | -- | | | `timeout` | number of seconds the query has to execute before being canceled (default 60) | | `profiling` | enables performance profiler that prints resource consumption metrics in the logs during the execution (CPU, MEM) | | `fail-on` | which kind of results should return an exit code different from 0 accepts: critical, high, medium, low and info example: "high,low" (default [critical,high,medium,low,info]) | | `ignore-on-exit` | defines which kind of non-zero exits code should be ignored accepts: all, results, errors, none example: if 'results' is set, only engine errors will make KICS exit code different| | flag | shorthand | Description | Change | | -- | | -- | - | | `path` | `-p` | paths or directories to scan | `path` flag now accepts multiple values | Query execution timeout is now parametrized, the flag `timeout` will override the default value (60 seconds) KICS can now scan multiple paths (WARNING: For multiple paths, kics.config will not be loaded automatically, configuration flag must be explicitly used to load any configuration file.) For performance improvements, KICS will now run scans concurrently by parser. KICS will now do a pre-scan analysis to determine which type of queries and parsers to load. The analyzer will also exclude non Infrastructure as Code files. (WARNING: Using the `type` flag will disable the analyzer)
Project: KICS (Provisioning / Security & Compliance)
File: 86571149-eef3-4280-a645-01e60df854b0.md

title: BOM - AWS EBS hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 86571149-eef3-4280-a645-01e60df854b0 Query name: BOM - AWS EBS Platform: Terraform Severity: <span style="color:#CCCCCC">Trace</span> Category: Bill Of Materials URL: A list of EBS resources found. Amazon Elastic Block Store (Amazon EBS) is an easy-to-use, scalable, high-performance block-storage service designed for Amazon Elastic Compute Cloud (Amazon EC2).<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsebsvolume" "positive1" { availability_zone = "us-west-2a" size = 40 tags = { Name = "HelloWorld" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "awsebsvolume" "positive2" { availability_zone = "us-west-2a" size = 40 tags = { Name = "HelloWorld2" } encrypted = true } ``` ```tf title="Negative test num. 1 - tf file" variable "web_type" { description = "Size/type of the host." default = "m5.large" } module "ebs_optimized" { source = "terraform-aws-modules/ebs-optimized/aws" version = "~> 2.0" instancetype = var.webtype } resource "aws_instance" "web" { ami = data.aws_ami.ubuntu.id instancetype = var.webtype ebsoptimized = module.ebsoptimized.answer } ```
Project: Dragonfly (Provisioning / Container Registry)
File: dfcache_stat.md

% DFCACHE(1) Version v2.1.0 | Frivolous "Dfcache" Documentation dfcache stat stat checks if a file exists in P2P cache system Stat checks if a file exists in P2P cache system. ```shell dfcache stat <-i cid> [flags] ``` ```shell -i, --cid string content or cache ID, e.g. sha256 digest of the content --config string the path of configuration file with yaml extension name, default is /etc/dragonfly/dfcache.yaml, it can also be set by env var: DFCACHE_CONFIG --console whether logger output records to the stdout --jaeger string jaeger endpoint url, like: http://localhost:14250/api/traces --logdir string Dfcache log directory --pprof-port int listen port for pprof, 0 represents random port (default -1) --service-name string name of the service for tracer (default "dragonfly-dfcache") -t, --tag string different tags for the same cid will be recognized as different files in P2P network --timeout duration Timeout for this cache operation, 0 is infinite --verbose whether logger use debug level --workhome string Dfcache working directory -h, --help help for stat -l, --local only check task exists locally, and don't check other peers in P2P network ``` - the P2P cache client of dragonfly
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.7.24.md

RabbitMQ `3.7.24` is a maintenance release. RabbitMQ `3.7.x` series is supported . Per the new Erlang version support policy in effect starting with January 2019, this release . Make sure a is used before upgrading. explains what package repositories and tools can be used to provision latest patch versions of Erlang `21.3.x` and `22.x`. When upgrading to this release and upgrading Erlang to 21.x or later at the same time, extra care has to be taken. Since CLI tools from RabbitMQ releases older than 3.7.7 will fail on Erlang 21 or later, RabbitMQ must be upgraded before Erlang. See upgrade and compatibility notes first if upgrading from an earlier release. See the for general documentation on upgrades and for release notes of other releases. Any questions about this release, upgrades or RabbitMQ in general are welcome on the . Autoheal could fail to finish if one of its state transitions initiated by a remote node timed out. Contributed by @tomyouyou. GitHub issue: Reduced scheduled GC activity in connection socket writer to one run per 1 GiB of data transferred, with an option to change the value or disable scheduled run entirely. More frequent binary heap GC runs seem unneccesary on Erlang 22. Contributed by Aleksander Nycz. GitHub issue: The node now can recover even if virtual host recovery terms file was corrupted. Contributed by @tomyouyou. GitHub issue: Better error reporting in an edge case with classic queue leader replica election. Contributed by Ayanda Dube. GitHub issue: Fixed an incorrect return value in the internal queue data store module. Contributed by Sergey Loguntsov. GitHub issue: Syslog client is now started even when Syslog logging is configured only for some log sinks. GitHub issue: RabbitMQ nodes will now gracefully shutdown when receiving a `SIGTERM` or `SIGQUIT` signals. Previously the runtime would invoke a default handler that terminates the VM giving RabbitMQ no chance to execute its shutdown steps. In addition, `SIGUSER1` and `SIGUSR2` signals are ignored. GitHub issue: Some proxy protocol errors are now logged at debug level. This reduces log noise in environments where TCP load balancers and proxies perform health checks by opening a TCP connection but never sending any data. GitHub issue: A new `POST /login` endpoint can be used by custom management UI login forms to authenticate the user and set the cookie. GitHub issue: Warning about a missing `handle.exe` in `PATH` on Windows is now only logged every few minutes. GitHub issue: Warning: The source code archive provided by GitHub only contains the source of the broker, not the plugins or the client libraries. Please download the archive named `rabbitmq-server-3.7.24.tar.xz`.
Project: ArangoDB (App Definition and Development / Database)
File: hook_outcome_move_construction2.md

+++ title = "`void hookoutcomemove_construction(T *, U &&, V &&) noexcept`" description = "(Until v2.2.0) ADL discovered free function hook invoked by the converting move constructors of `basic_outcome`." +++ Removed in Outcome v2.2.0, unless {{% api "BOOSTOUTCOMEENABLELEGACYSUPPORT_FOR" %}} is set to less than `220` to enable emulation. Use {{% api "onoutcomemove_construction(T *, U &&, V &&) noexcept" %}} instead in new code. One of the constructor hooks for {{% api "basicoutcome<T, EC, EP, NoValuePolicy>" %}}, generally invoked by the converting move constructors of `basicoutcome` (NOT the standard move constructor) which consume two arguments. See each constructor's documentation to see which specific hook it invokes. Overridable: By Argument Dependent Lookup. Requires: Nothing. Namespace: `BOOSTOUTCOMEV2_NAMESPACE::hooks` Header: `<boost/outcome/basic_outcome.hpp>`
Project: KICS (Provisioning / Security & Compliance)
File: 579a0727-9c29-4d58-8195-fc5802a8bdb4.md

title: Shielded GKE Nodes Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 579a0727-9c29-4d58-8195-fc5802a8bdb4 Query name: Shielded GKE Nodes Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: GKE cluster nodes must be launched with Shielded VM enabled, which means the attribute 'enableshieldednodes' must be set to 'true'.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4" resource "googlecontainercluster" "false" { name = "my-gke-cluster" location = "us-central1" enableshieldednodes = false } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecontainercluster" "negative1" { name = "my-gke-cluster" location = "us-central1" enableshieldednodes = true } ```
Project: CloudTTY (App Definition and Development / Application Definition & Image Build)
File: LICENSE.md

The MIT License (MIT) Copyright (c) 2014 Mitchell Hashimoto Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Project: Cyclops (App Definition and Development / Application Definition & Image Build)
File: concepts.md

For the sake of the rest of the docs to be more clear, here are some Cyclops-specific terms that will be used: <strong>Module</strong> - an umbrella for all the Kubernetes resources your application needs to work as expected. For example, your application might require a deployment, a service, and an ingress to do its job. All of those are abstracted under a Cyclops Module. <br /><br /> <strong>Template</strong> - each Module references a Template that maps values from the Module into a valid Kubernetes manifest. <br /><br /> <strong>Template origin</strong> - templates can live on different places. You can store your templates as Helm charts, on git, or even inside Cyclops. <br /><br /> <strong>Template version</strong> - a part of the template reference in each Module is the version of the template. Templates can evolve and change over time, and in order to maintain changes in your system, you can reference different template versions in different Modules. <br /><br />
Project: KICS (Provisioning / Security & Compliance)
File: 4a9e0f00-0765-4f72-a0d4-d31110b78279.md

title: Azure Cognitive Search Public Network Access Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4a9e0f00-0765-4f72-a0d4-d31110b78279 Query name: Azure Cognitive Search Public Network Access Enabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Public Network Access should be disabled for Azure Cognitive Search<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" resource "azurermsearchservice" "positive1" { name = "example-search-service" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location sku = "standard" publicnetworkaccess_enabled = true } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "azurermsearchservice" "positive2" { name = "example-search-service" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location sku = "standard" } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermsearchservice" "example" { name = "example-search-service" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location sku = "standard" publicnetworkaccess_enabled = false } ```
Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: dependent-watches.md

title: Dependent Watches weight: 20 This document describes the `watchDependentResources` option in file. It delves into what dependent resources are, why the option is required, how it is achieved and finally gives an example. In most cases, an operator creates a bunch of Kubernetes resources in the cluster, that helps deploy and manage the application. For instance, the creates two services and a number of pods for a single `EtcdCluster` CR. In this case, all the Kubernetes resources created by the operator for a CR is defined as dependent resources. Often, an operator needs to watch dependent resources. To achieve this, a developer would set the field, `watchDependentResources` to `True` in the `watches.yaml` file. If enabled, a change in a dependent resource will trigger the reconciliation loop causing Ansible code to run. For example, since the etcd-operator needs to ensure that all the pods are up and running, it needs to know when a pod changes. Enabling the dependent watches option would trigger the reconciliation loop to run. The Ansible logic needs to handle these cases and make sure that all the dependent resources are in the desired state as declared by the `CR spec` `Note: By default it is enabled when using ansible-operator` The `ansible-operator` base image achieves this by leveraging the concept of . Whenever a Kubernetes resource is created by Ansible code, the `ansible-operator`'s `proxy` module injects `owner-references` into the resource being created. The `owner-references` means the resource is owned by the CR for which reconciliation is taking place. Whenever the `watchDependentResources` field is enabled, the `ansible-operator` will watch all the resources owned by the CR, registering callbacks to their change events. Upon a change, the callback will enqueue a `ReconcileRequest` for the CR. The enqueued reconciliation request will trigger the `Reconcile` function of the controller which will execute the ansible logic for reconciliation. This is an example of a watches file with the `watchDependentResources` field set to `True` ```yaml version: v1alpha1 group: app.example.com kind: AppService playbook: playbook.yml maxRunnerArtifacts: 30 reconcilePeriod: 5s manageStatus: False watchDependentResources: True ```
Project: KICS (Provisioning / Security & Compliance)
File: 254c932d-e3bf-44b2-bc9d-eb5fdb09f8d4.md

title: Redis Not Compliant hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 254c932d-e3bf-44b2-bc9d-eb5fdb09f8d4 Query name: Redis Not Compliant Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: Check if the redis version is compliant with the necessary AWS PCI DSS requirements<br> ```tf title="Positive test num. 1 - tf file" hl_lines="7" resource "awselasticachecluster" "positive1" { cluster_id = "cluster-example" engine = "redis" node_type = "cache.m4.large" numcachenodes = 1 engine_version = "2.6.13" port = 6379 } ``` ```tf title="Negative test num. 1 - tf file" resource "awselasticachecluster" "negative1" { cluster_id = "cluster-example" engine = "redis" node_type = "cache.m4.large" numcachenodes = 1 engine_version = "5.0.0" port = 6379 } ```
Project: Beam (App Definition and Development / Streaming & Messaging)
File: akvelon.md

title: "Akvelon" icon: /images/logos/powered-by/akvelon.png hasNav: true cardDescription: "<p><a href='https://akvelon.com/' target='_blank' rel='noopener noreferrer'>Akvelon</a> is a software engineering company that helps start-ups, SMBs, and Fortune 500 companies unlock the full potential of cloud, data, and AI/ML to empower their strategic advantage. Akvelon team has deep expertise in integrating Apache Beam with diverse data processing ecosystems and is an enthusiastic Apache Beam community contributor.</p>" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: sysdig-image-scanner.md

title: Sysdig Image Scanner Admission Controller software: kubernetes sysdigsecure labels: category: containers layer: orchestration code: https://github.com/sysdiglabs/opa-image-scanner inventors: sysdig docs_feature: kubernetes: note: | Integrates image scanning results with Kubernetes admission checks using Rego to make pod admission decisions. See the for more details. Sysdigs OPA Image Scanner combines Sysdig Secure image scanner with OPA policy-based rego language to evaluate the scan results and the admission context, providing great flexibility on the admission decision.
Project: Tremor (App Definition and Development / Streaming & Messaging)
File: drop.md

Drop halts event processing for the current event being processed returning control to the tremor runtime, dropping the event. The `drop` operation should be used with care as the in-flight event is discarded by the runtime. Where circuit breakers, guaranteed delivery and quality of service operations are being managed by the engine downstream these should be carefully programmed so that `drop` operations have no side-effects on non-functional behaviours of the tremor runtime. Here be dragons!
Project: StarRocks (App Definition and Development / Database)
File: pipes.md

displayed_sidebar: "English" `pipes` provides information about all pipes stored in the current or specified database. This view is supported from StarRocks v3.2 onwards. :::note You can also use to view the pipes stored in a specified database or in the current database in use. This command is also supported from v3.2 onwards. ::: The following fields are provided in `pipes`: | Field | Description | | - | | | DATABASE_NAME | The name of the database in which the pipe is stored. | | PIPE_ID | The unique ID of the pipe. | | PIPE_NAME | The name of the pipe. | | TABLENAME | The name of the destination table. Format: `<databasename>.<table_name>`. | | STATE | The status of the pipe. Valid values: `RUNNING`, `FINISHED`, `SUSPENDED`, and `ERROR`. | | LOAD_STATUS | The overall status of the data files to be loaded via the pipe, including the following sub-fields:<ul><li>`loadedFiles`: the number of data files that have been loaded.</li><li>`loadedBytes`: the volume of data that has been loaded, measured in bytes.</li><li>`loadingFiles`: the number of data files that are being loaded.</li></ul> | | LAST_ERROR | The details about the last error that occurred during the pipe execution. Default value: `NULL`. | | CREATED_TIME | The date and time when the pipe was created. Format: `yyyy-MM-dd HH:mm:ss`. Example: `2023-07-24 14:58:58`. |
Project: KICS (Provisioning / Security & Compliance)
File: fbe9b2d0-a2b7-47a1-a534-03775f3013f7.md

title: Cluster Labels Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: fbe9b2d0-a2b7-47a1-a534-03775f3013f7 Query name: Cluster Labels Disabled Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Kubernetes Clusters must be configured with labels, which means the attribute 'resource_labels' must be defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17 2 47" name: create a cluster1 google.cloud.gcpcontainercluster: name: my-cluster1 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a cluster2 google.cloud.gcpcontainercluster: name: my-cluster3 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present resource_labels: name: create a cluster3 google.cloud.gcpcontainercluster: name: my-cluster3 initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present resource_labels: "" ``` ```yaml title="Negative test num. 1 - yaml file" name: create a cluster google.cloud.gcpcontainercluster: name: my-cluster initialnodecount: 2 master_auth: username: cluster_admin password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present resource_labels: label1 ```
Project: Meshery (Provisioning / Automation & Configuration)
File: 10-11-2022-22-24-10_79781888.md

timestamp: "2022-10-11 22:24:21 UTC Tue" meshery-component: meshery-consul meshery-component-version: v0.6.4 meshery-server-version: "v0.6.15" k8s-distro: minikube k8s-version: "v1.20.11" service-mesh: Consul service-mesh-version: "v0.49.0" tests: consul-client: null consul-server: null overall-status: "failing"
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: mllib-guide.md

layout: global title: "MLlib: RDD-based API" displayTitle: "MLlib: RDD-based API" license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. This page documents sections of the MLlib guide for the RDD-based API (the `spark.mllib` package). Please see the for the DataFrame-based API (the `spark.ml` package), which is now the primary API for MLlib. * * * * * * * * * * * * * *
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: shm-size.md

Size of /dev/shm. A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes). If the unit is omitted, the system uses bytes. If the size is omitted, the default is 64m. When size is 0, there is no limit on the amount of memory used for IPC by the <<container|pod>>. This option conflicts with --ipc=host.