cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: acfdbec6-4a17-471f-b412-169d77553332.md

title: Google Container Node Pool Auto Repair Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: acfdbec6-4a17-471f-b412-169d77553332 Query name: Google Container Node Pool Auto Repair Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Google Container Node Pool Auto Repair should be enabled. This service periodically checks for failing nodes and repairs them to ensure a smooth running state.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="19 15" resource "googlecontainercluster" "positive1" { name = "my-gke-cluster" location = "us-central1" removedefaultnode_pool = true initialnodecount = 1 } resource "googlecontainernode_pool" "positive2" { name = "my-node-pool" location = "us-central1" cluster = googlecontainercluster.primary.name node_count = 1 management { auto_repair = false } } resource "googlecontainernode_pool" "positive3" { name = "my-node-pool" location = "us-central1" cluster = googlecontainercluster.primary.name node_count = 1 } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecontainercluster" "negative1" { name = "my-gke-cluster" location = "us-central1" removedefaultnode_pool = true initialnodecount = 1 } resource "googlecontainernode_pool" "negative2" { name = "my-node-pool" location = "us-central1" cluster = googlecontainercluster.primary.name node_count = 1 management { auto_repair = true } } ```
Project: ClickHouse (App Definition and Development / Database)
File: v22.3.7.28-lts.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Fix unexpected errors with a clash of constant strings in aggregate function, prewhere and join. Close . (). Backported in : Fix logical error in normalizeUTF8 functions. Closes . (). Backported in : Fix segmentation fault in `show create table` from mysql database when it is configured with named collections. Closes . (). Backported in : Fix setting castipv4ipv6defaultonconversionerror for internal cast function. Closes . (). Backported in : Fix check asof join key nullability, close . (). Backported in : Fix bug in indexes of not presented columns in -WithNames formats that led to error `INCORRECTNUMBEROF_COLUMNS ` when the number of columns is more than 256. Closes . (). Backported in : Server might fail to start if it cannot resolve hostname of external ClickHouse dictionary. It's fixed. Fixes . (). Backported in : Fix bug in clickhouse-keeper which can lead to corrupted compressed log files in case of small load and restarts. (). Backported in : Fixed problem with infs in `quantileTDigest`. Fixes . (). Fix mongodb test with new cert (). Integration tests (). Update protobuf files for kafka and rabbitmq (). Try fix `testgrpcprotocol/test.py::test_progress` ().
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_bench_tpch.md

title: kbcli bench tpch Run tpch benchmark ``` kbcli bench tpch [Step] [BenchmarkName] [flags] ``` ``` kbcli bench tpch mytest --cluster mycluster --user xxx --password xxx --database mydb kbcli bench tpch run mytest --cluster mycluster --user xxx --password xxx --database mydb ``` ``` --cluster string the cluster of database --database string database name --driver string the driver of database --extra-args strings extra arguments for benchmark -h, --help help for tpch --host string the host of database --password string the password of database --port int the port of database --tolerations strings Tolerations for benchmark, such as '"dev=true:NoSchedule,large=true:NoSchedule"' --user string the user of database ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server ``` - Run a benchmark.
Project: Meshery (Provisioning / Automation & Configuration)
File: vault-secrets.md

layout: integration title: Vault Secrets subtitle: Collaborative and visual infrastructure as code for Vault Secrets image: /assets/img/integrations/vault-secrets/icons/color/vault-secrets-color.svg permalink: extensibility/integrations/vault-secrets docURL: https://docs.meshery.io/extensibility/integrations/vault-secrets description: integrations-category: Provisioning integrations-subcategory: Key Management registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: YDB (App Definition and Development / Database)
File: decommissioning.md

Decommissioning is the procedure for moving a VDisk from a PDisk that needs to be decommissioned. Data is moved to PDisk clusters where there is enough free space to create new slots. Moving is performed only when there is a possibility of moving with at least partial preservation of the failure model. It may happen that the system can't strictly follow the failure model during decommissioning. However, it does its best to ensure fault-tolerance as fully as under normal operation. For example, when encoding `mirror-3-dc`, a situation may arise when a group is located in four rather than three data centers. Decommissioning is done asynchronously, meaning that data is not moved immediately while handling the command. If the failure model allows, SelfHeal moves slots one by one in the background to completely release the specified PDisks. To manage the state of decommissioning, set the `DecommitStatus` parameter for the appropriate PDisk. The parameter can take the following values: `DECOMMIT_NONE`: The disk is not being decommissioned and is running normally, according to its condition. `DECOMMIT_PENDING`: Disk decommissioning is scheduled. Data is not transferred from the disk. However, slots for new groups won't be created and the slots of the previously created groups won't be moved. `DECOMMITIMMINENT`: Disk decommissioning is required. Data is transferred in the background to disks that have the `DECOMMITNONE` status and satisfy the failure model. The `DECOMMITPENDING` and `DECOMMITIMMINENT` values shouldn't be removed under normal decommissioning, since the equipment is removed from the cluster by running the `DefineBox` command. To cancel decommissioning, just change the disk status to `DECOMMITNONE`. In this case, BSCONTROLLER won't take any additional actions: the previously moved VDisks remain where they are. To return them, you can use commands to move slots point by point, depending on the specific situation. By managing the `DECOMMITPENDING` and `DECOMMITIMMINENT` states, you can perform cluster decommissioning in parts. For example, you need to move equipment from data center-1 (DC-1) to data center-2 (DC-2): The DC-2 hosts buffer equipment to transfer the first chunk of data to. Switch the status of all DC-1 disks to `DECOMMIT_PENDING` so that no data can be moved inside the DC-1. Switch the status of all DC-1 disks to `DECOMMIT_IMMINENT` on the equipment that is equivalent to the buffer one. Wait until all the disks in the `DECOMMIT_IMMINENT` status are released. Move the released equipment from the DC-1 to the DC-2 and switch the status of its disks to `DECOMMIT_NONE`. Repeat the above steps for the next set of equipment in the DC-1 until all the equipment is moved. To set the desired state of disk decommissioning, use the utility. The command below sets the `DECOMMIT_IMMINENT` status for the disk with the ID `1000` on the node with the ID `1`: ```bash ydb-dstool -e <bsendpoint> pdisk set --decommit-status DECOMMITIMMINENT --pdisk-ids "[1:1000]" ```
Project: Flink (App Definition and Development / Streaming & Messaging)
File: system_functions.md

title: "System (Built-in) Functions" weight: 32 type: docs aliases: /dev/python/table-api-users-guide/builtinfunctions.html <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <meta http-equiv="refresh" content="0; url={{< ref "docs/dev/table/functions/systemfunctions" >}} "/>
Project: SPIRE (Provisioning / Key Management)
File: README.md

This suite sets up a Kubernetes cluster using , installs HashiCorp Vault. It then asserts the following: PKI tree ```mermaid flowchart TD subgraph Vault PKI Secret Engine A[Vault PKI Root CA] --> B[Vault PKI Intermediate CA] end B --> C[SPIRE Intermediate CA] C --> D[Leaf X509 SVID] ``` SPIRE server successfully requests an intermediate CA from the referenced Vault PKI Secret Engine Verifies that Auth Methods are configured successfully Verifies that obtained identities have been signed by that intermediate CA, and the Vault PKI Secret Engine is the root of trust
Project: KICS (Provisioning / Security & Compliance)
File: 37cca703-b74c-48ba-ac81-595b53398e9b.md

title: API Gateway Cache Encrypted Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 37cca703-b74c-48ba-ac81-595b53398e9b Query name: API Gateway Cache Encrypted Disabled Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: 'API::Gateway::Deployment' should have 'CacheDataEncrypted' enabled when 'CachingEnabled' is set to true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" Resources: Deployment: Type: 'AWS::ApiGateway::Deployment' Properties: RestApiId: !Ref MyApi Description: My deployment StageName: DummyStage StageDescription: CachingEnabled: true ``` ```json title="Positive test num. 2 - json file" hl_lines="11" { "Resources": { "Deployment": { "Type": "AWS::ApiGateway::Deployment", "Properties": { "RestApiId": { "Ref": "MyApi" }, "Description": "My deployment", "StageName": "DummyStage", "StageDescription": { "CachingEnabled": true } } } } } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="9" Resources: Deployment: Type: 'AWS::ApiGateway::Deployment' Properties: RestApiId: !Ref MyApi Description: My deployment StageName: DummyStage StageDescription: CacheDataEncrypted: false CachingEnabled: true ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="12" { "Resources": { "Deployment": { "Type": "AWS::ApiGateway::Deployment", "Properties": { "RestApiId": { "Ref": "MyApi" }, "Description": "My deployment", "StageName": "DummyStage", "StageDescription": { "CacheDataEncrypted": false, "CachingEnabled": true } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Resources: Deployment: Type: 'AWS::ApiGateway::Deployment' Properties: RestApiId: !Ref MyApi Description: My deployment StageName: DummyStage StageDescription: CacheDataEncrypted: true CachingEnabled: true ``` ```json title="Negative test num. 2 - json file" { "Resources": { "Deployment": { "Type": "AWS::ApiGateway::Deployment", "Properties": { "RestApiId": { "Ref": "MyApi" }, "Description": "My deployment", "StageName": "DummyStage", "StageDescription": { "CacheDataEncrypted": true, "CachingEnabled": true } } } } } ```
Project: KICS (Provisioning / Security & Compliance)
File: 86b97bb4-85c9-462d-8635-cbc057c5c8c5.md

title: Allow Unsafe Lookups Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 86b97bb4-85c9-462d-8635-cbc057c5c8c5 Query name: Allow Unsafe Lookups Enabled Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: When enabled, this option allows lookup plugins to return data that is not marked 'unsafe'.<br> ```cfg title="Positive test num. 1 - cfg file" hl_lines="19" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become fact_caching=memory factcachingprefix=ansible_facts factcachingtimeout=86400 collectionsonansibleversionmismatch=warning collections_path=~/.ansible/collections:/usr/share/ansible/collections collectionsscansys_path=True command_warnings=False action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action allowunsafelookups=True ``` ```cfg title="Negative test num. 1 - cfg file" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become fact_caching=memory factcachingprefix=ansible_facts factcachingtimeout=86400 collectionsonansibleversionmismatch=warning collections_path=~/.ansible/collections:/usr/share/ansible/collections collectionsscansys_path=True command_warnings=False action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action allowunsafelookups=False ``` ```cfg title="Negative test num. 2 - cfg file" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become fact_caching=memory factcachingprefix=ansible_facts factcachingtimeout=86400 collectionsonansibleversionmismatch=warning collections_path=~/.ansible/collections:/usr/share/ansible/collections collectionsscansys_path=True command_warnings=False action_plugins=~/.ansible/plugins/action:/usr/share/ansible/plugins/action ```
Project: BigchainDB (App Definition and Development / Database)
File: reverse-proxy-notes.md

<! Copyright 2020 Interplanetary Database Association e.V., BigchainDB and IPDB software contributors. SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0) Code is Apache-2.0 and docs are CC-BY-4.0 > You may want to: rate limit inbound HTTP requests, authenticate/authorize inbound HTTP requests, block requests with an HTTP request body that's too large, or enable HTTPS (TLS) between your users and your node. While we could have built all that into BigchainDB Server, we didn't, because you can do all that (and more) using a reverse proxy such as NGINX or HAProxy. (You would put it in front of your BigchainDB Server, so that all inbound HTTP requests would arrive at the reverse proxy before maybe being proxied onwards to your BigchainDB Server.) For detailed instructions, see the documentation for your reverse proxy. Below, we note how a reverse proxy can be used to do some BigchainDB-specific things. You may also be interested in (open source, on GitHub). The BigchainDB HTTP API has several endpoints, but only one of them, the `POST /transactions` endpoint, expects a non-empty HTTP request body: the transaction being submitted by the user. If you want to enforce a maximum-allowed transaction size (discarding any that are larger), then you can do so by configuring a maximum request body size in your reverse proxy. For example, NGINX has the `clientmaxbody_size` configuration setting. You could set it to 15 kB with the following line in your NGINX config file: ```text clientmaxbody_size 15k; ``` For more information, see . Note: By enforcing a maximum transaction size, you .
Project: KICS (Provisioning / Security & Compliance)
File: 01d5a458-a6c4-452a-ac50-054d59275b7c.md

title: ELB With Security Group Without Outbound Rules hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 01d5a458-a6c4-452a-ac50-054d59275b7c Query name: ELB With Security Group Without Outbound Rules Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: An AWS Elastic Load Balancer (ELB) shouldn't have security groups without outbound rules<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" AWSTemplateFormatVersion: 2010-09-09 Resources: sgwithoutegress: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Limits security group egress traffic MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: SecurityGroups: sgwithoutegress ``` ```json title="Positive test num. 2 - json file" hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "sgwithoutegress": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Limits security group egress traffic" } }, "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "SecurityGroups": [ "sgwithoutegress" ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: sgwithegress: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Limits security group egress traffic SecurityGroupEgress: IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: 0.0.0.0/0 MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: SecurityGroups: sgwithegress ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "sgwithegress": { "Properties": { "GroupDescription": "Limits security group egress traffic", "SecurityGroupEgress": [ { "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "CidrIp": "0.0.0.0/0" } ] }, "Type": "AWS::EC2::SecurityGroup" }, "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "SecurityGroups": [ "sgwithegress" ] } } } } ```
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.Settings.md

/ / Settings .Settings getOrSetPreference(`key`, `defaultValue`): `Promise`<`string`\> | Name | Type | | :- | :- | | `key` | `string` | | `defaultValue` | `string` \| () => `string` \| `Promise`<`string`\> | `Promise`<`string`\> `Const` getPreference(`key`): `Promise`<`string`\> Get a persisted preference | Name | Type | | :- | :- | | `key` | `string` | `Promise`<`string`\> the preference value `Const` setPreference(`key`, `value`): `Promise`<`string`\> Set a persisted preference | Name | Type | | : | :- | | `key` | `string` | | `value` | `string` | `Promise`<`string`\> the preference value uiThemes(): `Promise`<`ThemeSet`[]\> `Promise`<`ThemeSet`[]\> `Const` userDataDir(): `string` Get the userdata directory `string`
Project: Druid (App Definition and Development / Database)
File: orc.md

id: orc title: "ORC Extension" <!-- ~ Licensed to the Apache Software Foundation (ASF) under one ~ or more contributor license agreements. See the NOTICE file ~ distributed with this work for additional information ~ regarding copyright ownership. The ASF licenses this file ~ to you under the Apache License, Version 2.0 (the ~ "License"); you may not use this file except in compliance ~ with the License. You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, ~ software distributed under the License is distributed on an ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ~ KIND, either express or implied. See the License for the ~ specific language governing permissions and limitations ~ under the License. --> This Apache Druid extension enables Druid to ingest and understand the Apache ORC data format. The extension provides the and the for and , respectively. Please see corresponding docs for details. To use this extension, make sure to `druid-orc-extensions` in the extensions load list. This extension, first available in version 0.15.0, replaces the previous 'contrib' extension which was available until 0.14.0-incubating. While this extension can index any data the 'contrib' extension could, the JSON spec for the ingestion task is incompatible, and will need modified to work with the newer 'core' extension. To migrate to 0.15.0+: In `inputSpec` of `ioConfig`, `inputFormat` must be changed from `"org.apache.hadoop.hive.ql.io.orc.OrcNewInputFormat"` to `"org.apache.orc.mapreduce.OrcInputFormat"` The 'contrib' extension supported a `typeString` property, which provided the schema of the ORC file, of which was essentially required to have the types correct, but notably not the column names, which facilitated column renaming. In the 'core' extension, column renaming can be achieved with . For example, `"typeString":"struct<time:string,name:string>"` with the actual schema `struct<col0:string,col1:string>`, to preserve Druid schema would need replaced with: ```json "flattenSpec": { "fields": [ { "type": "path", "name": "time", "expr": "$._col0" }, { "type": "path", "name": "name", "expr": "$._col1" } ] ... } ``` The 'contrib' extension supported a `mapFieldNameFormat` property, which provided a way to specify a dimension to flatten `OrcMap` columns with primitive types. This functionality has also been replaced with . For example: `"mapFieldNameFormat": "<PARENT>_<CHILD>"` for a dimension `nestedData_dim1`, to preserve Druid schema could be replaced with ```json "flattenSpec": { "fields": [ { "type": "path", "name": "nestedData_dim1", "expr": "$.nestedData.dim1" } ] ... } ```