cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 14abda69-8e91-4acb-9931-76e2bee90284.md

title: Image Policy Webhook Admission Control Plugin Not Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 14abda69-8e91-4acb-9931-76e2bee90284 Query name: Image Policy Webhook Admission Control Plugin Not Set Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Build Process URL: When using kube-apiserver command, the --enable-admission-plugins flag should have 'ImagePolicyWebhook' plugin and the plugin should be correctly configured in AdmissionControl Config file<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--enable-admission-plugins=AlwaysAdmit"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--enable-admission-plugins=ImagePolicyWebhook", "--admission-control-config-file=path/to/plugin/config/file.yaml"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver","--enable-admission-plugins=ImagePolicyWebhook", "--admission-control-config-file=path/to/plugin/config/file.yaml"] args: [] restartPolicy: OnFailure ```
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: question.md

name: Question about: Ask a question about Dapr title: '' labels: kind/question assignees: '' <!-- If you need to report a security issue please visit https://docs.dapr.io/operations/support/support-security-issues --> Note: If you have a general support question and are looking for a quicker response, please checkout our discord channel for answers from the community: https://aka.ms/dapr-discord <!-- Remove the '> ' to select --> /area runtime /area operator /area placement /area docs /area test-and-release
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-network-update.1.md

% podman-network-update 1 podman\-network\-update - Update an existing Podman network podman network update [options] network Allow changes to existing container networks. At present, only changes to the DNS servers in use by a network is supported. NOTE: Only supported with the netavark network backend. Accepts array of DNS resolvers and add it to the existing list of resolvers configured for a network. Accepts array of DNS resolvers and removes them from the existing list of resolvers configured for a network. Update a network: ``` $ podman network update network1 --dns-add 8.8.8.8,1.1.1.1 ``` Update a network and add/remove dns servers: ``` $ podman network update network1 --dns-drop 8.8.8.8 --dns-add 3.3.3.3 ``` , , ,
Project: Veinmind Tools (Provisioning / Security & Compliance)
File: veinmind-runner_scan_iac.md

Scan iac Scan iac from multi source, include host/git/kubernetes ``` veinmind-runner scan iac [flags] target ``` ``` scan host iac (current directory) veinmind-runner scan iac host:./ scan github kubernetes-sigs/kustomize repo iac veinmind-runner scan iac git:https://github.com/kubernetes-sigs/kustomize.git scan kubernetes pod iac veinmind-runner scan iac --kubeconfig admin.yaml kubernetes:pod use openai analyze result veinmind-runner scan iac --kubeconfig admin.yaml --enable-analyze --openai-token <youropenaitoken> kubernetes:pod use openai analyze result with yourself questions veinmind-runner scan iac --kubeconfig admin.yaml --enable-analyze --openai-token <youropenaitoken> -p "explain what happened at this json" kubernetes:pod ``` ``` -h, --help help for iac --iac-type string dedicate iac type for iac files -k, --kubeconfig string k8s config file -n, --namespace string k8s resource namespace (default "all") --proxy string proxy to git like: https://xxxxx or socks5://xxxx --sshkey string auth to git if use by ssh proto ``` ``` --enable-analyze auto use openai analyze result -e, --exit-code int exit-code when veinmind-runner find security issues --format string output format: html/json/cli (default "cli") -g, --glob string specifies the pattern of plugin file to find --insecure-skip skip tls config --openai-token string auto openai analyze openai_key -o, --output string output filepath of report -p, --prefix string training openai limit sentence --threads int threads for scan action (default 5) -v, --verbose output verbose detail ``` - Scan cloud native objects security, include image/container/iac
Project: YugabyteDB (App Definition and Development / Database)
File: verify-deployment.md

title: Verify deployment headerTitle: Verify deployment linkTitle: 5. Verify deployment description: Verify deployment of your YugabyteDB cluster menu: v2.18: identifier: deploy-manual-deployment-verify-deployment parent: deploy-manual-deployment weight: 615 type: docs You now have a cluster/universe on six nodes with a replication factor of `3`. Assume their IP addresses are `172.151.17.130`, `172.151.17.220`, `172.151.17.140`, `172.151.17.150`, `172.151.17.160`, and `172.151.17.170`. YB-Master servers are running on only the first three of these nodes. While the YCQL and YSQL APIs are turned on by default after all of the YB-TServers start, the Redis-compatible YEDIS API is off by default. If you want this cluster to be able to support Redis clients, run the following command from any of the 4 instances. The command adds the special Redis table into the DB and starts the YEDIS server on port 6379 on all instances. ```sh $ ./bin/yb-admin --masteraddresses 172.151.17.130:7100,172.151.17.220:7100,172.151.17.140:7100 setupredis_table ``` {{< note title="Note" >}} If you want this cluster to be able to support Redis clients, you must perform this step. {{< /note >}} You should now be able to view the master dashboard on the IP address of any master. In this example, this is one of the following URLs: `http://172.151.17.130:7000` `http://172.151.17.220:7000` `http://172.151.17.140:7000` {{< tip title="Tip" >}} If this is a public cloud deployment, remember to use the public IP for the nodes, or a HTTP proxy to view these pages. {{< /tip >}} Clients can connect to YSQL API at the following addresses: ```sh 172.151.17.130:5433,172.151.17.220:5433,172.151.17.140:5433,172.151.17.150:5433,172.151.17.160:5433,172.151.17.170:5433 ``` Clients can connect to YCQL API at the following addresses: ```sh 172.151.17.130:9042,172.151.17.220:9042,172.151.17.140:9042,172.151.17.150:9042,172.151.17.160:9042,172.151.17.170:9042 ``` Clients can connect to YEDIS API at the following addresses: ```sh 172.151.17.130:6379,172.151.17.220:6379,172.151.17.140:6379,172.151.17.150:6379,172.151.17.160:6379,172.151.17.170:6379 ``` The preceding deployment uses the following default ports: Service | Type | Port --|| - `yb-master` | RPC | 7100 `yb-master` | Admin web server | 7000 `yb-tserver` | RPC | 9100 `yb-tserver` | Admin web server | 9000 `ycql` | RPC | 9042 `ycql` | Admin web server | 12000 `yedis` | RPC | 6379 `yedis` | Admin web server | 11000 `ysql` | RPC | 5433 `ysql` | Admin web server | 13000 For more information on ports used by YugabyteDB, refer to .
Project: YDB (App Definition and Development / Database)
File: pq.md

A persistent queue consists of one or more partitions, where each partition is a ) ensuring reliable delivery between two or more components. Data messages have no type and are data blobs. Partitioning is a parallel processing tool that helps ensure high queue bandwidth. Mechanisms are provided to implement the "at least once" and the "exactly once" persistent queue delivery guarantees. A persistent queue in {{ ydb-short-name }} is similar to a topic in .
Project: StackRox (Provisioning / Security & Compliance)
File: 0007-redhat-cvss-scores.md

Author(s): Ross Tannenbaum Created: [2023-12-15 Fri] provides us with CVSS scores from NVD in the form of a Vulnerability Report enrichment. These scores may be inaccurate for Red Hat products, as Red Hat analyzes each CVE and, potentially, reassigns the CVSS score. For example: . There is currently work being done in ClairCore to , which will deprecate the . Though there are plans to expose Red Hat's CVSS scores once the adoption is complete, this work is not expected to be completed until after the StackRox 4.4 release is cut. So, we need a temporary solution. We want to minimize any divergences we have with upstream ClairCore, which means we do not want to fork the ClairCore repository. That being said, forking the repository is the simplest way to proceed here. Instead of a true, git fork, however, we opt to copy over the necessary files into the `scanner/` directory. This simplifies things, as we will not need to manage an entire forked repository. For the remainder of this document, we will still refer to this process as a fork. We know there is already an effort to replace the current with an implementation which supports CSAF and VEX files, and we know Red Hat Product Security is definitely moving away from the OVAL v2 feeds in favor of CSAF and VEX. Therefore, we are assured this is a temporary fork of the ClairCore repository. This fork provides us with the simplest path forward. There are no plans to create a Red Hat CVSS score enricher in upstream ClairCore at this time, and creating our own out-of-tree enricher will be time-consuming and tricky, as CVSS scores are potentially also product-dependent instead of just CVE-specific. The simplest path forward is to utilize a field of the which Scanner v4/StackRox does not plan on utilizing at this time: `Severity` (not to be mistaken for `NormalizedSeverity`). This idea was conceived a few months back, but was , as the team did not want to change the semantics of this field which may be used by consumers. For Scanner v4/StackRox, we know we are not using this field, so we do not mind overwriting it. As can be seen from the original pull request, implementing this is rather straightforward and quick to do. There is already work towards this effort . Again, we expect this to be temporary, as we know there is work in-progress to adopt CSAF and VEX files in favor of OVAL v2. Once ClairCore implements CSAF and VEX support, our fork will be deleted in favor of using the new upstream updater. There is always a risk this fork becomes more permanent than expected/desired. There is a very strong drive to ensure differences between upstream Clair/ClairCore and Scanner v4 are minimal, so should this happen, corrective action will need to be taken. The main annoyance is the requirement to maintain a fork of the upstream ClairCore repository (even though it's a subset). Any changes/fixes to ClairCore's current pre-VEX version will need to be ported to our repository.
Project: Trivy (Provisioning / Security & Compliance)
File: faq.md

`tri` is pronounced like trigger, `vy` is pronounced like envy. Check out the . If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering. You can find a high level comparison table specific to Trivy users . In addition check out the <https://aquasec.com> website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: <https://www.aquasec.com/demo> See . See . See .
Project: ArangoDB (App Definition and Development / Database)
File: exception_rvalue_const.md

+++ title = "`const exception_type &&exception() const &&`" description = "Wide contract const rvalue reference observer of the stored exception. Constexpr propagating." categories = ["observers"] weight = 788 +++ Wide contract const rvalue reference observer of the stored exception. `NoValuePolicy::wideexceptioncheck()` is first invoked, then the reference to the exception is returned. As a valid default constructed exception is always present, no undefined behaviour occurs if `NoValuePolicy::wideexceptioncheck()` returns. Note that if `exception_type` is `void`, only a `const` overload returning `void` is present. Requires: Always available. Complexity: Depends on `NoValuePolicy::wideexceptioncheck()`. Guarantees: None.
Project: KusionStack (Provisioning / Automation & Configuration)
File: kusion_init.md

Initialize the scaffolding for a project This command initializes the scaffolding for a project, generating a project from an appointed template with correct structure. The scaffold templates can be retrieved from local or online. The built-in templates are used by default, self-defined templates are also supported by assigning the template repository path. ``` kusion init ``` ``` kusion init kusion init --online=true kusion init https://github.com/<user>/<repo> --online=true kusion init /path/to/templates ``` ``` --custom-params string Custom params in JSON. If specified, it will be used as the template default value and skip prompts --force Force generating the scaffolding files, even if it would change the existing files -h, --help help for init --online Use templates from online repository to initialize project, or use locally cached templates --project-name string Initialize with specified project name. If not specified, a prompt will request it --template-name string Initialize with specified template. If not specified, a prompt will request it --yes Skip prompts and proceed with default values ``` ``` --profile string Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex) (default "none") --profile-output string Name of the file to write the profile to (default "profile.pprof") ``` - Kusion is the Platform Orchestrator of Internal Developer Platform - List templates used to initialize a project
Project: KubeEdge (Provisioning / Automation & Configuration)
File: CHANGELOG-1.1.md

* * * * | filename | Size | sha512 hash | | -- | - | -- | | | 76.3 MB | `f28aebb6ac26e859f8f2510987dd727e018a3c6cd3bdbb66464228cd2f32387cc4d216275cd3cba9c78216f143a611ad3b3c7e2bfc70648da6f73f46d6f85084` | | | 70.9 MB | `4fafd8447dca3466a42d145f3e229f186d8725b53ec6a51681b9f79cdda4b955bef7494c7b7a68513eccb9393383a50c850b76e3b678ae1da1b198b891d9e09e` | | filename | Size | sha512 hash | | -- | - | -- | | | 8.27 MB | `0f17124675adcb2396771b5ac872cf60b09b32e5d18ab5909c243c7a97adb56acd428e21df3073ec5df701ce08ae8dead98f7cd4b38e323cc9aed60c97c0df41` | | filename | Size | sha512 hash | | -- | - | -- | | | 27.4 MB | `a16d7f5e2f45ecb0f500f794c4f07ea74b2663bcac8008711a44b3cdea34d1f104f38c1c147ca90f3ab1ff7cf529d4445c1da34c3eff3386fc9b98f45ee173be` | | | 25.1 MB | `facef575c67759d234568fef16cf7d8e2797874520f845817b56372a45413448aa55a9014d33de5535dd7a73b4d521ad5ebdedaff9f147e838a7f8d2887f4bf4` | Container Storage Interface (CSI) support This feature enables running applications with persistent data store at edge and KubeEdge to support and is compatible with Kubernetes and CSI. Dynamic Admission Control Webhook Admission control webhook is an effective way of validating/mutating the object configuration for KubeEdge API objects like devicemodels, devices. Kubernetes Upgrade Upgrade the venderod kubernetes version to v1.15.3, so users can use the feature of new version on the cloud and on the edge side. KubeEdge local setup scripts A bash script that can start a KubeEdge cluster in a VM with cloudcore, edgecore binaries and kind. It uses kind to start K8s cluster and runs cloudcore, edgecore binaries as processes in a single VM. Reliable message delivery between cloud and edge is missing. There is no logic to partition the configmap containing multiple device models and device instances. Add New Feature: support dockershim in edged. (, ) Fix edge_core cannot connect to edgecontroller after disconnecting once (, ) Raspberry Pi3/4 cross build (, ) Upgrade to Kubernetes v1.15 (, ) Use go mod (, ) Rename device dir to mappers which places mappers (, ) New feature: L4 Proxy support in edgemesh (, ) Initialize feature lifecycle doc (, ) Change go version from go 1.11 to go 1.12 (, ) Add admission webhook for validate device CRD (, ) Rename edgecontroller to cloudcore (, ) Rename edge_core to edgecore (, ) Unifying logging library to klog (, ) Add in-tree csi plugin implementations (, ) Add csi driver from kubeedge (, ) Add local up kubeedge script (, ) Fix panic: concurrent write to websocket (, )
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-cloudwatch-controller.md

layout: integration title: AWS CloudWatch subtitle: Collaborative and visual infrastructure as code for AWS CloudWatch image: /assets/img/integrations/aws-cloudwatch-controller/icons/color/aws-cloudwatch-controller-color.svg permalink: extensibility/integrations/aws-cloudwatch-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-cloudwatch-controller description: integrations-category: Observability and Analysis integrations-subcategory: Management Governance registrant: GitHub components: name: field-export colorIcon: assets/img/integrations/aws-cloudwatch-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-cloudwatch-controller/components/field-export/icons/white/field-export-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-cloudwatch-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-cloudwatch-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: metric-alarm colorIcon: assets/img/integrations/aws-cloudwatch-controller/components/metric-alarm/icons/color/metric-alarm-color.svg whiteIcon: assets/img/integrations/aws-cloudwatch-controller/components/metric-alarm/icons/white/metric-alarm-white.svg description: featureList: [ "Provides you with data and actionable insights to monitor your applications, respond to system-wide performance changes, and optimize resource utilization.", "Collects monitoring and operational data in the form of logs, metrics, and traces.", "Get a unified view of operational health and gain complete visibility of your AWS resources, applications, and services running on AWS and on-premises." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Beam (App Definition and Development / Streaming & Messaging)
File: six-months.md

title: "Apache Beam: Six Months in Incubation" date: 2016-08-03 00:00:01 -0700 categories: blog aliases: /blog/2016/08/03/six-months.html authors: fjp <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> Its been just over six months since Apache Beam was formally accepted into incubation with the . As a community, weve been hard at work getting Beam off the ground. <!--more--> Looking just at raw numbers for those first six months, thats: 48,238 lines of preexisting code donated by Cloudera, dataArtisans, and Google. 761 pull requests from 45 contributors. 498 Jira issues opened and 245 resolved. 1 incubating release (and another 1 in progress). 4,200 hours of automated tests. 161 subscribers / 606 messages on user@. 217 subscribers / 1205 messages on dev@. 277 stars and 174 forks on GitHub. And behind those numbers, theres been a ton of technical progress, including: Refactoring of the entire codebase, examples, and tests to be truly runner-independent. New functionality in the Apache Flink runner for timestamps/windows in batch and bounded sources and side inputs in streaming mode. Work in progress to upgrade the Apache Spark runner to use Spark 2.0. Several new runners from the wider Apache community -- Apache Gearpump has its own feature branch, Apache Apex has a PR, and conversations are starting on Apache Storm and others. New SDKs/DSLs for exposing the Beam model -- the Python SDK from Google is in on a feature branch, and there are plans to add the Scio DSL from Spotify. Support for additional data sources and sinks -- Apache Kafka and JMS are in, there are PRs for Amazon Kinesis, Apache Cassandra, and MongoDB, and more connectors are being planned. But perhaps most importantly, were committed to building an involved, welcoming community. So far, weve: Started building a vibrant developer community, with detailed design discussions on features like DoFn reuse semantics, serialization technology, and an API for accessing state. Started building a user community with an active mailing list and improvements to the website and documentation. Had multiple talks on Beam at venues including ApacheCon, Hadoop Summit, Kafka Summit, JBCN Barcelona, and Strata. Presented at multiple existing meetups and are starting to organize some of our own. While its nice to reflect back on all weve done, were working full stream ahead towards a stable release and graduation from incubator. And wed love your help -- join the , check out the , and grab a ) from Jira!
Project: ClickHouse (App Definition and Development / Database)
File: v20.10.5.10-stable.md

Backported in : Make it possible to connect to `clickhouse-server` secure endpoint which requires SNI. This is possible when `clickhouse-server` is hosted behind TLS proxy. (). Backported in : fixes fixes fix remote query failure when using 'if' suffix aggregate function. (). Backported in : Fix crash when using `any` without any arguments. This is for . cc @azat. (). Backported in : Abort multipart upload if no data was written to WriteBufferFromS3. (). Backported in : Prevent clickhouse server crashes when using TimeSeriesGroupSum. (). Backported in : Fix possible error `Illegal type of argument` for queries with `ORDER BY`. Fixes . (). Backported in : Install script should always create subdirs in config folders. This is only relevant for Docker build with custom config. (). Backported in : Blame info was not calculated correctly in `clickhouse-git-import`. (). Backported in : Fix possible server crash after `ALTER TABLE ... MODIFY COLUMN ... NewType` when `SELECT` have `WHERE` expression on altering column and alter doesn't finished yet. (). Backported in : Reresolve the IP of the `formatavroschemaregistryurl` in case of errors. (). Backported in : Fixed wrong result in big integers (128, 256 bit) when casting from double. (). Backported in : Fix bug when `ON CLUSTER` queries may hang forever for non-leader ReplicatedMergeTreeTables. ().