cwielenb/CNCF-Dataset huggingface dataset:
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: e5.4.1.en.md

Resolved compatibility issues with Open Telemetry configurations defined in `emqx.conf` from versions before EMQX 5.4.0, ensuring smooth integration of legacy configurations with the latest EMQX release. Fixed client ID generation in MQTT broker data integration to comply with MQTT 3.1 specification of 23-byte limit. Client ID is now prefixed with user-assigned connector name, followed by the first 8 bytes of node name's SHA hash and pool member ID. If the resulting ID exceeds 23 bytes, additional SHA hash and truncation are applied to ensure compliance. Resolved compatibility issue with the error format configurations introduced in the HTTP Action feature of EMQX version 5.3.2. Modified the `/file_transfer` API to return file transfer configurations in their original raw format. This change prevents the conversion of time units, such as "1h", to seconds, ensuring that callers receive the initially configured values. This modification aligns with other getter APIs, maintaining consistency in data representation. Fixed a bug where configuring additional HTTP headers for S3 API interactions disrupted file transfers using the S3 storage backend, ensuring stable and uninterrupted file transfer operations. Stopped exposing port 11883 by default in Docker and removed it from Helm charts, as this port is no longer in use. Fixed an issue in the `/configs` API where attempting to modify a read-only configuration value resulted in a garbled response message. Resolved an issue where the `filetransfer` configuration's `secretaccess_key` value was erroneously being updated to masked stars (`*`), ensuring that the original key value remains unaltered and secure. Fixed an issue that prevented establishing connections to MySQL resources without a password. Fix rolling upgrade when replica nodes join cluster with core nodes prior to version 5.4.
Project: KICS (Provisioning / Security & Compliance)
File: 2f06d22c-56bd-4f73-8a51-db001fcf2150.md

title: BOM - GCP SB hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2f06d22c-56bd-4f73-8a51-db001fcf2150 Query name: BOM - GCP SB Platform: Terraform Severity: <span style="color:#CCCCCC">Trace</span> Category: Bill Of Materials URL: A list of Storage Bucket resources found. Buckets are the basic containers that hold your data. Everything that you store in Cloud Storage must be contained in a bucket.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="35 21 7" resource "googlestoragebucketaccesscontrol" "public_rule" { bucket = googlestoragebucket.bucket.name role = "READER" entity = "allUsers" } resource "googlestoragebucket" "bucket" { name = "static-content-bucket" location = "US" } resource "googlestoragebucketiambinding" "binding" { bucket = googlestoragebucket.bucket2.name role = "roles/storage.admin" members = [ "allUsers", ] } resource "googlestoragebucket" "bucket2" { name = "static-content-bucket" location = "US" encryption { defaultkmskey_name = "somekey" } } resource "googlestoragebucketiammember" "member" { bucket = googlestoragebucket.bucket3.name role = "roles/storage.admin" member = "user:jane@example.com" } resource "googlestoragebucket" "bucket3" { name = "static-content-bucket" location = "US" } ``` ```tf title="Negative test num. 1 - tf file" resource "googlebigquerydataset" "negative1" { datasetid = "exampledataset" friendly_name = "test" description = "This is a test description" location = "EU" defaulttableexpiration_ms = 3600000 labels = { env = "default" } access { role = "OWNER" userbyemail = googleserviceaccount.bqowner.email } access { role = "READER" domain = "hashicorp.com" } } ```
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: rbac.md

User: ```yaml name: user userRoles: ["app-developer"] ... ``` ProjectUser: ```yaml username: user project: demo userRoles: ["app-developer"] ``` Role: ```yaml name: app-developer project: demo permissions: ["app-manage"] ``` ```yaml name: admin permissions: ["all"] ``` Permission: ```yaml name: app-manage project: demo resource: ["project:demo/application:*"] actions: ["*"] effect: Allow principal: {} condition: {} ``` ```yaml name: app1-manage project: demo resource: ["project:demo/application:app1/*"] actions: ["*"] effect: Allow principal: {} condition: {} name: app2-manage project: demo resource: ["project:demo/application:app2/*"] actions: ["*"] effect: Allow principal: {} condition: {} ``` ```yaml name: cluster-manage resource: ["cluster:*"] actions: ["*"] effect: Allow principal: {} condition: {} ``` ```yaml name: cluster-beijing-manage resource: ["cluster:beijing"] actions: ["*"] effect: Allow principal: {} condition: {} ``` ```yaml name: all resource: ["*"] actions: ["*"] effect: Allow principal: {} condition: {} ``` PermissionTemplate: ```yaml name: app-manage resource: ["project:${projectName}/application:*"] actions: ["*"] level: project effect: Allow principal: {} condition: {} ``` ```yaml name: deny-delete-cluster resource: ["cluster:*"] actions: ["delete"] level: platform effect: Deny ```
Project: ClickHouse (App Definition and Development / Database)
File: v21.8.14.5-lts.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Server might fail to start if database with `MySQL` engine cannot connect to MySQL server, it's fixed. Fixes . (). Backported in : Fix hdfs url check that didn't allow using HA namenode address. Bug was introduced in https://github.com/ClickHouse/ClickHouse/pull/31042. (). Backported in : Fix s3 table function reading empty file. Closes . ().
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: stress-fault.md

title: Simulate stress faults description: Simulate stress faults sidebar_position: 8 sidebar_label: Simulate stress faults StressChaos experiments simulate stress scenarios inside containers. This document describes how to create StressChaos experiments. | Option | Description | Default value | Required | | :-- | : | : | :- | | `--cpu-worker` | It specifies the number of threads that exert CPU stress. One of `--cpu-worker` and `--memory-worker` must be specified. | None | No | | `--cpu-load` | It specifies the percentage of occupied CPU. `0` means no extra load added and `100` means full load. The total load is workers * load. | 20 | No | | `--memory-worker` | It specifies the number of threads that exert memory pressure. One of `--cpu-worker` and `--memory-worker` must be specified. | None | No | | `--memory-size` | It specifies the size of the allocated memory or the percentage of the total memory occupied, and the sum of the allocated memory is size. | None | No | | `--container` | It specifies a container name and multiple containers can be specified. If not specified, it defaults to the first container in the Pod. | None | No | The command below creates a process in the first container of all pods in the default namespace and continuously allocates and reads and writes in CPU and memory, occupying up to 100 MB of memory for 10 seconds. During this process, 2 threads exert CPU stress and 1 thread that exerts memory stress. ```bash kbcli fault stress --cpu-worker=2 --cpu-load=50 --memory-worker=1 --memory-size=100Mi ``` This section introduces the YAML configuration file examples. You can view the YAML file by adding `--dry-run` at the end of the above kbcli commands. Meanwhile, you can also refer to the for details. Write the experiment configuration to the `stress.yaml` file. In the following example, Chaos Mesh creates a process in the first container of all pods in the default namespace and continuously allocates and reads and writes in CPU and memory, occupying up to 100MB of memory for 10 seconds. During this process, 2 threads exert CPU stress and 1 thread that exerts memory stress. ```yaml apiVersion: chaos-mesh.org/v1alpha1 kind: StressChaos metadata: creationTimestamp: null generateName: stress-chaos- namespace: default spec: duration: 10s mode: all selector: namespaces: default stressors: cpu: load: 50 workers: 2 memory: size: 100Mi workers: 1 ``` Run `kubectl` to start an experiment. ```bash kubectl apply -f ./stress.yaml ```
Project: ClickHouse (App Definition and Development / Database)
File: attach.md

slug: /en/sql-reference/statements/attach sidebar_position: 40 sidebar_label: ATTACH title: "ATTACH Statement" Attaches a table or a dictionary, for example, when moving a database to another server. Syntax ``` sql ATTACH TABLE|DICTIONARY|DATABASE [IF NOT EXISTS] [db.]name [ON CLUSTER cluster] ... ``` The query does not create data on the disk, but assumes that data is already in the appropriate places, and just adds information about the specified table, dictionary or database to the server. After executing the `ATTACH` query, the server will know about the existence of the table, dictionary or database. If a table was previously detached ( query), meaning that its structure is known, you can use shorthand without defining the structure. Syntax ``` sql ATTACH TABLE [IF NOT EXISTS] [db.]name [ON CLUSTER cluster] ``` This query is used when starting the server. The server stores table metadata as files with `ATTACH` queries, which it simply runs at launch (with the exception of some system tables, which are explicitly created on the server). If the table was detached permanently, it won't be reattached at the server start, so you need to use `ATTACH` query explicitly. The query creates a new table with provided structure and attaches table data from the provided directory in `user_files`. Syntax ```sql ATTACH TABLE name FROM 'path/to/data/' (col1 Type1, ...) ``` Example Query: ```sql DROP TABLE IF EXISTS test; INSERT INTO TABLE FUNCTION file('01188_attach/test/data.TSV', 'TSV', 's String, n UInt8') VALUES ('test', 42); ATTACH TABLE test FROM '01188_attach/test' (s String, n UInt8) ENGINE = File(TSV); SELECT * FROM test; ``` Result: ```sql sn test 42 ``` This query creates a new table with provided structure and attaches data from the table with the specified UUID. It is supported by the database engine. Syntax ```sql ATTACH TABLE name UUID '<uuid>' (col1 Type1, ...) ``` Attaches a previously detached dictionary. Syntax ``` sql ATTACH DICTIONARY [IF NOT EXISTS] [db.]name [ON CLUSTER cluster] ``` Attaches a previously detached database. Syntax ``` sql ATTACH DATABASE [IF NOT EXISTS] name [ENGINE=<database engine>] [ON CLUSTER cluster] ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: postfix_conf.md

+++ title = "postfix_conf resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "postfix_conf" identifier = "inspec/resources/os/postfixconf.md postfixconf resource" parent = "inspec/resources/os" +++ Use the `postfix_conf` Chef InSpec audit resource to test the main configuration of the Postfix Mail Transfer Agent. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} A `postfix_conf` resource block declares the configuration settings to be tested: describe postfix_conf do its('setting_name') { should cmp 'value' } end where `'setting_name'` is a setting key defined in main.cf `{ should cmp 'value' }` is the value to be expected When using `postfix_conf` with a custom configuration directory, the following syntax can be used: describe postfix_conf('path') do ... end where `'path'` is the path to your Postfix configuration (ex. '/etc/path/to/postfix/main.cf') This resource supports any of the settings listed in the main.cf file as properties. The following examples show how to use this Chef InSpec audit resource. For example, the following Postfix configuration: /etc/postfix/main.cf: myorigin = $myhostname myhostname = host.local.domain mynetworks = 127.0.0.0/8 can be tested like this: describe postfix_conf do its('myorigin') { should cmp '$myhostname' } its('myhostname') { should cmp 'host.local.domain' } its('mynetworks') { should cmp '127.0.0.0/8' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: KICS (Provisioning / Security & Compliance)
File: fa62ac4f-f5b9-45b9-97c1-625c8b6253ca.md

title: Role With Privilege Escalation By Actions 'lambda:CreateFunction' And 'iam:PassRole' And 'lambda:InvokeFunction' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: fa62ac4f-f5b9-45b9-97c1-625c8b6253ca Query name: Role With Privilege Escalation By Actions 'lambda:CreateFunction' And 'iam:PassRole' And 'lambda:InvokeFunction' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Role with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamrole" "cosmic" { name = "cosmic" } resource "awsiamrolepolicy" "testinline_policy" { name = "testinlinepolicy" role = awsiamrole.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "lambda:CreateFunction", "lambda:InvokeFunction" ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" roles = [awsiamrole.cosmic.name] policyarn = awsiam_policy.policy.arn } resource "awsiampolicy" "policy" { name = "test-policy" description = "A test policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:PassRole", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: delete-mysql-cluster.md

title: Delete a MySQL Cluster description: How to delete a MySQL Cluster keywords: [mysql, delete a cluster] sidebar_position: 7 sidebar_label: Delete protection import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; :::note The termination policy determines how you delete a cluster. ::: | terminationPolicy | Deleting Operation | |:-|:-| | `DoNotTerminate` | `DoNotTerminate` blocks delete operation. | | `Halt` | `Halt` deletes workload resources such as statefulset, deployment workloads but keep PVCs. | | `Delete` | `Delete` deletes workload resources and PVCs but keep backups. | | `WipeOut` | `WipeOut` deletes workload resources, PVCs and all relevant resources included backups. | To check the termination policy, execute the following command. <Tabs> <TabItem value="kbcli" label="kbcli" default> ```bash kbcli cluster list mysql-cluster NAME NAMESPACE CLUSTER-DEFINITION VERSION TERMINATION-POLICY STATUS CREATED-TIME mysql-cluster default apecloud-mysql ac-mysql-8.0.30 Delete Running Feb 06,2023 18:27 UTC+0800 ``` </TabItem> <TabItem value="kubectl" label="kubectl"> ```bash kubectl -n demo get cluster mysql-cluster NAME CLUSTER-DEFINITION VERSION TERMINATION-POLICY STATUS AGE mysql-cluster apecloud-mysql ac-mysql-8.0.30 Delete Running 67m ``` </TabItem> </Tabs> Run the command below to delete a specified cluster. <Tabs> <TabItem value="kbcli" label="kbcli" default> ```bash kbcli cluster delete mysql-cluster ``` </TabItem> <TabItem value="kubectl" label="kubectl"> If you want to delete a cluster and its all related resources, you can modify the termination policy to `WipeOut`, then delete the cluster. ```bash kubectl patch -n demo cluster mysql-cluster -p '{"spec":{"terminationPolicy":"WipeOut"}}' --type="merge" kubectl delete -n demo cluster mysql-cluster ``` </TabItem> </Tabs>
Project: Hexa (Provisioning / Security & Compliance)
File: CODE_OF_CONDUCT.md

We commit to the following guidelines as members of the Hexa community. Foster an open and welcoming community. Each individual contributor adds unique value to the forward momentum of Hexa. Treat all members and contributors with dignity, kindness, and respect. Promote diversity, equity and inclusion in our community. Actively work to grow the community through new contributors. Zero tolerance for abusive and hurtful language as well as discriminatory actions and behaviors. Build a community that supports one another and is willing to stand up for others by reporting inappropriate actions to Hexa staff and the CNCF. Welcome and share open, honest, and constructive feedback without any fear of dismissive or retaliatory behaviors. Ensure that all uses of Hexa and the IDQL protocol are both legal and ethical while also prioritizing the security and privacy of users identity data. Have fun building both Hexa and the IDQL protocol. Improve the everyday experiences of users, developers, administrators, and the organizations they represent.
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: keep-legacy-resources.md

Suppose you want to keep the resources created by the old version of the app. You only need to specify garbage-collect in the policy field of the app and enable the option `keepLegacyResource`. ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: first-vela-app spec: components: name: express-server type: webservice properties: image: crccheck/hello-world port: 8000 traits: type: ingress-1-20 properties: domain: testsvc.example.com http: "/": 8000 policies: name: keep-legacy-resource type: garbage-collect properties: keepLegacyResource: true ``` create app ``` shell kubectl apply -f app.yaml ``` ```shell $ kubectl get app NAME COMPONENT TYPE PHASE HEALTHY STATUS AGE first-vela-app express-server webservice running true 29s ``` update the app ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: first-vela-app spec: components: name: express-server-1 type: webservice properties: image: crccheck/hello-world port: 8000 traits: type: ingress-1-20 properties: domain: testsvc.example.com http: "/": 8000 policies: name: keep-legacy-resource type: garbage-collect properties: keepLegacyResource: true ``` ``` shell kubectl apply -f app1.yaml ``` ```shell $ kubectl get app NAME COMPONENT TYPE PHASE HEALTHY STATUS AGE first-vela-app express-server-1 webservice running true 9m35s ``` check whether legacy resources are reserved. ``` $ kubectl get deploy NAME READY UP-TO-DATE AVAILABLE AGE express-server 1/1 1 1 10m express-server-1 1/1 1 1 40s ``` ``` $ kubectl get svc NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE express-server ClusterIP 10.96.102.249 <none> 8000/TCP 10m express-server-1 ClusterIP 10.96.146.10 <none> 8000/TCP 46s ``` ``` $ kubectl get ingress NAME CLASS HOSTS ADDRESS PORTS AGE express-server <none> testsvc.example.com 80 10m express-server-1 <none> testsvc.example.com 80 50s ``` ``` $ kubectl get resourcetrackers.core.oam.dev NAME AGE first-vela-app-default 12m first-vela-app-v1-default 12m first-vela-app-v2-default 2m56s ``` delete the app ``` $ kubectl delete app first-vela-app ```
Project: EDB (App Definition and Development / Database)
File: networking.md

CloudNativePG assumes the underlying Kubernetes cluster has the required connectivity already set up. Networking on Kubernetes is an important and extended topic; please refer to the for further information. If you're following the quickstart guide to install CloudNativePG on a local KinD or K3d cluster, you should not encounter any networking issues as neither platform will add any networking restrictions by default. However, when deploying CloudNativePG on existing infrastructure, networking restrictions might be in place that could impair the communication of the operator with PostgreSQL clusters. Specifically, existing might restrict certain types of traffic. Or, you might be interested in adding network policies in your environment for increased security. As mentioned in the , please ensure the operator can reach every cluster pod on ports 8000 and 5432, and that pods can connect to each other. Following the quickstart guide or using helm chart for deployment will install the operator in a dedicated namespace (`cnpg-system` by default). We recommend that you create clusters in a different namespace. The operator must be able to connect to cluster pods. This might be precluded if there is a `NetworkPolicy` restricting cross-namespace traffic. For example, the contains an example policy denying all ingress traffic by default. If your local kubernetes setup has this kind of restrictive network policy, you will need to create a `NetworkPolicy` to explicitly allow connection from the operator namespace and pod to the cluster namespace and pods. You can find an example in the file in this repository. Please note, you'll need to adjust the cluster name and cluster namespace to match your specific setup, and also the operator namespace if it is not the default namespace. While from another cluster or when using the `externalClusters` section, ensure connectivity among all clusters, object stores, and namespaces involved. Again, we refer you to the for setup information.
Project: YugabyteDB (App Definition and Development / Database)
File: cr-bucket-using-width-bucket.md

title: crbucketusingwidthbucket.sql linkTitle: crbucketusingwidthbucket.sql headerTitle: crbucketusingwidthbucket.sql description: crbucketusingwidthbucket.sql - Part of the code kit for the "Analyzing a normal distribution" section within the YSQL window functions documentation. menu: v2.18: identifier: cr-bucket-using-width-bucket parent: analyzing-a-normal-distribution weight: 70 type: docs Save this script as `crbucketusingwidthbucket.sql`. ```plpgsql -- This approach subtracts a tiny value, epsilon, from the input value -- to change "width_bucket()"'s "closed-open" interval bucket semantics to -- the required "open-closed" interval bucket semantics. -- -- You might consider this to be a rather obscure and possibly risky trick. -- However, this implementation of "bucket()" does pass the rigorous -- acceptance test. create or replace function bucket( val in double precision, lower_bound in double precision default 0, upper_bound in double precision default 1, noofvalues in int default 10) returns int language plpgsql as $body$ begin declare one constant int := 1; zero constant double precision := 0; epsilon constant double precision := 0.0000000001; result constant int not null := case when val between zero and epsilon then one else widthbucket((val - epsilon), lowerbound, upperbound, noof_values) end; begin assert (result between one and noofvalues), 'bucket():'|| ' val '||val|| ' must be between lowerbound '||lowerbound|| ' and upperbound '||upperbound; return result; end; end; $body$; ```
Project: KICS (Provisioning / Security & Compliance)
File: 9ef7d25d-9764-4224-9968-fa321c56ef76.md

title: AWS Password Policy With Unchangeable Passwords hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9ef7d25d-9764-4224-9968-fa321c56ef76 Query name: AWS Password Policy With Unchangeable Passwords Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Unchangeable passwords in AWS password policy<br> ```tf title="Positive test num. 1 - tf file" hl_lines="12" resource "awssqsqueue" "positive1" { name = "examplequeue" } // comment resource "awsiamaccountpasswordpolicy" "positive2" { minimumpasswordlength = 8 requirelowercasecharacters = true require_numbers = true requireuppercasecharacters = true require_symbols = true allowuserstochangepassword = false } ``` ```tf title="Negative test num. 1 - tf file" resource "awssqsqueue" "negative1" { name = "examplequeue" } // comment resource "awsiamaccountpasswordpolicy" "negative2" { minimumpasswordlength = 10 requirelowercasecharacters = true require_numbers = true requireuppercasecharacters = true require_symbols = true allowuserstochangepassword = true } ```