cwielenb/CNCF-Dataset huggingface dataset:
Project: external-secrets (Provisioning / Security & Compliance)
File: senhasegura-dsm.md

External Secrets Operator integrates with module to sync application secrets to secrets held on the Kubernetes cluster. Authentication in senhasegura uses DevOps Secrets Management (DSM) application authorization schema You need to create an Kubernetes Secret with desired auth parameters, for example: Instructions to setup authorizations and secrets in senhasegura DSM can be found at and ```yaml {% include 'senhasegura-dsm-secret.yaml' %} ``` To sync secrets between senhasegura and Kubernetes with External Secrets, we need to define an SecretStore or ClusterSecretStore resource with senhasegura provider, setting authentication in DSM module with Secret defined before ``` yaml {% include 'senhasegura-dsm-secretstore.yaml' %} ``` ``` yaml {% include 'senhasegura-dsm-clustersecretstore.yaml' %} ``` In examples below, consider that three secrets (api-settings, db-settings and hsm-settings) are defined in senhasegura DSM Secret Identifier: api-settings Secret data: ```bash URL=https://example.com/api/example TOKEN=example-token-value ``` Secret Identifier: db-settings Secret data: ```bash DB_HOST='db.example' DB_PORT='5432' DB_USERNAME='example' DB_PASSWORD='example' ``` Secret Identifier: hsm-settings Secret data: ```bash HSM_ADDRESS='hsm.example' HSM_PORT='9223' ``` You can fetch all key/value pairs for a given secret identifier If you leave the remoteRef.property empty. This returns the json-encoded secret value for that path. If you only need a specific key, you can select it using remoteRef.property as the key name. In this method, you can overwrites data name in Kubernetes Secret object (e.g APISETTINGS and APISETTINGS_TOKEN) ``` yaml {% include 'senhasegura-dsm-external-secret-single.yaml' %} ``` Kubernetes Secret will be create with follow `.data.X` ```bash API_SETTINGS='[{"TOKEN":"example-token-value","URL":"https://example.com/api/example"}]' APISETTINGSTOKEN='example-token-value' ``` If your app requires multiples secrets, it is not required to create multiple ExternalSecret resources, you can aggregate secrets using a single ExternalSecret resource In this method, every secret data in senhasegura creates an Kubernetes Secret `.data.X` field ``` yaml {% include 'senhasegura-dsm-external-secret-multiple.yaml' %} ``` Kubernetes Secret will be create with follow `.data.X` ```bash URL='https://example.com/api/example' TOKEN='example-token-value' DB_HOST='db.example' DB_PORT='5432' DB_USERNAME='example' DB_PASSWORD='example' ``` <!-- https://github.com/external-secrets/external-secrets/pull/830#discussion_r858657107 --> <!-- ### Sync all secrets from DSM authorization You can sync all secrets that your authorization in DSM has using find, in a future release you will be able to filter secrets by name, path or tags ``` yaml {% include 'senhasegura-dsm-external-secret-all.yaml' %} ``` Kubernetes Secret will be create with follow `.data.X` ```bash URL='https://example.com/api/example' TOKEN='example-token-value' DB_HOST='db.example' DB_PORT='5432' DB_USERNAME='example' DB_PASSWORD='example' HSM_ADDRESS='hsm.example' HSM_PORT='9223' ``` -->
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.7.0.md

layout: release date: 2023-12-08 tag: v0.7.0 fix gcp icons @aabidsofi19 (#9605) [Meshmodel] Update Annotations and add capabities @aabidsofi19 (#9603) [Relationships] Update relationships definitions to include `RoleBinding to Service Account` mapping. @MUzairS15 (#9601) add capabilities to flow chart shapes @aabidsofi19 (#9596) chore: relocate and rename conn and cred @leecalcote (#9559) [Model] Flowchart Shapes: Document, MultipleDocuments, Process, StoredData @leecalcote (#9563) hard reset database @VihasMakwana (#9545) [UI] Fix K8s formatter for `meshery controller` statuses. @MUzairS15 (#9597) Fix Issue #9590 in component "DashboardComponent" in UI. @Dananjay996 (#9594) Bump @babel/types from 7.23.0 to 7.23.5 in /ui @dependabot (#9528) [Fixes - Documentation] update the CONTRIBUTING.md with Issues & Pull Requests sections @sandramsc (#9579) Bump cypress from 13.4.0 to 13.6.1 in /provider-ui @dependabot (#9591) [UI] Dashboard: Styling for details view in grids @leecalcote (#9593) [UI] Dashboard enhancement @theBeginner86 (#9589) fix: fix bug where node name is empty @VihasMakwana (#9511) [UI] Fixes eslint warnings/errors in Provider UI @Pushkarm029 (#9576) Bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0 @dependabot (#9534) Bump @babel/types from 7.23.0 to 7.23.5 in /ui @dependabot (#9528) Bump cypress from 13.4.0 to 13.6.1 in /provider-ui @dependabot (#9591) Added about uninstalling meshery using a Docker Extension platform @Srishtihere (#8638) [Docs] Add code for additional alert types and eliminate duplicate entries @coder12git (#9225) Updated creating-a-meshery-design.md @nwanduka (#9507) Add setup instructions for using WSL2 on contributing UI page w/signoff @gyancodes (#9585) Thank you to our contributors for making this release possible: @Dananjay996, @MUzairS15, @Pushkarm029, @Srishtihere, @VihasMakwana, @aabidsofi19, @coder12git, @dependabot, @dependabot[bot], @gyancodes, @leecalcote, @nwanduka, @sandramsc and @theBeginner86
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: lagoon-files.md

Lagoon files are used to store the file output of tasks, such as backups, and can be hosted on any S3-compatible storage. Create new AWS User with policies: ```json title="Example files IAM user" { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListBucketMultipartUploads" ], "Resource":"arn:aws:s3:::S3BUCKETNAME" }, { "Effect":"Allow", "Action":[ "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource":"arn:aws:s3:::S3BUCKETNAME/*" } ] } ``` Update `lagoon-core-values.yml`: ```yaml title="lagoon-core-values.yml" s3FilesAccessKeyID: <<Access Key ID>> s3FilesBucket: <<Bucket Name for Lagoon Files>> s3FilesHost: <<S3 endpoint like "https://s3.eu-west-1.amazonaws.com" >> s3FilesSecretAccessKey: <<Access Key Secret>> s3FilesRegion: <<S3 Region >> ``` If you use `ingress-nginx` in front of `lagoon-core`, we suggest setting this configuration which will allow for bigger file uploads: ```yaml title="lagoon-core-values.yml" controller: config: client-body-timeout: '600' # max 600 secs fileuploads proxy-send-timeout: '1800' # max 30min connections - needed for websockets proxy-read-timeout: '1800' # max 30min connections - needed for websockets proxy-body-size: 1024m # 1GB file size proxy-buffer-size: 64k # bigger buffer ```
Project: Chef Habitat (App Definition and Development / Application Definition & Image Build)
File: keys.md

+++ title = "Keys" description = "Chef Habitat Security" gh_repo = "habitat" [menu] [menu.habitat] title = "Keys" identifier = "habitat/reference/keys" parent = "habitat/reference" +++ Chef Habitat has strong cryptography built into Chef Habitat Builder, the Supervisor, and the `hab` CLI commands. This means there are several different kinds of keys. Every Chef Habitat artifact belongs to an and is cryptographically signed with that origin's private key. Chef Habitat requires the private key for producing artifacts and requires the public key for verification of artifacts before installation. If it is present on Builder, Chef Habitat will automatically download the public key for an origin when necessary. Origin key cryptography is asymmetric: it has a public key that you can distribute freely, and a private key that you should keep safe. Chef Habitat uses the public origin key to verify the integrity of downloaded artifacts before installing them. Chef Habitat will only install artifacts for which it has the public origin key. You can provide a public origin key to Chef Habitat by pointing it to a Builder site that has the origin key with the `--url` argument to `hab pkg install` or using the `hab origin key import` command. Use `hab origin key upload` to upload origin keys to Builder. Use `hab origin key download` to download your origin keys from Builder to your environment. Use `hab origin key import` to read the key from a standard input stream or local file: ```bash hab origin key import <enter or paste key> hab origin key import < <PATHTOKEY> curl <URLTHATRETURNS_KEY> | hab origin key import ``` See the command documentation for more information about working with origin keys from the command line. User and service group keys are used to set up trust relationships between these two entities. Service groups can be set up to reject communication (e.g. applying new configuration via `hab config apply`) from untrusted users. By default, service groups will trust any communication, so for a production deployment of Chef Habitat, setting up these relationships is essential. User and service group keys also use asymmetric cryptography. To apply configuration changes to service groups when running in this mode, a user uses their own private key to encrypt configuration information for a service group, using that service group's public key. The service group then uses its private key to decrypt the configuration information, and the user's public key to verify. A Supervisor network can be optionally set up to encrypt all supervisor-to-supervisor communication. This requires the use of a symmetric, pre-shared key.
Project: ShardingSphere (App Definition and Development / Database)
File: show-sharding-algorithms.en.md

+++ title = "SHOW SHARDING ALGORITHMS" weight = 2 +++ The `SHOW SHARDING ALGORITHMS` syntax is used to query the sharding algorithms in the specified database. {{< tabs >}} {{% tab name="Grammar" %}} ```sql ShowShardingAlgorithms::= 'SHOW' 'SHARDING' 'ALGORITHMS' ('FROM' databaseName)? databaseName ::= identifier ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} When `databaseName` is not specified, the default is the currently used `DATABASE`. If `DATABASE` is not used, `No database selected` will be prompted. | Column | Description | |--|-| | name | Sharding algorithm name | | type | Sharding algorithm type | | props | Sharding algorithm properties | Query the sharding table algorithms of the specified logical database ```sql SHOW SHARDING ALGORITHMS FROM sharding_db; ``` ```sql mysql> SHOW SHARDING ALGORITHMS FROM sharding_db; +-+--+--+ | name | type | props | +-+--+--+ | torderinline | INLINE | algorithm-expression=torder${order_id % 2} | | torderiteminline | INLINE | algorithm-expression=torderitem${order_id % 2} | +-+--+--+ 2 rows in set (0.01 sec) ``` Query the sharding table algorithms of the current logical database ```sql SHOW SHARDING ALGORITHMS; ``` ```sql mysql> SHOW SHARDING ALGORITHMS; +-+--+--+ | name | type | props | +-+--+--+ | torderinline | INLINE | algorithm-expression=torder${order_id % 2} | | torderiteminline | INLINE | algorithm-expression=torderitem${order_id % 2} | +-+--+--+ 2 rows in set (0.01 sec) ``` `SHOW`, `SHARDING`, `ALGORITHMS`, `FROM`
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_plugin_show.md

Print the full definition of the named plugin file ``` sonobuoy plugin show <plugin filename> [flags] ``` ``` -h, --help help for show ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Manage your installed plugins
Project: KICS (Provisioning / Security & Compliance)
File: 54378d69-dd7c-4b08-a43e-80d563396857.md

title: MSK Broker Is Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 54378d69-dd7c-4b08-a43e-80d563396857 Query name: MSK Broker Is Publicly Accessible Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Public AWS MSK allows anyone to interact with the Apache Kafka broker, therefore increasing the opportunity for malicious activity. To prevent such a scenario, it is recommended for AWS MSK to not be publicly accessible<br> ```tf title="Positive test num. 1 - tf file" hl_lines="9" resource "awsmskcluster" "positive1" { cluster_name = "example" kafka_version = "2.7.1" numberofbroker_nodes = 3 brokernodegroup_info { connectivity_info { public_access { type = "SERVICEPROVIDEDEIPS" } } instance_type = "kafka.m5.4xlarge" client_subnets = [ awssubnet.subnetaz1.id, awssubnet.subnetaz2.id, awssubnet.subnetaz3.id, ] storage_info { ebsstorageinfo { provisioned_throughput { enabled = true volume_throughput = 250 } volume_size = 1000 } } securitygroups = [awssecurity_group.sg.id] } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsmskcluster" "negative1" { cluster_name = "example" kafka_version = "2.7.1" numberofbroker_nodes = 3 brokernodegroup_info { connectivity_info { public_access { type = "DISABLED" } } instance_type = "kafka.m5.4xlarge" client_subnets = [ awssubnet.subnetaz1.id, awssubnet.subnetaz2.id, awssubnet.subnetaz3.id, ] storage_info { ebsstorageinfo { provisioned_throughput { enabled = true volume_throughput = 250 } volume_size = 1000 } } securitygroups = [awssecurity_group.sg.id] } } ``` ```tf title="Negative test num. 2 - tf file" resource "awsmskcluster" "negative2" { cluster_name = "example" kafka_version = "2.7.1" numberofbroker_nodes = 3 brokernodegroup_info { instance_type = "kafka.m5.4xlarge" client_subnets = [ awssubnet.subnetaz1.id, awssubnet.subnetaz2.id, awssubnet.subnetaz3.id, ] storage_info { ebsstorageinfo { provisioned_throughput { enabled = true volume_throughput = 250 } volume_size = 1000 } } securitygroups = [awssecurity_group.sg.id] } } ```
Project: Crate.io (App Definition and Development / Database)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at support@crate.io. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: ARC-001-refactor-for-modularity-and-testability.md

Accepted As we keep building up Dapr features, it becomes apparent that we need to refactor the existing code base to reinforce component modularity. This will improve testability and maintainability in long run. And this refactor also lays the foundation of opening up extensible points (such as Bindings) to the community. Formally separate hosting and API implementations. Hosting provides communication protocols (HTTP/gRPC) as different access heads to the same Dapr API implementation. Ensure consistency between gRPC and HTTP interface. Separate binding implementations to a separate repository. Use smart defaults for configurable parameters. Rename Dapr runtime binary from dapr to daprd*. We may consider allowing Dapr to dynamically load bindings during runtime. However, we are not going to implement this unless it's justified by customer asks. A unified configuration file that includes paths to individual configuration files. Provide a Discovery building block with hopefully pluggable discovery mechanisms (such as a custom DNS). This will improve testability and maintainability in long run.
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: asp-dotnet-core.md

title: ASP.NET Core labels: category: application layer: network code: https://github.com/build-security/OPA-AspDotNetCore-Middleware inventors: build-security Use ASP.NET Core to create web apps and services that are fast, secure, cross-platform, and cloud-based. OPA can be used to implement authorization policies for APIs used in the ASP.NET Core framework.
Project: YDB (App Definition and Development / Database)
File: tz_date_types.md

Time zone label for the `TzDate`, `TzDatetime`, `TzTimestamp` types is an attribute that is used: When converting (, , ) to a string and from a string. In , a timezone component is added to `Resource<TM>`. The point in time for these types is stored in UTC, and the timezone label doesn't participate in any other calculations in any way. For example: ```yql select --these expressions are always true for any timezones: the timezone doesn't affect the point in time. AddTimezone(CurrentUtcDate(), "Europe/Moscow") == AddTimezone(CurrentUtcDate(), "America/New_York"), AddTimezone(CurrentUtcDatetime(), "Europe/Moscow") == AddTimezone(CurrentUtcDatetime(), "America/New_York"); ``` Keep in mind that when converting between `TzDate` and `TzDatetime`, or `TzTimestamp` the date's midnight doesn't follow the local time zone, but midnight in UTC for the date in UTC.
Project: Redpanda (App Definition and Development / Streaming & Messaging)
File: 03_doc_proposal.md

name: Documentation request about: Suggest a documentation change to Redpanda labels: "area/docs" <!-- Describe what's wrong or missing Describe the current pain points the user has --> <!-- Why is this impactful for you? Relevant GH issues and pull requests Dependencies on other features or components Specific Redpanda contributors youd like to notify -->
Project: YugabyteDB (App Definition and Development / Database)
File: secondary-indexes-with-jsonb-ysql.md

title: Secondary indexes with JSONB in YugabyteDB YSQL headerTitle: Secondary indexes with JSONB linkTitle: Secondary indexes with JSONB description: Secondary indexes with JSONB in YugabyteDB YSQL headContent: Explore secondary indexes with JSONB in YugabyteDB using YSQL menu: v2.18: identifier: secondary-indexes-with-jsonb-ysql parent: explore-indexes-constraints weight: 265 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li > <a href="../secondary-indexes-with-jsonb-ysql/" class="nav-link active"> <i class="icon-postgres" aria-hidden="true"></i> YSQL </a> </li> <li > <a href="../secondary-indexes-with-jsonb-ycql/" class="nav-link"> <i class="icon-cassandra" aria-hidden="true"></i> YCQL </a> </li> </ul> Coming soon !!!
Project: ThreatMapper (Provisioning / Security & Compliance)
File: sensor-agent-not-start.md

title: Sensor Agent does not start Running `kubectl get pods -n deepfence` gives output similar to: ``` NAME READY STATUS RESTARTS AGE deepfence-agent-8lxng 0/1 ContainerCreating 0 3m14s deepfence-cluster-agent-d86cd4df8-c4fz2 1/1 Running 0 3m14s ``` Running `kubectl describe pod -n deepfence deepfence-agent-8lxng` reveals: ``` Warning FailedMount 30s (x8 over 3m14s) kubelet MountVolume.SetUp failed for volume "containerd-sock" : hostPath type check failed: /run/containerd/containerd.sock is not a socket file ``` Solution: edit `deepfenceagentvalues.yaml` and set `containerdSock` to be `"false"`. Redeploy the agent using: ```bash helm delete deepfence-agent -n deepfence helm show values deepfence/deepfence-agent --version 2.1.1 > deepfenceagentvalues.yaml vim deepfenceagentvalues.yaml helm install -f deepfenceagentvalues.yaml deepfence-agent deepfence/deepfence-agent \ --namespace deepfence \ --create-namespace \ --version 2.1.1 ```
Project: kpt (Provisioning / Automation & Configuration)
File: 03-registering-a-repository.md

In the following sections of this chapter you will explore package authoring using Porch. You will need: A GitHub repository for your blueprints. An otherwise empty repository with an initial commit works best. The initial commit is required to establish the `main` branch. A GitHub with the `repo` scope for Porch to authenticate with the repository and allow it to create commits in the repository. A repository is a porch representation of either a git repo or an oci registry. Package revisions always belong to a single repository. A repository exists in a Kubernetes namespace and all package revisions in a repo also belong to the same namespace. Use the `kpt alpha repo register` command to register your repository with Porch: The command below uses the repository `deployments.git`. Your repository name may be different; please update the command with the correct repository name. ```sh GITHUB_USERNAME=<GitHub Username> GITHUB_TOKEN=<GitHub Personal Access Token> REPOSITORY_ADDRESS=<Your Repository URL> $ kpt alpha repo register \ --namespace default \ --name deployments \ --deployment \ --repo-basic-username=${GITHUB_USERNAME} \ --repo-basic-password=${GITHUB_TOKEN} \ ${REPOSITORY_ADDRESS} ``` And register the sample repository we used in the : ```sh kpt alpha repo register --namespace default \ https://github.com/GoogleContainerTools/kpt-samples.git ``` ?> Refer to the for usage. You now have two repositories registered, and your repository is marked as deployment repository. This indicates that published packages in the repository are considered deployment-ready. ```sh $ kpt alpha repo get NAME TYPE CONTENT DEPLOYMENT READY ADDRESS deployments git Package true True [Your repository address] kpt-samples git Package True https://github.com/GoogleContainerTools/kpt-samples.git ``` ?> Refer to the for usage.