cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 12a7a7ce-39d6-49dd-923d-aeb4564eb66c.md

title: IAM Policy Grants 'AssumeRole' Permission Across All Services hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 12a7a7ce-39d6-49dd-923d-aeb4564eb66c Query name: IAM Policy Grants 'AssumeRole' Permission Across All Services Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: IAM Policy should not grant 'AssumeRole' permission across all services.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4" name: Create IAM Managed Policy community.aws.iammanagedpolicy: policy_name: "ManagedPolicy" policy: Version: "2012-10-17" Statement: Effect: "Allow" Action: "logs:CreateLogGroup" Resource: "*" Principal: Service: "ec2.amazonaws.com" AWS: "*" make_default: false state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: Create IAM Managed Policy community.aws.iammanagedpolicy: policy_name: ManagedPolicy policy: Version: '2012-10-17' Statement: Effect: Allow Action: logs:CreateLogGroup Resource: '*' make_default: false state: present ```
Project: ClickHouse (App Definition and Development / Database)
File: v20.6.7.4-stable.md

Backported in : Cleanup data directory after Zookeeper exceptions during CreateQuery for StorageReplicatedMergeTree Engine. (). Backported in : Fix bug when `ALTER UPDATE` mutation with Nullable column in assignment expression and constant value (like `UPDATE x = 42`) leads to incorrect value in column or segfault. Fixes , . (). Backported in : Fixed missed default database name in metadata of materialized view when executing `ALTER ... MODIFY QUERY`. (). Backported in : Fix SIGSEGV for an attempt to INSERT into StorageFile(fd). (). Backported in : Fix the issue when some invocations of `extractAllGroups` function may trigger "Memory limit exceeded" error. This fixes . ().
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.50.md

layout: release date: 2023-02-07 tag: v0.6.50 language: en Update Dockerfile to fix permission issue @Revolyssup (#7016) new edge type relationships @MUzairS15 (#7005) Fix apiVersion bug in dynamically generated Kubernetes components @Revolyssup (#7001) fix modal behaviour @MUzairS15 (#7024) [UI] Extensions style bugs fix which were affecting light mode. @Chadha93 (#7017) Turn configuration option blue on selection @mohit-marathe (#7011) [UI] Footer color fix for dark mode light mode and playground @Chadha93 (#7010) Krishna2323/enhancement/docs website @Krishna2323 (#6639) Thank you to our contributors for making this release possible: @Chadha93, @GaganpreetKaurKalsi, @Krishna2323, @MUzairS15, @Revolyssup, @acald-creator, @l5io, @leecalcote, @mohit-marathe and l5io
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_data_drop_mysql.md

title: Kubectl-Dba Data Drop Mysql menu: docs_{{ .version }}: identifier: kubectl-dba-data-drop-mysql name: Kubectl-Dba Data Drop Mysql parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Drop data from mysql Use this cmd to drop data from a mysql database ``` kubectl-dba data drop mysql [flags] ``` ``` kubectl dba data drop mysql -n demo sample-mysql ``` ``` -h, --help help for mysql ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - Drop data from a database
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: rego-language-comparisons.md

title: Rego Language Comparisons subtitle: Learn Rego by comparison labels: category: learning inventors: styra tutorials: https://docs.styra.com/opa/rego-language-comparisons docs_features: learning-rego: note: | The guide provides a series of examples illustrating how a policy can be expressed in a given language and the corresponding Rego code for comparison. , , and are currently covered. The guide provides a series of examples illustrating how a policy can be expressed in a given language and the corresponding Rego code for comparison. , , and are currently covered.
Project: Stolon (App Definition and Development / Database)
File: stolonctl_register.md

Register stolon keepers for service discovery Register stolon keepers for service discovery ``` stolonctl register [flags] ``` ``` --debug enable debug logging -h, --help help for register --register-backend string register backend type (consul) (default "consul") --register-ca-file string verify certificates of HTTPS-enabled register servers using this CA bundle --register-cert-file string certificate file for client identification to the register --register-endpoints string a comma-delimited list of register endpoints (use https scheme for tls communication) defaults: http://127.0.0.1:8500 for consul (default "http://127.0.0.1:8500") --register-key string private key file for client identification to the register --register-master register master as well for service discovery (use it with caution!!!) --register-skip-tls-verify skip register certificate verification (insecure!!!) --sleep-interval int number of seconds to sleep before probing for change (default 10) --tag-master-as string a comma-delimited list of tag to be used when registering master (default "master") --tag-slave-as string a comma-delimited list of tag to be used when registering slave (default "slave") ``` ``` --cluster-name string cluster name --kube-context string name of the kubeconfig context to use --kube-namespace string name of the kubernetes namespace to use --kube-resource-kind string the k8s resource kind to be used to store stolon clusterdata and do sentinel leader election (only "configmap" is currently supported) --kubeconfig string path to kubeconfig file. Overrides $KUBECONFIG --log-level string debug, info (default), warn or error (default "info") --metrics-listen-address string metrics listen address i.e "0.0.0.0:8080" (disabled by default) --store-backend string store backend type (etcdv2/etcd, etcdv3, consul or kubernetes) --store-ca-file string verify certificates of HTTPS-enabled store servers using this CA bundle --store-cert-file string certificate file for client identification to the store --store-endpoints string a comma-delimited list of store endpoints (use https scheme for tls communication) (defaults: http://127.0.0.1:2379 for etcd, http://127.0.0.1:8500 for consul) --store-key string private key file for client identification to the store --store-prefix string the store base prefix (default "stolon/cluster") --store-skip-tls-verify skip store certificate verification (insecure!!!) --store-timeout duration store request timeout (default 5s) ``` - stolon command line client
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.7.4-patch.1.md

layout: release date: 2023-12-28 tag: v0.7.4-patch.1 preload kubernetesresourceobject_meta @MUzairS15 (#9753) [Connection Register] - Register MeshSync data as a connection @senali-d (#9548) Thank you to our contributors for making this release possible: @MUzairS15, @leecalcote and @senali-d
Project: KubeVirt (App Definition and Development / Application Definition & Image Build)
File: fuzzy_mode_convert_table.md

| json type \ dest type | bool | int | uint | float |string| | | | | |--|--| | number | positive => true <br/> negative => true <br/> zero => false| 23.2 => 23 <br/> -32.1 => -32| 12.1 => 12 <br/> -12.1 => 0|as normal|same as origin| | string | empty string => false <br/> string "0" => false <br/> other strings => true | "123.32" => 123 <br/> "-123.4" => -123 <br/> "123.23xxxw" => 123 <br/> "abcde12" => 0 <br/> "-32.1" => -32| 13.2 => 13 <br/> -1.1 => 0 |12.1 => 12.1 <br/> -12.3 => -12.3<br/> 12.4xxa => 12.4 <br/> +1.1e2 =>110 |same as origin| | bool | true => true <br/> false => false| true => 1 <br/> false => 0 | true => 1 <br/> false => 0 |true => 1 <br/>false => 0|true => "true" <br/> false => "false"| | object | true | 0 | 0 |0|originnal json| | array | empty array => false <br/> nonempty array => true| [] => 0 <br/> [1,2] => 1 | [] => 0 <br/> [1,2] => 1 |[] => 0<br/>[1,2] => 1|original json|
Project: YugabyteDB (App Definition and Development / Database)
File: ddl_drop_server.md

title: DROP SERVER statement [YSQL] headerTitle: DROP SERVER linkTitle: DROP SERVER description: Use the DROP SERVER statement to drop a foreign server. menu: v2.18: identifier: ddldropforeign_server parent: statements type: docs Use the `DROP SERVER` command to remove a foreign server. The user who executes the command must be the owner of the foreign server. {{%ebnf%}} drop_server {{%/ebnf%}} Drop a foreign server named server_name. If it doesnt exist in the database, an error will be thrown unless the `IF EXISTS` clause is used. `RESTRICT` is the default and it will not drop the foreign server if any objects depend on it. `CASCADE` will drop the foreign server and any objects that transitively depend on it. Drop the foreign-data wrapper `my_server`, along with any objects that depend on it. ```plpgsql yugabyte=# DROP SERVER my_server CASCADE; ```
Project: ClickHouse (App Definition and Development / Database)
File: v23.12.4.15-stable.md

sidebar_position: 1 sidebar_label: 2024 Fix incorrect result of arrayElement / map (). Fix crash in topK when merging empty states (). Fix distributed table with a constant sharding key (). Fix leftPad / rightPad function with FixedString input (). Fix 02720rowpolicycolumnwith_dots (). Pin python dependencies in stateless tests ().
Project: ko (App Definition and Development / Application Definition & Image Build)
File: k8s.md

You could stop at just building and pushing images. But, because building images is so easy with `ko`, and because building with `ko` only requires a string importpath to identify the image, we can integrate this with YAML generation to make Kubernetes use cases much simpler. Traditionally, you might have a Kubernetes deployment, defined in a YAML file, that runs an image: ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: my-deployment spec: replicas: 3 ... template: spec: containers: name: my-app image: registry.example.com/my-app:v1.2.3 ``` ...which you apply to your cluster with `kubectl apply`: ```plaintext kubectl apply -f deployment.yaml ``` With `ko`, you can instead reference your Go binary by its importpath, prefixed with `ko://`: ```yaml ... spec: containers: name: my-app image: ko://github.com/my-user/my-repo/cmd/app ``` With this small change, running `ko resolve -f deployment.yaml` will instruct `ko` to: scan the YAML file(s) for values with the `ko://` prefix, for each unique `ko://`-prefixed string, execute `ko build <importpath>` to build and push an image, replace `ko://`-prefixed string(s) in the input YAML with the fully-specified image reference of the built image(s), as above. Print the resulting resolved YAML to stdout. The result can be redirected to a file, to distribute to others: ```plaintext ko resolve -f config/ > release.yaml ``` Taken together, `ko resolve` aims to make packaging, pushing, and referencing container images an invisible implementation detail of your Kubernetes deployment, and let you focus on writing code in Go. To apply the resulting resolved YAML config, you can redirect the output of `ko resolve` to `kubectl apply`: ```plaintext ko resolve -f config/ | kubectl apply -f - ``` Since this is a relatively common use case, the same functionality is available using `ko apply`: ```plaintext ko apply -f config/ ``` Also, any flags passed after `--` are passed to `kubectl apply` directly, for example to specify context and kubeconfig: ``` ko apply -f config -- --context=foo --kubeconfig=cfg.yaml ``` NB: This requires that `kubectl` is available. To teardown resources applied using `ko apply`, you can run `ko delete`: ```plaintext ko delete -f config/ ``` This is purely a convenient alias for `kubectl delete`, and doesn't perform any builds, or delete any previously built images.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: 50_beam_yaml.md

Prompt: Can I create Apache Beam pipelines using YAML? Response: The Beam YAML API enables the creation of basic Apache Beam pipelines using YAML files, which can be edited with any text editor. The API provides an intuitive, declarative syntax that simplifies pipeline authoring by eliminating the need for coding experience or SDK familiarity. Manipulating and understanding YAML semantics is easier compared to working directly with Beam protos. Additionally, YAML's readability and ease of authorship make it a suitable intermediate representation for tools such as pipeline authoring GUIs or lineage analysis tools. The Beam YAML parser is currently integrated into the Apache Beam Python SDK. The Beam YAML SDK offers a wide range of built-in transforms and allows the creation of custom transforms through the notion of `providers` that leverage expansion services and schema transforms, or by integrating Python packages into your pipeline. You can give names to transforms to help you monitor, debug, and disambiguate identical transforms, enhancing readability. Beam YAML enables authoring both linear and non-linear pipelines. For linear pipelines, Beam YAML allows the inputs to be implicit by specifying the pipeline as a `chain` type. Additionally, you can denote the first and last transforms as `source` and `sink`, respectively. For non-linear pipelines, inputs must be explicitly named, although `chains` can be nested within them. The following Beam YAML code snippet demonstrates a linear pipeline that reads data from a CSV file, filters rows based on a specified condition, executes an SQL query, and writes the resulting data to a JSON file: ```yaml pipeline: type: chain source: type: ReadFromCsv config: path: /path/to/input*.csv transforms: type: Filter config: language: python keep: "col3 > 100" type: Sql name: MySqlTransform config: query: "select col1, count(*) as cnt from PCOLLECTION group by col1" sink: type: WriteToJson config: path: /path/to/output.json ``` With Beam YAML, you can define both streaming and batch pipelines. Beam YAML also supports Apache Beams windowing and triggering, allowing windowing to be declared using the standard `WindowInto` transform or by tagging a transform with specified windowing. The latter applies the windowing to its inputs and the transform itself. The following example demonstrates a streaming Beam YAML pipeline with a chain of transforms. It reads from a Pub/Sub topic, applies a grouping transform with sliding windowing, and then writes the output to another Pub/Sub topic: ```yaml pipeline: type: chain transforms: type: ReadFromPubSub config: topic: myPubSubTopic format: ... schema: ... type: SomeGroupingTransform config: arg: ... windowing: type: sliding size: 60s period: 10s type: WriteToPubSub config: topic: anotherPubSubTopic format: json ``` You can execute a pipeline defined in a YAML file using the standard `python -m` command: ```python python -m apachebeam.yaml.main --yamlpipeline_file=/path/to/pipeline.yaml [other pipeline options such as the runner] ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: device-read-iops.md

Limit read rate (in IO operations per second) from a device (e.g. --device-read-iops=/dev/sda:1000). On some systems, changing the resource limits may not be allowed for non-root users. For more details, see https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error This option is not supported on cgroups V1 rootless systems.
Project: Harbor (Provisioning / Container Registry)
File: 10-02-Clair-scan-a-image-with-vulnerability.md

Test 10-02 Trivy scan a image with vulnerability ======= To verify that trivy can scan a image with vulnerability. User guide This test requires that a Harbor instance is running and available. Harbor is installed with trivy enable. A linux host with Docker CLI installed. Trivy has been updated to the latest. Login Harbor as admin. Push an image with vulnerability. Scan the image. Click tag link enter detail page. Rescan the image. Step3 should exist result summary chart. Step4 should see cve link and detail is match with summary in step3. Step4 cve link should clickable. Step5 rescan should successful. None
Project: Beam (App Definition and Development / Streaming & Messaging)
File: ML6.md

title: "ML6" icon: /images/logos/powered-by/ML6.jpg hasLink: "https://www.youtube.com/watch?v=wDhxW0J7GbM&list=PL4dEBWmGSIU9OkXQU2OAXmITPLhiMSPRp&index=45" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: Meshery (Provisioning / Automation & Configuration)
File: 06-06-2023-02-11-06_c65d7a72.md

timestamp: "2023-06-06 02:11:23 UTC Tue" meshery-component: meshery-consul meshery-component-version: edge meshery-server-version: "*name" k8s-distro: minikube k8s-version: "v1.21.5" service-mesh: Consul service-mesh-version: "v1.1.2" tests: consul-client: null consul-server: null overall-status: "failing"
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: v1.10.0.md

id: v1.10.0 title: v1.10.0 description: Backstage Release v1.10.0 These are the release notes for the v1.10.0 release of . A huge thanks to the whole team of maintainers and contributors as well as the amazing Backstage Community for the hard work in getting this release developed and done. The `create-plugin` command of the `backstage-cli` is deprecated, and we have removed its usage in newly created apps and in our documentation. We recommend that you update your root `package.json` as follows: ```diff "scripts": { ... "create-plugin": "backstage-cli create-plugin --scope internal" "new": "backstage-cli new --scope internal" } ``` Weve made it easier to re-use some of the Scaffolder components outside of the Scaffolder plugin as well as re-homing some common types that might live between other frontend modules in the future. With this change theres been some deprecations that have been shipped which are just renaming the imports from `@backstage/plugin-scaffolder` to `@backstage/plugin-scaffolder-react`. You can find out more in the for the `@backstage/plugin-scaffolder` A new module has been created that allows the creation of projects with a new `sentry:project:create` action. Contributed by in Parts of the tooling that powers the Backstage main repository are being externalized, into . Documentation is sparse and so far it houses only the API extractor (which makes the `api-report.md` files) and the type dependencies check which makes sure that `@types/*` packages that are visible in the public API are added as dependencies. Examples can now be added to `createTemplateAction` in the backend and can be browsed under `/create/actions` on your Backstage instance. Contributed by in The `allowedKinds` has been deprecated from the `OwnerPicker` and `EntityPicker` in favor of a `catalogFilter` option that allows you to be more flexible in the filtering from the Catalog. Contributed by in Weve made good progress towards getting the new backend system ready for broader testing. While were not quite there yet, youll see a lot of changes in the `@backstage/backend-app-api` and `@backstage/backend-plugin-api` packages as well as supporting packages like `@backstage/backend-defaults`. Theres some initial support for event (web hook) based updates for GitHub org entities that are ingested using `GithubOrgEntityProvider`. We are excited to see the `events-backend` starting to power this type of functionality. More information on the setup can be found . Contributed by in This release does not contain any security fixes. We recommend that you keep your Backstage project up to date with this latest release. For more guidance on how to upgrade, check out the documentation for . Below you can find a list of links and references to help you learn about and start using this new release. , , and Backstage's for discussions and support Backstage , , and Sign up for our if you want to be informed about what is happening in the world of Backstage.
Project: YugabyteDB (App Definition and Development / Database)
File: create_rule,rule_event,command.grammar.md

```output.ebnf createrule ::= CREATE [ OR REPLACE ] RULE rulename AS ON rule_event TO tablename [ WHERE booleanexpression ] DO [ ALSO | INSTEAD ] { NOTHING | command | ( command [ ; ... ] ) } rule_event ::= SELECT | INSERT | UPDATE | DELETE command ::= SELECT | INSERT | UPDATE | DELETE | NOTIFY ```
Project: Goldilocks (Provisioning / Security & Compliance)
File: ROADMAP.md

Most of the future roadmap of this project will be to improve the quality of the code, as well as the usability of the dashboard. The basic functionality is simple: provide resource recommendation aggregation. Much better unit testing. See #5 Container name exclusion. See #7 Deployment reconciliation - Allow the labelling of deployments instead of just namespaces Deployment - be able to deploy VPA, prometheus, and goldilocks with Helm.