cwielenb/CNCF-Dataset huggingface dataset:
Project: Trivy (Provisioning / Security & Compliance)
File: amazon.md

Trivy supports the following scanners for OS packages. | Scanner | Supported | | :--: | :-: | | SBOM | | | Vulnerability | | | License | | Please see for supported versions. The table below outlines the features offered by Trivy. | Feature | Supported | |::|::| | Unfixed vulnerabilities | - | | | | Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. Amazon Linux offers its own security advisories, and these are utilized when scanning Amazon Linux for vulnerabilities. See . When looking at fixed versions, it's crucial to consider the patches supplied by Amazon. For example, for CVE-2023-0464, the fixed version for Amazon Linux 2023 is listed as `3.0.8-1.amzn2023.0.2` in [ALAS2023-2023-181]. Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and so on. Typically, only the upstream information gets listed on [NVD], so it's important not to get confused. Trivy determines vulnerability severity based on the severity metric provided by Amazon. For example, the security patch for [CVE-2023-0464] in Amazon Linux 2023 is provided as [ALAS2023-2023-181]. Its severity is rated as "Medium". Thus, even though it's evaluated as "HIGH" in the NVD, Trivy displays it with a severity of "MEDIUM". The table below is the mapping of Amazon's severity to Trivy's severity levels. | Amazon | Trivy | | :-: | :: | | Low | Low | | Medium | Medium | | Important | High | | Critical | Critical | Trivy supports the following [vulnerability statuses] for Amazon Linux. | Status | Supported | | :--: | :-: | | Fixed | | | Affected | | | Under Investigation | | | Will Not Fix | | | Fix Deferred | | | End of Life | | Trivy identifies licenses by examining the metadata of RPM packages.
Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: multi-tenancy.md

title: "Multi-Tenancy" linkTitle: "Multi-Tenancy" weight: 4 description: This guide describes the best practices concepts to write Operators for Multi-Tenancy solutions. If your Operator creates or manages configurations ensure that your solution: applies fine-grained network policies to the extent that is required for your managed application to function properly applies fine-grained network policies to enable your managed application internal components to communicate among each other allows users to configure your operator so it does not create or manage instances does not create `allow traffic from everywhere in the cluster` type policies are popular in multi-tenant cluster to provide an extra layer of segregation among tenants within SDN solutions. Users typically customize this extensively with goal of disallowing network traffic among unrelated tenants. Operators that deploy an `accept all traffic from anywhere in the cluster` style policy, are creating an obstacle in pursuing this goal, especially in instances where these policies cannot be disabled. In security-conscious environments policies like these are not allowed in production. In such cases your operator should minimally have the option to prevent objects from being created and leave this responsibility to the user. In more advanced cases, your operator should create configurations that follow the least-privilege principle, i.e. denying access to everything and from everywhere by default and only allowing access to specific authorized resources from specific authorized components. The goal is to split or to isolated ingress traffic from certain environments, e.g. production and development environments, ending up on different routers and in this way, being managed by a different Ingress controller. This is a popular configuration option for heavily populated multi-tenant clusters, with several deployed. If your Operator creates ingress resources the recommendation is to allow the users to customize them, through the use of a CRD. The required needs then to be propagated to the ingress resources created so that they get picked up by the desired . Annotations are deprecated in favour of . To run on the OpenShift distribution of Kubernetes you probably will use the API. When sharding these routes may be configured with a label selector. Based on this label selector they will amend their configuration when a route (having the label) is created or not (if the route does not have the label). The label is applied at the `Route` level and there is no pre-defined convention here, so users set these custom labels in accordance to how they configured their instances. In this way, your operator should allow the user to specify custom labels for any Route that it manages. Check the and this for an end-to-end examples and further information.
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.5.41.md

layout: release date: 2021-07-28 tag: v0.5.41 Upgraded to meshkit error @sayantan1413 (#3610) Revert "[UI] block fetch to grafana or prometheus if not configured" @sudo-NithishKarthik (#3677) system start fails with empty platform flag @nehaLohia27 (#3675) added meshery operator logo to docs @debo19 (#3676) changed the message to view the status of pods @guptapriyanshu7 (#3672) [UI] block fetch to grafana or prometheus if not configured @bariqhibat (#3595) [Docs] Custom Callback @utkarsh-pro (#3655) [CI] Fixed the lint failure @sayantan1413 (#3669) [mesheryctl] Unit tests for `system context` @Revolyssup (#3555) Thank you to our contributors for making this release possible: @Revolyssup, @bariqhibat, @debo19, @dhruv0000, @guptapriyanshu7, @hexxdump, @leecalcote, @nehaLohia27, @piyushsingariya, @sayantan1413, @sudo-NithishKarthik, @utkarsh-pro and l5io
Project: StarRocks (App Definition and Development / Database)
File: from_base64.md

displayed_sidebar: "English" Decodes a Base64-encoded string. This function is an inverse of . ```Haskell from_base64(str); ``` `str`: the string to decode. It must be of the VARCHAR type. Returns a value of the VARCHAR type. If the input is NULL or an invalid Base64 string, NULL is returned. If the input is empty, an error is returned. This function accepts only one string. More than one input string causes an error. ```Plain Text mysql> select from_base64("starrocks"); +--+ | from_base64('starrocks') | +--+ | $ | +--+ 1 row in set (0.00 sec) mysql> select from_base64('c3RhcnJvY2tz'); +--+ | from_base64('c3RhcnJvY2tz') | +--+ | starrocks | +--+ ```
Project: NomsDB (App Definition and Development / Database)
File: demo-ipfs-chat.md

Decentralized &nbsp; | &nbsp;&nbsp; | &nbsp;&nbsp; | &nbsp;&nbsp; | &nbsp;IPFS Chat Demo <br><br> This sample app demonstrates backing a P2P noms app by a decentralized blockstore (in this case, IPFS). Data is pulled off the network dynamically as needed - each client doesn't need a complete copy. Demo app code is in the directory. To get it up and running take the following steps: Use git to clone the noms repository onto your computer: ```shell go get github.com/attic-labs/noms/samples/go/decent/ipfs-chat ``` From the noms/samples/go/decent/ipfs-chat directory, build the program with the following command: ```shell go build ``` Run the ipfs-chat client with the following command: ```shell ./ipfs-chat client --username <aname1> --node-idx=1 ipfs:/tmp/ipfs1::chat >& /tmp/err1 ``` Run a second ipfs-chat client with the following command: ```shell ./ipfs-chat client --username <aname2> --node-idx=2 ipfs:/tmp/ipfs2::chat >& /tmp/err2 ``` If desired, ipfs-chat can be run as a daemon which will replicate all chat content in a local store which will enable clients to go offline without causing data to become unavailable to other clients: ```shell ./ipfs-chat daemon --node-idx=3 ipfs:/tmp/ipfs3::chat ``` Note: the 'node-idx' argument ensures that each IPFS-based program uses a distinct set of ports. This is useful when running multiple IPFS-based programs on the same machine.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_resourcemanager_project_iam_binding.md

+++ title = "googleresourcemanagerprojectiambinding resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleresourcemanagerprojectiambinding" identifier = "inspec/resources/gcp/googleresourcemanagerprojectiambinding.md googleresourcemanagerprojectiambinding resource" parent = "inspec/resources/gcp" +++ A `googleresourcemanagerprojectiambinding` is used to test a Google Project Iam Bindings ```ruby describe googleresourcemanagerprojectiambinding(project_id: "projectId", role: "roles/editor") do it { should exist } its('members') { should include 'user:testuser@example.com' } end ``` Properties that can be accessed from the `googleresourcemanagerprojectiambinding` resource: `role` : Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. `members` : Specifies the identities requesting access for a Cloud Platform resource. Ensure the is enabled for the current project.
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: since.md

Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration strings (e.g. 10m, 1h30m) computed relative to the client machine's time. Supported formats for date formatted time stamps include RFC3339Nano, RFC3339, 2006-01-02T15:04:05, 2006-01-02T15:04:05.999999999, 2006-01-02Z07:00, and 2006-01-02.
Project: The Update Framework (TUF) (Provisioning / Security & Compliance)
File: 0009-what-is-a-reference-implementation.md

Status: accepted Date: 2021-08-25 The original goal for the reference implementation refactor was to provide an implementation which is both an aid to understanding the specification and a good architecture for other implementations to mimic. During refactoring efforts on the metadata API and ngclient, several friction points have arisen where a safe object-oriented API would result in a less direct mapping to the [Document formats] in the specification. The archetypal example friction point is that [Timestamp] lists snapshot only in a `meta` dictionary of `METAPATH` -> attribute fields. The dictionary will only ever contain one value and creates an extra level of indirection for implementations which try to map to the file format. When presented with such cases, we have considered multiple options: Strict mapping to the [Document formats] Simple and safe API in preference to mapping to the [Document formats] Strict mapping to the [Document formats] with additional convenience API which is documented as the preferred interface for users So far implementation has tended towards the final option, but this is unsatisfying because: the API contains traps for the unsuspecting users two code paths to achieve the same goal is likely to result in inconsistent behaviour and bugs Therefore, we would like to define our primary purpose so that we can make consistent decisions. The reference implementation is often the starting point for new implementations, porting architecture of the reference implementation to new languages/frameworks Reading reference implementation code is a common way to learn about TUF The TUF formats include non-intuitive JSON object formats when mapping to OOP objects Multiple code paths/API for the same feature is a common source of bugs Primary purpose of the reference implementation is: a learning resource to aid understanding of the specification (pedagogical reference) a good architecture for other implementations to mimic (exemplary reference) Primary purpose of the reference implementation is as an exemplary reference: providing a safe, consistent API for users and a good architecture for other implementations to mimic. Discussed Discussed in the
Project: Beam (App Definition and Development / Streaming & Messaging)
File: enrichment.md

title: "Enrichment" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> {{< localstorage language language-py >}} <table> <tr> <td> <a> {{< button-pydoc path="apache_beam.transforms.enrichment" class="Enrichment" >}} </a> </td> </tr> </table> The enrichment transform lets you dynamically enrich data in a pipeline by doing a key-value lookup to a remote service. The transform uses internally. This feature uses client-side throttling to ensure that the remote service isn't overloaded with requests. If service-side errors occur, like `TooManyRequests` and `Timeout` exceptions, it retries the requests by using exponential backoff. This transform is available in Apache Beam 2.54.0 and later versions. The following examples demonstrate how to create a pipeline that use the enrichment transform to enrich data from external services. {{< table >}} | Service | Example | |:--|:--| | Cloud Bigtable | | | Vertex AI Feature Store | | | Vertex AI Feature Store (Legacy) | | {{< /table >}} Not applicable. {{< button-pydoc path="apache_beam.transforms.enrichment" class="Enrichment" >}}
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_init.md

title: "Command - devspace init" sidebar_label: devspace init Initializes DevSpace in the current folder ``` devspace init [flags] ``` ``` Initializes a new devspace project within the current folder. Creates a devspace.yaml with all configuration. ``` ``` --context string Context path to use for intialization --dockerfile string Dockerfile to use for initialization (default "./Dockerfile") -h, --help help for init --provider string The cloud provider to use -r, --reconfigure Change existing configuration ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: KICS (Provisioning / Security & Compliance)
File: cfdef2e5-1fe4-4ef4-bea8-c56e08963150.md

title: ElastiCache Nodes Not Created Across Multi AZ hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cfdef2e5-1fe4-4ef4-bea8-c56e08963150 Query name: ElastiCache Nodes Not Created Across Multi AZ Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Availability URL: ElastiCache Nodes should be created across multi az, which means 'AZMode' should be set to 'cross-az' in multi nodes cluster<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Resources: myCacheCluster3: Type: 'AWS::ElastiCache::CacheCluster' Properties: AZMode: single-az CacheNodeType: cache.m3.medium Engine: memcached NumCacheNodes: '3' PreferredAvailabilityZones: us-west-2a us-west-2a us-west-2b ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="5" AWSTemplateFormatVersion: "2010-09-09" Resources: myCacheCluster4: Type: 'AWS::ElastiCache::CacheCluster' Properties: CacheNodeType: cache.m3.medium Engine: memcached NumCacheNodes: '3' PreferredAvailabilityZones: us-west-2a us-west-2a us-west-2b ``` ```json title="Positive test num. 3 - json file" hl_lines="6" { "Resources": { "myCacheCluster5": { "Type": "AWS::ElastiCache::CacheCluster", "Properties": { "AZMode": "single-az", "CacheNodeType": "cache.m3.medium", "Engine": "memcached", "NumCacheNodes": "3", "PreferredAvailabilityZones": [ "us-west-2a", "us-west-2a", "us-west-2b" ] } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="5" { "Resources": { "myCacheCluster6": { "Type": "AWS::ElastiCache::CacheCluster", "Properties": { "CacheNodeType": "cache.m3.medium", "Engine": "memcached", "NumCacheNodes": "3", "PreferredAvailabilityZones": [ "us-west-2a", "us-west-2a", "us-west-2b" ] } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Resources: myCacheCluster: Type: 'AWS::ElastiCache::CacheCluster' Properties: AZMode: cross-az CacheNodeType: cache.m3.medium Engine: memcached NumCacheNodes: '3' PreferredAvailabilityZones: us-west-2a us-west-2a us-west-2b ``` ```json title="Negative test num. 2 - json file" { "Resources": { "myCacheCluster2": { "Type": "AWS::ElastiCache::CacheCluster", "Properties": { "AZMode": "cross-az", "CacheNodeType": "cache.m3.medium", "Engine": "memcached", "NumCacheNodes": "3", "PreferredAvailabilityZones": [ "us-west-2a", "us-west-2a", "us-west-2b" ] } } } } ```
Project: KICS (Provisioning / Security & Compliance)
File: a1423864-2fbc-4f46-bfe1-fbbf125c71c9.md

title: CodeBuild Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a1423864-2fbc-4f46-bfe1-fbbf125c71c9 Query name: CodeBuild Not Encrypted Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: CodeBuild Project should be encrypted<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2" name: My project community.aws.aws_codebuild: description: My nice little project v2 service_role: "arn:aws:iam::123123:role/service-role/code-build-service-role" source: type: CODEPIPELINE buildspec: '' artifacts: namespaceType: NONE packaging: NONE type: CODEPIPELINE name: my_project environment: computeType: BUILDGENERAL1SMALL privilegedMode: "true" image: "aws/codebuild/docker:17.09.0" type: LINUX_CONTAINER region: us-east-1 state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: My project v2 community.aws.aws_codebuild: description: My nice little project service_role: arn:aws:iam::123123:role/service-role/code-build-service-role source: type: CODEPIPELINE buildspec: '' artifacts: namespaceType: NONE packaging: NONE type: CODEPIPELINE name: my_project environment: computeType: BUILDGENERAL1SMALL privilegedMode: 'true' image: aws/codebuild/docker:17.09.0 type: LINUX_CONTAINER encryption_key: arn:aws:kms:us-east-1:123123:alias/aws/s3 region: us-east-1 state: present ```
Project: KCL (Provisioning / Automation & Configuration)
File: E1I37.md

KCL will report `IllegalArgumentSyntaxError` when KCL has an illegal argument in KCL syntax. For example: ```python a = option(type="list", default={"key": "value"}, "key1") ``` The KCL program will cause the following error message. ```shell error[E1001]: InvalidSyntax --> /option/typeconvertfail_2/main.k:3:57 | 3 | a = option(type="list", default={"key": "value"}, "key1") | ^ positional argument follows keyword argument | ``` Possible resolution: ```python func(input1, ..., inputn, paramwithkey1 = inputwithkey1, ..., paramwithkeyn = inputwithkeyn) ```
Project: StarRocks (App Definition and Development / Database)
File: cos_similarity.md

displayed_sidebar: "English" Measures the similarity of two vectors by calculating the cosine of the angle between them. The angle is formed by the direction of the vectors while the difference in their magnitude is ignored. The similarity is between -1 and 1. Smaller angles between vectors indicate greater cosine similarity. If two vectors have the same direction, they have a 0-degree angle and the cosine similarity is 1. Perpendicular vectors have a 90-degree angle and a cosine similarity of 0. Opposite vectors have a 180-degree angle and a cosine similarity of -1. `cosine_similarity` is commonly used for assessing text and video similarity. This function normalizes vectors before measuring the cosine similarity. If the input vectors have been normalized, you can use . ```Haskell cosine_similarity(a, b) ``` `a` and `b` are the vectors to compare. They must have the same dimension. The supported data type is `Array<float>`. The two arrays must have the same number of elements. Otherwise, an error is returned. Returns a FLOAT value within the range of [-1, 1]. If any input parameter is null or invalid, an error is reported. Create a table to store vectors and insert data into this table. ```SQL CREATE TABLE t1_similarity (id int, data array<float>) DISTRIBUTED BY HASH(id); INSERT INTO t1_similarity VALUES (1, array<float>[0.1, 0.2, 0.3]), (2, array<float>[0.2, 0.1, 0.3]), (3, array<float>[0.3, 0.2, 0.1]); ``` Calculate the similarity of each row in the `data` column compared to the array `[0.1, 0.2, 0.3]` and list the result in descending order. ```Plain SELECT id, data, cosine_similarity([0.1, 0.2, 0.3], data) as dist FROM t1_similarity ORDER BY dist DESC; +++--+ | id | data | dist | +++--+ | 1 | [0.1,0.2,0.3] | 0.9999999 | | 2 | [0.2,0.1,0.3] | 0.9285713 | | 3 | [0.3,0.2,0.1] | 0.7142856 | +++--+ ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_logging_folder_exclusion.md

+++ title = "googleloggingfolder_exclusion resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleloggingfolder_exclusion" identifier = "inspec/resources/gcp/googleloggingfolderexclusion.md googleloggingfolderexclusion resource" parent = "inspec/resources/gcp" +++ A `googleloggingfolder_exclusion` is used to test a Google FolderExclusion resource ```ruby describe.one do googleresourcemanagerfolders(parent: 'organizations/12345').names.each do |folder_name| googleloggingfolderexclusions(folder: foldername.split('/')[1]).names.each do |exclusion_name| describe googleloggingfolderexclusion(folder: foldername.split('/')[1], name: exclusion_name) do its('name'){ should cmp 'inspec-folder-exclusion' } its('description'){ should cmp 'My folder exclusion description' } its('filter'){ should cmp 'resource.type = gce_instance AND severity <= DEBUG' } end end end end ``` Properties that can be accessed from the `googleloggingfolder_exclusion` resource: `folder` : Id of the folder that this exclusion applies to. `name` : Name of the exclusion, specified by the server during create. `description` : A user provided description of this exclusion. `filter` : An advanced logs filter. The only exported log entries are those that are in the resource owning the sink and that match the filter. `disabled` : If set to true then this exclusion is disabled and it does not exclude any log entries. Ensure the is enabled for the current project.