cwielenb/CNCF-Dataset huggingface dataset:
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_gen_plugin.md

Generates the manifest Sonobuoy uses to define a plugin ``` sonobuoy gen plugin [flags] ``` ``` sonobuoy gen plugin -n myPlugin -i myregistry/myimage:v0 ``` ``` -a, --arg stringArray Arg values to set on the plugin. Can be set multiple times (e.g. --arg 'arg 1' --arg arg2) -c, --cmd stringArray Command to run when starting the plugin's container. Can be set multiple times (e.g. --cmd /bin/sh -c "-c") (default [./run.sh]) --configmap stringArray Specifies files to read and add as configMaps. Will be mounted to the plugin at /tmp/sonobuoy/configs/<filename>. -D, --description string Description for the plugin -e, --env envvar Env var values to set on the plugin (e.g. --env FOO=bar) (default map[]) -f, --format string Result format (junit or raw) (default "raw") -h, --help help for plugin -i, --image string Plugin image -n, --name string Plugin name --node-selector stringToString Node selector for the plugin (key=value). Usually set to specify OS via kubernetes.io/os=windows. Can be set multiple times. (default []) --show-default-podspec If true, include the default pod spec used for plugins in the output. -t, --type pluginDriver Plugin Driver (job or daemonset) (default Job) -u, --url string URL for the plugin ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Generates a sonobuoy manifest for submission via kubectl - Generates the e2e plugin definition based on the given options - Generates the systemd-logs plugin definition based on the given options
Project: KubeClarity (Provisioning / Security & Compliance)
File: SECURITY.md

This document outlines security procedures and general policies for the KubeClarity project. The KubeClarity team and community take all security bugs in KubeClarity seriously. Thank you for improving the security of KubeClarity. We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions. Report security bugs by emailing `oss-security@cisco.com`. The lead maintainer will acknowledge your email within 48 hours, and will send a more detailed response within 48 hours indicating the next steps in handling your report. After the initial reply to your report, the security team will endeavor to keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance. When the security team receives a security bug report, they will assign it to a primary handler. This person will coordinate the fix and release process, involving the following steps: Confirm the problem and determine the affected versions. Audit code to find any potential similar problems. Prepare fixes for all releases still under maintenance. These fixes will be released as quickly as possible. If you have suggestions on how this process could be improved please submit a pull request.
Project: YugabyteDB (App Definition and Development / Database)
File: yba_provider_kubernetes_describe.md

Describe a Kubernetes YugabyteDB Anywhere provider Describe a Kubernetes provider in YugabyteDB Anywhere ``` yba provider kubernetes describe [flags] ``` ``` -h, --help help for describe ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -n, --name string [Optional] The name of the provider for the action. Required for create, delete, describe, update. -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Manage a YugabyteDB Anywhere K8s provider
Project: Pluto (Provisioning / Security & Compliance)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: [triage, enhancement] assignees: '' Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] Describe the solution you'd like A clear and concise description of what you want to happen. Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered. Additional context Add any other context or screenshots about the feature request here.
Project: KICS (Provisioning / Security & Compliance)
File: 6d34aff3-fdd2-460c-8190-756a3b4969e8.md

title: Cloud SQL Instance With Contained Database Authentication On hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6d34aff3-fdd2-460c-8190-756a3b4969e8 Query name: Cloud SQL Instance With Contained Database Authentication On Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: SQL Instance should not have Contained Database Authentication On<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10" name: sql_instance google.cloud.gcpsqlinstance: auth_kind: serviceaccount databaseversion: SQLSERVER13_1 name: "{{ resource_name }}-2" project: test_project region: us-central1 serviceaccountfile: /tmp/auth.pem settings: database_flags: name: contained database authentication value: on tier: db-n1-standard-1 state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: sql_instance google.cloud.gcpsqlinstance: auth_kind: serviceaccount databaseversion: SQLSERVER13_1 name: '{{ resource_name }}-2' project: test_project region: us-central1 serviceaccountfile: /tmp/auth.pem settings: database_flags: name: name1 value: value1 tier: db-n1-standard-1 state: present ```
Project: Beam (App Definition and Development / Streaming & Messaging)
File: TrustPilot.md

title: "TrustPilot" icon: /images/logos/powered-by/Trustpilot.png hasLink: "https://www.youtube.com/watch?v=Sq3maplM0EQ&list=PL4dEBWmGSIU9OkXQU2OAXmITPLhiMSPRp&index=37" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-healthcheck.1.md

% podman-healthcheck 1 podman\-healthcheck - Manage healthchecks for containers podman healthcheck subcommand podman healthcheck is a set of subcommands that manage container healthchecks | Command | Man Page | Description | | - | - | | | run | | Run a container healthcheck | Feb 2019, Originally compiled by Brent Baude <bbaude@redhat.com>
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-ref-syntax-ddl-drop-view.md

layout: global title: DROP VIEW displayTitle: DROP VIEW license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. `DROP VIEW` removes the metadata associated with a specified view from the catalog. ```sql DROP VIEW [ IF EXISTS ] view_identifier ``` IF EXISTS* If specified, no exception is thrown when the view does not exist. view_identifier* Specifies the view name to be dropped. The view name may be optionally qualified with a database name. Syntax: `[ databasename. ] viewname` ```sql -- Assumes a view named `employeeView` exists. DROP VIEW employeeView; -- Assumes a view named `employeeView` exists in the `userdb` database DROP VIEW userdb.employeeView; -- Assumes a view named `employeeView` does not exist. -- Throws exception DROP VIEW employeeView; Error: org.apache.spark.sql.AnalysisException: Table or view not found: employeeView; (state=,code=0) -- Assumes a view named `employeeView` does not exist,Try with IF EXISTS -- this time it will not throw exception DROP VIEW IF EXISTS employeeView; ```
Project: YugabyteDB (App Definition and Development / Database)
File: managed-cli-backup.md

title: ybm CLI backup resource headerTitle: ybm backup linkTitle: backup description: YugabyteDB Managed CLI reference backup resource. headcontent: Manage cluster backups menu: preview_yugabyte-cloud: identifier: managed-cli-backup parent: managed-cli-reference weight: 20 type: docs Use the `backup` resource to perform operations on cluster backups, including the following: create and delete cluster backups restore a backup get information about cluster backups ```text Usage: ybm backup [command] [flags] ``` Create a backup: ```sh ybm backup create \ --cluster-name=test-cluster \ --retention-period=7 ``` Create a backup of a specified cluster. | Flag | Description | | : | : | | --cluster-name | Required. Name of the cluster to back up. | | --retention-period | Retention period for the backup in days. Default is 1. | | --description | A description of the backup. | Delete a specified backup. | Flag | Description | | : | : | | --backup-id | Required. The ID of the backup to delete. | Display the backups of a specified cluster. | Flag | Description | | : | : | | --cluster-name | Name of the cluster of which you want to view the backups. | Restore a specified backup to a specified cluster. | Flag | Description | | : | : | | --cluster-name | Required. Name of the cluster to restore to. | | --backup-id | Required. The ID of the backup to restore. |
Project: Chef Habitat (App Definition and Development / Application Definition & Image Build)
File: service_group_configuration.md

+++ title = "Service Group Configuration" description = "Update Services with File Uploads" gh_repo = "habitat" [menu] [menu.habitat] title = "Service Group Configuration" identifier = "habitat/services/Service Group Configuration" parent = "habitat/services" weight = 40 +++ In addition to , you can upload files to a service group. Keep these small - we recommend 4k or less per file, and keep the count of files to a minimum. Use the command to submit a file to a service group. Specify a peer in the ring to connect to, the version number of the file, and the new path to the file itself. {{< note >}} File updates for service groups must be versioned. The version number must be an integer that starts at one and must be incremented with every subsequent update to the same service group. If the version number is less than or equal to the current version number, the change(s) will not be applied. {{< /note >}} The following example shows how to upload a file to the ring: ```bash hab file upload myapp.prod 1 /tmp/yourfile.txt --remote-sup=hab1.mycompany.com ``` Your output would look something like this: ``` Uploading file yourfile.txt to 1 incarnation myapp.prod Creating service file Applying via peer 172.0.0.3:9632 Uploaded file ``` The services in the `myapp.prod` service group will receive the file, restarting if necessary: ``` hab-sup(MR): Receiving new version 1 of file secret.txt for myapp.prod ... myapp.prod(SR): Service file updated, yourfile.txt ``` Note: Habitat will put the uplodaded file in your service's `svc/files` directory. Files can be encrypted for the service group they are intended for. To do so, pass the `--user` option with the name of your user key, and the `--org` option with the organization of the service group. If you have the public key for the service group, the data will be encrypted for that key, signed with your user key, and sent to the ring. It will then be stored encrypted in memory, and decrypted on disk.
Project: KubeArmor (Provisioning / Security & Compliance)
File: network_segmentation.md

In Kubernetes, the is a set of network traffic rules that are applied to a group of pods in a Kubernetes cluster. The network policy specifies how a pod is allowed to communicate with others. Network policy controllers (running as pods in the Kubernetes cluster) convert the requirements and restrictions of the network policies that are retrieved from the Kubernetes API into the network infrastructure. KubeArmor has visibility into the network connections made into or from the pods. It has visibility across socket(), bind(), connect(), accept() calls. KubeArmor along with the could now auto-generate which are enforceable using most of the k8s CNIs (Container Network Interface). Note that the discovered policies use k8s abstractions for identifying services, deployments, and pods such as k8s labels, namespaces. This release allows kubearmor and discovery-engine to do automatic network microsegmentation by detecting the network connections and creating appropriate network policies based on it. These auto-generated network policies are enforceable using any CNI that supports k8s network policy namely, Cilium, Calico, AWS VPC CNI, Weave. <img src="../.gitbook/assets/network-segmentation.png" width="512" class="center" alt="Network Segmentation"> Pre-requisites: Install KubeArmor `curl -sfL http://get.kubearmor.io/ | sudo sh -s -- -b /usr/local/bin && karmor install` Install `kubectl apply -f https://raw.githubusercontent.com/kubearmor/discovery-engine/dev/deployments/k8s/deployment.yaml` Next you install the workload. If the workload is already installed, then the behavior will be shown based on the new system events only. Get the application summary `karmor discover -n NAMESPACE` ``` karmor discover -n dvwa -f yaml -p NetworkPolicy ``` ```yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: autopol-ingress-igpxzbfksonhbya namespace: dvwa spec: ingress: from: podSelector: matchLabels: app: dvwa-web tier: frontend ports: port: 3306 protocol: TCP podSelector: matchLabels: app: dvwa-mysql tier: backend policyTypes: Ingress apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: autopol-egress-wjvlkuprwuwgera namespace: dvwa spec: egress: ports: protocol: UDP ports: port: 3306 protocol: TCP to: podSelector: matchLabels: app: dvwa-mysql tier: backend podSelector: matchLabels: app: dvwa-web tier: frontend policyTypes: Egress ``` Highlights of network segmentation: Ability to generate k8s network policies without depending on the CNI. No inserting of iptables rules required at the host level. System call information is used to discover the policies. Generated k8s network policies are enforceable using any CNI that supports k8s network policies. Yes. Open source Calico does not provide visibility into network flows, however, KubeArmor leverages system call information to derive generic network policies that can be applied using open source Calico CNI.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: venturedive.md

title: "Venture Dive" icon: /images/logos/powered-by/venturedive.png hasLink: "https://www.venturedive.com/" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: KubeVirt (App Definition and Development / Application Definition & Image Build)
File: SECURITY.md

Join the [kubernetes-security-announce] group for security and vulnerability announcements. You can also subscribe to an RSS feed of the above using . Instructions for reporting a vulnerability can be found on the [Kubernetes Security and Disclosure Information] page. Information about supported Kubernetes versions can be found on the [Kubernetes version and version skew support policy] page on the Kubernetes website.
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.5.16.md

layout: release date: 2021-05-29 tag: v0.5.16 Namespace input and chip overlap fix @Ayush-Khandelwal-007 (#3050) [update] Filter UI @Chadha93 (#3005) Add platform support to bash script @navendu-pottekkat (#2997) [mesheryctl] Improved UX for mesheryctl system check --pre @piyushsingariya (#3027) Fix auto publishing release notes @ramrodo (#3040) Fix auto publishing release notes @ramrodo (#3040) reference changed for introducing meshery @Anushka-shukla (#3026)
Project: Harbor (Provisioning / Container Registry)
File: 8-02-Authentication-edit-project-creation-restriction.md

Test 8-02 -Update-project-restrict ======= To verify that an admin user can update project restrict. User guide This test requires that a Harbor instance is running and available. A linux host with Docker CLI installed (Docker client). Login UI as admin user. In configuration page, change Project Creation Restriction from everyone to admin only. Logout admin user. Login as non-admin user. Try to add a project. In step5, non-admin user will not see the add project button. None
Project: Gradle Build Tool (App Definition and Development / Application Definition & Image Build)
File: 0002-avoid-using-java-serialization.md

2012-12-01 In Gradle we often need to serialize in-memory objects for caching, or to transmit them across process barriers, etc. Java serialization is one way to implement this, however, despite its simplicity of implementation, it has several drawbacks: Performance: Java's built-in serialization mechanism is often slower compared to other serialization solutions. This is due to Java's use of reflection and the need to maintain a lot of metadata. Size of Serialized Data: Java serialization tends to produce larger serialized objects because it includes class metadata and other overhead. Flexibility and Control: Java serialization offers limited control over the serialization process, such as excluding certain fields, customizing naming conventions, and handling complex data structures more gracefully. Security: Java serialization poses security risks, especially related to deserialization vulnerabilities. Version Compatibility: With Java serialization, even minor changes to a class (like adding a field) can break compatibility. Cross-Language Compatibility: Java serialization is inherently Java-centric and does not support cross-language scenarios well. Type Safety: Java serialization does not enforce type safety as strictly as some alternatives, potentially leading to runtime errors. We do not use Java serialization. Instead, we use custom serialization where we explicitly describe how data objects should be serialized and deserialized. For internal purposes, we use binary formats for their brevity. We use the `Serializer` abstraction to separate the actual implementation of serialization from its uses. When sharing data with external tools, we use JSON. ACCEPTED The configuration cache serialization infrastructure should be used for all serialization. Existing usages of Serializer outside of this infrastructure should be migrated to use it. Existing usages of Java serialization should be migrated to use it. It is ok for Serializer to be used as a replacement for Java serialization as a migration step. The configuration cache uses the `Serializer`s based on the for most serialization needs.
Project: Apache Hadoop (App Definition and Development / Database)
File: safemode.md

<! Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. See accompanying LICENSE file. --> The `SafeMode` interface provides a way to perform safe mode actions and obtain the status after such actions performed to the `FileSystem`. This is admin only interface, should be implemented accordingly when necessary to Filesystem that support safe mode, e.g. `DistributedFileSystem` (HDFS) and `ViewDistributedFileSystem`. ```java public interface SafeMode { default boolean setSafeMode(SafeModeAction action) throws IOException { return setSafeMode(action, false); } boolean setSafeMode(SafeModeAction action, boolean isChecked) throws IOException; } ``` The goals of this interface is allow any file system implementation to share the same concept of safe mode with the following actions and states `GET`, get the safe mode status of the file system. `ENTER`, enter the safe mode for the file system. `LEAVE`, exit safe mode for the file system gracefully. `FORCE_EXIT`, exit safe mode for the file system even if there is any ongoing data process. return true, when safe mode is on. return false, when safe mode is off, usually it's the result of safe mode actions with `GET`, `LEAVE`, `FORCE_EXIT`.
Project: ArangoDB (App Definition and Development / Database)
File: in_place_type.md

+++ title = "`BOOSTOUTCOMEUSESTDINPLACETYPE`" description = "How to implement `inplacetypet<T>` and `inplace_type<T>`." +++ How to implement {{% api "inplacetypet<T>" %}} and `inplace_type<T>`. If set to `1`, the `<utility>` header is included, and `std::inplacetype_t<T>` is aliased into `BOOSTOUTCOMEV2NAMESPACE::inplacetypet<T>` along with `std::inplacetype<T>`. If set to `0`, a local emulation is used. Overridable: Define before inclusion. Default: If the current compiler implements C++ 17 or later, if unset this macro is defaulted to `1`, otherwise it is defaulted to `0`. Header: `<boost/outcome/config.hpp>`