cwielenb/CNCF-Dataset huggingface dataset:
Project: SuperEdge (Provisioning / Automation & Configuration)
File: CHANGELOG-0.8.md

* * Support Kubernetes 1.22.6 version. ( ) Separate `edgeadm` from superedge project for easy maintenance. Please refer to the sub-project: Support SuperEdge cluster in TKEStack project. Please refer to this pr in () Tunnel support http_proxy ability to enable edge/edge edge/cloud communication. () Lite-apiserver support to cache some critical resourcenode, service, etc) at edge node with the purpose of reducing network traffic. ( ) application-grid-wrapper support to watch `Ingress` resource to enable `nginx-ingress-controller` at NodeUnit. () Add parameters to skip the verification of the domain name and ip signed by the apiserver certificate. () Tunnel supports ExternalName service forwarding. () Lite-apiserver can skip ca verification for serviceaccount. () AMR32 Platform building support .() site-manager: FIX NodeUnit and NodeGroup about setnode () Fix lite-apiserver problem: write cache error () application-grid-controller: Fix metadata.resourceVersion: Invalid value() edgeadm change kubeproxy configmap namespace() edgeadm should not create endpointslice: 'kubernetes-no-edge'() Solve the problem of network error causing cache return failure () Kubernetes 1.22 version: the edge node will obtain the fake token when the apiserver is inaccessible () In v0.8.0 verison, we don't add more big features. The main purpose of this version is to enhance the project's usability and stability. Thanks for the following contributors:
Project: KICS (Provisioning / Security & Compliance)
File: b897dfbf-322c-45a8-b67c-1e698beeaa51.md

title: Admin User Enabled For Container Registry hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b897dfbf-322c-45a8-b67c-1e698beeaa51 Query name: Admin User Enabled For Container Registry Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Admin user is enabled for Container Registry<br> ```tf title="Positive test num. 1 - tf file" hl_lines="11" resource "azurermresourcegroup" "positive1" { name = "resourceGroup1" location = "West US" } resource "azurermcontainerregistry" "positive2" { name = "containerRegistry1" resourcegroupname = azurermresourcegroup.rg.name location = azurermresourcegroup.rg.location sku = "Premium" admin_enabled = true georeplication_locations = ["East US", "West Europe"] } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermresourcegroup" "negative1" { name = "resourceGroup1" location = "West US" } resource "azurermcontainerregistry" "negative2" { name = "containerRegistry1" resourcegroupname = azurermresourcegroup.rg.name location = azurermresourcegroup.rg.location sku = "Premium" admin_enabled = false georeplication_locations = ["East US", "West Europe"] } ```
Project: LinuxKit (Provisioning / Automation & Configuration)
File: docker-for-mac.md

contains an example use of the open source components of Docker for Mac. The example has support for controlling `dockerd` from the host via `vsudd` and port forwarding with VPNKit. It requires HyperKit, VPNKit and a Docker client on the host to run. The easiest way to install these at the moment is to install a recent version of Docker for Mac. To build it with the latest Docker CE: ``` $ linuxkit build -format iso-efi docker-for-mac.yml ``` To run the VM with a 4G disk: ``` linuxkit run hyperkit --networking=vpnkit --vsock-ports=2376 --disk size=4096M --data-file ./metadata.json --iso --uefi docker-for-mac-efi ``` Where the file `./metadata.json` should contain the desired docker daemon configuration, for example: ``` { "docker": { "entries": { "daemon.json": { "content": "{\n \"debug\" : true,\n \"experimental\" : true\n}\n" } } } } ``` In another terminal you should now be able to access docker via the socket `guest.00000948` in the state directory (`docker-for-mac-efi-state/` by default): ``` $ docker -H unix://docker-for-mac-efi-state/guest.00000948 ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES ```
Project: Pinniped (Provisioning / Key Management)
File: pull_request_template.md

<!-- Thank you for submitting a pull request for Pinniped! Before submitting, please see the guidelines in CONTRIBUTING.md in this repo. Please note that a project maintainer will need to review and provide an initial approval on the PR to cause CI tests to automatically start. Also note that if you push additional commits to the PR, those commits will need another initial approval before CI will pick them up. Reminder: Did you remember to run all the linter, unit tests, and integration tests described in CONTRIBUTING.md on your branch before submitting this PR? Below is a template to help you describe your PR. --> <!-- Provide a summary of your change. Feel free to use paragraphs or a bulleted list, for example: Improves performance by 10,000%. Fixes all bugs. Boils the oceans. --> <!-- Does this PR fix one or more reported issues? If yes, use `Fixes #<issue number>` to automatically close the fixed issue(s) when the PR is merged. --> Release note: <!-- Does this PR introduce a user-facing change? If no, just write "NONE" in the release-note block below. If yes, a release note is required. Enter your extended release note in the block below. --> ```release-note ```
Project: external-secrets (Provisioning / Security & Compliance)
File: alibaba.md

External Secrets Operator integrates with for secrets and Keys management. We support Access key and RRSA authentication. To use RRSA authentication, you should follow to assign the RAM role to external-secrets operator. To use `accessKeyID` and `accessKeySecrets`, simply create them as a regular `Kind: Secret` beforehand and associate it with the `SecretStore`: ```yaml apiVersion: v1 kind: Secret metadata: name: secret-sample data: accessKeyID: bXlhd2Vzb21lYWNjZXNza2V5aWQ= accessKeySecret: bXlhd2Vzb21lYWNjZXNza2V5c2VjcmV0 ``` ```yaml apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: secretstore-sample spec: provider: alibaba: regionID: ap-southeast-1 auth: secretRef: accessKeyIDSecretRef: name: secret-sample key: accessKeyID accessKeySecretSecretRef: name: secret-sample key: accessKeySecret ``` When using RRSA authentication we manually project the OIDC token file to pod as volume ```yaml extraVolumes: name: oidc-token projected: sources: serviceAccountToken: path: oidc-token expirationSeconds: 7200 # The validity period of the OIDC token in seconds. audience: "sts.aliyuncs.com" extraVolumeMounts: name: oidc-token mountPath: /var/run/secrets/tokens ``` and provide the RAM role ARN and OIDC volume path to the secret store ```yaml apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: secretstore-sample spec: provider: alibaba: regionID: ap-southeast-1 auth: rrsa: oidcProviderArn: acs:ram::1234:oidc-provider/ack-rrsa-ce123456 oidcTokenFilePath: /var/run/secrets/tokens/oidc-token roleArn: acs:ram::1234:role/test-role sessionName: secrets ``` To create a kubernetes secret from the Alibaba Cloud Key Management Service secret a `Kind=ExternalSecret` is needed. ```yaml apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: example spec: refreshInterval: 1h secretStoreRef: name: secretstore-sample kind: SecretStore target: name: example-secret creationPolicy: Owner data: secretKey: secret-key remoteRef: key: ext-secret ```
Project: The Update Framework (TUF) (Provisioning / Security & Compliance)
File: template.md

Status: ] <!-- optional --> Deciders: [list everyone involved in the decision] <!-- optional --> Date: [YYYY-MM-DD when the decision was last updated] <!-- optional --> Technical Story: [description | ticket/issue URL] <!-- optional --> [Describe the context and problem statement, e.g., in free form using two to three sentences. You may want to articulate the problem in form of a question.] [driver 1, e.g., a force, facing concern, ] [driver 2, e.g., a force, facing concern, ] <!-- numbers of drivers can vary --> [option 1] [option 2] [option 3] <!-- numbers of options can vary --> Chosen option: "[option 1]", because [justification. e.g., only option, which meets k.o. criterion decision driver | which resolves force force | | comes out best (see below)]. [e.g., improvement of quality attribute satisfaction, follow-up decisions required, ] [e.g., compromising quality attribute, follow-up decisions required, ] [example | description | pointer to more information | ] <!-- optional --> Good, because [argument a] Good, because [argument b] Bad, because [argument c] <!-- numbers of pros and cons can vary --> [example | description | pointer to more information | ] <!-- optional --> Good, because [argument a] Good, because [argument b] Bad, because [argument c] <!-- numbers of pros and cons can vary --> [example | description | pointer to more information | ] <!-- optional --> Good, because [argument a] Good, because [argument b] Bad, because [argument c] <!-- numbers of pros and cons can vary --> --> <!-- numbers of links can vary -->
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: CHANGELOG-v2021.01.15.md

title: Changelog | KubeDB description: Changelog menu: docs_{{.version}}: identifier: changelog-kubedb-v2021.01.15 name: Changelog-v2021.01.15 parent: welcome weight: 20210115 product_name: kubedb menuname: docs{{.version}} sectionmenuid: welcome url: /docs/{{.version}}/welcome/changelog-v2021.01.15/ aliases: /docs/{{.version}}/CHANGELOG-v2021.01.15/ Prepare for release v0.1.1 (#10) Prepare for release v0.3.1 (#122) Update Elasticsearch Vertical Scaling (#120) Fix mongodb config directory name constants (#121) Fix mongodb config directory name constants (#687) Prepare for release v0.16.1 (#579) Prepare for release v0.16.1 (#457) Prepare for release v0.16.1 (#225) Prepare for release v0.9.1 (#273) Prepare for release v0.9.1 (#356) Fix mongodb config directory name constants (#355) Prepare for release v0.9.1 (#344) Prepare for release v0.16.1 (#381) Prepare for release v0.3.1 (#168) Update readme Prepare for release v0.3.1 (#134) Prepare for release v0.16.1 (#457) Prepare for release v0.3.1 (#149) Prepare for release v0.9.1 (#295) Prepare for release v0.3.1 (#119) Prepare for release v0.1.1 (#89)
Project: Scylla (App Definition and Development / Database)
File: README.md

Tests for the Scylla REST API. Tests use the requests library and the pytest frameworks (both are available from Linux distributions, or with "pip install"). To run all tests using test.py, just run `./test.py api/run`. To run all tests against an already-running local installation of Scylla, just run `pytest`. The "--host" and "--api-port" can be used to give a different location for the running Scylla. More conveniently, we have a script - "run" - which does all the work necessary to start Scylla, and run the tests on it. The Scylla process is run in a temporary directory which is automatically deleted when the test ends. "run" automatically picks the most recently compiled version of Scylla in `build/*/scylla` - but this choice of Scylla executable can be overridden with the `SCYLLA` environment variable. Additional options can be passed to "pytest" or to "run" to control which tests to run: To run all tests in a single file, do `pytest test_system.py`. To run a single specific test, do `pytest testsystem.py::testsystemuptimems`. To run the same test or tests 100 times, add the `--count=100` option. This is faster than running `run` 100 times, because Scylla is only run once, and also counts for you how many of the runs failed. For `pytest` to support the `--count` option, you need to install a pytest extension: `pip install pytest-repeat` Additional useful pytest options, especially useful for debugging tests: -v: show the names of each individual test running instead of just dots. -s: show the full output of running tests (by default, pytest captures the test's output and only displays it if a test fails)
Project: KICS (Provisioning / Security & Compliance)
File: e71d0bc7-d9e8-4e6e-ae90-0a4206db6f40.md

title: Root Account Has Active Access Keys hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e71d0bc7-d9e8-4e6e-ae90-0a4206db6f40 Query name: Root Account Has Active Access Keys Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: The AWS Root Account must not have active access keys associated, which means if there are access keys associated to the Root Account, they must be inactive.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3" name: Create two new IAM users with API keys community.aws.iam: iam_type: user name: "{{ root }}" state: present password: "{{ temp_pass }}" accesskeystate: active loop: jcleese mpython ``` ```yaml title="Negative test num. 1 - yaml file" name: Create two new IAM users with API keys community.aws.iam: iam_type: user name: '{{ root }}' state: present password: '{{ temp_pass }}' accesskeystate: inactive loop: jcleese mpython ```
Project: KICS (Provisioning / Security & Compliance)
File: 6938958b-3f1a-451c-909b-baeee14bdc97.md

title: Multiple ENTRYPOINT Instructions Listed hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6938958b-3f1a-451c-909b-baeee14bdc97 Query name: Multiple ENTRYPOINT Instructions Listed Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Build Process URL: There can only be one ENTRYPOINT instruction in a Dockerfile. Only the last ENTRYPOINT instruction in the Dockerfile will have an effect<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="11" FROM golang:1.7.3 WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go . RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=0 /go/src/github.com/foo/href-counter/app . ENTRYPOINT [ "/opt/app/run.sh", "--port", "8080" ] ENTRYPOINT [ "/opt/app/run.sh", "--port", "8000" ] ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM golang:1.7.3 WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go . RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . ENTRYPOINT [ "/opt/app/run.sh", "--port", "8080" ] FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=0 /go/src/github.com/foo/href-counter/app . ENTRYPOINT [ "/opt/app/run.sh", "--port", "8080" ] ``` ```dockerfile title="Negative test num. 2 - dockerfile file" FROM golang:1.16 AS builder WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go ./ RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . ENTRYPOINT [ "/opt/app/run.sh", "--port", "8080" ] ENTRYPOINT [ "/opt/app/run.sh", "--port", "8000" ] FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=builder /go/src/github.com/foo/href-counter/app ./ CMD ["./app"] RUN useradd -ms /bin/bash patrick USER patrick ```
Project: Meshery (Provisioning / Automation & Configuration)
File: vitess.md

layout: integration title: Vitess subtitle: Collaborative and visual infrastructure as code for Vitess image: /assets/img/integrations/vitess/icons/color/vitess-color.svg permalink: extensibility/integrations/vitess docURL: https://docs.meshery.io/extensibility/integrations/vitess description: integrations-category: App Definition and Development integrations-subcategory: Database registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: YugabyteDB (App Definition and Development / Database)
File: dataedo.md

title: Dataedo linkTitle: Dataedo description: Use Dataedo with YSQL API menu: preview_integrations: identifier: dataedo parent: data-discovery weight: 571 type: docs is a powerful database documentation tool and metadata repository that allows you to collaboratively catalog, describe and classify your data in the data dictionary, build linked business glossary, explain and visualize data model with ERDs, and share everything in accessible HTML pages, PDFs, and so on. Because YugabyteDB's YSQL API is wire-compatible with PostgreSQL, Dataedo can connect to YugabyteDB as a data source as it already supports . Your YugabyteDB cluster should be up and running. Refer to . Follow the steps in to connect the database. Perform the following modifications as part of the connection steps: Select PostgreSQL as the database type but provide the configuration to connect to YugabyteDB. Dataedo can connect to YugabyteDB considering it as PostgreSQL. Change the port from `5432` to `5433`.
Project: ClickHouse (App Definition and Development / Database)
File: v20.8.3.18-stable.md

Backported in : Allow using multi-volume storage configuration in storage Distributed. (). Speed up server shutdown process if there are ongoing S3 requests. (). Backported in : Fix rare segfaults in functions with combinator -Resample, which could appear in result of overflow with very large parameters. (). Backported in : Cleanup data directory after Zookeeper exceptions during CreateQuery for StorageReplicatedMergeTree Engine. (). Backported in : Added the checker as neither calling `lc->isNullable()` nor calling `ls->getDictionaryPtr()->isNullable()` would return the correct result. (). Backported in : Fix wrong Decimal multiplication result caused wrong decimal scale of result column. (). Backported in : Fix bug when `ALTER UPDATE` mutation with Nullable column in assignment expression and constant value (like `UPDATE x = 42`) leads to incorrect value in column or segfault. Fixes , . (). Backported in : Fixed missed default database name in metadata of materialized view when executing `ALTER ... MODIFY QUERY`. (). Backported in : Fix SIGSEGV for an attempt to INSERT into StorageFile(fd). (). Backported in : Fix the issue when some invocations of `extractAllGroups` function may trigger "Memory limit exceeded" error. This fixes . ().
Project: KICS (Provisioning / Security & Compliance)
File: 9a205ba3-0dd1-42eb-8d54-2ffec836b51a.md

title: Role With Privilege Escalation By Actions 'iam:CreateLoginProfile' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9a205ba3-0dd1-42eb-8d54-2ffec836b51a Query name: Role With Privilege Escalation By Actions 'iam:CreateLoginProfile' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Role with privilege escalation by actions 'iam:CreateLoginProfile' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamrole" "cosmic" { name = "cosmic" } resource "awsiamrolepolicy" "testinline_policy" { name = "testinlinepolicy" role = awsiamrole.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:CreateLoginProfile", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Qdrant (App Definition and Development / Database)
File: roadmap-2022.md

This document describes what features and milestones were planned and achieved in 2022. The main goals for the 2022 year were: Make API and Storage stable* - ensure backward compatibility for at least one major version back. Starting from the release, breaking changes in API should only be done with a proper deprecation notice Storage should be compatible between any two consequent major versions Achieve horizontal scalability* - distributed deployment able to serve billions of points Easy integration* - make the user experience as smooth as possible Resource efficiency* - push Qdrant performance on the single machine to the limit :earth_americas: Distributed Deployment [x] Distributed querying for distributed consistency [x] Sharding - group segments into shards [x] Cluster scaling [x] Replications - automatic segment replication between nodes in cluster :electric_plug: Integration & Interfaces [x] gPRC version of each REST API endpoint [x] Split REST Endpoints for better documentation and client generation :truck: Payload Processing [x] Support storing any JSON as a Payload [ ] Support more payload types, e.g. Data-time [x] Support for `Null` values [x] Enable more types of filtering queries, e.g. [x] Filter by Score [x] Filter by number of stored elements [x] `isNull` or `isEmpty` query conditions Additionally [x] Full-text filtering support [x] Multiple vectors per record support :racing_car: Performance improvements [x] Indexing of geo-payload [x] On the fly payload index [x] Multiprocessing segment optimization [x] Fine-tuned HNSW index configuration