cwielenb/CNCF-Dataset huggingface dataset:
Project: Druid (App Definition and Development / Database)
File: topnmetricspec.md

id: topnmetricspec title: "Sorting (topN)" <!-- ~ Licensed to the Apache Software Foundation (ASF) under one ~ or more contributor license agreements. See the NOTICE file ~ distributed with this work for additional information ~ regarding copyright ownership. The ASF licenses this file ~ to you under the Apache License, Version 2.0 (the ~ "License"); you may not use this file except in compliance ~ with the License. You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, ~ software distributed under the License is distributed on an ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ~ KIND, either express or implied. See the License for the ~ specific language governing permissions and limitations ~ under the License. --> :::info Apache Druid supports two query languages: and . This document describes the native language. For information about sorting in SQL, refer to the . ::: In Apache Druid, the topN metric spec specifies how topN values should be sorted. The simplest metric specification is a String value indicating the metric to sort topN results by. They are included in a topN query with: ```json "metric": "<metric_name>" ``` The metric field can also be given as a JSON object. The grammar for dimension values sorted by numeric value is shown below: ```json "metric": { "type": "numeric", "metric": "<metric_name>" } ``` |property|description|required?| |--|--|| |type|this indicates a numeric sort|yes| |metric|the actual metric field in which results will be sorted by|yes| This metric specification sorts TopN results by dimension value, using one of the sorting orders described here: |property|type|description|required?| |--|-|--|| |type|String|this indicates a sort a dimension's values|yes, must be 'dimension'| |ordering|String|Specifies the sorting order. Can be one of the following values: "lexicographic", "alphanumeric", "numeric", "strlen". See for more details.|no, default: "lexicographic"| |previousStop|String|the starting point of the sort. For example, if a previousStop value is 'b', all values before 'b' are discarded. This field can be used to paginate through all the dimension values.|no| The following metricSpec uses lexicographic sorting. ```json "metric": { "type": "dimension", "ordering": "lexicographic", "previousStop": "<previousStop_value>" } ``` Note that in earlier versions of Druid, the functionality provided by the DimensionTopNMetricSpec was handled by two separate spec types, Lexicographic and Alphanumeric (when only two sorting orders were supported). These spec types have been deprecated but are still usable. Sort dimension values in inverted order, i.e inverts the order of the delegate metric spec. It can be used to sort the values in ascending order. ```json "metric": { "type": "inverted", "metric": <delegatetopnmetricspec> } ``` |property|description|required?| |--|--|| |type|this indicates an inverted sort|yes| |metric|the delegate metric spec. |yes|
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-ref-syntax-aux-cache-refresh-table.md

layout: global title: REFRESH TABLE displayTitle: REFRESH TABLE license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. `REFRESH TABLE` statement invalidates the cached entries, which include data and metadata of the given table or view. The invalidated cache is populated in lazy manner when the cached table or the query associated with it is executed again. ```sql REFRESH [TABLE] table_identifier ``` table_identifier* Specifies a table name, which is either a qualified or unqualified name that designates a table/view. If no database identifier is provided, it refers to a temporary view or a table/view in the current database. Syntax: `[ databasename. ] tablename` ```sql -- The cached entries of the table will be refreshed -- The table is resolved from the current database as the table name is unqualified. REFRESH TABLE tbl1; -- The cached entries of the view will be refreshed or invalidated -- The view is resolved from tempDB database, as the view name is qualified. REFRESH TABLE tempDB.view1; ```
Project: SPIRE (Provisioning / Key Management)
File: plugin_server_upstreamauthority_disk.md

The `disk` plugin loads CA credentials from disk, using them to generate intermediate signing certificates for the server's signing authority. The intermediate certificates are minted against CSRs generated by the ServerCA plugin. The `disk` plugin reloads CA credentials on all CSR requests. If the credentials cannot be loaded, then the previously loaded credentials will be used. This provides two things: first, it ensures that the spire-server process does not need to be restarted to load a new UpstreamAuthority from disk, providing a seamless rotation; second, it ensures that a failed disk does not effect a running spire-server until the loaded UpstreamAuthority expires. The plugin accepts the following configuration options: | Configuration | Description | ||| | certfilepath | If SPIRE is using a self-signed CA, `certfilepath` should specify the path to a single PEM encoded certificate representing the upstream CA certificate. If not self-signed, `certfilepath` should specify the path to a file that must contain one or more certificates necessary to establish a valid certificate chain up the root certificates defined in `bundlefilepath`. | | keyfilepath | Path to the "upstream" CA key file. Key files must contain a single PEM encoded key. The supported key types are EC (ASN.1 or PKCS8 encoded) or RSA (PKCS1 or PKCS8 encoded). | | bundlefilepath | If SPIRE is using a self-signed CA, `bundlefilepath` can be left unset. If not self-signed, then `bundlefilepath` should be the path to a file that must contain one or more certificates representing the upstream root certificates and the file at certfilepath contains one or more certificates necessary to chain up the root certificates in bundlefilepath (where the first certificate in certfilepath is the upstream CA certificate). | The `disk` plugin is able to function as either a root CA, or join an existing PKI. When joining an existing PKI, the trust bundle for that PKI MUST be set explicitly using the `bundlefilepath` option; this MUST contain the certificates of the trusted roots for the PKI being joined in PEM format. When using the `bundlefilepath` option `certfilepath` MUST contain a chain of certificates, in PEM format, up to the trusted root. When functioning as a root CA, the trust bundle is unused. The `certfilepath` MUST contain exactly one certificate which is self-signed and `keyfilepath` MUST contain the key for that certificate. Key files must contain a single PEM encoded key. The supported key types are EC (ASN.1 or PKCS8 encoded) or RSA (PKCS1 or PKCS8 encoded). A sample configuration: ```hcl UpstreamAuthority "disk" { plugin_data { certfilepath = "conf/server/dummyupstreamca.crt" keyfilepath = "conf/server/dummyupstreamca.key" } } ```
Project: Apache Hadoop (App Definition and Development / Database)
File: RELEASENOTES.3.0.2.md

<! --> These release notes cover new developer and user-facing incompatibilities, important issues, features, and major improvements. | Major | Apache Hadoop release 3.0.2 to fix deploying shaded jars in artifacts.* Release Apache Hadoop 3.0.2 on the same code base as Hadoop 3.0.1, but deploy with shaded jars.
Project: KICS (Provisioning / Security & Compliance)
File: 221e0658-cb2a-44e3-b08a-db96a341d6fa.md

title: Pids Limit Not Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 221e0658-cb2a-44e3-b08a-db96a341d6fa Query name: Pids Limit Not Set Platform: DockerCompose Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: 'pids_limit' should be set and different than -1<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" version: '2.2' volumes: front_build: services: auth: build: context: . dockerfile: docker_config/Dockerfile restart: on-failure cpus: 0.25 mem_limit: 500M ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="12" version: '2.2' volumes: front_build: services: auth: build: context: . dockerfile: docker_config/Dockerfile restart: on-failure pids_limit: -1 cpus: 0.25 mem_limit: 500M ``` ```yaml title="Negative test num. 1 - yaml file" version: '2.2' volumes: front_build: services: auth: build: context: . dockerfile: docker_config/Dockerfile restart: on-failure pids_limit: 10 cpus: 0.25 mem_limit: 500M ```
Project: TDengine (App Definition and Development / Database)
File: 07-tag-index.md

sidebar_label: Tag Index title: Tag Index description: Use Tag Index to Improve Query Performance Prior to TDengine 3.0.3.0 (excluded), only one index is created by default on the first tag of each super table, but it's not allowed to dynamically create index on any other tags. From version 3.0.30, you can dynamically create index on any tag of any type. The index created automatically by TDengine is still valid. Query performance can benefit from indexes if you use properly. The syntax of creating an index ```sql CREATE INDEX indexname ON tblname (tagColName) ``` In the above statement, `indexname` if the name of the index, `tblname` is the name of the super table,`tagColName` is the name of the tag on which the index is being created. `tagColName` can be any type supported by TDengine. The syntax of drop an index ```sql DROP INDEX index_name ``` In the above statement, `index_name` is the name of an existing index. If the index doesn't exist, the command would fail but doesn't generate any impact to the system. The syntax of show indexes in the system ```sql SELECT * FROM informationschema.INSINDEXES ``` You can also add filter conditions to limit the results. ````sql SHOW INDEXES FROM tblname [FROM dbname]; SHOW INDEXES FROM [dbname.]tblname ; ```` Use `show indexes` commands to show indices that have been created for the specified database or table. Indexes can improve query performance significantly if they are used properly. The operators supported by tag index include `=`, `>`, `>=`, `<`, `<=`. If you use these operators with tags, indexes can improve query performance significantly. However, for operators not in this scope, indexes don't help. More and more operators will be added in future. Only one index can be created on each tag, error would be reported if you try to create more than one indexes on same tag. Each time you can create an index on a single tag, you are not allowed to create indexes on multiple tags together. The name of each index must be unique across the whole system, regardless of the type of the index, e.g. tag index or sma index. There is no limit on the number of indexes, but each index may add some burden on the metadata subsystem. So too many indexes may decrease the efficiency of reading or writing metadata and then decrease the system performance. So it's better not to add unnecessary indexes. You can' create index on a normal table or a child table. If the unique values of a tag column are too few, it's better not to create index on such tag columns, the benefit would be very small. The newly created super table will randomly generate an index name for the first column of tags, which is composed of the name tag0 column with 23 random bytes, and can be rebuilt or dropped.
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-completion.1.md

% podman-completion 1 podman\-completion - Generate shell completion scripts podman completion [options] bash | zsh | fish | powershell podman completion generates shell completion scripts for a variety of shells. Supported shells are bash, zsh, fish and powershell. These script are used by the shell to provide suggestions and complete commands when the command is typed and `[TAB]` is pressed. Usually these scripts are automatically installed via the package manager. Write the generated output to a file. Do not provide description in the completions.\ The default is false. `bash-completion` has to be installed on the system. To load the completion script into the current session run: ``` source <(podman completion bash) ``` To make it available for all bash sessions run: ``` podman completion -f /etc/bash_completion.d/podman bash ``` Shell completion needs to be already enabled in the environment. The following can be executed: ``` echo "autoload -U compinit; compinit" >> ~/.zshrc ``` To make it available for all zsh sessions run: ``` podman completion -f "${fpath[1]}/_podman" zsh ``` Once the shell is reloaded the auto-completion works. To load the completion script into the current session run: ``` podman completion fish | source ``` To make it available for all fish sessions run: ``` podman completion -f ~/.config/fish/completions/podman.fish fish ``` To load the completion script into the current session run: ``` podman.exe completion powershell | Out-String | Invoke-Expression ``` To make it available in all powershell sessions that a user has, write the completion output to a file and source that to the user's powershell profile. More information about profiles is available with Get-Help about_Profiles. , zsh(1), fish(1), powershell(1)
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: api-report-playwright.md

Do not edit this file. It is a report generated by . ```ts import { PlaywrightTestConfig } from '@playwright/test'; // @public export function failOnBrowserErrors(): void; // @public export function generateProjects(): PlaywrightTestConfig['projects']; // (No @packageDocumentation comment for this package) ```
Project: Polaris (Provisioning / Security & Compliance)
File: efficiency.md

meta: name: description content: "Fairwinds Polaris | Ensure that CPU and memory settings are configured, so that Kubernetes can schedule your workload effectively" These checks ensure that CPU and memory settings are configured, so that Kubernetes can schedule your workload effectively. To simplify ensure that these values have been set, the following attributes are available: key | default | description -|| `cpuRequestsMissing` | `warning` | Fails when `resources.requests.cpu` attribute is not configured. `memoryRequestsMissing` | `warning` | Fails when `resources.requests.memory` attribute is not configured. `cpuLimitsMissing` | `warning` | Fails when `resources.limits.cpu` attribute is not configured. `memoryLimitsMissing` | `warning` | Fails when `resources.limits.memory` attribute is not configured. Configuring resource requests and limits for containers running in Kubernetes is an important best practice to follow. Setting appropriate resource requests will ensure that all your applications have sufficient compute resources. Setting appropriate resource limits will ensure that your applications do not consume too many resources. Having these values appropriately configured ensures that: Cluster autoscaling can function as intended. New nodes are scheduled once pods are unable to be scheduled on an existing node due to insufficient resources. This will not happen if resource requests are not configured. Each container has sufficient access to compute resources. Without resource requests, a pod may be scheduled on a node that is already overutilized. Without resource limits, a single poorly behaving pod could utilize the majority of resources on a node, significantly impacting the performance of other pods on the same node.
Project: KICS (Provisioning / Security & Compliance)
File: 2b3c8a6d-9856-43e6-ab1d-d651094f03b4.md

title: EMR Without VPC hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2b3c8a6d-9856-43e6-ab1d-d651094f03b4 Query name: EMR Without VPC Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: Elastic MapReduce Cluster (EMR) should be launched in a Virtual Private Cloud (VPC)<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsemrcluster" "positive1" { name = "emr-test-arn" release_label = "emr-4.6.0" } ``` ```tf title="Negative test num. 1 - tf file" resource "awsemrcluster" "negative1" { name = "emr-test-arn" release_label = "emr-4.6.0" subnetid = awssubnet.main.id } ```
Project: KICS (Provisioning / Security & Compliance)
File: 874d68a3-bfbe-4a4b-aaa0-9e74d7da634b.md

title: Certificate RSA Key Bytes Lower Than 256 hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 874d68a3-bfbe-4a4b-aaa0-9e74d7da634b Query name: Certificate RSA Key Bytes Lower Than 256 Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: The certificate should use a RSA key with a length equal to or higher than 256 bytes<br> ```tf title="Positive test num. 1 - tf file" hl_lines="2" resource "awsapigatewaydomainname" "example" { certificate_body = file("./rsa1024.pem") domain_name = "api.example.com" } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="3" resource "awsiamservercertificate" "testcert2" { name = "sometestcert" certificate_body = file("./rsa1024.pem") private_key = <<EOF --BEGIN RSA PRIVATE KEY-- [......] # cert contents --END RSA PRIVATE KEY-- EOF } ``` ```tf title="Negative test num. 1 - tf file" resource "awsapigatewaydomainname" "example3" { certificate_body = file("./rsa4096.pem") domain_name = "api.example.com" } ``` ```tf title="Negative test num. 2 - tf file" resource "awsiamservercertificate" "testcert22" { name = "sometestcert" certificate_body = file("./rsa4096.pem") private_key = <<EOF --BEGIN RSA PRIVATE KEY-- [......] # cert contents --END RSA PRIVATE KEY-- EOF } ```
Project: Beam (App Definition and Development / Streaming & Messaging)
File: industrialtechnologyresearchinstitute.md

title: "Industrial Technology Research Institute" icon: /images/logos/powered-by/industrialtechnologyresearchinstitute.png hasLink: "https://www.itri.org.tw/" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: seccomp-policy.md

Specify the policy to select the seccomp profile. If set to image, Podman looks for a "io.containers.seccomp.profile" label in the container-image config and use its value as a seccomp profile. Otherwise, Podman follows the default policy by applying the default profile unless specified otherwise via --security-opt seccomp as described below. Note that this feature is experimental and may change in the future.
Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: operator-sdk_generate_kustomize.md

title: "operator-sdk generate kustomize" Contains subcommands that generate operator-framework kustomize data for the operator ``` -h, --help help for kustomize ``` ``` --plugins strings plugin keys to be used for this subcommand execution --verbose Enable verbose logging ``` - Invokes a specific generator - Generates kustomize bases and a kustomization.yaml for operator-framework manifests
Project: KICS (Provisioning / Security & Compliance)
File: 11e7550e-c4b6-472e-adff-c698f157cdd7.md

title: Network Policy Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 11e7550e-c4b6-472e-adff-c698f157cdd7 Query name: Network Policy Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Kubernetes Engine Clusters must have Network Policy enabled, meaning that the attribute 'networkpolicy.enabled' must be true and the attribute 'addonsconfig.networkpolicyconfig.disabled' must be false <br> ```tf title="Positive test num. 1 - tf file" hl_lines="2 16 48 86 30 63" resource "googlecontainercluster" "positive1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 network_policy { enabled = true } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive2" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 network_policy { enabled = true } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive3" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive4" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 network_policy { enabled = true } addons_config { } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive5" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 network_policy { enabled = false } addons_config { networkpolicyconfig { disabled = false } } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive6" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 network_policy { enabled = true } addons_config { networkpolicyconfig { disabled = true } } timeouts { create = "30m" update = "40m" } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecontainercluster" "negative1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 network_policy { enabled = true } addons_config { networkpolicyconfig { disabled = false } } networkingmode = "VPCNATIVE" timeouts { create = "30m" update = "40m" } } ```
Project: KICS (Provisioning / Security & Compliance)
File: 91dacd0e-d189-4a9c-8272-5999a3cc32d9.md

title: PSP Allows Sharing Host PID hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 91dacd0e-d189-4a9c-8272-5999a3cc32d9 Query name: PSP Allows Sharing Host PID Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Pod Security Policy allows containers to share the host process ID namespace<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: example spec: hostPID: true seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny runAsUser: rule: RunAsAny fsGroup: rule: RunAsAny ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: example spec: hostPID: false seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny runAsUser: rule: RunAsAny fsGroup: rule: RunAsAny ```