cwielenb/CNCF-Dataset huggingface dataset:
Project: Weaviate (App Definition and Development / Database)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to make participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies within all project spaces, and it also applies when an individual is representing the project or its community in public spaces. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at laura@semi.technology. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq
Project: ThreatMapper (Provisioning / Security & Compliance)
File: troubleshooting.md

title: Troubleshooting In Amazon Linux / RHEL, number of open files per container has to be configured. ```shell $ cat /etc/sysconfig/docker DAEMON_MAXFILES=1048576 OPTIONS=" default-ulimit nofile=1024:4096" ``` You can change the desired value as below. ```shell OPTIONS=" default-ulimit nofile=1024000:1024000" ``` Restart Docker daemon If you have not configured and need to reset the password, please follow these steps ```shell docker exec -it deepfence-server bash -c "/usr/local/bin/deepfence_server --reset-password" ``` :::note If the helm chart name was customized, please change the deployment name accordingly ```shell kubectl get deploy --namespace deepfence-console ``` ::: ```shell kubectl exec -it deploy/deepfence-console-server \ -c server \ --namespace deepfence-console \ -- bash -c "/usr/local/bin/deepfence_server --reset-password" ```
Project: Pomerium (Provisioning / Key Management)
File: REAME.md

Run this demo locally on your docker-compose capable workstation, or replace `localhost.pomerium.io` with your own domain if running on a server. Authentication and Authorization managed by pomerium Update `config.yaml` for your e-mail address, if not using gmail/google. Replace secrets in `config.yaml`. Replace `email.is` in `config.yaml` Configure read-only or writer users by changing readers and writers parameter of tiddlywiki in `docker-compose.yaml`. Run `docker-compose up` from this directory. Navigate to `https://wiki.localhost.pomerium.io`
Project: external-secrets (Provisioning / Security & Compliance)
File: yandex-certificate-manager.md

External Secrets Operator integrates with for secret management. At the moment, authentication is only supported: Create a in Yandex.Cloud: ```bash yc iam service-account create --name eso-service-account ``` Create an authorized key for the service account and save it to `authorized-key.json` file: ```bash yc iam key create \ --service-account-name eso-service-account \ --output authorized-key.json ``` Create a k8s secret containing the authorized key saved above: ```bash kubectl create secret generic yc-auth --from-file=authorized-key=authorized-key.json ``` Create a pointing to `yc-auth` k8s secret: ```yaml apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: secret-store spec: provider: yandexcertificatemanager: auth: authorizedKeySecretRef: name: yc-auth key: authorized-key ``` NOTE: In case of a `ClusterSecretStore`, Be sure to provide `namespace` in all `authorizedKeySecretRef` with the namespace where the secret resides. To make External Secrets Operator sync a k8s secret with a Certificate Manager certificate: Create a Certificate Manager certificate (follow ), if not already created. Assign the role for accessing the certificate content to the service account used for authentication (`*` is the certificate ID): ```bash yc cm certificate add-access-binding \ --id * \ --service-account-name eso-service-account \ --role certificate-manager.certificates.downloader ``` Run the following command to ensure that the correct access binding has been added: ```bash yc cm certificate list-access-bindings --id * ``` Create an pointing to `secret-store` and the certificate in Certificate Manager: ```yaml apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: external-secret spec: refreshInterval: 1h secretStoreRef: name: secret-store kind: SecretStore target: name: k8s-secret # the target k8s secret name template: type: kubernetes.io/tls data: secretKey: tls.crt # the target k8s secret key remoteRef: key: * # the certificate ID property: chain secretKey: tls.key # the target k8s secret key remoteRef: key: * # the certificate ID property: privateKey ``` The following property values are possible: `chain` to fetch PEM-encoded certificate chain `privateKey` to fetch PEM-encoded private key `chainAndPrivateKey` or missing property to fetch both chain and private key The operator will fetch the Yandex Certificate Manager certificate and inject it as a `Kind=Secret` ```yaml kubectl get secret k8s-secret -ojson | jq '."data"."tls.crt"' -r | base64 --decode kubectl get secret k8s-secret -ojson | jq '."data"."tls.key"' -r | base64 --decode ```
Project: YugabyteDB (App Definition and Development / Database)
File: publish.md

title: PUBLISH linkTitle: PUBLISH description: PUBLISH menu: preview: parent: api-yedis weight: 2551 aliases: /preview/api/redis/publish /preview/api/yedis/publish type: docs `PUBLISH channel message` This command publishes the given message to the specified channel. All subscribers that are subscribed to the specified channel across all the Yugabyte YEDIS API server(s) in the cluster will receive the message. Returns, as an integer value, the number of subscribers that the message was forwarded to. ```sh $ PUBLISH channel message ``` ``` 2 ``` , , , ,
Project: KICS (Provisioning / Security & Compliance)
File: ec49cbfd-fae4-45f3-81b1-860526d66e3f.md

title: Group With Privilege Escalation By Actions 'iam:CreatePolicyVersion' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ec49cbfd-fae4-45f3-81b1-860526d66e3f Query name: Group With Privilege Escalation By Actions 'iam:CreatePolicyVersion' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Group with privilege escalation by actions 'iam:CreatePolicyVersion' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamgroup" "cosmic" { name = "cosmic" } resource "awsiamgrouppolicy" "testinline_policy" { name = "testinlinepolicy" group = awsiamgroup.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:CreatePolicyVersion", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Hexa (Provisioning / Security & Compliance)
File: SECURITY.md

Hexa Policy Orchestrator follows similar security policy as other CNCF projects. Please report any security bugs privately to the maintainers listed in the file. We will fix the issue and coordinate a release date, acknowledging your effort. Hexa consists of a number of services (see Docker-compose) which work together to demonstrate the control and management of policy. The Hexa Administration application is a web based graphical interface used to administer Hexa and IDQL Policy. When deployed in a shared environment (outside of development) Hexa-Admin must be deployed behind a secured web proxy in order to authenticate user sessions and enforce RBAC policy as Hexa-Admin does not implement its own access control system. The long-term intent is to leverage authentication providers (e.g. OpenID Connect), establish browser sessions, and enforce access management using IDQL. Hexa Orchestrator is the internal API gateway through which policy provisioning and retrieval takes place. Requests from Hexa-Admin and other container clients are secured using which implements a form of . Note The credentials used within this repository are for testing. Please create new credentials for your environment. In the current implementation HAWK verifies that the request URI used by the client matches the configured request URI. You will need to ensure Hexa-Admin and Hexa-Orchestrator use the same domain and port numbers or requests will fail. When deployed in a container framework such as Kubernetes, the Hexa-Orcha API is not normally exposed for external ingress. Eventually the orchestrator shall be expanded to support common API authentication methods such as JWT tokens, PATs, and sender constrained tokens such as . Hexa currently uses PostgreSQL to store provider service account credentials. Please ensure your PostgreSQL instance and client connection is secure. More information can be found below - The docker-compose configuration does not normally expose the database outside of docker. If you get a network connection refused message in Hexa Orchestrator (e.g. beause Hexa Orchestrator is not running inside Docker), then port 5432 will need to be exposed by the postgresql container by revising your docker-compose.yml.
Project: YugabyteDB (App Definition and Development / Database)
File: ddl_use.md

title: USE statement [YCQL] headerTitle: USE linkTitle: USE description: Use the USE statement to specify a default keyspace for the current client session. menu: v2.18: parent: api-cassandra weight: 1290 type: docs Use the `USE` statement to specify a default keyspace for the current client session. When a database object (such as or ) name does not identify a keyspace, this default keyspace is used. <svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="181" height="35" viewbox="0 0 181 35"><path class="connector" d="M0 22h5m45 0h10m116 0h5"/><rect class="literal" x="5" y="5" width="45" height="25" rx="7"/><text class="text" x="15" y="22">USE</text><a xlink:href="../grammardiagrams#keyspace-name"><rect class="rule" x="60" y="5" width="116" height="25"/><text class="text" x="70" y="22">keyspacename</text></a></svg> ```ebnf usekeyspace ::= USE keyspacename; ``` Where `keyspace_name` must be an identifier that cannot be any reserved keyword and cannot contains whitespaces, or it has to be double-quoted. If the specified keyspace does not exist, an error is raised. Any unqualified table or type name will use the current default keyspace (or raise an error if no keyspace is set). ```sql ycqlsh> CREATE KEYSPACE example; ``` ```sql ycqlsh> CREATE KEYSPACE other_keyspace; ``` ```sql ycqlsh> USE example; ``` ``` sql ycqlsh:example> CREATE TABLE test(id INT PRIMARY KEY); ycqlsh:example> INSERT INTO test(id) VALUES (1); ycqlsh:example> SELECT * FROM test; ``` ```output id 1 ``` ``` sql ycqlsh:example> CREATE TABLE other_keyspace.test(id INT PRIMARY KEY); ycqlsh:example> INSERT INTO other_keyspace.test(id) VALUES (2); ycqlsh:example> SELECT * FROM other_keyspace.test; ``` ```output id 2 ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-network-exists.1.md

% podman-network-exists 1 podman\-network\-exists - Check if the given network exists podman network exists network podman network exists checks if a network exists. The Name or ID of the network may be used as input. Podman returns an exit code of `0` when the network is found. A `1` is returned otherwise. An exit code of `125` indicates there was another issue. Print usage statement Check if specified network exists (the network does actually exist): ``` $ podman network exists net1 $ echo $? 0 ``` Check if nonexistent network exists: ``` $ podman network exists webbackend $ echo $? 1 ``` , January 2021, Originally compiled by Paul Holzinger `<paul.holzinger@web.de>`
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: test-case-validation.md

id: test-case-validation title: Validate your OpenAPI spec against test data description: Documentation on how to use the `repo schema openapi test` command. This is primarily performed by `backstage-repo-tools repo schema openapi test`. Any errors found in the generated specs can be either Fixed manually, this is usually relevant for request body or response body changes. Fixed automatically with `backstage-repo-tools repo schema openapi test --update`. Fixing the test case. This can happen where a response is mocked as ```ts it('should return the right value', () => { // We will assume that this is the actual response and update the spec accordingly. // Ideally, this should be a fully populated return value. const entity: Entity = {} as any; app.get('/test', () => { return entity; }); const response = await request(app).get('/test'); expect(response.body).toEqual(entity); }); ``` will cause an invalid spec validation. The return value doesn't have all properties as defined in the type. Try to avoid this if possible. Something better would be, ```ts it('should return the right value', () => { // We will assume that this is the actual response and update the spec accordingly. // Ideally, this should be a fully populated return value. const entity: Entity = { apiVersion: 'a1', kind: 'k1', metadata: { name: 'n1' }, }; app.get('/test', () => { return entity; }); const response = await request(app).get('/test'); expect(response.body).toEqual(entity); }); ``` Additionally, for more advanced use cases, you can run `yarn optic capture {PATHTOOPENAPI_FILE} --update interactive` and go through the prompts on the screen. Under the hood, the test validation + updating is done by , a great project around supporting OpenAPI specs and development. You can find additional options .
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: v1.6.3.md

All Actor APIs return errors without an actor state store component being provided. This is the correct behavior for services that register actors, as they require state storage, but clients that invoke actors should operate with or without an actor state store. The code that initializes the Actor API raises an error when there is no actor state storage component available, regardless of whether or not the service registers actors. This fix changes the actor runtime initialization logic such that, when there is no actor state store available, the API will initialize correctly as long as the service does not register actors. As a result, the Actor API will be available to services acting only as clients (i.e invoking actors) with or without an actor state store component; the Actor API will continue to be unavailable in those services that register actors without providing an actor state store component.
Project: Salt Project (Provisioning / Automation & Configuration)
File: 0001-adding-package-logic-to-loader.md

Feature Name: addingpythonpackagelogicto_loader Start Date: 2018-06-29 RFC PR: Salt Issue: Add support for python packages to the loader. Instead of just having apache.py, we would have `salt/modules/apache/init.py`, and all the other modules under that directory loaded in the `apache.<function>` namespace that we already have. Split modules out into different git repositories, and allow the community more control to help maintain them. This should be pretty straight forward, we should be able to use the same moduledirs that we are using now, and iterate over the files, and if they are a directory, then we load all of the modules underneath it into the namespace of the directory. Heirarchy would be alphabetical, and we would need to log messages if the function exists in an earlier file that has been loaded.
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: bug_report.md

name: Bug report about: Create a report to help us improve A clear and concise description of what the bug is. Steps to reproduce the behavior: Go to '...' Click on '....' Scroll down to '....' See error A clear and concise description of what you expected to happen. If applicable, add screenshots to help explain your problem. Add any other context about the problem here.
Project: KubeMQ (App Definition and Development / Streaming & Messaging)
File: kubemq_queues_stream.md

Queues stream a message from a queue command Queues stream command allows to receive message from a queue in push mode response an appropriate action ``` kubemq queues stream [flags] ``` ``` kubemq queue stream q1 kubemq queue stream q1 -v 120 -w 180 ``` ``` -h, --help help for stream -v, --visibility int set initial visibility seconds (default 30) -w, --wait int set how many seconds to wait for 'queues' messages (default 60) ``` - Execute Kubemq 'queues' commands
Project: ClickHouse (App Definition and Development / Database)
File: v21.12.2.17-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Quota limit was not reached, but the limit was exceeded. This PR fixes . (). Backported in : Fix unexpected projection removal when detaching parts. (). Backported in : Fix 'APPLY lambda' parsing which could lead to client/server crash. (). Backported in : Some replication queue entries might hang for `temporarydirectorieslifetime` (1 day by default) with `Directory tmpmerge<part_name>` or `Part ... (state Deleting) already exists, but it will be deleted soon` or similar error. It's fixed. Fixes . (). Backported in : Fix failures in queries that are trying to use skipping indices, which are not materialized yet. Fixes and . (). Backported in : Fix crash in `JoinCommon::removeColumnNullability`, close . (). Backported in : Fix sparse_hashed dict performance with sequential keys (wrong hash function). (). Backported in : Fix table lifetime (i.e. possible use-after-free) in case of parallel DROP TABLE and INSERT. (). Backported in : Fix possible exception at RabbitMQ storage startup by delaying channel creation. (). Backported in : Fix surprisingly bad code in function `file`. (). Backported in : fix crash when used fuzzBits with multiply same FixedString, Close . (). Backported in : Fix possible crash (or incorrect result) in case of `LowCardinality` arguments of window function. Fixes . (). Fix data race in ProtobufSchemas (). Follow-up to (). Fix arraySlice with null args. (). Fix crash in case of MATERIALIZE COLUMN with no default expression. (). Fix queries with hasColumnInTable constant condition and non existing column ().
Project: KICS (Provisioning / Security & Compliance)
File: e8c80448-31d8-4755-85fc-6dbab69c2717.md

title: CosmosDB Account IP Range Filter Not Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e8c80448-31d8-4755-85fc-6dbab69c2717 Query name: CosmosDB Account IP Range Filter Not Set Platform: Ansible Severity: <span style="color:#ff0000">Critical</span> Category: Networking and Firewall URL: The IP range filter should be defined to secure the data stored<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2" name: Create Cosmos DB Account - max azurermcosmosdbaccount: resource_group: myResourceGroup name: myDatabaseAccount location: westus kind: mongo_db georeplocations: name: southcentralus failover_priority: 0 databaseaccountoffer_type: Standard enablemultiplewrite_locations: yes virtualnetworkrules: subnet: "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVi rtualNetwork/subnets/mySubnet" consistency_policy: defaultconsistencylevel: bounded_staleness maxstalenessprefix: 10 maxintervalin_seconds: 1000 ``` ```yaml title="Negative test num. 1 - yaml file" name: Create Cosmos DB Account - max azurermcosmosdbaccount: resource_group: myResourceGroup name: myDatabaseAccount location: westus kind: mongo_db georeplocations: name: southcentralus failover_priority: 0 databaseaccountoffer_type: Standard iprangefilter: 10.10.10.10 enablemultiplewrite_locations: yes virtualnetworkrules: subnet: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVi rtualNetwork/subnets/mySubnet consistency_policy: defaultconsistencylevel: bounded_staleness maxstalenessprefix: 10 maxintervalin_seconds: 1000 ```