cwielenb/CNCF-Dataset huggingface dataset:
Project: kiosk (Provisioning / Automation & Configuration)
File: RELEASE.md

The `yaml` Project is released on an as-needed basis. The process is as follows: An issue is proposing a new release with a changelog since the last release All must LGTM this release An OWNER runs `git tag -s $VERSION` and inserts the changelog and pushes the tag with `git push $VERSION` The release issue is closed An announcement email is sent to `kubernetes-dev@googlegroups.com` with the subject `[ANNOUNCE] kubernetes-template-project $VERSION is released`
Project: Trivy (Provisioning / Security & Compliance)
File: selectors.md

Sometimes you might want to limit a certain policy to only be run on certain resources. This can be achieved with input selectors. For instance, if you have a custom policy that you only want to be evaluated if a certain resource type is being scanned. In such a case you could utilize input selectors to limit its evaluation on only those resources. !!! example ``` package builtin.aws.rds.aws0999 deny[res] { instance := input.aws.rds.instances[_] instance.publicaccess.value res := result.new("Instance has Public Access enabled", instance.publicaccess) ``` Observe the following `subtypes` defined: ```yaml ``` They will ensure that the policy is only run when the input to such a policy contains an `RDS` instance. Currently, the following are supported: | Selector | Subtype fields required | Example | |--|-|| | Cloud (AWS, Azure, etc.) | `provider`, `service` | `provider: aws`, `service: rds` | | Kubernetes | | `type: kubernetes` | | Dockerfile | | `type: dockerfile` | If no subtypes or selectors are specified, the policy will be evaluated regardless of input.
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_images_delete.md

Deletes all images downloaded to local docker client ``` sonobuoy images delete [flags] ``` ``` --context string Context in the kubeconfig to use. --dry-run If true, only print the image operations that would be performed. --e2e-repo string Specify a registry for KUBETESTREPO, overriding registries for test images. --e2e-repo-config string Specify a yaml file acting as KUBETESTREPO_LIST, overriding registries for test images. -h, --help help for delete --kubeconfig Kubeconfig Path to explicit kubeconfig file. --kubernetes-version string Use default E2E image, but override the version. Default is 'auto', which will be set to your cluster's version if detected, erroring otherwise. 'ignore' will try version resolution but ignore errors. 'latest' will find the latest dev image/version upstream. -p, --plugin strings Describe which plugin's images to interact with (Valid plugins are 'e2e', 'systemd-logs'). (default [e2e,systemd-logs]) ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Manage images used in a plugin to facilitate running them in airgapped (or similar) environments. Supported plugins are: 'e2e'
Project: Chef InSpec (Provisioning / Security & Compliance)
File: apache_conf.md

+++ title = "apache_conf resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "apache_conf" identifier = "inspec/resources/os/apacheconf.md apacheconf resource" parent = "inspec/resources/os" +++ Use the `apache_conf` Chef InSpec audit resource to test the configuration settings for Apache. This file is typically located under `/etc/apache2` on the Debian and Ubuntu platforms and under `/etc/httpd` on the Fedora, CentOS, RedHat Enterprise Linux, and ArchLinux platforms. The configuration settings may vary significantly from platform to platform. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} `ServerRoot` must be included in an Apache configuration file. If not present, the included configurations will not be accessible to the resource. This resource first became available in v1.0.0 of InSpec. An `apache_conf` Chef InSpec audit resource block declares configuration settings that should be tested: describe apache_conf('path') do its('setting_name') { should eq 'value' } end where `'setting_name'` is a configuration setting defined in the Apache configuration file `('path')` is the non-default path to the Apache configuration file `{ should eq 'value' }` is the value that is expected The following examples show how to use this Chef InSpec audit resource. describe apache_conf do its('AllowOverride') { should cmp 'None' } end describe apache_conf do its('Listen') { should cmp '443' } end describe apache_conf do its('Listen') { should =~ [ '80', '443' ] } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This Chef InSpec audit resource matches any service that is listed in the Apache configuration file: its('PidFile') { should_not eq '/var/run/httpd.pid' } or: its('Timeout') { should cmp '300' } For example: describe apache_conf do its('MaxClients') { should cmp '100' } its('Listen') { should cmp '443' } end
Project: CDK for Kubernetes (CDK8s) (Provisioning / Automation & Configuration)
File: include.md

The `Include` construct can be used to include an existing manifest in a chart. The following example will include the Kubernetes Dashboard in `MyChart`: ```ts import { Include } from 'cdk8s'; class MyChart extends Chart { constructor(scope: Construct, id: string) { super(scope, id); const dashboard = new Include(this, 'dashboard', { url: 'https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml', // or url: 'dashboard.yaml' }); // ...other resources } } ``` All API objects defined in the included manifest will be added as children `ApiObject`s under the `Include` construct's scope and can be accessed through the `apiObject` property: The following example queries for all the `Deployment` resources in the dashboard: ```ts const deploymentApiObject = dashboard.apiObjects.find(c => c.kind === 'Deployment'); ``` NOTE: names of included objects (`metadata.name`) are preserved. This means that if you try to include the same manifest twice into the same chart, your manifest will have duplicate definitions of the same objects.
Project: Docker Compose (App Definition and Development / Application Definition & Image Build)
File: compose_images.md

<!MARKERGENSTART--> List images used by the created containers | Name | Type | Default | Description | |:-|:|:--|:-| | `--dry-run` | | | Execute command in dry run mode | | `--format` | `string` | `table` | Format the output. Values: [table \| json] | | `-q`, `--quiet` | | | Only display IDs | <!MARKERGENEND-->
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: handle-a-cluster-exception.md

title: Handle a cluster exception description: How to handle an exception in a cluster keywords: [cluster exception] sidebar_position: 1 sidebar_label: Handle an exception When an exception occurs during your operation, you can perform the following steps to solve it. Check the cluster status. ```bash kbcli cluster list mycluster ``` Handle the exception according to the status information. | Status | Information | | : | : | | Abnormal | The cluster can be accessed but exceptions occur in some pods. This might be a mediate status of the operation process and the system recovers automatically without executing any extra operation. Wait until the cluster status changes to `Running`. | | ConditionsError | The cluster is normal but an exception occurs to the condition. It might be caused by configuration loss or exception, which further leads to operation failure. Manual recovery is required. | | Failed | The cluster cannot be accessed. Check the `status.message` string and get the exception reason. Then manually recover it according to the hints. | You can check the cluster's status for more information. If the above operations can not solve the problem, try the following steps: Restart this cluster. If the restart fails, you can delete the pod manually. Roll the cluster status back to the status before changes.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_project.md

+++ title = "google_project resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "google_project" identifier = "inspec/resources/gcp/googleproject.md googleproject resource" parent = "inspec/resources/gcp" +++ A `google_project` is used to test a Google Project resource ```ruby describe google_project(project: 'chef-gcp-inspec') do it { should exist } its('project_id') { should cmp 'chef-gcp-inspec' } its('lifecycle_state') { should cmp 'ACTIVE' } end ``` describe google_project(project: 'chef-inspec-gcp') do its('project_number') { should eq 12345678 } end describe google_project(project: 'chef-inspec-gcp') do its('lifecycle_state') { should eq "ACTIVE" } end describe googleproject(project: 'chef-inspec-gcp').labelvaluebykey('season') do it {should match '^(winter|spring|summer|autumn)$' } end Properties that can be accessed from the `google_project` resource: `number` : Number uniquely identifying the project. `lifecycle_state` : The Project lifecycle state. Possible values: LIFECYCLESTATEUNSPECIFIED ACTIVE DELETE_REQUESTED DELETEINPROGRESS `name` : The user-assigned display name of the Project. It must be 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. `create_time` : Time of creation `labels` : The labels associated with this Project. Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `?`. Label values must be between 0 and 63 characters long and must conform to the regular expression `(?)?`. No more than 256 labels can be associated with a given resource. Clients should store labels in a representation such as JSON that does not depend on specific characters being disallowed `parent` : A parent organization `type` : Must be organization. `id` : Id of the organization `project_id` : The unique, user-assigned ID of the Project. It must be 6 to 30 lowercase letters, digits, or hyphens. It must start with a letter. Trailing hyphens are prohibited. Ensure the is enabled for the current project.
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: 03 - debug.md

We can use for Go debugging. Follow the . > Make sure `PATH` containers `$GOPATH/bin` which will allow you to run Go binary executables without specifying the absolute path. If you are using MacOS, you can install vid HomeBrew with the following command : ```shell brew install delve ``` Check your installation ```shell dlv version ``` You can start a delve debug server for running and debugging specific package or . ```shell make run-delve GO_PACKAGE=./cmd/manager/main.go ``` ```shell make run-delve GO_PACKAGE=./cmd/cli/main.go ARGUMENTS='cluster create test-cluster --termination-policy=Halt' ``` ```shell make test-delve TEST_PACKAGES=./controllers/apps/... ``` Unlike `go test` supports multiple packages, `Delve` needs a single executable to work, it only supports single package. You can change debug server port for `make run-delve` and `make test-delve`. ```shell make run-delve DEBUG_PORT=2347 ``` After bug server started, it will show the listen address: ```shell API server listening at: [::]:2347 ``` `Delve` support lots of code editors (), you can choose your favorite editor to connect with the listen address for debugging. This section introduces how to start debugging with the Delve CLI, Goland and VSCode. Please refer to the Delve or editors documentation for more details. ```shell $ dlv connect 127.0.0.1:2345 Type 'help' for list of commands. (dlv) break cluster_controller.go:303 (dlv) continue (dlv) next (dlv) ...... ``` Click Run Edit configurations, add new debug configuration, select "Go Remote": Add debug server listen address to `Host` and `Port` And then set breakpoints, and run debug. Create/modify .vscode/launch.json file for connecting debug server: ```json { "version": "0.2.0", "configurations": [ { "name": "debug envtest", "type": "go", "request": "attach", "mode": "remote", "remotePath": "", "port": 2346, "host": "127.0.0.1", "showLog": true, "trace": "log", "logOutput": "rpc" } ] } ``` Set breakpoints and run `Start Debugging`.
Project: kpt (Provisioning / Automation & Configuration)
File: 07-composing-a-package.md

A package can be composed of subpackages (HAS A relationship). _Package composition_ is when you change the package hierarchy by adding or removing subpackages. There are two different ways to add a subpackage to a package on the local filesystem: [Create a new package] in a subdirectory [Get an existing package] in a subdirectory Let's revisit the `wordpress` package and see how it was composed in the first place. Currently, it has the following package hierarchy: ```shell $ kpt pkg tree wordpress/ Package "wordpress" [Kptfile] Kptfile wordpress [service.yaml] Service wordpress deployment [deployment.yaml] Deployment wordpress [volume.yaml] PersistentVolumeClaim wp-pv-claim Package "mysql" [Kptfile] Kptfile mysql [deployment.yaml] PersistentVolumeClaim mysql-pv-claim [deployment.yaml] Deployment wordpress-mysql [deployment.yaml] Service wordpress-mysql ``` First, let's delete the `mysql` subpackage. Deleting a subpackage is done by simply deleting the subdirectory: ```shell $ rm -r wordpress/mysql ``` We're going to add back the `mysql` subpackage using the two different approaches: Create the directory: ```shell $ mkdir wordpress/mysql ``` Initialize the package: ```shell $ kpt pkg init wordpress/mysql ``` This creates a [dependent package]. Remove the existing directory if it exists: ```shell $ rm -rf wordpress/mysql ``` Fetch the package: ```shell $ kpt pkg get https://github.com/kubernetes/website.git/content/en/examples/application/mysql@snapshot-initial-v1.20 wordpress/mysql ``` This creates an [independent package]. If you wish to make this a dependent package, you can delete the `upstream` and `upstreamLock` sections of the `Kptfile` in `mysql` directory.
Project: ClickHouse (App Definition and Development / Database)
File: v22.9.6.20-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Fixed backward incompatibility in (de)serialization of states of `min`, `max`, `any`, `argMin`, `argMax` aggregate functions with `String` argument. The incompatibility was introduced in https://github.com/ClickHouse/ClickHouse/pull/41431 and affects 22.9, 22.10 and 22.11 branches (fixed since 22.9.6, 22.10.4 and 22.11.2 correspondingly). Some minor releases of 22.3, 22.7 and 22.8 branches are also affected: 22.3.13...22.3.14 (fixed since 22.3.15), 22.8.6...22.8.9 (fixed since 22.8.10), 22.7.6 and newer (will not be fixed in 22.7, we recommend to upgrade from 22.7.* to 22.8.10 or newer). This release note does not concern users that have never used affected versions. Incompatible versions append extra `'\0'` to strings when reading states of the aggregate functions mentioned above. For example, if an older version saved state of `anyState('foobar')` to `statecolumn` then incompatible version will print `'foobar\0'` on `anyMerge(statecolumn)`. Also incompatible versions write states of the aggregate functions without trailing `'\0'`. Newer versions (that have the fix) can correctly read data written by all versions including incompatible versions, except one corner case. If an incompatible version saved a state with a string that actually ends with null character, then newer version will trim trailing `'\0'` when reading state of affected aggregate function. For example, if an incompatible version saved state of `anyState('abrac\0dabra\0')` to `statecolumn` then incompatible versions will print `'abrac\0dabra'` on `anyMerge(statecolumn)`. The issue also affects distributed queries when an incompatible version works in a cluster together with older or newer versions. (). Backported in : Wait for all files are in sync before archiving them in integration tests. (). Backported in : Fix a bug when row level filter uses default value of column. (). Backported in : Fixed primary key analysis with conditions involving `toString(enum)`. (). Fix 02267fileglobsschemainference.sql flakiness (). Temporarily disable `testhivequery` (). Do not checkout submodules recursively (). Use docker images cache from merged PRs in master and release branches (). Fix pagination issue in GITHUBJOBID() ().
Project: KICS (Provisioning / Security & Compliance)
File: 404fde2c-bc4b-4371-9747-7054132ac953.md

title: Default Seccomp Profile Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 404fde2c-bc4b-4371-9747-7054132ac953 Query name: Default Seccomp Profile Disabled Platform: DockerCompose Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: Seccomp offers a whitelist of common system calls, blocking all others. Having less kernel exposed to an app then increases security.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="13" version: "3.8" services: demo: image: not/a/real/image cap_add: SYS_PTRACE volumes: type: volume source: not-a-real-source-docker target: /var/lib/docker security_opt: label:seccomp:unconfined volumes: not-a-real-source-docker: ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="10" version: "3.9" networks: backend: services: example: build: . security_opt: seccomp:unconfined networks: backend ports: "5002:5002" ``` ```yaml title="Negative test num. 1 - yaml file" version: "3.9" services: webapp: build: context: ./ dockerfile: Dockerfile-alternate args: buildno: 1 ```
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_list_namespaces.md

title: "Command - devspace list namespaces" sidebar_label: devspace list namespaces Lists all namespaces in the current context ``` devspace list namespaces [flags] ``` ``` Lists all namespaces in the selected kube context ``` ``` -h, --help help for namespaces ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: 04 - basics.md

`KubeBlocks` is using kubebuilder as the operator framework, before your start to code, suggest to read . `KubeBlocks` includes a in the root of the repo. This serves as a high-level interface for common commands. Running `make help` will produce a list of make targets with descriptions. These targets will be referenced throughout this document. `kbcli` is a command line interface for `KubeBlocks` which support to the basic interaction commands such as `install/uninstall/upgrade` KubeBlocks and all kinds of actions for KubeBlocks The kbcli repository: https://github.com/apecloud/kbcli First, read the Go (Golang) coding guidelines again, looking for any style violations. It's easier to remember a style rule once you've violated it. Run our suite of linters: ``` shell make lint ``` This is not a fast command. On my machine, at the time of writing, it takes about a full minute to run. You can instead run
Project: ShardingSphere (App Definition and Development / Database)
File: count-shadow-rule.en.md

+++ title = "COUNT SHADOW RULE" weight = 5 +++ The `COUNT SHADOW RULE` syntax is used to query the number of shadow rules for specified database. {{< tabs >}} {{% tab name="Grammar" %}} ```sql CountShadowRule::= 'COUNT' 'SHADOW' 'RULE' ('FROM' databaseName)? databaseName ::= identifier ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} When `databaseName` is not specified, the default is the currently used `DATABASE`. If `DATABASE` is not used, `No database selected` will be prompted. | Column | Description | |--|-| | rule_name | rule type | | database | the database to which the rule belongs | | count | the number of the rule | Query the number of shadow rules for specified database. ```sql COUNT SHADOW RULE FROM shadow_db; ``` ```sql mysql> COUNT SHADOW RULE FROM shadow_db; +--+--+-+ | rule_name | database | count | +--+--+-+ | shadow | shadow_db | 1 | +--+--+-+ 1 row in set (0.00 sec) ``` Query the number of shadow rules for current database. ```sql COUNT SHADOW RULE; ``` ```sql mysql> COUNT SHADOW RULE; +--+--+-+ | rule_name | database | count | +--+--+-+ | shadow | shadow_db | 1 | +--+--+-+ 1 row in set (0.01 sec) ``` `COUNT`, `SHADOW`, `RULE`, `FROM`