cwielenb/CNCF-Dataset huggingface dataset:
Project: StarRocks (App Definition and Development / Database)
File: percentile_hash.md

displayed_sidebar: "English" Constructs DOUBLE values as PERCENTILE values. ```Haskell PERCENTILE_HASH(x); ``` `x`: The supported data type is DOUBLE. Returns a PERCENTILE value. ```Plain Text mysql> select percentileapproxraw(percentile_hash(234.234), 0.99); +-+ | percentileapproxraw(percentile_hash(234.234), 0.99) | +-+ | 234.23399353027344 | +-+ 1 row in set (0.00 sec) ```
Project: Meshery (Provisioning / Automation & Configuration)
File: search.md

title: Search sitemap: false permalink: /search/ not_editable: true excludedinsearch: true display-title : "false" list: exclude <h3><span id="search-process">Loading</span> results <span id="search-query-container" style="display: none;">for "<strong id="search-query"></strong>"</span></h3> <ul id="search-results"></ul> <script> window.data = { {% for post in site.docs %} {% unless post.excludedinsearch %} {% if added %},{% endif %} {% assign added = false %} "{{ post.url | slugify }}": { "id": "{{ post.url | slugify }}", "title": "{{ post.title | xml_escape }}", "categories": "{{ post.categories | join: ", " | xml_escape }}", "url": " {{ post.url | xml_escape }}", "content": {{ post.content | striphtml | replaceregex: "[\s/\n]+"," " | strip | jsonify }} } {% assign added = true %} {% endunless %} {% endfor %} {% for post in site.pages %} {% unless post.excludedinsearch %} {% if added %},{% endif %} {% assign added = false %} "{{ post.url | slugify }}": { "id": "{{ post.url | slugify }}", "title": "{{ post.title | xml_escape }}", "categories": "{{ post.categories | join: ", " | xml_escape }}", "url": " {{ post.url | xml_escape }}", "content": {{ post.content | striphtml | replaceregex: "[\s/\n]+"," " | strip | jsonify }} } {% assign added = true %} {% endunless %} {% endfor %} }; </script> <script src="{{ site.baseurl }}/assets/js/lunr.min.js"></script> <script src="{{ site.baseurl }}/assets/js/search.js"></script>
Project: KICS (Provisioning / Security & Compliance)
File: 6b6bdfb3-c3ae-44cb-88e4-7405c1ba2c8a.md

title: Shared Host Network Namespace hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6b6bdfb3-c3ae-44cb-88e4-7405c1ba2c8a Query name: Shared Host Network Namespace Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: Container should not share the host network namespace<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: hostNetwork: true securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: name: sec-ctx-vol emptyDir: { } containers: name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="9" apiVersion: serving.knative.dev/v1 kind: Configuration metadata: name: dummy-config namespace: knative-sequence spec: template: spec: hostNetwork: true securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: name: sec-ctx-vol emptyDir: { } containers: name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: name: sec-ctx-vol emptyDir: { } containers: name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: serving.knative.dev/v1 kind: Configuration metadata: name: dummy-config namespace: knative-sequence spec: template: spec: hostNetwork: false securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: name: sec-ctx-vol emptyDir: { } containers: name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false ```
Project: sso (Provisioning / Key Management)
File: bug_report.md

name: Bug report about: Create a report to help us improve Describe the bug A clear and concise description of what the bug is. To Reproduce Steps to reproduce the behavior: Go to '...' Click on '....' Scroll down to '....' See error Expected behavior A clear and concise description of what you expected to happen. Screenshots If applicable, add screenshots to help explain your problem. Desktop (please complete the following information): OS: [e.g. iOS] Browser [e.g. chrome, safari] Version [e.g. 22] Smartphone (please complete the following information): Device: [e.g. iPhone6] OS: [e.g. iOS8.1] Browser [e.g. stock browser, safari] Version [e.g. 22] Additional context Add any other context about the problem here.
Project: ArangoDB (App Definition and Development / Database)
File: success_type.md

+++ title = "`success_type<T>`" description = "Type sugar for constructing a successful result or outcome." +++ Type sugar for constructing a successful result or outcome. Generally not constructed directly, but via the free function {{% api "success(T &&, ...)" %}}. Detectable using {{% api "issuccesstype<T>" %}}. This is a regular wrapper type, with defaulted default, copy and move constructor, defaulted assignment, and defaulted destructor. A member type alias `value_type` indicates `T`. There is an explicit initialising constructor taking any type `U` which is not a `successtype<T>`, and which will forward construct the contained `T` from that `U`. It also has an optional parameter `sparestorage`, if you wish to specify a spare storage value. There is a `.value()` reference observer with the usual constexpr lvalue, const lvalue, rvalue and const rvalue overloads. There is a specialisation `success_type<void>` which stores nothing and provides no `.value()` observers. There is a `.spare_storage()` observer which returns the spare storage value with which the success type sugar was constructed. Requires: Nothing. Namespace: `BOOSTOUTCOMEV2_NAMESPACE` Header: `<boost/outcome/success_failure.hpp>`
Project: Numaflow (App Definition and Development / Streaming & Messaging)
File: session.md

Session window is a type of Unaligned window where the windows end time keeps moving until there is no data for a given time duration. Unlike fixed and sliding windows, session windows do not overlap, nor do they have a set start and end time. They can be used to group data based on activity. ```yaml vertices: name: my-udf udf: groupBy: window: session: timeout: duration ``` NOTE: A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "1.5h" or "2h45m". Valid time units are "ns", "us" (or "s"), "ms", "s", "m", "h". The `timeout` is the duration of inactivity (no data flowing in for the particular key) after which the session is considered to be closed. To create a session window of timeout 1 minute, we can use the following snippet. ```yaml vertices: name: my-udf udf: groupBy: window: session: timeout: 60s ``` The yaml snippet above contains an example spec of a reduce vertex that uses session window aggregation. As we can see, the timeout of the window is 60s. This means we no data arrives for a particular key for 60 seconds, we will mark it as closed. Let's say, `time.now()` in the pipeline is `2031-09-29T18:46:30Z` as the current time, and we have a session gap of 30s. If we receive events in this pattern: ```text Event-1 at 2031-09-29T18:45:40Z Event-2 at 2031-09-29T18:45:55Z # Notice the 15 sec interval from Event-1, still within session gap Event-3 at 2031-09-29T18:46:20Z # Notice the 25 sec interval from Event-2, still within session gap Event-4 at 2031-09-29T18:46:55Z # Notice the 35 sec interval from Event-3, beyond the session gap Event-5 at 2031-09-29T18:47:10Z # Notice the 15 sec interval from Event-4, within the new session gap ``` This would lead to two session windows as follows: ```text [2031-09-29T18:45:40Z, 2031-09-29T18:46:20Z) # includes Event-1, Event-2 and Event-3 [2031-09-29T18:46:55Z, 2031-09-29T18:47:10Z) # includes Event-4 and Event-5 ``` In this example, the start time is inclusive and the end time is exclusive. `Event-1`, `Event-2`, and `Event-3` fall within the first window, and this window closes 30 seconds after `Event-3` at `2031-09-29T18:46:50Z`. `Event-4` arrives 5 seconds later, meaning it's beyond the session gap of the previous window, initiating a new window. The second window includes `Event-4` and `Event-5`, and it closes 30 seconds after `Event-5` at `2031-09-29T18:47:40Z`, if no further events arrive for the key until the timeout. Note: Streaming mode is by default enabled for session windows. Check the links below to see the UDF examples for different languages. Currently, we have the SDK support for Golang and Java.
Project: KICS (Provisioning / Security & Compliance)
File: d364984a-a222-4b5f-a8b0-e23ab19ebff3.md

title: Athena Workgroup Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d364984a-a222-4b5f-a8b0-e23ab19ebff3 Query name: Athena Workgroup Not Encrypted Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: Athena Workgroup query results should be encrypted, for all queries that run in the workgroup<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8 1 21" resource "awsathenaworkgroup" "example" { name = "example" } resource "awsathenaworkgroup" "example_2" { name = "example" configuration { enforceworkgroupconfiguration = true publishcloudwatchmetrics_enabled = true } } resource "awsathenaworkgroup" "example_3" { name = "example" configuration { enforceworkgroupconfiguration = true publishcloudwatchmetrics_enabled = true result_configuration { outputlocation = "s3://${awss3_bucket.example.bucket}/output/" } } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsathenaworkgroup" "example" { name = "example" configuration { enforceworkgroupconfiguration = true publishcloudwatchmetrics_enabled = true result_configuration { outputlocation = "s3://${awss3_bucket.example.bucket}/output/" encryption_configuration { encryptionoption = "SSEKMS" kmskeyarn = awskmskey.example.arn } } } } ```
Project: YugabyteDB (App Definition and Development / Database)
File: best-practices.md

title: Best practices linkTitle: Best practices description: Best practices menu: v2.18: identifier: best-practices parent: deploy-kubernetes weight: 626 type: docs Kubernetes provides you with an option of employing remote disks using dynamic provisioning or local storage which has to be preprovisioned. Local storage provides great performance, but the data is not replicated and can be lost if the node fails. This option is ideal for databases, such as YugabyteDB, that manage their own replication and can guarantee high availability (HA). Remote storage has slightly lower performance but the data is resilient to failures. This type of storage is absolutely essential for databases that do not offer HA (for example, traditional relational databases, such as PostgreSQL and MySQL). The following table summarizes the features and when to use local or remote storage: <table> <tr> <th>Feature</th> <th>Local SSD storage</th> <th>Remote SSD storage</th> </tr> <tr> <td>Provision large disk capacity per node</td> <td>Depends on cloud-provider</td> <td>Yes</td> </tr> <tr> <td>Ideal deployment strategy with YugabyteDB</td> <td>Use for latency sensitive apps <br> Add remote storage to increase capacity / cost-efficient tiering</td> <td>Use for large disk capacity per node</td> </tr> <tr> <td>Disk storage resilient to failures</td> <td>No</td> <td>Yes</td> </tr> <tr> <td>Performance - latency</td> <td>Lower</td> <td>Higher</td> </tr> <tr> <td>Performance - throughput</td> <td>Higher</td> <td>Lower</td> </tr> <tr> <td>Typical cost characteristics</td> <td>Lower</td> <td>Higher</td> </tr> <tr> <td>Kubernetes provisioning scheme</td> <td>Pre-provisioned</td> <td>Dynamic provisioning</td> </tr> </table> It is generally preferable to use local storage where possible for higher performance and lower costs. For information on how to deploy YugabyteDB on Kubernetes using local SSDs, see .
Project: ShardingSphere (App Definition and Development / Database)
File: appendix.en.md

+++ title = "Appendix with SQL operator" weight = 3 +++ Unsupported SQL RAL and RDL operations of DistSQL that are used in transactions. DDL statements that are used in XA transactions. Privileges required for XA transactions: In MySQL8, you need to grant the user `XARECOVERADMIN` privileges, otherwise, the XA transaction manager will report an error when executing the `XA RECOVER` statement.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_key_vault_keys.md

+++ title = "azurermkeyvault_keys resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurermkeyvault_keys" identifier = "inspec/resources/azure/azurermkeyvaultkeys.md azurermkeyvaultkeys resource" parent = "inspec/resources/azure" +++ {{< inspec/azurermdeprecated resource="azurekeyvaultkeys" >}} Use the `azurermkeyvault_keys` InSpec audit resource to test properties and configuration of Azure Keys within Vaults. This resource interacts with version `2016-10-01` of the Azure Management API. For more information see the . At the moment, there doesn't appear to be a way to select the version of the Azure API docs. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: name: inspec-azure git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . This resource first became available in 1.3.0 of the inspec-azure resource pack. An `azurermkeyvault_keys` resource block returns all Keys within a Vault. describe azurermkeyvault_keys('my-vault') do ... end The following examples show how to use this InSpec audit resource. azurermkeyvault_keys('my-vault').entries.each do |key| describe key do its('kid') { should_not be nil } its('attributes.enabled') { should eq true } end end All fields described in can be used to filter. Below is an example using `managed`. Filters the results to include only those Keys which are not managed by the Vault. This is a boolean value. describe azurermkeyvault_keys('my-vault').where{ managed.eql?(false) } do it { should_not exist } end `attributes` `kid` `managed` `tags` The key management attributes. Key identifier. True if the key's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true. Resource tags applied to the Key. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The control will pass if the filter returns at least one result. Use `should_not` if you expect zero matches. describe azurermkeyvault_keys('my-vault') do it { should exist } end Your [Service Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal) must be setup with a `contributor` role on the subscription you wish to test. Your Azure Key Vault should also have this Service Principal listed in it's Access Policy with `keys/list` permissions.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: mongodb_conf.md

+++ title = "mongodb_conf resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "mongodb_conf" identifier = "inspec/resources/os/mongodbconf.md mongodbconf resource" parent = "inspec/resources/os" +++ Use the `mongodb_conf` Chef InSpec audit resource to test the contents of the configuration file for MongoDB, typically located at `/etc/mongod.conf` or `C:\Program Files\MongoDB\Server\<version>\bin\mongod.cfg`, depending on the platform. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} A `mongodb_conf` resource block declares one (or more) settings in the `mongodb.conf` file, and then compares the setting in the configuration file to the value stated in the test: describe mongodb_conf('path') do its('setting') { should eq 'value' } end where `'setting'` specifies a setting in the `mongodb.conf` file `('path')` is the non-default path to the `mongodb.conf` file (optional) `should eq 'value'` is the value that is expected The following examples show how to use this Chef InSpec audit resource. describe mongodb_conf do its(["security", "enableEncryption"]) { should eq true } end describe mongodb_conf do its(["net", "port"]) { should eq 27017 } end describe mongodb_conf do its(["security", "authorization"]) { should eq "enabled" } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: YugabyteDB (App Definition and Development / Database)
File: jsonb-pretty.md

title: jsonb_pretty() headerTitle: jsonb_pretty() linkTitle: jsonb_pretty() description: Format the text representation of the JSON value that the input jsonb actual argument represents, using whitespace, to make it more human-readable. menu: v2.18: identifier: jsonb-pretty parent: json-functions-operators weight: 200 type: docs Purpose: Format the text representation of the JSON value that the input `jsonb` actual argument represents, using whitespace, to make it more human-readable. Signature: ``` input value: jsonb return value: text ``` Notes: There is no `json` variant. However, you can trivially typecast a `json` value to a `jsonb` value. Because, in the main, JSON is mechanically generated and mechanically consumed, it's unlikely that you'll use `jsonb_pretty()` in final production code. However, because JSON isn't self-describing, and because external documentation of a corpus's data-representation intent isn't always available, developers often need to study a representative set of extant JSON values and deduce the intended rules of composition. This task is made easier when JSON values are formatted in a standard, well designed, way. The pretty format makes conventional, and liberal, use of newlines and spaces, thus: ```plpgsql do $body$ declare orig_text constant text := ' { "a": 1, "b": {"x": 1, "y": 19}, "c": true }'; expectedprettytext text := '{ "a": 1, "b": { "x": 1, "y": 19 }, "c": true }'; j constant jsonb := orig_text::jsonb; prettytext constant text := jsonbpretty(j); begin assert prettytext = expectedpretty_text, 'unexpected'; end; $body$; ``` You might prefer to use the `::text` typecast to visualize a small `jsonb` value.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_compute_node_group.md

+++ title = "googlecomputenode_group resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlecomputenode_group" identifier = "inspec/resources/gcp/googlecomputenodegroup.md googlecomputenodegroup resource" parent = "inspec/resources/gcp" +++ A `googlecomputenode_group` is used to test a Google NodeGroup resource This resource has beta fields available. To retrieve these fields, include `beta: true` in the constructor for the resource ```ruby describe googlecomputenode_group(project: 'chef-gcp-inspec', zone: 'zone', name: 'inspec-node-group') do it { should exist } its('description') { should cmp 'A description of the node group' } its('size') { should cmp '0' } end describe googlecomputenode_group(project: 'chef-gcp-inspec', zone: 'zone', name: 'nonexistent') do it { should_not exist } end ``` Properties that can be accessed from the `googlecomputenode_group` resource: `creation_timestamp` : Creation timestamp in RFC3339 text format. `description` : An optional textual description of the resource. `name` : Name of the resource. `node_template` : The URL of the node template to which this node group belongs. `size` : The total number of nodes in the node group. `autoscaling_policy` : (Beta only) If you use sole-tenant nodes for your workloads, you can use the node group autoscaler to automatically manage the sizes of your node groups. `mode` : The autoscaling mode. Set to one of the following: - OFF: Disables the autoscaler. - ON: Enables scaling in and scaling out. - ONLYSCALEOUT: Enables only scaling out. You must use this mode if your node groups are configured to restart their hosted VMs on minimal servers. Possible values: OFF ON ONLYSCALEOUT `min_nodes` : Minimum size of the node group. Must be less than or equal to max-nodes. The default value is 0. `max_nodes` : Maximum size of the node group. Set to a value less than or equal to 100 and greater than or equal to min-nodes. `zone` : Zone where this node group is located Ensure the is enabled for the current project.
Project: Flink (App Definition and Development / Streaming & Messaging)
File: table-sample.md

title: "Table Sample" weight: 11 type: docs <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> The `TABLESAMPLE` statement is used to sample rows from the table. ```sql TABLESAMPLE ( num_rows ROWS ) ``` {{< hint warning >}} Note: Currently, only sample specific number of rows is supported. {{< /hint >}} num_rows `ROWS` num_rows is a constant positive to specify how many rows to sample. ```sql SELECT * FROM src TABLESAMPLE (5 ROWS) ```
Project: KICS (Provisioning / Security & Compliance)
File: a8128dd2-89b0-464b-98e9-5d629041dfe0.md

title: RAM Account Password Policy without Reuse Prevention hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a8128dd2-89b0-464b-98e9-5d629041dfe0 Query name: RAM Account Password Policy without Reuse Prevention Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: RAM Account Password Policy 'passwordreuseprevention' should be defined and set to 24 or less<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 maxloginattempts = 3 } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="9" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 25 maxloginattempts = 3 } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 5 maxloginattempts = 3 } ```