cwielenb/CNCF-Dataset huggingface dataset:
Project: LinuxKit (Provisioning / Automation & Configuration)
File: 2017-04-16.md

The sixth weekly development report. Feel free to send PRs if you want to add to these reports (or correct them). The project was finally renamed to "LinuxKit". We are just in the run up to the public release of LinuxKit on Tuesday, so a lot of the work this week has been tweaking for demos and trying not to break anything; lots of work planned for afterwards. Welcome everyone, looking forward to your contributions and working with you. Please open issues on GitHub if you need help, or ask on #moby (soon to be #linuxkit) in the . Most of the project updates this week for around improved demos for Dockercon; we are looking forward to showing many of these over the course of the week. This week @errordeveloper got the Kubernetes setup working with a three node cluster, which he will demo at DockerCon. We added more useful system containers, such as `openntp`. We will add more as we port the base blueprints for the Docker Editions into the repo, so we have support for more platforms. Thomas @samoht added yaml validation, to catch the errors, which has been very useful. Anil @avsm added packet.net support into the CLI; this needs some further work but it will allow us to test on bare metal easily, which is useful where we need to test with VMs on top of LinuxKit, or we need bare metal support for other tests. We cleaned up the GCP CLI support a bit, although there are still some design issues to resolve around the large number of options for cloud providers. Added initial support to actually use `containerd` to run the system containers rather than `runc`. This is a temporary version; the plan is to switch to using the `containerd` image store after DockerCon but this needs some development work and build changes, but will be a big improvement. You can get `containerd` Prometheus metrics on the system containers now, which is nice. open sourcing the project introducing LinuxKit to many new people there will be a talk by @justincormack on LinuxKit (billed as "Moby's Secret Session") with some demos by various people there will be a Docker Security talk with @riyazdf (`Secure Substrate: Least Privilege Container Deployment`) that will highlight LinuxKit there will be a session and lots of time to talk at the Thursday summit - get in touch if you need an invite. Please add topics you would like to talk about to via PR
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: API-010-appcallback-versioning.md

Accepted There was a proposal to introducing versioning for HTTP App Callbacks. The goal of this review was to understand if a versioning was required and how it could handle situations post v1.0 of DAPR Introducing versioning to app callback APIs would require changes to the user applications which is not feasible There would be no way for DAPR runtime to find out the app callback version before hand We decided not to introduce such a versioning scheme on the app callback APIs. Post v1.0, if required, the versioning could be implemented inside the payload but not on the API itself. A missing version in the payload could imply v1.0.
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: setup.md

title: Setup Custom PostgresVersions menu: docs_{{ .version }}: identifier: pg-custom-versions-setup-postgres name: Overview parent: pg-custom-versions-postgres weight: 10 menuname: docs{{ .version }} sectionmenuid: guides New to KubeDB? Please start . PostgresVersions are KubeDB crds that define the docker images KubeDB will use when deploying a postgres database. For more details about PostgresVersion crd, please visit . The best way to create a custom image is to build on top of the existing kubedb image. ```docker FROM kubedb/postgres:10.2-v3 ENV TIMESCALEDB_VERSION 0.9.1 RUN set -ex \ && apk add --no-cache --virtual .fetch-deps \ ca-certificates \ openssl \ tar \ && mkdir -p /build/timescaledb \ && wget -O /timescaledb.tar.gz https://github.com/timescale/timescaledb/archive/$TIMESCALEDB_VERSION.tar.gz \ && tar -C /build/timescaledb --strip-components 1 -zxf /timescaledb.tar.gz \ && rm -f /timescaledb.tar.gz \ \ && apk add --no-cache --virtual .build-deps \ coreutils \ dpkg-dev dpkg \ gcc \ libc-dev \ make \ cmake \ util-linux-dev \ \ && cd /build/timescaledb \ && ./bootstrap \ && cd build && make install \ && cd ~ \ \ && apk del .fetch-deps .build-deps \ && rm -rf /build RUN sed -r -i "s/[#]\s(sharedpreloadlibraries)\s=\s'(.*)'/\1 = 'timescaledb,\2'/;s/,'/'/" /scripts/primary/postgresql.conf ``` From there, we would define a PostgresVersion that contains this new image. Let's say we tagged it as `myco/postgres:timescale-0.9.1` ```yaml apiVersion: catalog.kubedb.com/v1alpha1 kind: PostgresVersion metadata: name: timescaledb-2.14.2-pg14 spec: archiver: addon: name: postgres-addon tasks: manifestBackup: name: manifest-backup manifestRestore: name: manifest-restore volumeSnapshot: name: volume-snapshot walg: image: ghcr.io/kubedb/postgres-archiver:(v0.6.0)_14.10-alpine coordinator: image: ghcr.io/kubedb/pg-coordinator:v0.29.0 db: baseOS: alpine image: timescale/timescaledb:2.14.2-pg14-oss distribution: TimescaleDB exporter: image: prometheuscommunity/postgres-exporter:v0.15.0 initContainer: image: ghcr.io/kubedb/postgres-init:0.12.0 podSecurityPolicies: databasePolicyName: postgres-db securityContext: runAsAnyNonRoot: false runAsUser: 70 stash: addon: backupTask: name: postgres-backup-14.0 restoreTask: name: postgres-restore-14.0 version: "14.11" ``` Once we add this PostgresVersion we can use it in a new Postgres like: ```yaml apiVersion: kubedb.com/v1alpha2 kind: Postgres metadata: name: timescale-postgres namespace: demo spec: version: "timescaledb-2.14.2-pg14" # points to the name of our custom PostgresVersion storage: storageClassName: "standard" accessModes: ReadWriteOnce resources: requests: storage: 1Gi ```
Project: ThreatMapper (Provisioning / Security & Compliance)
File: deploy-agent.md

title: Deploy Sensors You should first and push the images to a suitable repository. You can then adapt the standard installation instructions (, ) to refer to your custom images rather than the Deepfence-provided ones. :::tip Refer to the along with the modifications below. ::: Execute the following command to install and start the sensors: ```bash ACC=myorg # the name of the dockerhub account docker login -u $ACC # log in to the account docker run -dit \ --cpus=".2" \ --name=deepfence-agent \ --restart on-failure \ --pid=host \ --net=host \ --log-driver json-file \ --log-opt max-size=50m \ --privileged=true \ -v /sys/kernel/debug:/sys/kernel/debug:rw \ -v /var/log/fenced \ -v /var/run/docker.sock:/var/run/docker.sock \ -v /:/fenced/mnt/host/:ro \ -e DFLOGLEVEL="info" \ -e USERDEFINEDTAGS="" \ -e MGMTCONSOLEURL="CONSOLE-IP" \ -e MGMTCONSOLEPORT="443" \ -e DEEPFENCE_KEY="DEEPFENCE-API-KEY" \ $ACC/deepfenceagentce:2.1.1 ``` :::tip Refer to the along with the modifications below. ::: You can use these instructions for helm-based installations in standalone and hosted Kubernetes clusters ```bash helm repo add deepfence https://deepfence-helm-charts.s3.amazonaws.com/threatmapper helm repo update helm show values deepfence/deepfence-agent --version 2.1.1 > deepfenceagentvalues.yaml vim deepfenceagentvalues.yaml helm install -f deepfenceagentvalues.yaml deepfence-agent deepfence/deepfence-agent \ --namespace deepfence \ --create-namespace \ --version 2.1.1 ``` Allow a few seconds for the containers to pull and deploy in your Kubernetes environment. Full instructions can be found in the .
Project: KICS (Provisioning / Security & Compliance)
File: 69b5d7da-a5db-4db9-a42e-90b65d0efb0b.md

title: ActionTrail Trail OSS Bucket is Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 69b5d7da-a5db-4db9-a42e-90b65d0efb0b Query name: ActionTrail Trail OSS Bucket is Publicly Accessible Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Observability URL: ActionTrail Trail OSS Bucket should not be publicly accessible<br> ```tf title="Positive test num. 1 - tf file" hl_lines="3" resource "alicloudossbucket" "bucket_actiontrail3" { bucket = "bucketactiontrail3" acl = "public-read" } resource "alicloudactiontrailtrail" "actiontrail3" { trail_name = "action-trail" osswriterole_arn = "acs:ram::1182725xxxxxxxxxxx" ossbucketname = "bucketactiontrail3" event_rw = "All" trail_region = "All" } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="3" resource "alicloudossbucket" "bucket_actiontrail4" { bucket = "bucketactiontrail4" acl = "public-read-write" } resource "alicloudactiontrailtrail" "actiontrail4" { trail_name = "action-trail" osswriterole_arn = "acs:ram::1182725xxxxxxxxxxx" ossbucketname = "bucketactiontrail4" event_rw = "All" trail_region = "All" } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudossbucket" "bucket_actiontrail1" { bucket = "bucketactiontrail1" acl = "private" } resource "alicloudactiontrailtrail" "actiontrail1" { trail_name = "action-trail" osswriterole_arn = "acs:ram::1182725xxxxxxxxxxx" ossbucketname = "bucketactiontrail1" event_rw = "All" trail_region = "All" } ``` ```tf title="Negative test num. 2 - tf file" resource "alicloudossbucket" "bucket_actiontrail2" { bucket = "bucketactiontrail2" } resource "alicloudactiontrailtrail" "actiontrail2" { trail_name = "action-trail" osswriterole_arn = "acs:ram::1182725xxxxxxxxxxx" ossbucketname = "bucketactiontrail2" event_rw = "All" trail_region = "All" } ```
Project: Chef Infra (Provisioning / Automation & Configuration)
File: BUG_TEMPLATE.md

name: Bug Report about: If something isn't working as expected . labels: "Status: Untriaged" <! !!!!!! NOTE: CHEF CLIENT BUGS ONLY !!!!!! This issue tracker is for the code contained within this repo -- `chef-client`, base `knife` functionality (not plugins), `chef-apply`, `chef-solo`, `chef-client -z`, etc. Requests for new or alternative functionality should be made to Cookbook Issues (see the https://github.com/chef-cookbooks repos or search or GitHub/Google) --> <! Briefly describe the issue --> <! Tell us which version of chef-client you are using (see below for Server+ChefDK bugs). --> <! Tell us which operating system distribution and version chef-client is running on. --> <! Tell us what steps to take to replicate your problem. See for information on how to create a good replication case. --> <! The relevant output of the chef-client run or a link to a gist of the entire run, if there is one. The debug output (chef-client -l debug) may be useful, but please link to a gist, or truncate it. --> ``` ``` <! Please include the stacktrace.out output or link to a gist of it, if there is one. -->
Project: Beam (App Definition and Development / Streaming & Messaging)
File: 23_io_gcs.md

Prompt: Is the Google Cloud Storage file system supported in Apache Beam? Response: is an object storage service for storing and accessing data on Google Cloud. Apache Beam supports both working with the Google Cloud Storage file system and reading data from and writing data to Google Cloud Storage buckets. Apache Beam has a built-in TextIO connector for reading data from and writing data to Google Cloud Storage buckets. For more information, see the TextIO connector documentation for your programming language of choice: The Apache Beam AvroIO, XMLIO, TFRecordIO, and ParquetIO connectors also support reading data from and writing data to different file formats within Google Cloud Storage buckets. You can specify the Google Cloud Storage file path using the following format: `gs://<bucket>/<path>`. For example, `gs://my-bucket/my-file.txt`. You can use wildcards in read and write transforms to process data from multiple files or write data to multiple files simultaneously. For instance, you can specify `gs://my-bucket/my-files-*.txt` to read or write to files with names matching the specified pattern. Apache Beam also allows pipelines to interact directly with the Google Cloud Storage file system. For instance, you can use this file system to verify the existence of a file, retrieve a list of files in a directory, or delete a file. The Google Cloud Storage file system is supported in the following languages:
Project: Stolon (App Definition and Development / Database)
File: stolonctl_init.md

Initialize a new cluster Initialize a new cluster ``` stolonctl init [flags] ``` ``` -f, --file string file contaning the new cluster spec -h, --help help for init -y, --yes don't ask for confirmation ``` ``` --cluster-name string cluster name --kube-context string name of the kubeconfig context to use --kube-namespace string name of the kubernetes namespace to use --kube-resource-kind string the k8s resource kind to be used to store stolon clusterdata and do sentinel leader election (only "configmap" is currently supported) --kubeconfig string path to kubeconfig file. Overrides $KUBECONFIG --log-level string debug, info (default), warn or error (default "info") --metrics-listen-address string metrics listen address i.e "0.0.0.0:8080" (disabled by default) --store-backend string store backend type (etcdv2/etcd, etcdv3, consul or kubernetes) --store-ca-file string verify certificates of HTTPS-enabled store servers using this CA bundle --store-cert-file string certificate file for client identification to the store --store-endpoints string a comma-delimited list of store endpoints (use https scheme for tls communication) (defaults: http://127.0.0.1:2379 for etcd, http://127.0.0.1:8500 for consul) --store-key string private key file for client identification to the store --store-prefix string the store base prefix (default "stolon/cluster") --store-skip-tls-verify skip store certificate verification (insecure!!!) --store-timeout duration store request timeout (default 5s) ``` - stolon command line client
Project: KICS (Provisioning / Security & Compliance)
File: 16732649-4ff6-4cd2-8746-e72c13fae4b8.md

title: RDS Associated with Public Subnet hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 16732649-4ff6-4cd2-8746-e72c13fae4b8 Query name: RDS Associated with Public Subnet Platform: Ansible Severity: <span style="color:#ff0000">Critical</span> Category: Networking and Firewall URL: RDS should not run in public subnet<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9" name: create minimal aurora instance in default VPC and default subnet group community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" cluster_id: ansible-test-cluster dbsubnetgroupname: mysubnet_group name: Add or change a subnet group community.aws.rdssubnetgroup: state: present name: mysubnetgroup description: My Fancy Ex Parrot Subnet Group subnets: "{{ subnet1.subnet.id }}" "{{ subnet2.subnet.id }}" register: mysubnetgroup name: Create subnet for database servers amazon.aws.ec2vpcsubnet: state: present vpc_id: vpc-123456 cidr: 0.0.0.0/0 tags: Name: Database Subnet register: subnet1 name: Create subnet for database servers2 amazon.aws.ec2vpcsubnet: state: present vpc_id: vpc-123456 cidr: 10.0.1.16/28 tags: Name: Database Subnet register: subnet2 ``` ```yaml title="Negative test num. 1 - yaml file" name: create minimal aurora instance in default VPC and default subnet group2 community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" cluster_id: ansible-test-cluster dbsubnetgroupname: mysubnet_group2 name: Add or change a subnet group2 community.aws.rdssubnetgroup: state: present name: mysubnetgroup2 description: My Fancy Ex Parrot Subnet Group subnets: "{{ subnet22.subnet.id }}" register: mysubnetgroup2 name: Create subnet for database servers22 amazon.aws.ec2vpcsubnet: state: present vpc_id: vpc-123456 cidr: 10.0.1.16/28 tags: Name: Database Subnet register: subnet22 ```
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_data_verify_postgres.md

title: Kubectl-Dba Data Verify Postgres menu: docs_{{ .version }}: identifier: kubectl-dba-data-verify-postgres name: Kubectl-Dba Data Verify Postgres parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Verify rows in a postgres database Use this cmd to verify data in a postgres object ``` kubectl-dba data verify postgres [flags] ``` ``` kubectl dba verify pg -n demo sample-postgres --rows 500 ``` ``` -h, --help help for postgres -r, --rows int number of rows to verify (default 100) ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - Verify data in a database
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_kms_crypto_key_iam_binding.md

+++ title = "googlekmscryptokeyiam_binding resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlekmscryptokeyiam_binding" identifier = "inspec/resources/gcp/googlekmscryptokeyiambinding.md googlekmscryptokeyiambinding resource" parent = "inspec/resources/gcp" +++ A `googlekmscryptokeyiam_binding` is used to test a Google CryptoKey Iam Bindings ```ruby describe googlekmscryptokeyiambinding(project: "project", location: "location", keyringname: "keyringname", cryptokeyname: "cryptokey_name", role: "roles/editor") do it { should exist } its('members') { should include 'user:testuser@example.com' } end ``` Properties that can be accessed from the `googlekmscryptokeyiam_binding` resource: `role` : Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. `members` : Specifies the identities requesting access for a Cloud Platform resource. Ensure the is enabled for the current project.
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: feature_request.md

name: "\U0001F680 Feature request" about: Suggest an idea for this project title: "[Feature]" labels: kind/feature assignees: '' Is your feature request related to a problem? Please describe. <!-- A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] --> Describe the solution you'd like <!-- A clear and concise description of what you want to happen. --> Describe alternatives you've considered <!-- A clear and concise description of any alternative solutions or features you've considered. --> Additional context <!-- Add any other context or screenshots about the feature request here. -->
Project: Qdrant (App Definition and Development / Database)
File: bug_report.md

name: Bug report about: Create a report to help us improve title: '' labels: bug assignees: '' <! Provide a general summary of the issue in the Title above --> <! Tell us what happens instead of the expected behavior --> <! Provide a link to a live example, or an unambiguous set of steps to --> <! reproduce this bug. Include code to reproduce, if relevant --> <! Please make sure to include the data which could be used to reproduce the problem --> <! Tell us what should happen --> <! Not obligatory, but suggest a fix/reason for the bug, --> <! How has this issue affected you? What are you trying to accomplish? --> <! Providing context helps us come up with a solution that is most useful in the real world --> <! Provide a general summary of the issue in the Title above --> <! Provide a detailed description of the change or addition you are proposing --> <! Not obligatory, but suggest an idea for implementing addition or change -->