cwielenb/CNCF-Dataset huggingface dataset:
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: PULL_REQUEST_TEMPLATE.md

<!-- Thanks for submitting a PR to OPA! Before pressing 'Create pull request' please read the checklist below. All code changes should be accompanied with tests. If you are not modifying any tests, just provide a short explanation of why updates to tests are not necessary. In addition to helping catch bugs, tests are extremely helpful in providing context that explains how your changes can be used. All changes to public APIs must* be accompanied with docs. Examples of public APIs include built-in functions, config fields, and of course, exported Go types/functions/constants/etc. Commit messages should explain why you made the changes, not what you changed. Use active voice. Keep the subject line under 50 characters or so. All commits must be signed off by the author. If you are not familiar with signing off, see our contributor guide below. For more information on contributing to OPA see: for high-level contributing guidelines and development setup. --> <!-- Include a short description of WHY the changes were made. --> <!-- Include a short description of WHAT changes were made. --> <!-- Here you can add information you think will help the reviewer(s). --> <!-- Here you can include links to additional resources related to the changes, discuss your solution, other approaches you considered etc. -->
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_query.md

Runs queries against your cluster in order to aid in debugging. ``` sonobuoy query [flags] ``` ``` --config Sonobuoy config Path to a sonobuoy configuration JSON file. -h, --help help for query -o, --output string Directory to output results into. If empty, will default to a UUID folder in the pwd. ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Generate reports on your Kubernetes cluster by running plugins
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_images_list.md

List images ``` sonobuoy images list [flags] ``` ``` --context string Context in the kubeconfig to use. --dry-run If true, only print the image operations that would be performed. -h, --help help for list --kubeconfig Kubeconfig Path to explicit kubeconfig file. --kubernetes-version string Use default E2E image, but override the version. Default is 'auto', which will be set to your cluster's version if detected, erroring otherwise. 'ignore' will try version resolution but ignore errors. 'latest' will find the latest dev image/version upstream. -p, --plugin strings Describe which plugin's images to interact with (Valid plugins are 'e2e', 'systemd-logs'). (default [e2e,systemd-logs]) ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Manage images used in a plugin to facilitate running them in airgapped (or similar) environments. Supported plugins are: 'e2e'
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: ipc.image.md

Sets the configuration for IPC namespaces when handling `RUN` instructions. The configured value can be "" (the empty string) or "container" to indicate that a new IPC namespace is created, or it can be "host" to indicate that the IPC namespace in which `podman` itself is being run is reused, or it can be the path to an IPC namespace which is already in use by another process.
Project: Terraform (Provisioning / Automation & Configuration)
File: BUILDING.md

Pre-built binaries are available for download for a variety of supported platforms through the . However, if you'd like to build Terraform yourself, you can do so using the Go build toolchain and the options specified in this document. Ensure you've installed the Go language version specified in . Clone this repository to a location of your choice. Terraform accepts certain options passed using `ldflags` at build time which control the behavior of the resulting binary. Terraform will include a `-dev` flag when reporting its own version (ex: 1.5.0-dev) unless `version.dev` is set to `no`: ``` go build -ldflags "-w -s -X 'github.com/hashicorp/terraform/version.dev=no'" -o bin/ . ``` Experimental features of Terraform will be disabled unless `main.experimentsAllowed` is set to `yes`: ``` go build -ldflags "-w -s -X 'main.experimentsAllowed=yes'" -o bin/ . ``` In the official build process for Terraform, experiments are only allowed in alpha release builds. We recommend that third-party distributors follow that convention in order to reduce user confusion. For the most part, the Terraform release process relies on the Go toolchain defaults for the target operating system and processor architecture. One exception is the `CGOENABLED` option, which is set explicitly when building Terraform binaries. For most platforms, we build with `CGOENABLED=0` in order to produce a statically linked binary. For MacOS/Darwin operating systems, we build with `CGO_ENABLED=1` to avoid a platform-specific issue with DNS resolution.
Project: KICS (Provisioning / Security & Compliance)
File: 3206240f-2e87-4e58-8d24-3e19e7c83d7c.md

title: ECS Service Admin Role Is Present hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3206240f-2e87-4e58-8d24-3e19e7c83d7c Query name: ECS Service Admin Role Is Present Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: ECS Services must not have Admin roles, which means the attribute 'iam_role' must not be an admin role<br> ```tf title="Positive test num. 1 - tf file" hl_lines="7" resource "awsecsservice" "positive1" { name = "mongodb" cluster = awsecscluster.foo.id taskdefinition = awsecstaskdefinition.mongo.arn desired_count = 3 iam_role = "admin" dependson = [awsiamrolepolicy.foo] orderedplacementstrategy { type = "binpack" field = "cpu" } load_balancer { targetgrouparn = awslbtarget_group.foo.arn container_name = "mongo" container_port = 8080 } placement_constraints { type = "memberOf" expression = "attribute:ecs.availability-zone in [us-west-2a, us-west-2b]" } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsecsservice" "negative1" { name = "mongodb" cluster = awsecscluster.foo.id taskdefinition = awsecstaskdefinition.mongo.arn desired_count = 3 iamrole = awsiam_role.foo.arn dependson = [awsiamrolepolicy.foo] orderedplacementstrategy { type = "binpack" field = "cpu" } load_balancer { targetgrouparn = awslbtarget_group.foo.arn container_name = "mongo" container_port = 8080 } placement_constraints { type = "memberOf" expression = "attribute:ecs.availability-zone in [us-west-2a, us-west-2b]" } } ```
Project: StarRocks (App Definition and Development / Database)
File: concat_ws.md

displayed_sidebar: "English" This function uses the first argument sep as the separator which combines the second with the rest to form a string. If the separator is NULL, the result is NULL. concat_ws does not skip empty strings, but it will skip NULL values. ```Haskell VARCHAR concat_ws(VARCHAR sep, VARCHAR str,...) ``` ```Plain Text MySQL > select concat_ws("Rock", "Star", "s"); +--+ | concat_ws('Rock', 'Star', 's') | +--+ | StarRocks | +--+ MySQL > select concat_ws(NULL, "Star", "s"); ++ | concat_ws(NULL, 'Star', 's') | ++ | NULL | ++ 1 row in set (0.01 sec) MySQL > StarRocks > select concat_ws("Rock", "Star", NULL, "s"); +--+ | concat_ws('Rock', 'Star', NULL, 's') | +--+ | StarRocks | +--+ 1 row in set (0.04 sec) ``` CONCAT_WS,CONCAT,WS
Project: Harbor (Provisioning / Container Registry)
File: 10-10-Manual-scan-all.md

10-10 Manual scan all ======= To verify scan all button works correctly. User guide. This test requires that one Harbor instance is running and available. Harbor is installed with trivy enable. A Linux host with Docker client installed. Trivy has been updated to the latest. Login Harbor as admin. Create several projects. Push some images to each project. Goto configuration and click vulnerability. Click scan all. View scan result. Step6 timestamp should be time when click scan all. None
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_data_verify_elasticsearch.md

title: Kubectl-Dba Data Verify Elasticsearch menu: docs_{{ .version }}: identifier: kubectl-dba-data-verify-elasticsearch name: Kubectl-Dba Data Verify Elasticsearch parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Verify rows in a elasticsearch database Use this cmd to verify data in a elasticsearch object ``` kubectl-dba data verify elasticsearch [flags] ``` ``` kubectl dba verify -n demo es es-quickstart --rows 1000 ``` ``` -h, --help help for elasticsearch -r, --rows int number of rows to verify (default 100) ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - Verify data in a database
Project: YugabyteDB (App Definition and Development / Database)
File: alter_role,alter_role_option,role_specification,alter_role_rename,alter_role_config,config_setting.grammar.md

```output.ebnf alterrole ::= ALTER ROLE rolespecification [ [ WITH ] alterroleoption [ , ... ] ] alterroleoption ::= SUPERUSER | NOSUPERUSER | CREATEDB | NOCREATEDB | CREATEROLE | NOCREATEROLE | INHERIT | NOINHERIT | LOGIN | NOLOGIN | CONNECTION LIMIT connlimit | [ ENCRYPTED ] PASSWORD ' password ' | PASSWORD NULL | VALID UNTIL ' timestamp ' rolespecification ::= rolename | CURRENTUSER | SESSIONUSER alterrolerename ::= ALTER ROLE rolename RENAME TO newrole_name alterroleconfig ::= ALTER ROLE { role_specification | ALL } [ IN DATABASE databasename ] configsetting configsetting ::= SET configparam { TO | = } { config_value | DEFAULT } | SET config_param FROM CURRENT | RESET config_param | RESET ALL ```
Project: StarRocks (App Definition and Development / Database)
File: monthname.md

displayed_sidebar: "English" Returns the name of the month for a given date. The `date` parameter must be of the DATE or DATETIME type. ```Haskell VARCHAR MONTHNAME(date) ``` ```Plain Text MySQL > select monthname('2008-02-03 00:00:00'); +-+ | monthname('2008-02-03 00:00:00') | +-+ | February | +-+ ``` MONTHNAME, monthname
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_plugin_list.md

title: kbcli plugin list List all visible plugin executables on a user's PATH ``` kbcli plugin list ``` ``` kbcli plugin list ``` ``` -h, --help help for list ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Provides utilities for interacting with plugins.
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: v5.1.5.en.md

This change allows to set the minReadySeconds for the StatefulSet. This allows to add a gap between the restarts of each pod by upgrade or restart command. Add `node.brokerpoolsize`, `node.genericpoolsize`, `node.channelcleanupbatch_size` options to EMQX configuration. Tuning these options can significantly improve performance if cluster interconnect network latency is high. Improved retained message publishing latency by consolidating multiple index update operations into a single mnesia activity, leveraging the new APIs introduced in mria 0.6.0. Increase `emqxroutersup` restart intensity. The goal is to tolerate occasional crashes that can happen under relatively normal conditions and don't seem critical to shutdown the whole app (emqx). For example, mria write/delete call delegated from a replicant to a core node by `emqxrouterhelper` may fail, if the core node is being stopped / restarted / not ready. Reintroduce `cacerts` TLS client option as a deprecated option. This fixes issues found when trying to upgrade from 5.1.3 where that option is set in the configuration files or persisted in EMQX Operator settings.
Project: Shifu (Provisioning / Automation & Configuration)
File: CHANGELOG-v0.43.0.md

Bump golang.org/x/net from 0.21.0 to 0.24.0 by @dependabot in Bump github.com/Azure/azure-sdk-for-go/sdk/ai/azopenai from 0.5.0 to 0.5.1 by @dependabot in Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.10.0 to 1.11.1 by @dependabot in Bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @dependabot in Bump github.com/minio/minio-go/v7 from 7.0.67 to 7.0.69 by @dependabot in Full Changelog: https://github.com/Edgenesis/shifu/compare/v0.42.0...v0.43.0
Project: Apache Hadoop (App Definition and Development / Database)
File: RELEASENOTES.0.16.3.md

<! --> These release notes cover new developer and user-facing incompatibilities, important issues, features, and major improvements. | Blocker | JobClient creates submitJobDir with SYSTEM\_DIR\_PERMISSION ( rwx-wx-wx)* Changed \<job-dir\> from 733 to 777, so that a shared JobTracker can be started by a non-superuser account.
Project: Trivy (Provisioning / Security & Compliance)
File: helm.md

Trivy supports two types of Helm scanning, templates and packaged charts. The following scanners are supported. | Format | [Misconfiguration] | [Secret] | | -- | :-: | :: | | Template | | | | Chart | | - | Trivy recursively searches directories and scans all found Helm files. It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks. See for more details on the built-in checks. There are a number of options for overriding values in Helm charts. When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact. Overrides can be set inline on the command line ```bash trivy conf --helm-set securityContext.runAsUser=0 ./charts/mySql ``` Overrides can be in a file that has the key=value set. ```yaml securityContext: runAsUser: 0 ``` ```bash trivy conf --helm-values overrides.yaml ./charts/mySql ``` the `--helm-set-string` is the same as `--helm-set` but explicitly retains the value as a string ```bash trivy config --helm-set-string name=false ./infrastructure/tf ``` Specific override values can come from specific files ```bash trivy conf --helm-set-file environment=dev.values.yaml ./charts/mySql ``` The secret scan is performed on plain text files, with no special treatment for Helm. Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.
Project: YugabyteDB (App Definition and Development / Database)
File: cpp.md

title: Build a YugabyteDB application using C++ and YEDIS headerTitle: Build an application using C++ linkTitle: C++ description: Use C++ to build a YugabyteDB application that interacts with YEDIS aliases: /preview/yedis/develop/client-drivers/cpp menu: preview: identifier: client-drivers-yedis-cpp parent: develop-yedis type: docs The tutorial assumes that you have: installed YugabyteDB, created a universe, and are able to interact with it using the Redis shell. If not, follow the steps in . have C++ 11 or later. We use the driver. To install the library do the following: Clone the `cpp_redis` repository ```sh $ git clone https://github.com/Cylix/cpp_redis.git ``` Get the networking module () ```sh $ cd cpp_redis $ git submodule init && git submodule update ``` Create a build directory and move into it ```sh $ mkdir build && cd build ``` Generate the Makefile using CMake ```sh $ cmake .. -DCMAKEBUILDTYPE=Release ``` Build and install the library ```sh $ make $ make install ``` Create a file `ybredishelloworld.cpp` and copy the contents below: ```cpp using namespace std; int main() { cpp_redis::client client; client.connect("127.0.0.1", 6379, { if (status == cppredis::client::connectstate::dropped) { std::cout << "client disconnected from " << host << ":" << port << std::endl; } }); string userid = "1"; vector<pair<string, string>> userProfile; userProfile.pushback(makepair("name", "John")); userProfile.pushback(makepair("age", "35")); userProfile.pushback(makepair("language", "Redis")); // Insert the data client.hmset(userid, userProfile, { cout<< "HMSET returned " << reply << ": id=1, name=John, age=35, language=Redis" << endl; }); // Query the data client.hgetall(userid, { std::vector<cpp_redis::reply> retVal; if (reply.is_array()) { retVal = reply.as_array(); } cout << "Query result:" <<endl; for (int i = 0; i < retVal.size(); i=i+2) { cout << retVal[i] << "=" <<retVal[i+1] << endl; } }); // synchronous commit, no timeout client.sync_commit(); return 0; } ``` To compile the file, run the following command. ```sh $ g++ -ltacopie -lcppredis -std=c++11 -o ybredishelloworld ybredishello_world.cpp ``` To run the application, run the following command. ```sh $ ./ybredishelloworld ``` You should see the following output. ``` HMSET returned OK: id=1, name=John, age=35, language=Redis Query result: age=35 language=Redis name=John ```
Project: SPIFFE (Provisioning / Key Management)
File: MARIUSZ_SABATH.md

Mariusz has been a maintainer on the helm charts project since it started and has been a long time contributer to SPIRE. Be sure to preserve the two empty spaces at the end of each line below. GitHub Handle: @mrsabath Email Address: mrsabath@gmail.com LinkedIn Profile: https://www.linkedin.com/in/mariusz-sabath-b36b0b20/ Current Affiliation: IBM Research
Project: KICS (Provisioning / Security & Compliance)
File: a507daa5-0795-4380-960b-dd7bb7c56661.md

title: ELB Using Weak Ciphers hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a507daa5-0795-4380-960b-dd7bb7c56661 Query name: ELB Using Weak Ciphers Platform: Crossplane Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: ELB Predefined or Custom Security Policies must not use weak ciphers, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the 'sslPolicy' of 'Listener' must not coincide with any of a predefined list of weak ciphers.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="18 58" apiVersion: elbv2.aws.crossplane.io/v1alpha1 kind: Listener metadata: name: test-listener spec: forProvider: region: us-east-1 defaultActions: actionType: forward forwardConfig: targetGroups: targetGroupArnRef: name: test-targetgroup loadBalancerArnRef: name: test-loadbalancer port: 80 protocol: HTTP sslPolicy: TLSNULLWITHNULLNULL providerConfigRef: name: example apiVersion: apiextensions.crossplane.io/v1 kind: Composition metadata: name: cluster-aws labels: provider: aws cluster: eks spec: compositeTypeRef: apiVersion: mydev.org/v1alpha1 kind: CompositeCluster writeConnectionSecretsToNamespace: crossplane-system patchSets: name: metadata patches: fromFieldPath: metadata.labels resources: name: sample-ec2 base: apiVersion: elbv2.aws.crossplane.io/v1alpha1 kind: Listener metadata: name: test-listener2 spec: forProvider: region: us-east-1 defaultActions: actionType: forward forwardConfig: targetGroups: targetGroupArnRef: name: test-targetgroup loadBalancerArnRef: name: test-loadbalancer port: 80 protocol: HTTP sslPolicy: TLSNULLWITHNULLNULL providerConfigRef: name: example ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: elbv2.aws.crossplane.io/v1alpha1 kind: Listener metadata: name: test-listener spec: forProvider: region: us-east-1 defaultActions: actionType: forward forwardConfig: targetGroups: targetGroupArnRef: name: test-targetgroup loadBalancerArnRef: name: test-loadbalancer port: 80 protocol: HTTP sslPolicy: ELBSecurityPolicy-2015-05 providerConfigRef: name: example apiVersion: apiextensions.crossplane.io/v1 kind: Composition metadata: name: cluster-aws labels: provider: aws cluster: eks spec: compositeTypeRef: apiVersion: mydev.org/v1alpha1 kind: CompositeCluster writeConnectionSecretsToNamespace: crossplane-system patchSets: name: metadata patches: fromFieldPath: metadata.labels resources: name: sample-ec2 base: apiVersion: elbv2.aws.crossplane.io/v1alpha1 kind: Listener metadata: name: test-listener2 spec: forProvider: region: us-east-1 defaultActions: actionType: forward forwardConfig: targetGroups: targetGroupArnRef: name: test-targetgroup loadBalancerArnRef: name: test-loadbalancer port: 80 protocol: HTTP sslPolicy: ELBSecurityPolicy-2015-05 providerConfigRef: name: example ```