cwielenb/CNCF-Dataset huggingface dataset:
Project: KubeVirt (App Definition and Development / Application Definition & Image Build)
File: CONDUCT.md

Cobra will follow a steady release cadence. Non breaking changes will be released as minor versions quarterly. Patch bug releases are at the discretion of the maintainers. Users can expect security patch fixes to be released within relatively short order of a CVE becoming known. For more information on security patch fixes see the CVE section below. Releases will follow . Users tracking the Master branch should expect unpredictable breaking changes as the project continues to move forward. For stability, it is highly recommended to use a release. We will maintain two major releases in a moving window. The N-1 release will only receive bug fixes and security updates and will be dropped once N+1 is released. Deprecation of Go versions or dependent packages will only occur in major releases. To reduce the change of this taking users by surprise, any large deprecation will be preceded by an announcement in the and an Issue on Github. Maintainers will make every effort to release security patches in the case of a medium to high severity CVE directly impacting the library. The speed in which these patches reach a release is up to the discretion of the maintainers. A low severity CVE may be a lower priority than a high severity one. Cobra maintainers will use GitHub issues and the as the primary means of communication with the community. This is to foster open communication with all users and contributors. Breaking changes are generally allowed in the master branch, as this is the branch used to develop the next release of Cobra. There may be times, however, when master is closed for breaking changes. This is likely to happen as we near the release of a new version. Breaking changes are not allowed in release branches, as these represent minor versions that have already been released. These version have consumers who expect the APIs, behaviors, etc, to remain stable during the lifetime of the patch stream for the minor release. Examples of breaking changes include: Removing or renaming exported constant, variable, type, or function. Updating the version of critical libraries such as `spf13/pflag`, `spf13/viper` etc... Some version updates may be acceptable for picking up bug fixes, but maintainers must exercise caution when reviewing. There may, at times, need to be exceptions where breaking changes are allowed in release branches. These are at the discretion of the project's maintainers, and must be carefully considered before merging. Maintainers will ensure the Cobra test suite utilizes the current supported versions of Golang. Changes to this document and the contents therein are at the discretion of the maintainers. None of the contents of this document are legally binding in any way to the maintainers or the users.
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: MIGRATION_GUIDE.md

In version `v2`, ORAS Go library has been completely refreshed with: More unified interfaces Notably fewer dependencies Higher test coverage Better documentation Besides, ORAS Go `v2` is now a registry client. Moves `content.FileStore` to Moves `content.OCIStore` to Moves `content.MemoryStore` to Provides to interact with OCI-compliant and Docker-compliant registries Supports with more flexible options Supports with options (experimental) No longer supports `docker.Login` and `docker.Logout` (removes the dependency on `docker`); instead, provides authentication through Documentation and examples are available at . Get the `v2` package ```sh go get oras.land/oras-go/v2 ``` Import and use the `v2` package ```go import "oras.land/oras-go/v2" ``` Run ```sh go mod tidy ``` Since breaking changes are introduced in `v2`, code refactoring is required for migrating from `v1` to `v2`. The migration can be done in an iterative fashion, as `v1` and `v2` can be imported and used at the same time.
Project: SeaTunnel (App Definition and Development / Streaming & Messaging)
File: quick-start-flink.md

sidebar_position: 3 Before starting, make sure you have downloaded and deployed SeaTunnel as described in Please first(required version >= 1.12.0). For more information you could see Configure SeaTunnel: Change the setting in `config/seatunnel-env.sh`, it is base on the path your engine install at . Change `FLINK_HOME` to the Flink deployment dir. Edit `config/v2.streaming.conf.template`, which determines the way and logic of data input, processing, and output after seatunnel is started. The following is an example of the configuration file, which is the same as the example application mentioned above. ```hocon env { parallelism = 1 job.mode = "BATCH" } source { FakeSource { resulttablename = "fake" row.num = 16 schema = { fields { name = "string" age = "int" } } } } transform { FieldMapper { sourcetablename = "fake" resulttablename = "fake1" field_mapper = { age = age name = new_name } } } sink { Console { sourcetablename = "fake1" } } ``` More information about config please check You could start the application by the following commands flink version between `1.12.x` and `1.14.x` ```shell cd "apache-seatunnel-${version}" ./bin/start-seatunnel-flink-13-connector-v2.sh --config ./config/v2.streaming.conf.template ``` flink version between `1.15.x` and `1.16.x` ```shell cd "apache-seatunnel-${version}" ./bin/start-seatunnel-flink-15-connector-v2.sh --config ./config/v2.streaming.conf.template ``` See The Output: When you run the command, you could see its output in your console. You can think this is a sign that the command ran successfully or not. The SeaTunnel console will prints some logs as below: ```shell fields : name, age types : STRING, INT row=1 : elWaB, 1984352560 row=2 : uAtnp, 762961563 row=3 : TQEIB, 2042675010 row=4 : DcFjo, 593971283 row=5 : SenEb, 2099913608 row=6 : DHjkg, 1928005856 row=7 : eScCM, 526029657 row=8 : sgOeE, 600878991 row=9 : gwdvw, 1951126920 row=10 : nSiKE, 488708928 row=11 : xubpl, 1420202810 row=12 : rHZqb, 331185742 row=13 : rciGD, 1112878259 row=14 : qLhdI, 1457046294 row=15 : ZTkRx, 1240668386 row=16 : SGZCr, 94186144 ``` For now, you are already take a quick look about SeaTunnel with Flink, you could see to find all source and sink SeaTunnel supported. Or see if you want to know more about SeaTunnel Run With Flink. SeaTunnel have an own engine named `Zeta` and `Zeta` is the default engine of SeaTunnel. You can follow to configure and run a data synchronization job.
Project: Docker Compose (App Definition and Development / Application Definition & Image Build)
File: compose_attach.md

<!MARKERGENSTART--> Attach local standard input, output, and error streams to a service's running container | Name | Type | Default | Description | |:-|:|:--|:-| | `--detach-keys` | `string` | | Override the key sequence for detaching from a container. | | `--dry-run` | | | Execute command in dry run mode | | `--index` | `int` | `0` | index of the container if service has multiple replicas. | | `--no-stdin` | | | Do not attach STDIN | | `--sig-proxy` | `bool` | `true` | Proxy all received signals to the process | <!MARKERGENEND-->
Project: Athenz (Provisioning / Key Management)
File: self_serve_roles.md

Athenz now supports configuring roles in domains as self-served thus allowing users to request domain administrators to approve their request to be added to a role. Athenz can send email notifications for administrators. See section to enable notifications. To designate a role as self-served, the domain administrator may use either or utility. To use Athenz UI, the domain administrator will login to their domain role view and choose the `Self Served` slider for the appropriate role. For example, in the following case, the `dbreaderaccess` role is configured as self-served. The equivalent setup using `zms-cli` would be: ``` zms-cli -d <domain-name> set-role-self-serve <role-name> true ``` The users can only add themselves (not other users or services) to any self-served roles. Their access is not active until one of the domain administrators approves the request. For example, in this use case, `user.johndoe` would like to be added to the `dbreaderaccess` role which is configured as self-served. When the user adds his principal id to the role, it will be added in the `Pending Approval` column. Once the pending request is processed, all domain administrators will receive an email notification (if ) stating that `user.johndoe` would like to be added to the `dbreaderaccess` role and they need to either approve or reject the request. The email will include a link to the Athenz UI workflow page which can also be accessed by clicking on the notifications icon in the Athenz UI toolbar: Once in the approval view page, the domain administrator may either approve or reject the request. The domain administrator will need to provide a justification in the `Audit Reference` field and optionally specify an expiration date (even if the user didn't request one). Once approved, the principal will become an active/approved member of the role. If rejected, the principal's name will be removed from the `Pending Approval` column.
Project: ArangoDB (App Definition and Development / Database)
File: value_rvalue.md

+++ title = "`value_type &&value() &&`" description = "Wide contract rvalue reference observer of any value present. Constexpr propagating." categories = ["observers"] weight = 660 +++ Wide contract rvalue reference observer of any value present. `NoValuePolicy::widevaluecheck()` is first invoked, then the reference to the value is returned. Note that if `value_type` is `void`, only a `const` overload returning `void` is present. Requires: Always available. Complexity: Depends on `NoValuePolicy::widevaluecheck()`. Guarantees: None.
Project: Checkov (Provisioning / Security & Compliance)
File: openapi.md

layout: default published: true title: OpenAPI configuration scanning nav_order: 20 Checkov supports the evaluation of policies on your OpenAPI files. When using checkov to scan a directory that contains OpenAPI manifests it will validate if the file is compliant with OpenAPI best practices such as securityDefinitions and security requirement are well-defined, and more. Full list of OpenAPI policies checks can be found . ```yaml { "swagger": "2.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "example", "summary": "example", "responses": { "200": { "description": "200 response" } }, "parameters": [ { "name": "limit2", "in": "body", "required": true, "schema": { "type": "object" } } ], "security": [ { "api_key": [] } ] } } }, "securityDefinitions": { "petstore_auth": { "type": "oauth2", "authorizationUrl": "http://swagger.io/api/oauth/dialog", "flow": "implicit", "scopes": { "write:pets": "write", "read:pets": "read" } } } } ``` ```bash checkov -d . --framework openapi ``` ```bash _| | _ | | / | '_ \ / _ \/ | |/ / _ \ \ / / | (| | | | / (| < (_) \ V / \_|_| |_|\|\|_|\_\/ \/ By Prisma Cloud | version: x.x.x openapi scan results: Passed checks: 4, Failed checks: 2, Skipped checks: 0 Check: CKVOPENAPI2: "Ensure that if the security scheme is not of type 'oauth2', the array value must be empty" PASSED for resource: security File: /openapi.yaml:2-47 Check: CKVOPENAPI5: "Ensure that security operations is not empty." PASSED for resource: security File: /openapi.yaml:2-47 Check: CKVOPENAPI1: "Ensure that securityDefinitions is defined and not empty." PASSED for resource: securityDefinitions File: /../aya/openapi.yaml:36-46 Check: CKVOPENAPI3: "Ensure that security schemes don't allow cleartext credentials over unencrypted channel" PASSED for resource: components File: /openapi.yaml:2-47 Check: CKVOPENAPI6: "Ensure that security requirement defined in securityDefinitions." FAILED for resource: security File: /openapi.yaml:27-31 27 | "security": [ 28 | { 29 | "api_key": [] 30 | } 31 | ] Check: CKVOPENAPI4: "Ensure that the global security field has rules defined" FAILED for resource: security File: /openapi.yaml:1-47 1 | { 2 | "swagger": "2.0", 3 | "info": { 4 | "title": "example", 5 | "version": "1.0.0" 6 | }, 7 | "paths": { 8 | "/": { 9 | "get": { 10 | "operationId": "example", 11 | "summary": "example", 12 | "responses": { 13 | "200": { 14 | "description": "200 response" 15 | } 16 | }, 17 | "parameters": [ 18 | { 19 | "name": "limit2", 20 | "in": "body", 21 | "required": true, 22 | "schema": { 23 | "type": "object" 24 | } 25 | } 26 | ], 27 | "security": [ 28 | { 29 | "api_key": [] 30 | } 31 | ] 32 | } 33 | } 34 | }, 35 | "securityDefinitions": { 36 | "petstore_auth": { 37 | "type": "oauth2", 38 | "authorizationUrl": "http://swagger.io/api/oauth/dialog", 39 | "flow": "implicit", 40 | "scopes": { 41 | "write:pets": "write", 42 | "read:pets": "read" 43 | } 44 | } 45 | } 46 | } ```
Project: kube-hunter (Provisioning / Security & Compliance)
File: KHV052.md

vid: KHV052 title: Exposed Pods categories: [Information Disclosure] severity: medium An attacker could view sensitive information about pods that are bound to a Node using the exposed /pods endpoint This can be done either by accessing the readonly port (default 10255), or from the secure kubelet port (10250) Ensure kubelet is protected using `--anonymous-auth=false` kubelet flag. Allow only legitimate users using `--client-ca-file` or `--authentication-token-webhook` kubelet flags. This is usually done by the installer or cloud provider. Disable the readonly port by using `--read-only-port=0` kubelet flag.
Project: Distribution (Provisioning / Container Registry)
File: filesystem.md

description: Explains how to use the filesystem storage drivers keywords: registry, service, driver, images, storage, filesystem title: Filesystem storage driver An implementation of the `storagedriver.StorageDriver` interface which uses the local filesystem. `rootdirectory`: (optional) The absolute path to a root directory tree in which to store all registry files. The registry stores all its data here so make sure there is adequate space available. Defaults to `/var/lib/registry`. If the directory does not exist, it will be created honoring bits. If `umask` bits are not set, the resulting permission will be `0777`. `maxthreads`: (optional) The maximum number of simultaneous blocking filesystem operations permitted within the registry. Each operation spawns a new thread and may cause thread exhaustion issues if many are done in parallel. Defaults to `100`, and cannot be lower than `25`.
Project: Meshery (Provisioning / Automation & Configuration)
File: 02-07-2023-22-04-02_2efcfcac.md

timestamp: "2023-02-07 22:04:22 UTC Tue" meshery-component: meshery-consul meshery-component-version: edge meshery-server-version: "v0.6.50" k8s-distro: minikube k8s-version: "v1.24.7" service-mesh: Consul service-mesh-version: "v1.0.4" tests: consul-client: null consul-server: null overall-status: "failing"
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_exec_postgres.md

title: Kubectl-Dba Exec Postgres menu: docs_{{ .version }}: identifier: kubectl-dba-exec-postgres name: Kubectl-Dba Exec Postgres parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Execute SQL commands to a postgres resource Use this cmd to execute postgresql commands to a postgres object's primary pod. Examples: kubectl dba exec pg pg-demo -n demo -f demo.sql kubectl dba exec pg pg-demo -c '\l' -d kubedb" ``` kubectl-dba exec postgres [flags] ``` ``` -c, --command string command to execute -d, --dbName string name of the database inside postgres to execute command -f, --file string path to command file -h, --help help for postgres ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - Execute script or command to a database.
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: lagoon-build-errors-and-warnings.md

Newer releases of Lagoon have the capability to identify potential issues with the build, and highlight them as warnings without failing. This is also a way for the Lagoon team to inform users of pending deprecations and changes to functionality. For example, if the Lagoon team makes a change to a setting in `lagoon.yml`, and theres something that users need to change, the warning will mention it, so users will be able to change it before it becomes a breaking change. They should be resolved ASAP wherever possible, as future releases of Lagoon may not be able to handle the errors, but they shouldn't stop your build. If you aren't sure how to resolve these errors, please reach out to your Lagoon administrator, or ask a question in the . Please also see the section on , as some of these issues may be covered there ``` shell title="Lagoon Build output indicating env_file error" an env_file is defined in your docker-compose file, but no matching file found ``` Docker Compose expects a referenced env file to be present at build time, but that env file is only present in local development, or has been excluded from the Dockerfile. The Lagoon team is working to hopefully allow Docker Compose to ignore this error, so this warning will remain until we have a resolution. ``` shell title="Lagoon Build output indicating string key error" an invalid string key was detected in your docker-compose file ``` There is an error in your Docker Compose file, most likely relating to a malformed or misused alias or anchor. The error message should help you understand where. ``` shell title="Lagoon Build output indicating yaml validation error" There are yaml validation errors in your docker-compose file that should be corrected ``` There is an error in your Docker Compose file, most likely relating to a malformed or misused alias or anchor. The error message should help you understand where.
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: fix-12158.en.md

Fix the issue that the rule engine cannot connect to `upstash` Redis. Before the fix, after establishing a TCP connection with the Redis service, the Redis driver of EMQX used to send AUTH and SELECT commands. However, the `upstash` Redis service does not support Inline Commands, which causes the rule engine to fail to connect to the `upstash` Redis service. After the fix, the Redis driver of EMQX uses RESP (REdis Serialization Protocol) to send AUTH and SELECT commands.
Project: ShardingSphere (App Definition and Development / Database)
File: question.md

name: "\U0001F914 Question" about: Usage question that isn't answered in docs or discussion For English only, other languages will not accept. Before asking a question, make sure you have: Googled your question. Searched open and closed . Read documentation: . Please pay attention on issues you submitted, because we maybe need more details. If no response anymore and we cannot reproduce it on current information, we will close it.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_compute_node_groups.md

+++ title = "googlecomputenode_groups resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlecomputenode_groups" identifier = "inspec/resources/gcp/googlecomputenodegroups.md googlecomputenodegroups resource" parent = "inspec/resources/gcp" +++ A `googlecomputenode_groups` is used to test a Google NodeGroup resource This resource has beta fields available. To retrieve these fields, include `beta: true` in the constructor for the resource ```ruby describe googlecomputenode_groups(project: 'chef-gcp-inspec', zone: 'zone') do it { should exist } its('descriptions') { should include 'A description of the node group' } its('sizes') { should include '0' } its('names') { should include 'inspec-node-group' } end ``` Properties that can be accessed from the `googlecomputenode_groups` resource: See the resource for more information. `creation_timestamps` : an array of `googlecomputenodegroup` creationtimestamp `descriptions` : an array of `googlecomputenode_group` description `names` : an array of `googlecomputenode_group` name `node_templates` : an array of `googlecomputenodegroup` nodetemplate `sizes` : an array of `googlecomputenode_group` size `autoscaling_policies` : (Beta only) an array of `googlecomputenodegroup` autoscalingpolicy `zones` : an array of `googlecomputenode_group` zone This resource supports all of the above properties as filter criteria, which can be used with `where` as a block or a method. Ensure the is enabled for the current project.