cwielenb/CNCF-Dataset huggingface dataset:
Project: GraphScope (App Definition and Development / Database)
File: intro.md

GraphScope is a comprehensive distributed graph computing platform that offers a user-friendly Python interface for performing various graph operations on a cluster of computers. By integrating key Alibaba technologies such as GRAPE, MaxGraph, Graph-Learn (GL), and Vineyard, GraphScope simplifies multi-stage processing of large-scale graph data on compute clusters. These technologies enable analytics, interactive, and graph neural networks (GNN) computation, while Vineyard provides efficient in-memory data transfers. GraphScope has several advantages: Performance: GraphScope significantly outperforms other state-of-the-art systems, offering up to 2X or higher performance improvements. Moreover, it includes a collection of optimized built-in graph algorithms for immediate use. Compatibility: It supports Gremlin and Cypher(coming soon) for querying graph, and NetworkX compatible APIs for graph analytic. PyData Integration: GraphScope offers a user-friendly Python interface, allowing seamless integration with PyData frameworks and management of complex workflows involving multiple stages beyond graph processing. Cloud Native: GraphScope is designed for easy deployment on Kubernetes, offering excellent elasticity and scalability. GraphScope is versatile and can be used for: Offline Graph Analytical Jobs: Iterative graph computations like pagerank, centrality, community detection, and graph clustering. Utilize built-in algorithms or custom ones for large graphs. Online Graph BI Analysis: Perform interactive graph analysis with complex Gremlin or Cypher queries, focusing on low latency. High QPS Graph Queries: Process high-rate graph queries with exceptional throughput. Graph Neural Network Training and Inference: Support large-scale GNNs and integrate seamlessly with PyG/TensorFlow. One-stop Graph Processing: Manage complex workflows involving multiple stages of graph analytics, queries, GNNs, and beyond. GraphScope is not a graph database: GraphScope focuses on analyzing and computing large-scale graphs using distributed computing, rather than storing and managing data in a graph format with ACID and transactions. See for more information. Security limitations: GraphScope currently lacks essential security features, such as authentication and encryption. You may want to with GraphScope; Learn more about the .
Project: Trivy-Operator (Provisioning / Security & Compliance)
File: compliance.md

!!! warning "EXPERIMENTAL" This feature might change without preserving backwards compatibility. Trivy-operator compliance crds allow you create a specific set of checks into a report. There are hundreds of different checks for many different components and configurations, but sometimes you already know which specific checks you are interested in. Often this would be an industry accepted set of checks such as CIS, or some vendor specific guideline, or your own organization policy that you want to comply with. These are all possible using the flexible compliance infrastructure that's built into Trivy-operator. Compliance reports are defined as simple YAML documents that select checks to include in the report. The compliance report will be generated every six hours by default. The compliance report is composed of two parts : `spec`: represents the compliance control checks specification, check details, and the mapping to the security scanner `status`: represents the compliance control checks results `report types` : compliance report can be produced in two formats, summary and detail (all) Spec can be customized by amending the control checks `report type (summary / all)` , `severity` and `cron` expression (report execution interval). As an example, let's enter `vi` edit mode and change the `cron` expression. ```shell kubectl edit compliance ``` Once the report has been generated, you can fetch and review its results section. As an example, let's fetch the compliance status report in JSON format ```shell kubectl get compliance nsa -o=jsonpath='{.status}' | jq . ``` You can create your own custom compliance report. A compliance report is a simple YAML document in the following format: ```yaml apiVersion: aquasecurity.github.io/v1alpha1 kind: ClusterComplianceReport metadata: creationTimestamp: "2022-12-04T18:25:27Z" labels: app.kubernetes.io/instance: trivy-operator app.kubernetes.io/managed-by: kubectl app.kubernetes.io/name: trivy-operator app.kubernetes.io/version: 0.8.0 name: nsa # report unique identifier. this should not container spaces. spec: cron: ' *' reportType: summary compliance: title: nsa # report title. Any one-line title. description: NSA, Kubernetes Hardening # description of the report. Any text. version: "1.0" controls: checks: id: AVD-KSV-0012 # check ID. Must start with `AVD-` description: Check that container is not running as root # Description (appears in the report as is). Any text. id: "1.0" name: Non-root containers # Name for the control (appears in the report as is). Any one-line name. severity: MEDIUM (note that checks severity isn't used) ``` The following reports are available out of the box: | Compliance | Name for command | More info | | NSA, CISA Kubernetes Hardening Guidance v1.2 | `nsa` | CIS Benchmark for Kubernetes v1.23 | `cis` | Kubernetes pss-restricted | `pss-restricted` | Kubernetes pss-baseline | `pss-baseline` |
Project: ClickHouse (App Definition and Development / Database)
File: v23.10.6.60-stable.md

sidebar_position: 1 sidebar_label: 2024 Backported in : Fix transfer query to MySQL compatible query. Fixes . Fixes . Fixes . (). Backported in : Handle sigabrt case when getting PostgreSQl table structure with empty array. (). Backported in : Fix issue caught in https://github.com/docker-library/official-images/pull/15846. (). Flatten only true Nested type if flatten_nested=1, not all Array(Tuple) (). Fix ALTER COLUMN with ALIAS (). Prevent incompatible ALTER of projection columns (). Fix segfault after ALTER UPDATE with Nullable MATERIALIZED column (). Fix incorrect JOIN plan optimization with partially materialized normal projection (). Fix `ReadonlyReplica` metric for all cases (). Background merges correctly use temporary data storage in the cache (). MergeTree mutations reuse source part index granularity (). Fix function jsonMergePatch for partially const columns (). Fix working with read buffers in StreamingFormatExecutor (). bugfix: correctly parse SYSTEM STOP LISTEN TCP SECURE (). Ignore ON CLUSTER clause in grant/revoke queries for management of replicated access entities. (). Disable system.kafka_consumers by default (due to possible live memory leak) (). Fix invalid memory access in BLAKE3 (Rust) (). Normalize function names in CREATE INDEX (). Fix invalid preprocessing on Keeper (). Fix Integer overflow in Poco::UTF32Encoding (). Remove parallel parsing for JSONCompactEachRow (). Fix parallel parsing for JSONCompactEachRow (). Fix lost blobs after dropping a replica with broken detached parts (). MergeTreePrefetchedReadPool disable for LIMIT only queries (). Backported in :. (). Pin alpine version of integration tests helper container (). Remove heavy rust stable toolchain (). Fix docker image for integration tests (fixes CI) (). Fix testuservalid_until ().
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.Presentation.md

/ / Presentation .Presentation Presentation modes Usage: import { Presentation } from '@kui-shell/core' { type: 'custom', presentation: Presentation.SidecarFullscreen, content: ... } Default = `0` FixedSize = `1` SidecarFullscreen = `3` SidecarFullscreenForPopups = `4` SidecarThin = `2`
Project: KICS (Provisioning / Security & Compliance)
File: 944439c7-b4b8-476a-8f83-14641ea876ba.md

title: Nifcloud LB Use Insecure TLS Policy ID hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 944439c7-b4b8-476a-8f83-14641ea876ba Query name: Nifcloud LB Use Insecure TLS Policy ID Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: The lb use insecure tls policy<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "nifcloudloadbalancer" "positive" { loadbalancername = "example" instance_port = 443 loadbalancerport = 443 } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "nifcloudloadbalancer" "positive" { loadbalancername = "example" instance_port = 443 loadbalancerport = 443 sslpolicyname = "1" } ``` ```tf title="Negative test num. 1 - tf file" resource "nifcloudloadbalancer" "negative" { loadbalancername = "example" instance_port = 443 loadbalancerport = 443 sslpolicyid = "4" } ```
Project: Monokle (App Definition and Development / Application Definition & Image Build)
File: apply-and-diff.md

When a resource is selected in the navigator, the Editor contains Deploy and Diff buttons in the top right. Selecting Deploy will deploy the selected resource to the currently configured Cluster. A status message will be shown in the top right after deploying. Selecting Diff will diff the selected resource against the currently configured cluster; If the resource does not exist in the cluster, an error will be shown. If the resource does exist, the Diff dialog will be shown. In this screenshot The left side shows the resource in Monokle Desktop. The right side shows the resource retrieved from the cluster. Differences are highlighted as shown. Refreshing the diff is done with the Refresh button and deploying your local version of the resource to your cluster is done with Deploy. Monokle Desktop allows you to edit any resource viewed in and use the Deploy button to apply those changes back to the cluster. This immediately applies "hot fixes" to your cluster during browsing. After editing a resource in Monokle Desktop, click the Deploy button: The following modal appears for selecting the namesapce for deployment: Select an existing namespace from the cluster, create a new namespace, or don't specify a namespace, which will deploy into namespaces already declared in the resource.
Project: KICS (Provisioning / Security & Compliance)
File: 48388bd2-7201-4dcc-b56d-e8a9efa58fad.md

title: PSP With Added Capabilities hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 48388bd2-7201-4dcc-b56d-e8a9efa58fad Query name: PSP With Added Capabilities Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: PodSecurityPolicy should not have added capabilities<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" resource "kubernetespodsecurity_policy" "example" { metadata { name = "terraform-example" } spec { allowedcapabilities = ["NETBIND_SERVICE"] privileged = false allowprivilegeescalation = false volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetespodsecurity_policy" "example2" { metadata { name = "terraform-example" } spec { privileged = false allowprivilegeescalation = false volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ```
Project: YugabyteDB (App Definition and Development / Database)
File: drop_cast.diagram.md

<svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="617" height="70" viewbox="0 0 617 70"><path class="connector" d="M0 22h15m53 0h10m51 0h30m32 0h10m64 0h20m-141 0q5 0 5 5v8q0 5 5 5h116q5 0 5-5v-8q0-5 5-5m5 0h10m25 0h10m108 0h10m25 0h30m77 0h22m-109 25q0 5 5 5h5m79 0h5q5 0 5-5m-104-25q5 0 5 5v33q0 5 5 5h89q5 0 5-5v-33q0-5 5-5m5 0h15"/><polygon points="0,29 5,22 0,15" style="fill:black;stroke-width:0"/><rect class="literal" x="15" y="5" width="53" height="25" rx="7"/><text class="text" x="25" y="22">DROP</text><rect class="literal" x="78" y="5" width="51" height="25" rx="7"/><text class="text" x="88" y="22">CAST</text><rect class="literal" x="159" y="5" width="32" height="25" rx="7"/><text class="text" x="169" y="22">IF</text><rect class="literal" x="201" y="5" width="64" height="25" rx="7"/><text class="text" x="211" y="22">EXISTS</text><rect class="literal" x="295" y="5" width="25" height="25" rx="7"/><text class="text" x="305" y="22">(</text><a xlink:href="../../../syntaxresources/grammardiagrams#cast-signature"><rect class="rule" x="330" y="5" width="108" height="25"/><text class="text" x="340" y="22">cast_signature</text></a><rect class="literal" x="448" y="5" width="25" height="25" rx="7"/><text class="text" x="458" y="22">)</text><rect class="literal" x="503" y="5" width="77" height="25" rx="7"/><text class="text" x="513" y="22">CASCADE</text><rect class="literal" x="503" y="35" width="79" height="25" rx="7"/><text class="text" x="513" y="52">RESTRICT</text><polygon points="613,29 617,29 617,15 613,15" style="fill:black;stroke-width:0"/></svg>
Project: APIClarity (Provisioning / Security & Compliance)
File: bug_report.md

name: Bug report about: Create a report to help us improve title: '' labels: '' assignees: '' <!-- Please use this template while reporting a bug and provide as much info as possible. --> (e.g. `kubectl logs -n apiclarity --selector=app=apiclarity`) Kubernetes version (use `kubectl version --short`): Istio version (use `istioctl version`): APIClarity version (use `kubectl -n apiclarity exec deploy/apiclarity -- ./backend version`) Cloud provider or hardware configuration: Others:
Project: kube-hunter (Provisioning / Security & Compliance)
File: KHV007.md

vid: KHV007 title: Specific Access to Kubernetes API categories: [Access Risk] severity: high kube-hunter was able to perform the action specified by the reported vulnerability (check the report for more information). This may or may not be a problem, depending on your cluster setup and preferences. Review the RBAC permissions to Kubernetes API server for the anonymous and default service account.
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.3.md

layout: release date: 2022-08-25 tag: v0.6.3 language: en [Fix ] Add logic to modify component scheme regarding inconsistent naming | CU-2jp390j @sudo-NithishKarthik (#6095) Fix path to local components @Revolyssup (#6094) Updated the embedded links @lavakush07 (#6093) [GraphQL] Improve Workloads widget @theBeginner86 (#6096) [Designer] URL Upload Refactors and Style Fixes @Abhishek-kumar09 (#6099) Fix path in Dockerfile @Revolyssup (#6100) [DOCS] Add Meshery Docker Extension to the supported platforms table in README @Devansu-Yadav (#6086) Thank you to our contributors for making this release possible: @Abhishek-kumar09, @Chadha93, @Devansu-Yadav, @Revolyssup, @l5io, @lavakush07, @leecalcote, @sudo-NithishKarthik and @theBeginner86
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.8.22.md

RabbitMQ `3.8.22` is a maintenance release. All users are recommended to upgrade to this release. RabbitMQ releases are distributed via , , and . This release and . explains what package repositories and tools can be used to provision modern Erlang versions. See the for general documentation on upgrades and for release notes of other releases. If upgrading from a`3.7.x` release, see upgrade and compatibility notes first. If upgrading from a `3.6.x` or older , first upgrade to and then to this version. Any questions about this release, upgrades or RabbitMQ in general are welcome on the and . Release notes are kept under . Contributors are encouraged to update them together with their changes. This helps with release automation and more consistent release schedule. Virtual host metadata (description, tags) was not imported from definitions. GitHub issue: AWS API calls are now retried multiple times. Contributed by AWS. GitHub issue: `PUT /api/vhosts/{name}` now can update metadata (tags and descriptions) for existing virtual hosts. GitHub issue: No dependency changes in this release. To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.8.22.tar.xz` instead of the source tarball produced by GitHub.
Project: StarRocks (App Definition and Development / Database)
File: all_match.md

displayed_sidebar: "English" Returns whether all elements of an array match the given predicate. Returns `true` (1) if all the elements match the predicate (a special case is when the array is empty). Returns `false` (0) if one or more elements do not match. Returns NULL if the predicate returns NULL for one or more elements and `true` for all other elements. This function is supported from v3.0.6 onwards. ```Haskell allmatch(lambdafunction, arr1, arr2...) ``` Returns whether all elements of `arr1` match the given predicate in the lambda function. `arr1`: the array to match. `arrN`: optional arrays used in the lambda function. `lambda_function`: the lambda function used to match values. Returns a BOOLEAN value. The lambda function follows the usage notes in . If the input array is null or the lambda function results in null, null is returned. If `arr1` is empty, `true` is returned. To apply this function to MAP, rewrite `allmatch((k,v)->k>v,map)` to `allmatch(mapvalues(transformvalues((k,v)->k>v, map)))`. For example, `select allmatch(mapvalues(transform_values((k,v)->k>v, map{2:1})));` returns 1. Check whether all elements in `x` are less than the elements in `y`. ```Plain select all_match((x,y) -> x < y, [1,2,-8], [4,5,6]); ++ | all_match((x, y) -> x < y, [1, 2, -8], [4, 5, 6]) | ++ | 1 | ++ select all_match((x,y) -> x < y, [1,2,null], [4,5,6]); +--+ | all_match((x, y) -> x < y, [1, 2, NULL], [4, 5, 6]) | +--+ | NULL | +--+ select all_match((x,y) -> x < y, [1,2,8], [4,5,6]); +--+ | all_match((x, y) -> x < y, [1, 2, 8], [4, 5, 6]) | +--+ | 0 | +--+ select all_match((x,y) -> x < y, [], []); ++ | all_match((x, y) -> x < y, [], []) | ++ | 1 | ++ select all_match((x,y) -> x < y, null, [4,5,6]); ++ | all_match((x, y) -> x < y, NULL, [4, 5, 6]) | ++ | NULL | ++ ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: ntp_conf.md

+++ title = "ntp_conf resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "ntp_conf" identifier = "inspec/resources/os/ntpconf.md ntpconf resource" parent = "inspec/resources/os" +++ Use the `ntp_conf` Chef InSpec audit resource to test the synchronization settings defined in the `ntp.conf` file. This file is typically located at `/etc/ntp.conf`. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. An `ntp_conf` resource block declares the synchronization settings that should be tested: describe ntp_conf('path') do its('setting_name') { should eq 'value' } end where `'setting_name'` is a synchronization setting defined in the `ntp.conf` file `('path')` is the non-default path to the `ntp.conf` file `{ should eq 'value' }` is the value that is expected This resource supports any of the settings listed in an `ntp.conf` file as properties. The following examples show how to use this Chef InSpec audit resource describe ntp_conf do its('server') { should_not eq nil } its('restrict') { should include '-4 default kod notrap nomodify nopeer noquery'} end describe ntp_conf do its('driftfile') { should eq '/var/lib/ntp/ntp.drift' } its('server') do should eq [ '0.ubuntu.pool.ntp.org', '1.ubuntu.pool.ntp.org', '2.ubuntu.pool.ntp.org' ] end end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Shifu (Provisioning / Automation & Configuration)
File: CHANGELOG-v0.12.0.md

Add MinIO support to telemetryservice by @Vacant2333 in https://github.com/Edgenesis/shifu/pull/458 <BugFix>Fix 404 in develop-deviceshifu.md by @BtXin in https://github.com/Edgenesis/shifu/pull/496 Bump github.com/onsi/ginkgo/v2 from 2.7.0 to 2.8.0 by @dependabot in https://github.com/Edgenesis/shifu/pull/480 Bump github.com/briandowns/spinner from 1.20.0 to 1.21.0 by @dependabot in https://github.com/Edgenesis/shifu/pull/488 Bump github.com/gopcua/opcua from 0.3.10 to 0.3.11 by @dependabot in https://github.com/Edgenesis/shifu/pull/487 Bump sigs.k8s.io/controller-runtime from 0.14.2 to 0.14.4 by @dependabot in https://github.com/Edgenesis/shifu/pull/490 Bump golang.org/x/net from 0.5.0 to 0.6.0 by @dependabot in https://github.com/Edgenesis/shifu/pull/491 Bump github.com/minio/minio-go/v7 from 7.0.46 to 7.0.47 by @dependabot in https://github.com/Edgenesis/shifu/pull/492 Bump golang.org/x/crypto from 0.5.0 to 0.6.0 by @dependabot in https://github.com/Edgenesis/shifu/pull/493 Bump github.com/onsi/ginkgo/v2 from 2.8.0 to 2.8.1 by @dependabot in https://github.com/Edgenesis/shifu/pull/494 Bump github.com/minio/minio-go/v7 from 7.0.47 to 7.0.48 by @dependabot in https://github.com/Edgenesis/shifu/pull/495 Bump golang.org/x/net from 0.6.0 to 0.7.0 by @dependabot in https://github.com/Edgenesis/shifu/pull/497 Full Changelog: https://github.com/Edgenesis/shifu/compare/v0.11.0...v0.12.0
Project: userver (App Definition and Development / Streaming & Messaging)
File: os_signals.md

`SIGINT` - return trace `SIGTERM`, `SIGQUIT` - shutdown service `SIGUSR1` - reopen file descriptors for log (logrotate) The component ossignals::ProcessorComponent stores ossignals::Processor and listens to `SIGUSR1` and `SIGUSR2` signals. You can use `AddListener` function to subscribe to these signals. For example, we use signal `SIGUSR1` in components::Logging for reopening files after executing . Add in private field class ```cpp ossignals::Subscriber signalsubscribe_ ``` In in the component's constructor, register a signal listener. For example, components::Logging uses the following code: @snippet core/src/logging/component.cpp Signals sample - init In the component's destructor, unsubscribe from the signal @snippet core/src/logging/component.cpp Signals sample - destr @htmlonly <div class="bottom-nav"> @endhtmlonly @ref scripts/docs/en/userver/dnscontrol.md | @ref scripts/docs/en/userver/deadlinepropagation.md @htmlonly </div> @endhtmlonly