cwielenb/CNCF-Dataset huggingface dataset:
Project: Okteto (App Definition and Development / Application Definition & Image Build)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: triage assignees: '' Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] Describe the solution you'd like A clear and concise description of what you want to happen. Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered. Additional context Add any other context or screenshots about the feature request here.
Project: userver (App Definition and Development / Streaming & Messaging)
File: pg_connlimit_mode_auto.md

A PostgreSQL server has a connection limit for all clients. If there are too many client connections, it may lead to random connection closing. You have to thoroughly calculate client instance count in the cluster and serverside connection limit to get maximum client pool size. Moreover, you have to recalculate the limit in case of cluster resize. It is a whole thing to maintain the limit all the time and it is error-prone. A wrong setup might lead to incidents. That's why we have "connlimit-mode: auto" that override the components::Postgres static config option `maxpoolsize`. The PostgreSQL driver allows one to automatically determine the required max connection limit. It is calculated as follows: ``` clientmaxconnections = servermaxconnections/instances - reserved ``` `servermaxconnections` is calculated based on `SHOW max_connections` answer and on the current user connection limit. The service identifies `instanses` based on the following algorithm. The service creates `u_clients` table and regularly writes down information about itself. After that the service reads the table and identifies alive instances. `reserved` is set to be 5 to reflect administrative scripts connections, migration scripts, etc. The limit is promptly changed after service topology change: node addition/removal, service instance stop, etc. The feature can be turned on/off in runtime via the dynamic config variable @ref POSTGRESCONNLIMITMODEAUTOENABLED. If disabled dynamically, the previous connection limit settings are used. If you want to disable the feature permanently for some clusters (e.g. in case the current user may not create `u_clients` table), you can do it in static config for components::Postgres: ``` components_manager: components: postgres-xxx: connlimit_mode: manual ``` @htmlonly <div class="bottom-nav"> @endhtmlonly @ref pgtopology | @ref scripts/docs/en/userver/pguser_types.md @htmlonly </div> @endhtmlonly
Project: Beam (App Definition and Development / Streaming & Messaging)
File: reify.md

title: "Reify" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> Transforms for converting between explicit and implicit form of various Beam values. See for updates. assigns timestamps to all the elements of a collection.
Project: Meshery (Provisioning / Automation & Configuration)
File: policies.md

layout: default title: Policies permalink: concepts/logical/policies type: concepts abstract: "Meshery Policies enable you with a broad set of controls and governance of the behavior of systems under Meshery's management." language: en list: include Policies offer an evaluation algorithm to ensure desired behavior enforcement. Policies can be applied to components and relationships, defining rules and actions based on predefined conditions. The relationships are a powerful way to design your infrastructure and each of them are backed by one or more policies. Policies evaluate the designs for potential relationships and the decide whether to create/delete/update the relationships. [Meshery Models Policy Evaluation]({{ site.baseurl }}/assets/img/concepts/meshery-models-policy-evaluation.svg) Meshery Server has a built-in policy engine, based on Open Policy Agent (OPA). Currently, Meshery Server is the only place where the policy evals occur. Policy evaluation is invoked each time a design is updated, and each time a design is imported. By default, policies evaluate for all registered relationships. In any given Meshery deployment, you can reference and search the full set of registered policies (in Meshery's internal registry) in using either of Meshery's client interfaces. {% include alert.html type="info" title="Viewing All Registered Relationships" content='<p>You can view all registered relationships using either Meshery UI or Meshery CLI.</p><dl><dt>Using Meshery UI...</dt><dd>Navigate to <i>Settings</i>, then to <i>Registry</i></dd>.<dt>Using Meshery CLI...</dt><dd><code>mesheryctl policy list</code></dd></dl>' %} <!-- There are different points in time in which policy evaluations are invoked Each time the design is updated. A Design/HelmChart/K8s Manifest/Docker Compose app is imported/uploaded. Ad-hoc invocation from the Actions Center (coming soon). --> In the event of a conflict or tie, Meshery relies on Open Policy Agent's for conflict resolution. {% include alert.html type="warning" title="Conflict Resolution" content="It may happen that certain eval decisions contain results such that two different components create a conflicting relationship with same component. While this is semantically correct, the visual representation of the relationship in such cases may be undesirable, and you may see relationships and components being redrawn depending upon how the client / Meshery UI visualizes the relationships." %} {% include alert.html type="dark" title="Future Feature" content="Policy evaluation in WASM runtime is on roadmap for Meshery v0.8.3." %}
Project: KICS (Provisioning / Security & Compliance)
File: cb7e695d-6a85-495c-b15f-23aed2519303.md

title: Not Unique Certificate Authority hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cb7e695d-6a85-495c-b15f-23aed2519303 Query name: Not Unique Certificate Authority Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: Certificate Authority should be unique for etcd<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="22" apiVersion: apps/v1 kind: Deployment metadata: name: database spec: selector: matchLabels: app: database version: v1 replicas: 1 template: metadata: labels: app: database version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/kube-apiserver:certification imagePullPolicy: IfNotPresent command: ["etcd"] args: ["--trusted-ca-file=/etc/env/valid3.pem"] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--client-ca-file=/etc/env/valid3.pem"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--client-ca-file=/etc/env/valid.pem"] restartPolicy: OnFailure apiVersion: apps/v1 kind: Deployment metadata: name: database spec: selector: matchLabels: app: database version: v1 replicas: 1 template: metadata: labels: app: database version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/kube-apiserver:certification imagePullPolicy: IfNotPresent command: ["etcd"] args: ["--trusted-ca-file=/etc/env/valid2.pem"] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure ```
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_dataprotection_list-backups.md

title: kbcli dataprotection list-backups List backups. ``` kbcli dataprotection list-backups [flags] ``` ``` kbcli dp list-backups kbcli dp list-backups --cluster mycluster ``` ``` --cluster string List backups in the specified cluster -h, --help help for list-backups -o, --output format prints the output in the specified format. Allowed values: table, json, yaml, wide (default table) -l, --selector string Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2). Matching objects must satisfy all of the specified label constraints. --show-labels When printing, show all labels as the last column (default hide labels column) ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Data protection command.
Project: ClickHouse (App Definition and Development / Database)
File: v22.8.18.31-lts.md

sidebar_position: 1 sidebar_label: 2023 Backported in : Fixed excessive reading in queries with `FINAL`. (). Backported in : Update time zones. The following were updated: Africa/Cairo, Africa/Casablanca, Africa/ElAaiun, America/Bogota, America/CambridgeBay, America/CiudadJuarez, America/Godthab, America/Inuvik, America/Iqaluit, America/Nuuk, America/Ojinaga, America/Pangnirtung, America/RankinInlet, America/Resolute, America/Whitehorse, America/Yellowknife, Asia/Gaza, Asia/Hebron, Asia/Kuala_Lumpur, Asia/Singapore, Canada/Yukon, Egypt, Europe/Kirov, Europe/Volgograd, Singapore. (). Fix bad cast from LowCardinality column when using short circuit function execution (). Fix msan issue in randomStringUTF8(<uneven number>) (). JIT compilation not equals NaN fix (). Fix crash with `multiIf` and constant condition and nullable arguments (). Fixed type conversion from Date/Date32 to DateTime64 when querying with DateTime64 index (). Fix Keeper deadlock on exception when preprocessing requests. (). Fix Log family table return wrong rows count after truncate (). Do not read all the columns from right GLOBAL JOIN table. (). Improve test reports (). Update github.com/distribution/distribution (). Catch issues with dockerd during the build ().
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_list.md

title: "Command - devspace list" sidebar_label: devspace list Lists configuration ``` ``` ``` -h, --help help for list ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: Kubewarden (Provisioning / Security & Compliance)
File: README.md

](https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller) ](https://bestpractices.coreinfrastructure.org/projects/6502) ](https://github.com/kubewarden/kubewarden-controller/actions/workflows/e2e-tests.yml) ](https://app.fossa.com/projects/custom%252B25850%252Fgithub.com%252Fkubewarden%252Fkubewarden-controller?ref=badge_shield) Kubewarden is a Kubernetes Dynamic Admission Controller that uses policies written in WebAssembly. For more information refer to the . `kubewarden-controller` is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. The `kubewarden-controller` will reconcile the admission policies you have registered against the Kubernetes webhooks of the cluster where it is deployed. The kubewarden-controller can be deployed using a helm chart. For instructions, see https://charts.kubewarden.io. Once the kubewarden-controller is up and running, Kubewarden policies can be defined via the `ClusterAdmissionPolicy` resource. The documentation of this Custom Resource can be found or on . Note well: `ClusterAdmissionPolicy` resources are cluster-wide. The following snippet defines a Kubewarden Policy based on the policy: ```yaml apiVersion: policies.kubewarden.io/v1alpha2 kind: ClusterAdmissionPolicy metadata: name: psp-capabilities spec: module: registry://ghcr.io/kubewarden/policies/psp-capabilities:v0.1.3 rules: apiGroups: [""] apiVersions: ["v1"] resources: ["pods"] operations: CREATE UPDATE mutating: true settings: allowed_capabilities: CHOWN requireddropcapabilities: NET_ADMIN ``` This `ClusterAdmissionPolicy` will evaluate all the `CREATE` and `UPDATE` operations performed against Pods. The homepage of this policy provides more insights about how this policy behaves. Creating the resource inside of Kubernetes is sufficient to enforce the policy: ```shell $ kubectl apply -f https://raw.githubusercontent.com/kubewarden/kubewarden-controller/main/config/samples/policiesv1alpha2clusteradmissionpolicy.yaml ``` You can delete the admission policy you just created: ``` $ kubectl delete clusteradmissionpolicy psp-capabilities $ kubectl patch clusteradmissionpolicy psp-capabilities -p '{"metadata":{"finalizers":null}}' --type=merge ``` The provides more insights about how the project works and how to use it. Kubewarden controller has its software bill of materials (SBOM) published every release. It follows the version 2.2 format and it can be found together with the signature and certificate used to signed it in the for the Kubewarden project. See our . We host regular online meetings for contributors, adopters, maintainers, and anyone else interested to connect in a synchronous fashion. These meetings usually take place on second Thursday of the month at 4PM UTC. We're a friendly group, so please feel free to join us! Slack: and
Project: KICS (Provisioning / Security & Compliance)
File: caa3479d-885d-4882-9aac-95e5e78ef5c2.md

title: Image Pull Policy Of The Container Is Not Set To Always hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: caa3479d-885d-4882-9aac-95e5e78ef5c2 Query name: Image Pull Policy Of The Container Is Not Set To Always Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Image Pull Policy of the container must be defined and set to Always<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9" apiVersion: v1 kind: Pod metadata: name: private-image-test-always spec: containers: name: uses-private-image image: $PRIVATEIMAGENAME:1.2 imagePullPolicy: Never command: [ "echo", "SUCCESS" ] ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="18" apiVersion: apps/v1 kind: Deployment metadata: name: deployment-with-image-pull-policy spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: name: nginx image: library/nginx:1.20.0 imagePullPolicy: IfNotPresent ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="16" apiVersion: apps/v1 kind: Deployment metadata: name: deployment-with-image-pull-policy1 spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: name: nginx image: library/nginx:1.20.0 ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: private-image-test-1 spec: containers: name: uses-private-image image: $PRIVATEIMAGENAME imagePullPolicy: Always command: [ "echo", "SUCCESS" ] ```
Project: Druid (App Definition and Development / Database)
File: influx.md

id: influx title: "InfluxDB Line Protocol Parser" <!-- ~ Licensed to the Apache Software Foundation (ASF) under one ~ or more contributor license agreements. See the NOTICE file ~ distributed with this work for additional information ~ regarding copyright ownership. The ASF licenses this file ~ to you under the Apache License, Version 2.0 (the ~ "License"); you may not use this file except in compliance ~ with the License. You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, ~ software distributed under the License is distributed on an ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ~ KIND, either express or implied. See the License for the ~ specific language governing permissions and limitations ~ under the License. --> To use this Apache Druid extension, `druid-influx-extensions` in the extensions load list. This extension enables Druid to parse the , a popular text-based timeseries metric serialization format. A typical line looks like this: ```cpu,application=dbhost=prdb123,region=us-east-1 usageidle=99.24,usageuser=0.55 1520722030000000000``` which contains four parts: measurement: A string indicating the name of the measurement represented (e.g. cpu, network, web_requests) tags: zero or more key-value pairs (i.e. dimensions) measurements: one or more key-value pairs; values can be numeric, boolean, or string timestamp: nanoseconds since Unix epoch (the parser truncates it to milliseconds) The parser extracts these fields into a map, giving the measurement the key `measurement` and the timestamp the key `_ts`. The tag and measurement keys are copied verbatim, so users should take care to avoid name collisions. It is up to the ingestion spec to decide which fields should be treated as dimensions and which should be treated as metrics (typically tags correspond to dimensions and measurements correspond to metrics). The parser is configured like so: ```json "parser": { "type": "string", "parseSpec": { "format": "influx", "timestampSpec": { "column": "ts", "format": "millis" }, "dimensionsSpec": { "dimensionExclusions": [ "ts" ] }, "whitelistMeasurements": [ "cpu" ] } ``` The `whitelistMeasurements` field is an optional list of strings. If present, measurements that do not match one of the strings in the list will be ignored.
Project: Meshery (Provisioning / Automation & Configuration)
File: opentelemetry-operator.md

layout: integration title: OpenTelemetry Operator subtitle: Collaborative and visual infrastructure as code for OpenTelemetry Operator image: /assets/img/integrations/opentelemetry-operator/icons/color/opentelemetry-operator-color.svg permalink: extensibility/integrations/opentelemetry-operator docURL: https://docs.meshery.io/extensibility/integrations/opentelemetry-operator description: integrations-category: Observability and Analysis integrations-subcategory: Tracing registrant: Artifact Hub components: name: op-amp-bridge colorIcon: assets/img/integrations/opentelemetry-operator/components/op-amp-bridge/icons/color/op-amp-bridge-color.svg whiteIcon: assets/img/integrations/opentelemetry-operator/components/op-amp-bridge/icons/white/op-amp-bridge-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-system-token-create.md

layout: default title: mesheryctl-system-token-create permalink: reference/mesheryctl/system/token/create redirect_from: reference/mesheryctl/system/token/create/ type: reference display-title: "false" language: en command: system subcommand: token Create a token in your meshconfig Create the token with provided token name (optionally token path) to your meshconfig tokens. <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system token create [flags] </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system token create [token-name] -f [token-path] </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system token create [token-name] (default path is auth.json) </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system token create [token-name] -f [token-path] --set </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -f, --filepath string Add the token location -h, --help help for create -s, --set Set as current token </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -c, --context string (optional) temporarily change the current context. -v, --verbose verbose output -y, --yes (optional) assume yes for user interactive prompts. </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.