cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 9630336b-3fed-4096-8173-b9afdfe346a7.md

title: Unscanned ECR Image hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9630336b-3fed-4096-8173-b9afdfe346a7 Query name: Unscanned ECR Image Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: Checks if the ECR Image has been scanned<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 11" resource "awsecrrepository" "positive1" { name = "imgp2" imagetagmutability = "MUTABLE" } resource "awsecrrepository" "positive2" { name = "imgp1" imagetagmutability = "MUTABLE" imagescanningconfiguration { scanonpush = false } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsecrrepository" "negative1" { name = "bar" imagetagmutability = "MUTABLE" imagescanningconfiguration { scanonpush = true } } ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_resourcemanager_organization_policy.md

+++ title = "googleresourcemanagerorganization_policy resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleresourcemanagerorganization_policy" identifier = "inspec/resources/gcp/googleresourcemanagerorganizationpolicy.md googleresourcemanagerorganizationpolicy resource" parent = "inspec/resources/gcp" +++ A `googleresourcemanagerorganization_policy` is used to test organization policy constraints. More information can be found here ```ruby describe googleresourcemanagerorganizationpolicy(organizationname: "organizations/123456789", constraint: "constraints/compute.disableSerialPortAccess") do it { should exist } its('constraint') { should eq 'constraints/compute.disableSerialPortAccess' } its('boolean_policy.enforced') { should be true } end ``` Properties that can be accessed from the `googleresourcemanagerorganization_policy` resource: `version` : The version of the policy. `constraint` : The name of the constraint the policy is configuring. `update_time` : The time stamp the policy was previously updated. `list_policy` : List of values either allowed or disallowed `allowed_values` : List of values allowed `denied_values` : List of values denied `boolean_policy` : Used to specify how a boolean policy will behave `enforced` : If true then the policy is enforced. If false then any configuration is acceptable Ensure the is enabled for the current project.
Project: Kubescape (Provisioning / Security & Compliance)
File: environment-dependencies-policy.md

This policy describes how Kubescape maintainers consume third-party packages. This policy applies to all Kubescape maintainers and all third-party packages used in the Kubescape project. Kubescape maintainers must follow these guidelines when consuming third-party packages: Only use third-party packages that are necessary for the functionality of Kubescape. Use the latest version of all third-party packages whenever possible. Avoid using third-party packages that are known to have security vulnerabilities. Pin all third-party packages to specific versions in the Kubescape codebase. Use a dependency management tool, such as Go modules, to manage third-party dependencies. When adding a new third-party package to Kubescape, maintainers must follow these steps: Evaluate the need for the package. Is it necessary for the functionality of Kubescape? Research the package. Is it well-maintained? Does it have a good reputation? Choose a version of the package. Use the latest version whenever possible. Pin the package to the specific version in the Kubescape codebase. Update the Kubescape documentation to reflect the new dependency. This policy is enforced by the Kubescape maintainers. Maintainers are expected to review each other's code changes to ensure that they comply with this policy. Exceptions to this policy may be granted by the Kubescape project lead on a case-by-case basis.
Project: YugabyteDB (App Definition and Development / Database)
File: grafana.md

title: Grafana dashboard headerTitle: Grafana dashboard linkTitle: Grafana dashboard description: Learn about setting up the community dashboards with Prometheus data source using Grafana. menu: v2.18: identifier: observability-2-macos parent: explore-observability weight: 240 type: docs You can create dashboards for your local YugabyteDB clusters using , an open source platform to perform visualization and analytics which lets you add queries and explore metrics to customize your graphs. To create dashboards, you need to add Prometheus metrics as a data source in Grafana. The visualization it provides gives a better understanding of the health and performance of your YugabyteDB clusters. In this tutorial, you use Grafana to populate dashboards with the metrics you collect using the . This tutorial requires a local multi-node universe with an instance of Prometheus displaying the metrics of your YugabyteDB cluster. Use the Prometheus setup you created for the example. To set up Grafana with Prometheus as a data source, do the following: Install Grafana and start the server according to the . Open the Grafana UI on <http://localhost:3000>. The default login is `admin`, with a password of `admin`. Follow the steps in to create a Prometheus data source. There are different ways to create a dashboard in Grafana. For this tutorial, you use the import option and pick the YugabyteDB community dashboard present under the list of Grafana . On the Grafana UI, click the + button and choose Import. On the next page, enter the YugabyteDB dashboard ID in the Import via grafana.com field and click Load. On the next screen, provide a name for your dashboard, a unique identifier, and the Prometheus data source. Be sure to choose the data source you created earlier. After clicking Import, you can see the new dashboard with various details, starting with the status of your YB-Master and YB-TServer nodes. The metrics displayed are further categorized by API types (YSQL, YCQL) and by API methods (Insert, Select, Update, and so on). Because this example uses the `CassandraKeyValue` workload generator from the page, you can see different YCQL-related metrics in addition to the YB-Master and YB-TServer statuses. The of the application uses only `SELECT` statements for reads and `INSERT` statements for writes (aside from the initial `CREATE TABLE`). This means that throughput and latency can be measured using the metrics corresponding to the `SELECT` and `INSERT` statements. The following illustration shows YCQL OPS and latency metrics: {{% explore-cleanup-local %}}
Project: TiDB (App Definition and Development / Database)
File: 2022-08-02-stats-lru-cache.md

Author(s): Tracking Issue: https://github.com/pingcap/tidb/issues/34052 This proposes a design of how to maintain stats cache by lru according to memory usage Previously, tidb maintained the all the indices' stats and some columns' stats which is needed during query. As the maintained stats grows, the total memory usage of the stats will increase and makes tidb server OOM. Thus we use lru to maintain stats cache in order to keep memory safe. Use LRU to maintain the stats cache in memory Keep the total memory usage of stats cache under the quota Support loading stats back into memory when tidb server needs it Considering the stats cache are in memory, we don't provide changing stats cache into LRU without restarting We will provide a Stats Cache Interface which is implemented by LRU Cache and Map Cache. If the tidb server didn't enable Stats LRU Cache, it will use Map Cache by default. Also, we will provide config and global session variable to control whether enable Stats LRU Cache and the capacity of it. ```go // statsCacheInner is the interface to manage the statsCache, it can be implemented by map, lru cache or other structures. type statsCacheInner interface { Get(int64) (*statistics.Table, bool) Put(int64, *statistics.Table) Del(int64) Cost() int64 Len() int SetCapacity(int64) } ``` For column or index stats, we maintained following data structure for stats: `Histogram` `TopN` `CMSketch` And we will also maintain status for each column and index stats in order to indicate its stats loading status like following: `AllLoaded` `OnlyCMSEvcited` `OnlyHistRemained` `AllEvicted` When the column or index stats load all data structures into memory, the status will be `AllLoaded`. When the Stats LRU Cache memory usage exceeds the quota, the LRU Cache will select one column or index stats to evict the data structures by following rules to reduce the memory usage: If the status is `AllLoaded`, it will discard the `CMSketch` and the status will be changed into `OnlyCMSEvcited` If the status is `OnlyCMSEvcited`, it will discard the `TopN` and the status will be changed into `OnlyHistRemained` If the status is `OnlyHistRemained`, it will discard the `Histogram` and the status will be changed into `AllEvicted` Previously tidb server has Sync Stats and asynchronously Loading Histograms in order to load column stats into memory during query. As Stats LRU Cache Policy may evict index stats in memory, we also need Sync Stats and asynchronously Loading Histograms to support loading index stats according to its loading status to keep compatible. During the query optimization, tidb server will collect the used columns and indices, if their stats are not fully loaded, tidb-server will try to load their stats back into the memory.
Project: ArangoDB (App Definition and Development / Database)
File: value_lvalue.md

+++ title = "`value_type &value() &`" description = "Wide contract lvalue reference observer of any value present. Constexpr propagating." categories = ["observers"] weight = 640 +++ Wide contract lvalue reference observer of any value present. `NoValuePolicy::widevaluecheck()` is first invoked, then the reference to the value is returned. Note that if `value_type` is `void`, only a `const` overload returning `void` is present. Requires: Always available. Complexity: Depends on `NoValuePolicy::widevaluecheck()`. Guarantees: None.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: waymo.md

title: "Waymo" icon: /images/logos/powered-by/waymo.png hasLink: "https://waymo.com/" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_plugin_uninstall.md

title: kbcli plugin uninstall Uninstall kbcli or kubectl plugins ``` kbcli plugin uninstall [flags] ``` ``` kbcli plugin uninstall [PLUGIN] ``` ``` -h, --help help for uninstall ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Provides utilities for interacting with plugins.
Project: YugabyteDB (App Definition and Development / Database)
File: type_blob.md

title: BLOB data type [YCQL] headerTitle: BLOB data type linkTitle: BLOB description: Use the BLOB data type to represent arbitrary binary data of variable length. menu: v2.18: parent: api-cassandra weight: 1370 type: docs Use the `BLOB` data type to represent arbitrary binary data of variable length. ``` type_specification ::= BLOB blobliteral ::= "0x" [ hexdigit hex_digit ...] ``` Where `hex_digit` is a hexadecimal digit (`[0-9a-fA-F]`). Columns of type `BLOB` can be part of the `PRIMARY KEY`. Implicitly, `BLOB` data type is neither convertible nor comparable with other data types. Two series of builtin-functions `BlobAs<Type>` and `<Type>AsBlob` are provided for conversion between `BLOB` and other data types. `BLOB` size is virtually unlimited. ```sql ycqlsh:example> CREATE TABLE messages(id INT PRIMARY KEY, content BLOB); ``` ```sql ycqlsh:example> INSERT INTO messages (id, content) VALUES (1, 0xab00ff); ``` ```sql ycqlsh:example> INSERT INTO messages (id, content) VALUES (2, 0x); ``` ```sql ycqlsh:example> UPDATE messages SET content = 0x0f0f WHERE id = 2; ``` ```sql ycqlsh:example> SELECT * FROM messages; ``` ``` id | content -+- 2 | 0x0f0f 1 | 0xab00ff ```
Project: KICS (Provisioning / Security & Compliance)
File: a33e9173-b674-4dfb-9d82-cf3754816e4b.md

title: PSP Allows Containers To Share The Host Network Namespace hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a33e9173-b674-4dfb-9d82-cf3754816e4b Query name: PSP Allows Containers To Share The Host Network Namespace Platform: Kubernetes Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Check if Pod Security Policies allow containers to share the host network namespace.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="14" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: '*' volumes: '*' hostNetwork: true hostPorts: min: 0 max: 65535 hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: '*' volumes: '*' hostNetwork: false hostPorts: min: 0 max: 65535 hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ```
Project: Sonobuoy (Provisioning / Security & Compliance)
File: README.md

The Vision To create a modern, geometric typeface. Open sourced, and openly available. Influenced by other popular geometric, minimalist sans-serif typefaces of the new millenium. Designed for optimal readability at small point sizes while beautiful at large point sizes. December 2017 update Currently working on greatly improving spacing and kerning of the base typeface. Once this is done, work on other variations (e.g. rounded or slab) can begin in earnest. The License Licensed under Open Font License (OFL). Available to anyone and everyone. Contributions welcome. Contact Contact me via chris.m.simpson@icloud.com or http://twitter.com/ChrisMSimpson for any questions, requests or improvements (or just submit a pull request). Support You can now support work on Metropolis via Patreon at https://www.patreon.com/metropolis.
Project: ko (App Definition and Development / Application Definition & Image Build)
File: ko_login.md

Log in to a registry ``` ko login [OPTIONS] [SERVER] [flags] ``` ``` ko login reg.example.com -u AzureDiamond -p hunter2 ``` ``` -h, --help help for login -p, --password string Password --password-stdin Take the password from stdin -u, --username string Username ``` ``` -v, --verbose Enable debug logs ``` - Rapidly iterate with Go, Containers, and Kubernetes.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: kernel_module.md

+++ title = "kernel_module resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "kernel_module" identifier = "inspec/resources/os/kernelmodule.md kernelmodule resource" parent = "inspec/resources/os" +++ Use the `kernel_module` Chef InSpec audit resource to test kernel modules on Linux platforms. These parameters are located under `/lib/modules`. Any submodule may be tested using this resource. The `kernel_module` resource can also verify if a kernel module is `blacklisted` or if a module is disabled via a fake install using the `bintrue` or `binfalse` method. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `kernel_module` resource block declares a module name, and then tests if that module is a loaded kernel module, if it is enabled, disabled or if it is blacklisted: describe kernelmodule('modulename') do it { should be_loaded } it { shouldnot bedisabled } it { shouldnot beblacklisted } end where `'module_name'` must specify a kernel module, such as `'bridge'` `{ should be_loaded }` tests if the module is a loaded kernel module `{ should be_blacklisted }` tests if the module is blacklisted or if the module is disabled via a fake install using /bin/false or /bin/true `{ should be_disabled }` tests if the module is disabled via a fake install using /bin/false or /bin/true The following examples show how to use this Chef InSpec audit resource. The `version` property tests if the kernel module on the system has the correct version: its('version') { should eq '3.2.2' } describe kernel_module('bridge') do it { should be_loaded } its('version') { should cmp >= '2.2.2' } end describe kernel_module('video') do it { should be_loaded } it { shouldnot bedisabled } it { shouldnot beblacklisted } end describe kernel_module('floppy') do it { should be_blacklisted } end describe kernel_module('video') do it { shouldnot beblacklisted } it { should be_loaded } end describe kernel_module('sstfb') do it { shouldnot beloaded } it { should be_disabled } end describe kernel_module('nvidiafb') do it { shouldnot beloaded } it { should be_blacklisted } end describe kernel_module('dhcp') do it { shouldnot beloaded } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `be_blacklisted` matcher tests if the kernel module is a blacklisted module: it { should be_blacklisted } The `be_disabled` matcher tests if the kernel module is disabled: it { should be_disabled } The `be_loaded` matcher tests if the kernel module is loaded: it { should be_loaded }
Project: ShardingSphere (App Definition and Development / Database)
File: docker.en.md

+++ title = "Use Docker" weight = 2 +++ This chapter is an introduction about how to start ShardingSphere-Proxy via Docker Using Docker to start ShardingSphere-Proxy does not require additional package supoort. Acquire Docker Image Method 1 (Recommended): Pull from DockerHub ```bash docker pull apache/shardingsphere-proxy ``` Method 2: Acquire latest master branch image master: <https://github.com/apache/shardingsphere/pkgs/container/shardingsphere-proxy> Method 3: Build your own image ```bash git clone https://github.com/apache/shardingsphere ./mvnw clean install cd shardingsphere-distribution/shardingsphere-proxy-distribution ./mvnw clean package -Prelease,docker ``` If the following problems emerge, please make sure Docker daemon Process is running. ``` I/O exception (java.io.IOException) caught when processing request to {}->unix://localhost:80: Connection refused ``` Configure `conf/global.yaml` and `conf/database-*.yaml` Configuration file template can be attained from the Docker container and can be copied to any directory on the host: ```bash docker run -d --name tmp --entrypoint=bash apache/shardingsphere-proxy docker cp tmp:/opt/shardingsphere-proxy/conf /host/path/to/conf docker rm tmp ``` Since the network conditions inside the container may differ from those of the host, if errors such as "cannot connect to the database" occurs, please make sure that the IP of the database specified in the `conf/database-*.yaml` configuration file can be accessed from inside the Docker container. For details, please refer to . (Optional) Introduce third-party dependencies or customized algorithms If you have any of the following requirements: ShardingSphere-Proxy Backend use MySQL Database; Implement customized algorithms; Use Etcd as Registry Center in cluster mode. Please create `ext-lib` directory anywhere inside the host and refer to the steps in . Start ShardingSphere-Proxy container Mount the `conf` and `ext-lib` directories from the host to the container. Start the container: ```bash docker run -d \ -v /host/path/to/conf:/opt/shardingsphere-proxy/conf \ -v /host/path/to/ext-lib:/opt/shardingsphere-proxy/ext-lib \ -e PORT=3308 -p13308:3308 apache/shardingsphere-proxy:latest ``` `ext-lib` is not necessary during the process. Users can mount it at will. ShardingSphere-Proxy default portal `3307` can be designated according to environment variable `-e PORT` Customized JVM related parameters can be set according to environment variable `JVM_OPTS` Note: Support setting environment variable CGROUP MEM OPTS: used to set related memory parameters in the container environment. The default values in the script are: ```sql -XX:InitialRAMPercentage=80.0 -XX:MaxRAMPercentage=80.0 -XX:MinRAMPercentage=80.0 ``` Use Client to connect to ShardingSphere-Proxy Please refer to .
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy.md

Generate reports on your Kubernetes cluster by running plugins Sonobuoy is a Kubernetes component that generates reports on cluster conformance, configuration, and more ``` sonobuoy [flags] ``` ``` -h, --help help for sonobuoy --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Deletes Kubernetes resources that were generated by a Sonobuoy run - Generates a list of all tests and tags in that tests - Generates a sonobuoy manifest for submission via kubectl - Fetches Sonobuoy resources of a specified type - Manage images used in a plugin to facilitate running them in airgapped (or similar) environments. Supported plugins are: 'e2e' - Dumps the logs of the currently running Sonobuoy containers for diagnostics - Display the various modes in which to run the e2e plugin - Manage your installed plugins - Runs queries against your cluster in order to aid in debugging. - Inspect plugin results. - Retrieves the results of a sonobuoy run to a specified path - Starts a Sonobuoy run by launching the Sonobuoy aggregator and plugin pods. - Gets a summarized status of a sonobuoy run - Print sonobuoy version - Waits on the Sonobuoy run in the targeted namespace.