cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: c09f4d3e-27d2-4d46-9453-abbe9687a64e.md

title: User Data Contains Encoded Private Key hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c09f4d3e-27d2-4d46-9453-abbe9687a64e Query name: User Data Contains Encoded Private Key Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: User Data should not contain a base64 encoded private key. If so, anyone can decode the private key easily<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9" name: note that encrypted volumes are only supported in >= Ansible 2.4 community.aws.ec2_lc: name: special image_id: ami-XXX key_name: default security_groups: ['group', 'group2' ] instance_type: t1.micro user_data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpzb21lS2V5 volumes: device_name: /dev/sda1 volume_size: 100 volume_type: io1 iops: 3000 deleteontermination: true encrypted: true device_name: /dev/sdb ephemeral: ephemeral0 ``` ```yaml title="Negative test num. 1 - yaml file" name: note that encrypted volumes are only supported in >= Ansible 2.4 community.aws.ec2_lc: name: special image_id: ami-XXX key_name: default security_groups: [group, group2] instance_type: t1.micro user_data: dGVzdA== volumes: device_name: /dev/sda1 volume_size: 100 volume_type: io1 iops: 3000 deleteontermination: true encrypted: true device_name: /dev/sdb ephemeral: ephemeral0 name: note that encrypted volumes are only supported in >= Ansible 2.4.2 community.aws.ec2_lc: name: special2 image_id: ami-XXX key_name: default security_groups: [group, group2] instance_type: t1.micro user_data: volumes: device_name: /dev/sda1 volume_size: 100 volume_type: io1 iops: 3000 deleteontermination: true encrypted: true device_name: /dev/sdb ephemeral: ephemeral0 ```
Project: ClickHouse (App Definition and Development / Database)
File: v21.6.7.57-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Fix `ALTER MODIFY COLUMN` of columns, which participates in TTL expressions. (). Backported in : Fix extremely long backoff for background tasks when the background pool is full. Fixes . (). Backported in : Fix wrong thread estimation for right subquery join in some cases. Close . (). Backported in : Fix possible crash in `pointInPolygon` if the setting `validate_polygons` is turned off. (). 21.6 manual backport of ().
Project: LinuxKit (Provisioning / Automation & Configuration)
File: platform-scaleway.md

This is a quick guide to run LinuxKit on Scaleway (only VPS x86_64 for now) You must create a Scaleway API Token (combination of Access and Secret Key), available at , first. Then you can use it either with the `SCWACCESSKEY` and `SCWSECRETKEY` environment variables or the `-access-key` and `-secret-key` flags of the `linuxkit push scaleway` and `linuxkit run scaleway` commands. In addition, Organization ID value has to be set, either with the `SCWDEFAULTORGANIZATION_ID` environment variable or the `-organization-id` command line flag. The environment variable `SCWDEFAULTZONE` is used to set the zone (there is also the `-zone` flag) Scaleway requires a `iso-efi` image. To create one: ``` $ linuxkit build -format iso-efi examples/scaleway.yml ``` You have to set `root=/dev/vda` in the `cmdline` to have the right device set on boot The metadata package is not only used to set the metadata, but also to signal Scaleway that the instance has booted. So it is encouraged to use it (dhcpcd must be set before) You have to do `linuxkit push scaleway scaleway.iso` to upload it to your Scaleway images. By default the image name is the name of the ISO file without the extension. It can be overidden with the `-img-name` flag or the `SCWIMAGENAME` environment variable. Note 1: If an image (and snapshot) of the same name exists, it will be replaced. Note 2: The image is zone specific: if you create an image in `par1` you can't use is in `ams1`. Building a Scaleway image have a special process. Basically: Create an `image-builder` instance with an additional volume, based on Ubuntu Bionic (only x86_64 for now) Copy the ISO image on this instance Use `dd` to write the image on the additional volume (`/dev/vdb` by default) Terminate the instance, create a snapshot, and create an image from the snapshot Note 1: An image is linked to a snapshot, so you can't delete a snapshot before the image. Note 2: You can specify an already running instance to act as the image builder with the `-instance-id` flag. But if you don't specify the `-no-clean` flag it will be destroyed upon completion. With the image created, we can now create an instance. ``` linuxkit run scaleway scaleway ``` By default, the instance name is `linuxkit`. It can be overidden with the `-instance-name` flag. If you don't set the `-no-attach` flag, you will be connected to the serial port. You can edit the Scaleway example to allow you to SSH to your instance in order to use it.
Project: Athenz (Provisioning / Key Management)
File: index.md

Athenz is a set of services and libraries supporting service authentication and role-based authorization (RBAC) for provisioning and configuration (centralized authorization) use cases as well as serving/runtime (decentralized authorization) use cases. Athenz authorization system utilizes x.509 certificates and Access Tokens. The name "Athenz" is derived from "AuthNZ" (N for authentication and Z for authorization). It provides support for the following three major functional areas. Athenz provides secure identity in the form of short lived X.509 certificate and a certificate and IP-based distributed system to handle for every workload or service deployed in private (e.g. Openstack, K8S, Screwdriver) on-box enforcement. or public cloud (e.g. AWS EC2, ECS, Fargate, Lambda). Using these X.509 certificates clients and services establish secure connections and through mutual TLS authentication verify each other's identity. The service identity certificates are valid for 30 days only and the service identity agents (SIA) part of those frameworks automatically refresh them daily. The term service within Athenz is more generic than a traditional service. A service identity could represent a command, job, daemon, workflow, as well as both an application client and an application service. Since Athenz service authentication is based on , it is important that you have a good understanding what X.509 certificates are and how they're used to establish secure connections in Internet protocols such as . Once the client is authenticated with its x.509 certificate, the service their own role-based access control systems that have no central store can then check if the given client is authorized to carry out the requested and often rely on network ACLs and manual updating. action. Athenz provides fine-grained role-based access control (RBAC) support for a centralized management system with support for control-plane access control decisions and a decentralized enforcement mechanism suitable for data-plane access control decisions. It also provides a delegated management model that supports multi-tenant and self-service concepts. When working with AWS, Athenz provides support to access AWS services from on-prem services with using AWS temporary credentials rather than static credentials. Athenz ZTS server can be used to request AWS temporary credentials for configured AWS IAM roles.
Project: YugabyteDB (App Definition and Development / Database)
File: 18-rollup.md

title: "ROLLUP" In this exercise we will query the products table, group the results by product\id_ and then generate multiple grouping sets from the results using ROLLUP. ``` SELECT product_id, supplier_id, product_name, SUM(unitsinstock) FROM products GROUP BY product_id, ROLLUP(supplier_id); ``` This query should return 154 rows In this exercise we will query the products table, group the results by product\id_ and then generate multiple grouping sets from the results using ROLLUP. ``` SELECT product_id, supplier_id, product_name, SUM(unitsinstock) FROM products GROUP BY productid ROLLUP(supplierid, product_id); ``` This query should return TBD rows
Project: Okteto (App Definition and Development / Application Definition & Image Build)
File: code-style.md

See example . The CLI has a lot of `os.XXX` calls that should be testable. This can be achieved either by: using libraries such as . We could initialize it at the beginning of the main.go and pass it through the commands and functions to be able to mock it without having to create tempdir/tempfiles defining an interface for the filesystem calls used and mock it in the tests Global variables such as `okteto.ContextStore` or `Logger` should be instantiated at the `main.go` level and passed as struct parameters through the commands. We should also remove all `okteto.Context().XXX` calls since they also refer to the global context. Creating command structs allows us to get rid of the global variables and mock some external dependency calls with dependency injection. This will also allow us to have a cleaner and more organized code. We should slowly be refactoring the build command, decreasing the structural complexity of the command. Currently its logic is distributed by several packages such as `cmd/build`, `pkg/cmd/build` and `pkg/model/build`. When adding new commands or refactor existing ones differentiate between the flags supported by the command and specified by the user vs the options internally used by the command. Avoid as much as possible to modify the values specified by the user
Project: Meshery (Provisioning / Automation & Configuration)
File: pg-db.md

layout: integration title: Postgres Database (CrunchyData) subtitle: Collaborative and visual infrastructure as code for Postgres Database (CrunchyData) image: /assets/img/integrations/pg-db/icons/color/pg-db-color.svg permalink: extensibility/integrations/pg-db docURL: https://docs.meshery.io/extensibility/integrations/pg-db description: integrations-category: Database integrations-subcategory: App Definition and Development registrant: Artifact Hub components: name: pgcluster colorIcon: assets/img/integrations/pg-db/components/pgcluster/icons/color/pgcluster-color.svg whiteIcon: assets/img/integrations/pg-db/components/pgcluster/icons/white/pgcluster-white.svg description: name: percona-pg-cluster colorIcon: assets/img/integrations/pg-db/components/percona-pg-cluster/icons/color/percona-pg-cluster-color.svg whiteIcon: assets/img/integrations/pg-db/components/percona-pg-cluster/icons/white/percona-pg-cluster-white.svg description: name: pgtask colorIcon: assets/img/integrations/pg-db/components/pgtask/icons/color/pgtask-color.svg whiteIcon: assets/img/integrations/pg-db/components/pgtask/icons/white/pgtask-white.svg description: name: pgreplica colorIcon: assets/img/integrations/pg-db/components/pgreplica/icons/color/pgreplica-color.svg whiteIcon: assets/img/integrations/pg-db/components/pgreplica/icons/white/pgreplica-white.svg description: name: pgpolicy colorIcon: assets/img/integrations/pg-db/components/pgpolicy/icons/color/pgpolicy-color.svg whiteIcon: assets/img/integrations/pg-db/components/pgpolicy/icons/white/pgpolicy-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Numaflow (App Definition and Development / Streaming & Messaging)
File: controllers.md

Currently in `Numaflow`, there are 3 CRDs introduced, each one has a corresponding controller. interstepbufferservices.numaflow.numaproj.io pipelines.numaflow.numaproj.io vertices.numaflow.numaproj.io The source code of the controllers is located at `./pkg/reconciler/`. `Inter-Step Buffer Service Controller` is used to watch `InterStepBufferService` object, depending on the spec of the object, it might install services (such as JetStream, or Redis) in the namespace, or simply provide the configuration of the `InterStepBufferService` (for example, when an `external` redis ISB Service is given). Pipeline Controller is used to watch `Pipeline` objects, it does following major things when there's a pipeline object created. Spawn a Kubernetes Job to create in the . Create `Vertex` objects according to `.spec.vertices` defined in `Pipeline` object. Create some other Kubernetes objects used for the Pipeline, such as a Deployment and a Service for daemon service application. Vertex controller watches the `Vertex` objects, based on the replica defined in the spec, creates a number of pods to run the workloads.
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_debug_mariadb.md

title: Kubectl-Dba Debug Mariadb menu: docs_{{ .version }}: identifier: kubectl-dba-debug-mariadb name: Kubectl-Dba Debug Mariadb parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Debug helper for mariadb database ``` kubectl-dba debug mariadb [flags] ``` ``` kubectl dba debug mariadb -n demo sample-mariadb --operator-namespace kubedb ``` ``` -h, --help help for mariadb -o, --operator-namespace string the namespace where the kubedb operator is installed (default "kubedb") ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - Debug any Database issue
Project: YugabyteDB (App Definition and Development / Database)
File: txn_start.md

title: START TRANSACTION statement [YSQL] headerTitle: START TRANSACTION linkTitle: START TRANSACTION description: Use the `START TRANSACTION` statement to start a transaction with the default (or specified) isolation level. menu: v2.18: identifier: txn_start parent: statements type: docs Use the `START TRANSACTION` statement to start a transaction with the default (or specified) isolation level. {{%ebnf%}} start_transaction {{%/ebnf%}} The `START TRANSACTION` statement is simply an alternative spelling for the statement. The syntax that follows `START TRANSACTION` is identical to that syntax that follows `BEGIN [ TRANSACTION | WORK ]`. And the two alternative spellings have identical semantics.
Project: ORY Hydra (Provisioning / Key Management)
File: GetVersion200Response.md

Name | Type | Description | Notes | - | - | - Version | Pointer to string | The version of Ory Hydra. | [optional] `func NewGetVersion200Response() *GetVersion200Response` NewGetVersion200Response instantiates a new GetVersion200Response object This constructor will assign default values to properties that have it defined, and makes sure properties required by API are set, but the set of arguments will change when the set of required properties is changed `func NewGetVersion200ResponseWithDefaults() *GetVersion200Response` NewGetVersion200ResponseWithDefaults instantiates a new GetVersion200Response object This constructor will only assign default values to properties that have it defined, but it doesn't guarantee that properties required by API are set `func (o *GetVersion200Response) GetVersion() string` GetVersion returns the Version field if non-nil, zero value otherwise. `func (o GetVersion200Response) GetVersionOk() (string, bool)` GetVersionOk returns a tuple with the Version field if it's non-nil, zero value otherwise and a boolean to check if the value has been set. `func (o *GetVersion200Response) SetVersion(v string)` SetVersion sets Version field to given value. `func (o *GetVersion200Response) HasVersion() bool` HasVersion returns a boolean if a field has been set.
Project: YugabyteDB (App Definition and Development / Database)
File: ddl_drop_rule.md

title: DROP RULE statement [YSQL] headerTitle: DROP RULE linkTitle: DROP RULE description: Use the DROP RULE statement to remove a rule. menu: v2.18: identifier: ddldroprule parent: statements type: docs Use the `DROP RULE` statement to remove a rule. {{%ebnf%}} drop_rule {{%/ebnf%}} See the semantics of each option in the . Basic example. ```plpgsql yugabyte=# CREATE TABLE t1(a int4, b int4); yugabyte=# CREATE TABLE t2(a int4, b int4); yugabyte=# CREATE RULE t1tot2 AS ON INSERT TO t1 DO INSTEAD INSERT INTO t2 VALUES (new.a, new.b); yugabyte=# DROP RULE t1tot2 ON t1; ```
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.30.md

layout: release date: 2022-11-25 tag: v0.6.30 language: en [CI] Decrease Golang requirements for Server builds @leecalcote (#6552) Fix empty namespace in Cyto conversion @Revolyssup (#6577) fix panic on error finding JWT claim @Revolyssup (#6576) Add Intel in ADOPTERS.md @gyohuangxin (#6570) readd introspect support, alongwith handling of infinite JWT @MUzairS15 (#6561) [mesheryctl] improve error message shown to users for system lifestyle commands #6286 @devkapilbansal (#6437) Fix google avatars not loading in navbar @nishantwrp (#6571) Bump @babel/traverse from 7.19.4 to 7.20.1 in /ui @dependabot (#6468) Bump cypress from 10.9.0 to 10.11.0 in /provider-ui @dependabot (#6466) Bump @babel/traverse from 7.19.4 to 7.20.1 in /ui @dependabot (#6468) Bump cypress from 10.9.0 to 10.11.0 in /provider-ui @dependabot (#6466) [Docs] Added instruction regarding redirect link on Docs and Contributing.md @asubedy (#6573) Readme, docs: update Meshery logo @tinniaru3005 (#6441) Thank you to our contributors for making this release possible: @Abhishek-kumar09, @MUzairS15, @Revolyssup, @asubedy, @dependabot, @dependabot[bot], @devkapilbansal, @gyohuangxin, @leecalcote, @nishantwrp and @tinniaru3005
Project: CloudEvents (App Definition and Development / Streaming & Messaging)
File: distributed-tracing.md

This extension embeds context from so that distributed systems can include traces that span an event-driven system. This extension is meant to contain historical data of the parent trace, in order to diagnose eventual failures of the system through tracing platforms like Jaeger, Zipkin, etc. As with the main , the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . However, the scope of these key words is limited to when this extension is used. For example, an attribute being marked as "REQUIRED" does not mean it needs to be in all CloudEvents, rather it needs to be included only when this extension is being used. Type: `String` Description: Contains a version, trace ID, span ID, and trace options as defined in Constraints REQUIRED Type: `String` Description: a comma-delimited list of key-value pairs, defined by . Constraints OPTIONAL The Distributed Tracing Extension is not intended to replace the protocol specific headers for tracing, like the ones described in for HTTP. Given a single hop event transmission (from source to sink directly), the Distributed Tracing Extension, if used, MUST carry the same trace information contained in protocol specific tracing headers. Given a multi hop event transmission, the Distributed Tracing Extension, if used, MUST carry the trace information of the starting trace of the transmission. In other words, it MUST NOT carry trace information of each individual hop, since this information is usually carried using protocol specific headers, understood by tools like . Middleware between the source and the sink of the event could eventually add a Distributed Tracing Extension if the source didn't include any, in order to provide to the sink the starting trace of the transmission. An example with HTTP: ```bash CURL -X POST example/webhook.json \ -H 'ce-id: 1' \ -H 'ce-specversion: 1.0' \ -H 'ce-type: example' \ -H 'ce-source: http://localhost' \ -H 'ce-traceparent: 00-0af7651916cd43dd8448eb211c80319c-b9c7c989f97918e1-01' \ -H 'traceparent: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01' \ -H 'tracestate: rojo=00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01,congo=lZWRzIHRoNhcm5hbCBwbGVhc3VyZS4` ```