cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 835a4f2f-df43-437d-9943-545ccfc55961.md

title: Azure Front Door WAF Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 835a4f2f-df43-437d-9943-545ccfc55961 Query name: Azure Front Door WAF Disabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: Azure Front Door WAF should be enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="38" resource "azurerm_frontdoor" "positive" { name = "example-FrontDoor" resourcegroupname = azurermresourcegroup.example.name enforcebackendpoolscertificatename_check = false routing_rule { name = "exampleRoutingRule1" accepted_protocols = ["Http", "Https"] patternstomatch = ["/*"] frontend_endpoints = ["exampleFrontendEndpoint1"] forwarding_configuration { forwarding_protocol = "MatchRequest" backendpoolname = "exampleBackendBing" } } backendpoolload_balancing { name = "exampleLoadBalancingSettings1" } backendpoolhealth_probe { name = "exampleHealthProbeSetting1" } backend_pool { name = "exampleBackendBing" backend { host_header = "www.bing.com" address = "www.bing.com" http_port = 80 https_port = 443 } loadbalancingname = "exampleLoadBalancingSettings1" healthprobename = "exampleHealthProbeSetting1" } frontend_endpoint { name = "exampleFrontendEndpoint1" host_name = "example-FrontDoor.azurefd.net" } } ``` ```tf title="Negative test num. 1 - tf file" resource "azurerm_frontdoor" "negative" { name = "example-FrontDoor" resourcegroupname = azurermresourcegroup.example.name enforcebackendpoolscertificatename_check = false routing_rule { name = "exampleRoutingRule1" accepted_protocols = ["Http", "Https"] patternstomatch = ["/*"] frontend_endpoints = ["exampleFrontendEndpoint1"] forwarding_configuration { forwarding_protocol = "MatchRequest" backendpoolname = "exampleBackendBing" } } backendpoolload_balancing { name = "exampleLoadBalancingSettings1" } backendpoolhealth_probe { name = "exampleHealthProbeSetting1" } backend_pool { name = "exampleBackendBing" backend { host_header = "www.bing.com" address = "www.bing.com" http_port = 80 https_port = 443 } loadbalancingname = "exampleLoadBalancingSettings1" healthprobename = "exampleHealthProbeSetting1" } frontend_endpoint { name = "exampleFrontendEndpoint1" host_name = "example-FrontDoor.azurefd.net" webapplicationfirewallpolicylink_id = "id" } } ```
Project: ClickHouse (App Definition and Development / Database)
File: v23.11.2.11-stable.md

sidebar_position: 1 sidebar_label: 2023 Backported in : Handle sigabrt case when getting PostgreSQl table structure with empty array. (). Ignore ON CLUSTER clause in grant/revoke queries for management of replicated access entities. (). Fix SIGSEGV for aggregation of sparse columns with any() RESPECT NULL (). Fix bug window functions: revert (). Pin alpine version of integration tests helper container ().
Project: Harbor (Provisioning / Container Registry)
File: 4-05-LDAP-admin-role-view-logs.md

Test 4-05 - User with Admin Role Views Logs (LDAP Mode) ======= To verify that a user with system admin role can views logs when users are managed externally by LDAP or AD (LDAP mode). User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against an LDAP or AD server. ( auth_mode is set to ldap_auth* .) The user data is stored in an LDAP or AD server. A linux host with Docker CLI installed (Docker client). NOTE: The below non-admin user A should NOT be the same as the non-admin user in Test 4-03. Assign an non-admin user M with system admin role and act as an admin user. Repeat all steps in Test 4-03. A user with system admin role can perform all operations the same as the admin user. Outcome should be the same as Test 4-03. None
Project: StarRocks (App Definition and Development / Database)
File: array_to_bitmap.md

displayed_sidebar: "English" Converts an array into BITMAP values. This function is supported from v2.3. ```Haskell BITMAP arraytobitmap(array) ``` `array`: Elements in an array can be of the BIGINT, INT, TINYINT, or SMALLINT type. Returns a value of the BITMAP type. If the data type of elements in the input array is invalid, such as STRING or DECIMAL, an error is returned. If an empty array is entered, an empty BITMAP value is returned. If `NULL` is entered, `NULL` is returned. Example 1: Convert an array into BITMAP values. This function must be nested in `bitmaptoarray` because BITMAP values cannot be displayed. ```Plain MySQL > select bitmaptoarray(arraytobitmap([1,2,3])); +-+ | bitmaptoarray(arraytobitmap([1,2,3])) | +-+ | [1,2,3] | +-+ ``` Example 2: Enter an empty array and an empty array is returned. ```Plain MySQL > select bitmaptoarray(arraytobitmap([])); +--+ | bitmaptoarray(arraytobitmap([])) | +--+ | [] | +--+ ``` Example 3: Enter `NULL` and `NULL` is returned. ```Plain MySQL > select arraytobitmap(NULL); +--+ | arraytobitmap(NULL) | +--+ | NULL | +--+ ```
Project: SeaTunnel (App Definition and Development / Streaming & Messaging)
File: Hudi.md

Hudi source connector Spark<br/> Flink<br/> SeaTunnel Zeta<br/> Used to read data from Hudi. Currently, only supports hudi cow table and Snapshot Query with Batch Mode. In order to use this connector, You must ensure your spark/flink cluster already integrated hive. The tested hive version is 2.3.9. :::tip Currently, only supports Hudi cow table and Snapshot Query with Batch Mode ::: | Hudi Data Type | Seatunnel Data Type | |-|| | ALL TYPE | STRING | | Name | Type | Required | Default | Description | |-|--|||-| | table.path | String | Yes | - | The hdfs root path of hudi table,such as 'hdfs://nameserivce/data/hudi/hudi_table/'. | | table.type | String | Yes | - | The type of hudi table. Now we only support 'cow', 'mor' is not support yet. | | conf.files | String | Yes | - | The environment conf file path list(local path), which used to init hdfs client to read hudi table file. The example is '/home/test/hdfs-site.xml;/home/test/core-site.xml;/home/test/yarn-site.xml'. | | use.kerberos | bool | No | false | Whether to enable Kerberos, default is false. | | kerberos.principal | String | yes when use.kerberos = true | - | When use kerberos, we should set kerberos principal such as 'test_user@xxx'. | | kerberos.principal.file | string | yes when use.kerberos = true | - | When use kerberos, we should set kerberos principal file such as '/home/test/test_user.keytab'. | | common-options | config | No | - | Source plugin common parameters, please refer to for details. | This example reads from a Hudi COW table and configures Kerberos for the environment, printing to the console. ```hocon env { parallelism = 2 job.mode = "BATCH" } source{ Hudi { table.path = "hdfs://nameserivce/data/hudi/hudi_table/" table.type = "cow" conf.files = "/home/test/hdfs-site.xml;/home/test/core-site.xml;/home/test/yarn-site.xml" use.kerberos = true kerberos.principal = "test_user@xxx" kerberos.principal.file = "/home/test/test_user.keytab" } } transform { } sink { Console {} } ``` Add Hudi Source Connector
Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: operator-sdk_generate_kustomize_manifests.md

title: "operator-sdk generate kustomize manifests" Generates kustomize bases and a kustomization.yaml for operator-framework manifests Running 'generate kustomize manifests' will (re)generate kustomize bases and a kustomization.yaml in 'config/manifests', which are used to build operator-framework manifests by other operator-sdk commands. This command will interactively ask for UI metadata, an important component of manifest bases, by default unless a base already exists or you set '--interactive=false'. ``` operator-sdk generate kustomize manifests [flags] ``` ``` $ operator-sdk generate kustomize manifests Display name for the operator (required): > memcached-operator ... $ tree config/manifests config/manifests bases memcached-operator.clusterserviceversion.yaml kustomization.yaml $ kustomize build config/manifests | operator-sdk generate bundle --version 0.0.1 $ kustomize build config/manifests | operator-sdk generate packagemanifests --version 0.0.1 ``` ``` --apis-dir string Root directory for API type defintions -h, --help help for manifests --input-dir string Directory containing existing kustomize files --interactive When set to false, if no kustomize base exists, an interactive command prompt will be presented to accept non-inferrable metadata --output-dir string Directory to write kustomize files --package string Package name -q, --quiet Run in quiet mode ``` ``` --plugins strings plugin keys to be used for this subcommand execution --verbose Enable verbose logging ``` - Contains subcommands that generate operator-framework kustomize data for the operator
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: request-readme.md

The request based API allows for custom backends in a way similar to the http package. In order to create a backend you need to implement 4 handler interfaces; one for reading, one for writing, one for misc commands and one for listing files. Each has 1 required method and in each case those methods take the Request as the only parameter and they each return something different. These 4 interfaces are enough to handle all the SFTP traffic in a simplified manner. The Request structure has 5 public fields which you will deal with. Method (string) - string name of incoming call Filepath (string) - POSIX path of file to act on Flags (uint32) - 32bit bitmask value of file open/create flags Attrs ([]byte) - byte string of file attribute data Target (string) - target path for renames and sym-links Below are the methods and a brief description of what they need to do. Handler for "Get" method and returns an io.Reader for the file which the server then sends to the client. Handler for "Put" method and returns an io.Writer for the file which the server then writes the uploaded file to. The file opening "pflags" are currently preserved in the Request.Flags field as a 32bit bitmask value. See the [SFTP spec](https://filezilla-project.org/specs/draft-ietf-secsh-filexfer-02.txt#section-6.3) for details. Handles "SetStat", "Rename", "Rmdir", "Mkdir" and "Symlink" methods. Makes the appropriate changes and returns nil for success or an filesystem like error (eg. os.ErrNotExist). The attributes are currently propagated in their raw form ([]byte) and will need to be unmarshalled to be useful. See the respond method on sshFxpSetstatPacket for example of you might want to do this. Handles "List", "Stat", "Readlink" methods. Gathers/creates FileInfo structs with the data on the files and returns in a list (list of 1 for Stat and Readlink). Add support for API users to see trace/debugging info of what is going on inside SFTP server. Unmarshal the file attributes into a structure on the Request object.
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: fix-11886.en.md

Fixed backward plugin compatibility. Currently, EMQX validates hookpoint names, so invalid hookspoints cannot be used for registering hooks. However, older versions of plugin templates used some misspelled hookpoints, and so could the real plugins. We allow the old hookpoints to be used for registering hooks, but issue a warning that they are deprecated. As before, these hooks are never called.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_project_iam_policy.md

+++ title = "googleprojectiam_policy resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleprojectiam_policy" identifier = "inspec/resources/gcp/googleprojectiampolicy.md googleprojectiampolicy resource" parent = "inspec/resources/gcp" +++ A `googleprojectiam_policy` is used to test a Google Project Iam Policy resource ```ruby describe googleprojectiam_policy(project: "project") do it { should exist } end googleprojectiam_policy(project: "project").bindings.each do |binding| describe binding do its('role') { should eq 'roles/editor'} its('members') { should include 'user:testuser@example.com'} end end ``` This resource supports . Properties that can be accessed from the `googleprojectiam_policy` resource: `iambindingroles` : The list of roles that exist on the policy. `bindings` : Associates a list of members to a role. `role` : Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. `members` : Specifies the identities requesting access for a Cloud Platform resource. `condition` : Contains information about when this binding is to be applied. `expression` : Textual representation of an expression in Common Expression Language syntax. `title` : An optional title for the expression, i.e. a short string describing its purpose. `description` : An optional description of the expression. This is a longer text which describes the expression. `audit_configs` : Specifies cloud audit logging configuration for this policy. `service` : Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services. `auditlogconfigs` : The configuration for logging of each type of permission. `log_type` : The log type that this config enables. For example, ADMINREAD, DATAWRITE or DATA_READ `exempted_members` : Specifies the identities that do not cause logging for this type of permission. Ensure the is enabled for the current project.
Project: KusionStack (Provisioning / Automation & Configuration)
File: kusion_env.md

Print Kusion environment information Env prints Kusion environment information. By default env prints information as a shell script (on Windows, a batch file). If one or more variable names is given as arguments, env prints the value of each named variable on its own line. The --json flag prints the environment in JSON format instead of as a shell script. For more about environment variables, see "kusion env -h". ``` kusion env [flags] ``` ``` kusion env kusion env --json ``` ``` -h, --help help for env --json Print the environment in JSON format ``` - Kusion is the platform engineering engine of KusionStack
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: opa-dotnet.md

title: OPA Wasm .NET core SDK software: csharp inventors: andriikurochka labels: category: wasm type: poweredbyopa tutorials: https://me-viper.github.io/OpaDotNet/articles/HowToStart.html code: https://github.com/me-viper/OpaDotNet https://www.nuget.org/packages/OpaDotNet.Wasm/ docs_features: wasm-integration: note: 'This project implements Open Policy Agent (OPA) WebAssembly .NET core SDK.' Open Policy Agent (OPA) WebAssembly .NET core SDK
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: cpu-shares.md

CPU shares (relative weight). By default, all containers get the same proportion of CPU cycles. This proportion can be modified by changing the container's CPU share weighting relative to the combined weight of all the running containers. Default weight is 1024. The proportion only applies when CPU-intensive processes are running. When tasks in one container are idle, other containers can use the left-over CPU time. The actual amount of CPU time varies depending on the number of containers running on the system. For example, consider three containers, one has a cpu-share of 1024 and two others have a cpu-share setting of 512. When processes in all three containers attempt to use 100% of CPU, the first container receives 50% of the total CPU time. If a fourth container is added with a cpu-share of 1024, the first container only gets 33% of the CPU. The remaining containers receive 16.5%, 16.5% and 33% of the CPU. On a multi-core system, the shares of CPU time are distributed over all CPU cores. Even if a container is limited to less than 100% of CPU time, it can use 100% of each individual CPU core. For example, consider a system with more than three cores. If the container C0 is started with --cpu-shares=512 running one process, and another container C1 with --cpu-shares=1024 running two processes, this can result in the following division of CPU shares: | PID | container | CPU | CPU share | | - | -- | - | | | 100 | C0 | 0 | 100% of CPU0 | | 101 | C1 | 1 | 100% of CPU1 | | 102 | C1 | 2 | 100% of CPU2 | On some systems, changing the resource limits may not be allowed for non-root users. For more details, see https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error This option is not supported on cgroups V1 rootless systems.
Project: ThreatMapper (Provisioning / Security & Compliance)
File: build.md

title: Build from Source Build host: 16 Gb RAM, 4 cores to build and run the Deepfence Management Console Packages: build tools, `golang`, `docker`, `docker-compose` If necessary, enable docker for the user account that will build the Deepfence containers: ```bash sudo usermod -aG docker $USER # start new shell, or 'su $USER' for group change to take effect ``` ```bash git clone https://github.com/deepfence/ThreatMapper.git cd ThreatMapper make ``` The build process will create a number of container images and store these in your local Docker repository. ```bash cd ThreatMapper/deployment-scripts docker-compose -f docker-compose.yml up --detach ``` Once started, you can point a web browser at `https://--IP-ADDRESS/` to register a first user on the Deepfence Management Console. See for more information. To stop the Deepfence Management Console: ```bash docker-compose -f docker-compose.yml down ``` If you plan to deploy the Management Console or Sensors (`deepfenceagentce` and `deepfenceclusteragent_ce`) on another host, you should push the images to a suitable, accessible repository: For example, to push the images to DockerHub: ```bash ACC=myorg # the name of the dockerhub account docker login -u $ACC # log in to the account for IMG in \ deepfenceredisce \ deepfencepostgresce \ deepfencekafkabroker_ce \ deepfencerouterce \ deepfencefileserver_ce \ deepfenceserverce \ deepfenceworkerce \ deepfenceuice \ deepfenceagentce \ deepfenceclusteragent_ce \ deepfencepackagescanner_ce \ deepfencemalwarescanner_ce \ deepfencesecretscanner_ce \ deepfenceneo4jce do docker tag deepfenceio/$IMG $ACC/$IMG:latest docker push $ACC/$IMG:latest done ```
Project: Ansible (Provisioning / Automation & Configuration)
File: bug_internal_api.md

Hi! Thanks very much for your submission to Ansible. It means a lot to us to have an active community that is willing to submit feedback so that we can continue to make Ansible better. The Ansible Python API is considered internal and an unsupported aspect of Ansible, as such this is not considered a bug unless it causes an issue with Ansible command line tools (`ansible`, `ansible-playbook`, `ansible-doc`, etc). We do support the provided API for use in developing plugins (modules, dynamic inventories, callbacks, strategies, etc), but this does not seem to match that case. If you really need a stable API target to use Ansible, consider using ansible-runner: <https://github.com/ansible/ansible-runner> Because this project is very active, we're unlikely to see comments made on closed tickets and we lock them after some time. If you or anyone else has any further questions, please let us know by using any of the communication methods listed in the page below: <https://docs.ansible.com/ansible/latest/community/communication.html> Thank you once again for this and your interest in Ansible!
Project: KICS (Provisioning / Security & Compliance)
File: edc95c10-7366-4f30-9b4b-f995c84eceb5.md

title: IAM Policies Attached To User hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: edc95c10-7366-4f30-9b4b-f995c84eceb5 Query name: IAM Policies Attached To User Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: IAM policies should be attached only to groups or roles<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10 14" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: myuser: Type: AWS::IAM::User Properties: Path: "/" LoginProfile: Password: myP@ssW0rd ManagedPoliciesArns: [ "arn:aws:iam::123456789012:policy/UsersManageOwnCredentials", "arn:aws:iam::123456789012:policy/divisionabc/subdivisionxyz/UsersManageOwnCredentials" ] Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn ``` ```json title="Positive test num. 2 - json file" hl_lines="10 14" { "Resources": { "myuser": { "Type": "AWS::IAM::User", "Properties": { "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd" }, "ManagedPoliciesArns": [ "arn:aws:iam::123456789012:policy/UsersManageOwnCredentials", "arn:aws:iam::123456789012:policy/divisionabc/subdivisionxyz/UsersManageOwnCredentials" ], "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ] }, { "NotResource": [ "myqueue.Arn" ], "Effect": "Deny", "Action": [ "sqs:*" ] } ] } } ] } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: myuser: Type: AWS::IAM::User Properties: Path: "/" LoginProfile: Password: myP@ssW0rd ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "myuser": { "Type": "AWS::IAM::User", "Properties": { "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd" } } } } } ```
Project: YDB (App Definition and Development / Database)
File: basic_filter_and_sort.md

Select the first three episodes from every season of "IT Crowd", except the first season. {% include %} ```sql SELECT series_id, season_id, episode_id, CAST(airdate AS Date) AS airdate, title FROM episodes WHERE series_id = 1 -- List of conditions to build the result AND season_id > 1 -- Logical AND is used for complex conditions ORDER BY -- Sorting the results. series_id, -- ORDER BY sorts the values by one or multiple season_id, -- columns. Columns are separated by commas. episode_id LIMIT 3 -- LIMIT N after ORDER BY means -- "get top N" or "get bottom N" results, ; -- depending on sort order. COMMIT; ```