cwielenb/CNCF-Dataset huggingface dataset:
Project: Carvel (App Definition and Development / Application Definition & Image Build)
File: README_Cognito_UserPools_PostConfirmation.md

The following is a sample Lambda function that receives Amazon Cognito User Pools post-confirmation event as an input and writes some of the record data to CloudWatch Logs. (Note that anything written to stdout or stderr will be logged as CloudWatch Logs events.) Please see instructions for setting up the Cognito triggers at https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html . ```go package main import ( "fmt" "github.com/aws/aws-lambda-go/lambda" "github.com/aws/aws-lambda-go/events" ) func handler(event events.CognitoEventUserPoolsPostConfirmation) (events.CognitoEventUserPoolsPostConfirmation, error) { fmt.Printf("PostConfirmation for user: %s\n", event.UserName) return event, nil } func main() { lambda.Start(handler) } ```
Project: kpt (Provisioning / Automation & Configuration)
File: 01-packages.md

A kpt package is a bundle of configuration data. It is represented as a directory tree containing KRM resources using YAML as the file format. A package is explicitly declared using a file named `Kptfile` containing a KRM resource of kind `Kptfile`. The Kptfile contains metadata about the package and is just a regular resource in the YAML format. Just as directories can be nested, a package can contain another package, called a subpackage. Let's take a look at the wordpress package as an example: ```shell $ kpt pkg get https://github.com/GoogleContainerTools/kpt.git/package-examples/wordpress@v0.9 ``` View the package hierarchy using the `tree` command: ```shell $ kpt pkg tree wordpress/ Package "wordpress" [Kptfile] Kptfile wordpress [service.yaml] Service wordpress deployment [deployment.yaml] Deployment wordpress [volume.yaml] PersistentVolumeClaim wp-pv-claim Package "mysql" [Kptfile] Kptfile mysql [deployment.yaml] PersistentVolumeClaim mysql-pv-claim [deployment.yaml] Deployment wordpress-mysql [deployment.yaml] Service wordpress-mysql ``` This package hierarchy contains two packages: `wordpress` is the top-level package in the hierarchy declared using `wordpress/Kptfile`. This package contains 2 subdirectories. `wordpress/deployment` is a regular directory used for organizing resources that belong to the `wordpress` package itself. The `wordpress` package contains 3 direct resources in 3 files: `service.yaml`, `deployment/deployment.yaml`, and `deployment/volume.yaml`. `wordpress/mysql` is a subpackage of `wordpress` package since it contains a `Kptfile`. This package contains 3 resources in `wordpress/mysql/deployment.yaml` file. kpt uses Git as the underlying version control system. A typical workflow starts by fetching an upstream package from a Git repository to the local filesystem using `kpt pkg` commands. All other functionality (i.e. `kpt fn` and `kpt live`) use the package from the local filesystem, not the remote Git repository. You may think of this as the vendoring used by tooling for some programming languages. The main difference is that kpt is designed to enable you to modify the vendored package on the local filesystem and then later update the package by merging the local and upstream changes. There is one scenario where a Kptfile is implicit: You can use kpt to fetch any Git directory containing KRM resources, even if it does not contain a `Kptfile`. Effectively, you are telling kpt to treat that Git directory as a package. kpt automatically creates the `Kptfile` on the local filesystem to keep track of the upstream repo. This means that kpt is compatible with large corpus of existing Kubernetes configuration stored on Git today! For example, `cockroachdb` is just a vanilla directory of KRM: ```shell $ kpt pkg get https://github.com/kubernetes/examples/staging/cockroachdb ``` We will go into details of how to work with packages in [Chapter 3].
Project: ArangoDB (App Definition and Development / Database)
File: explicit_result_move_converting_constructor.md

+++ title = "`explicit basicoutcome(basicresult<A, B, C> &&)`" description = "Explicit converting move constructor from compatible `basicresult`. Available if `predicate::enablecompatible_conversion<A, B, void, C>` is true. Constexpr, triviality and noexcept propagating." categories = ["constructors", "explicit-constructors", "converting-constructors"] weight = 340 +++ Explicit converting move constructor from compatible `basicresult`. Calls {{% api "void onoutcomemoveconstruction(T *, U &&) noexcept" %}} with `this` and the input. Requires: `predicate::enablecompatibleconversion<A, B, void, C>` is true. Complexity: Same as for the move constructors of the underlying types. Constexpr, triviality and noexcept of underlying operations is propagated. Guarantees: If an exception is thrown during the operation, the object is left in a partially completed state, as per the normal rules for the same operation on a `struct`.
Project: Kubescape (Provisioning / Security & Compliance)
File: README.md

| Key | Type | Default | Description | |--|||-| | affinity | object | `{}` | | | configMap | object | `{"create":true,"params":{"clusterName":"<MyK8sClusterName>","customerGUID":"<MyGUID>,"}}` | ARMO customer information | | fullnameOverride | string | `""` | | | image | object | `{"imageName":"kubescape","pullPolicy":"IfNotPresent","repository":"quay.io/armosec","tag":"latest"}` | Image and version to deploy | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | | resources | object | `{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"200m","memory":"256Mi"}}` | Default resources for running the service in cluster | | schedule | string | `"0 0 *"` | Frequency of running the scan | | securityContext | object | `{}` | | | serviceAccount | object | `{"annotations":{},"create":true,"name":"kubescape-discovery"}` | Service account that runs the scan and has permissions to view the cluster | | tolerations | list | `[]` | | Autogenerated from chart metadata using
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-ref-syntax-aux-cache.md

layout: global title: Cache Statements displayTitle: Cache Statements license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. * * *
Project: Tetragon (Provisioning / Security & Compliance)
File: configuration.md

title: "Configure Tetragon" linkTitle: "Configuration" weight: 6 Depending on your deployment mode, Tetragon configuration can be changed by: {{< tabpane lang=shell >}} {{< tab Kubernetes >}} kubectl edit cm -n kube-system tetragon-config kubectl rollout restart -n kube-system ds/tetragon {{< /tab >}} {{< tab Docker >}} echo "/var/log/tetragon/tetragon.log" > /etc/tetragon/tetragon.conf.d/export-file docker run --name tetragon --rm -d \ --pid=host --cgroupns=host --privileged \ -v /etc/tetragon:/etc/tetragon \ -v /sys/kernel:/sys/kernel \ -v /var/log/tetragon:/var/log/tetragon \ quay.io/cilium/tetragon:{{< latest-version >}} \ /usr/bin/tetragon {{< /tab >}} {{< tab systemd >}} echo "/var/log/tetragon/tetragon.log" > /etc/tetragon/tetragon.conf.d/export-file systemctl restart tetragon {{< /tab >}} {{< /tabpane >}} To read more about Tetragon configuration, please check our reference pages: For Kubernetes deployments, see the reference. For Container or systemd deployments, see the reference. On Linux each process has various associated user, group IDs and capabilities known as process credentials. To enable visility into , run Tetragon with `enable-process-creds` setting set. {{< tabpane lang=shell >}} {{< tab Kubernetes >}} kubectl edit cm -n kube-system tetragon-config kubectl rollout restart -n kube-system ds/tetragon {{< /tab >}} {{< tab Docker >}} echo "true" > /etc/tetragon/tetragon.conf.d/enable-process-cred docker run --name tetragon --rm -d \ --pid=host --cgroupns=host --privileged \ -v /etc/tetragon:/etc/tetragon \ -v /sys/kernel:/sys/kernel \ -v /var/log/tetragon:/var/log/tetragon \ quay.io/cilium/tetragon:{{< latest-version >}} \ /usr/bin/tetragon {{< /tab >}} {{< tab systemd >}} echo "true" > /etc/tetragon/tetragon.conf.d/enable-process-cred systemctl restart tetragon {{< /tab >}} {{< /tabpane >}}
Project: Athenz (Provisioning / Key Management)
File: capabilities.md

Athenz supports the OAuth2 standard by enabling the generation of Access Tokens. Access tokens represent an authoritative statement that a given principal may assume some number of roles in a domain for a limited period. They are signed to prevent tampering. For more information, please refer to Athenz can be configured to send Email Notifications. These notifications can remind users that there are tasks that require their attention such as approving a member's request to join a role, warn them on a certificate that is close to expiration, and even alert them on Athenz health when needed. To enable notifications, refer to Templates are a collection of predefined roles, policies, and services that can be applied to a domain. For more information, please refer to Athenz maintains a history of all the changes that were executed in a domain by their respective administrators. The audit log can be used whenever the administrator wants to find out who made a specific change. The query can be filtered for a specific role in a given period. The term service within Athenz is more generic than a traditional service. A service identity could represent a command, job, daemon, workflow, as well as both a client and a server. EC2 instances in AWS are no exception. They too can be bootstrapped to Athenz which allows them to access other Athenz enabled services while providing services for identities with valid authorization. For more information, please refer to This feature allows any service to obtain temporary session credentials for a role defined in AWS IAM to carry out operations against AWS Services. For more information, please refer to
Project: Flink (App Definition and Development / Streaming & Messaging)
File: operations.md

title: "Overview" weight: 30 type: docs aliases: /dev/python/table-api-users-guide/operations.html <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <meta http-equiv="refresh" content="0; url={{< ref "docs/dev/table/tableapi" >}} "/>
Project: KICS (Provisioning / Security & Compliance)
File: 5330b503-3319-44ff-9b1c-00ee873f728a.md

title: EC2 Group Has Public Interface hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5330b503-3319-44ff-9b1c-00ee873f728a Query name: EC2 Group Has Public Interface Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: The CIDR IP should not be a public interface<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="22" name: create minimal aurora instance in default VPC and default subnet group community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" cluster_id: ansible-test-cluster dbsecuritygroups: ["example"] name: example ec2 group ec2_group: name: example description: an example EC2 group vpc_id: 12345 region: eu-west-1a awssecretkey: SECRET awsaccesskey: ACCESS rules: proto: tcp from_port: 80 to_port: 80 cidr_ip: 0.0.0.0/0 ``` ```yaml title="Negative test num. 1 - yaml file" name: example ec2 group2 ec2_group1: name: example1 description: an example EC2 group vpc_id: 12345 region: eu-west-1a awssecretkey: SECRET awsaccesskey: ACCESS rules: proto: tcp from_port: 80 to_port: 80 cidr_ip: 10.1.1.1/32 ```
Project: ArangoDB (App Definition and Development / Database)
File: exception_rvalue.md

+++ title = "`exception_type &&exception() &&`" description = "Wide contract rvalue reference observer of the stored exception. Constexpr propagating." categories = ["observers"] weight = 787 +++ Wide contract rvalue reference observer of the stored exception. `NoValuePolicy::wideexceptioncheck()` is first invoked, then the reference to the exception is returned. As a valid default constructed exception is always present, no undefined behaviour occurs if `NoValuePolicy::wideexceptioncheck()` returns. Note that if `exception_type` is `void`, only a `const` overload returning `void` is present. Requires: Always available. Complexity: Depends on `NoValuePolicy::wideexceptioncheck()`. Guarantees: None.
Project: Akri (Provisioning / Automation & Configuration)
File: README.md

This Admission Controller (Webhook) validates Akri Configuration files. The HTTP service that implements the Webhook must be configured to use TLS. The Webhook expects its TLS certificate and private key to be stored within a Kubernetes . It is recommended to use in Kubernetes. `cert-manager` makes it easy to generate TLS certificates and private keys and, because it's a Kubernetes-native app, `cert-manager` stores these in Kubernetes Secrets. You may use a self-signed (!) CA with `cert-manager` and certificates signed by this CA will work with the Webhook. If you wish to install the Webhook, before installing the Helm Chart for Akri, you will need to have PEM-encoded versions of CA certificate, Webhook certificate and private key. The Webhook handler expects a Secret, with the same name (!), containing its certificate and private key, to exist in the Namespace where it will be deployed. If you're using `cert-manager` and have an `Issuer` called `ca`, you may generate a Secret for a Webhook called `${WEBHOOK}` in Namespace `${NAMESPACE}` with the following commands: ```bash WEBHOOK="akri-webhook-configuration" # Default name if not provided NAMESPACE="default" echo " apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: ${WEBHOOK} namespace: ${NAMESPACE} spec: secretName: ${WEBHOOK} duration: 8760h renewBefore: 720h isCA: false privateKey: algorithm: RSA encoding: PKCS1 size: 2048 usages: server auth dnsNames: ${WEBHOOK}.${NAMESPACE}.svc ${WEBHOOK}.${NAMESPACE}.svc.cluster.local issuerRef: name: ca kind: Issuer group: cert-manager.io " | kubectl apply --filename=- ``` NOTE You must provide the above with a `${NAMESPACE}` even if the value is `default` so that it may construct qualified DNS for the Webhook Service. When Kubernetes is configured to use the Webhook, it requires the base64-encoded PEM certificate of the CA. The CA certificate may be obtained from the Webhook's certificate using: ```bash CABUNDLE=$(\ kubectl get secret/${WEBHOOK} \ --namespace=${NAMESPACE} \ --output=jsonpath="{.data.ca\.crt}") && echo ${CABUNDLE} ``` Now you may proceed to install the Helm Chart for Akri, enabling the Webhook and providing the `CABUNDLE`: ```bash WEBHOOK=... NAMESPACE=... CABUNDLE=... helm install webhook akri-helm-charts/akri \ --namespace=${DEFAULT} \ --set=webhookConfiguration.enabled=true \ --set=webhookConfiguration.name=${WEBHOOK} \ --set=webhookConfiguration.caBundle=${CABUNDLE} \ --set=webhookConfiguration.image.repository=ghcr.io/project-akri/akri/webhook-configuration \ --set=webhookConfiguration.image.tag=v1 ```
Project: Athenz (Provisioning / Key Management)
File: try-out-Athenz-with-self-signed-CA.md

<a id="markdown-try-out-athenz-with-self-signed-ca-for-dev-only" name="try-out-athenz-with-self-signed-ca-for-dev-only"></a> <!-- TOC --> - - - <!-- /TOC --> <a id="markdown-prerequisites" name="prerequisites"></a> All the setup commands below are expected to run inside container. ```bash BASE_DIR="$(git rev-parse --show-toplevel)" docker run --rm -it \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh ``` <a id="markdown-prepare-certificates" name="prepare-certificates"></a> set up env. ```bash BASE_DIR="$(git rev-parse --show-toplevel)" . "${BASE_DIR}/docker/env.sh" . "${DOCKER_DIR}/sample/env.dev.sh" ``` create the self-signed CAs () ```bash sh "${DEVCADIR}/create-self-signed-ca.sh" ``` ```bash ls -l "${DEVATHENZCA_PATH}" ls -l "${DEVUSERCA_PATH}" ls -l "${DEVSERVICECA_PATH}" find "${DEVCADIR}" -name '*ca.pem' | xargs -I openssl x509 -text -in _ | grep 'Issuer: ' ``` create self-signed Athenz domain admin user certificate () ```bash curl --silent --fail --show-error https://api.github.com/users/<your github username> | grep '"id":' export DEVDOMAINADMIN='user.github-<your github ID>' ``` ```bash sh "${DEVDOMAINADMIN_DIR}/create-self-signed-user-cert.sh" ``` create ZMS server certificate () ```bash sh "${DEVZMSDIR}/create-self-signed-certs.sh" ``` create ZTS server certificates () ```bash sh "${DEVZTSDIR}/create-self-signed-certs.sh" ``` <a id="markdown-overwrite-env-and-continue-the-setup" name="overwrite-env-and-continue-the-setup"></a> ```bash cat <<EOF > "${DOCKER_DIR}/setup-scripts/dev-env-exports.sh" export CADIR="${DEVCA_DIR}" export ATHENZCAPATH="${DEVATHENZCA_PATH}" export USERCAPATH="${DEVUSERCA_PATH}" export SERVICECAPATH="${DEVSERVICECA_PATH}" export DOMAINADMIN="${DEVDOMAIN_ADMIN}" export DOMAINADMINDIR="${DEVCADIR}" export DOMAINADMINCERTKEYPATH="${DEVDOMAINADMINCERTKEY_PATH}" export DOMAINADMINCERTPATH="${DEVDOMAINADMINCERT_PATH}" export PRODZMSDIR="${DEVZMSDIR}" export ZMSCERTKEYPATH="${DEVZMSCERTKEY_PATH}" export ZMSCERTPATH="${DEVZMSCERT_PATH}" export PRODZTSDIR="${DEVZTSDIR}" export ZTSCERTKEYPATH="${DEVZTSCERTKEY_PATH}" export ZTSCERTPATH="${DEVZTSCERT_PATH}" export ZTSSIGNERCERTKEYPATH="${DEVZTSSIGNERCERTKEY_PATH}" export ZTSSIGNERCERTPATH="${DEVZTSSIGNERCERT_PATH}" export ZMSCLIENTCERTKEYPATH="${DEVZMSCLIENTCERTKEY_PATH}" export ZMSCLIENTCERTPATH="${DEVZMSCLIENTCERTBUNDLEPATH}" EOF ``` <a id="markdown-appendix" name="appendix"></a> <a id="markdown-note-for-mac-users-not-recommended" name="note-for-mac-users-not-recommended"></a> If you are using macOS 10.13+, the default `openssl` is `LibreSSL`, which does not support configuration using env. variables. ```bash openssl version ``` To fix this, please install the latest `openssl`, and change the reference temporarily. ```bash brew install openssl alias openssl=$(brew --prefix openssl)/bin/openssl ```
Project: ClickHouse (App Definition and Development / Database)
File: v21.1.3.32-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : fix data type convert issue for mysql engine ... (). Backported in : Disable constant folding for subqueries on the analysis stage, when the result cannot be calculated. (). Backported in : Fixed `There is no checkpoint` error when inserting data through http interface using `Template` or `CustomSeparated` format. Fixes . (). Backported in : Fix bug when concurrent `ALTER` and `DROP` queries may hang while processing ReplicatedMergeTree table. (). Backported in : Fix error `Cannot convert column now64() because it is constant but values of constants are different in source and result`. Continuation of . (). Backported in : Fixed possible wrong result or segfault on aggregation when Materialized View and its target table have different structure. Fixes . (). Backported in : Fix system.parts state column (LOGICALERROR when querying this column, due to incorrect order). (). Backported in : Added `cast`, `accurateCast`, `accurateCastOrNull` performance tests. (). Backported in : - Fix default value in join types with non-zero default (e.g. some Enums). Closes . (). Backported in : Fix possible buffer overflow in Uber H3 library. See https://github.com/uber/h3/issues/392. This closes . (). Backported in : Uninitialized memory read was possible in encrypt/decrypt functions if empty string was passed as IV. This closes . (). Backported in : Fixed very rare bug that might cause mutation to hang after `DROP/DETACH/REPLACE/MOVE PARTITION`. It was partially fixed by for the most cases. (). Backported in : Buffer overflow (on memory read) was possible if `addMonth` function was called with specifically crafted arguments. This fixes . This fixes . (). Backported in : Fix SIGSEGV with mergetreeminrowsforconcurrentread/mergetreeminbytesforconcurrentread=0/UINT64_MAX. (). Backported in : Query CREATE DICTIONARY id expression fix. (). Backported in : `DROP/DETACH TABLE table ON CLUSTER cluster SYNC` query might hang, it's fixed. Fixes . (). Backported in : Fix use-after-free of the CompressedWriteBuffer in Connection after disconnect. (). Backported in : Fix wrong result of function `neighbor` for `LowCardinality` argument. Fixes . (). Backported in : Some functions with big integers may cause segfault. Big integers is experimental feature. This closes . (). Backported in : Fix a segmentation fault in `bitmapAndnot` function. Fixes . (). Backported in : Fix crash when nested column name was used in `WHERE` or `PREWHERE`. Fixes . (). Backported in : Fixed stack overflow when using accurate comparison of arithmetic type with string type. (). Backported in : In previous versions, unusual arguments for function arrayEnumerateUniq may cause crash or infinite loop. This closes . (). Backported in : Fix filtering by UInt8 greater than 127. (). Backported in : Fix crash when pushing down predicates to union distinct subquery. This fixes . (). Backported in : Deadlock was possible if system.text_log is enabled. This fixes . (). Backported in : BloomFilter index crash fix. Fixes . (). Update Dragonbox ().