cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: be5b230d-4371-4a28-a441-85dc760e2aa3.md

title: IoT Policy Allows Wildcard Resource hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: be5b230d-4371-4a28-a441-85dc760e2aa3 Query name: IoT Policy Allows Wildcard Resource Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: IoT Policy should not allow Resource to be set as *<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: IoTPolicy: Type: AWS::IoT::Policy Properties: PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: iot:Connect Resource: "*" Effect: Deny Action: sqs:* NotResource: my-hardcoded-arn PolicyName: PolicyName ``` ```json title="Positive test num. 2 - json file" hl_lines="7" { "Description": "A sample template", "Resources": { "IoTPolicy": { "Type": "AWS::IoT::Policy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": [ "iot:Connect" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": "my-hardcoded-arn" } ] }, "PolicyName": "PolicyName" } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: IoTPolicy: Type: AWS::IoT::Policy Properties: PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: iot:Connect Resource: arn:aws:iot:us-east-1:123456789012:client/client1 PolicyName: PolicyName ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "IoTPolicy": { "Type": "AWS::IoT::Policy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:Connect" ], "Resource": [ "arn:aws:iot:us-east-1:123456789012:client/client1" ] } ] }, "PolicyName": "PolicyName" } } } } ```
Project: KubeMQ (App Definition and Development / Streaming & Messaging)
File: kubemq_events_store_attach.md

Events-Store attach to events store channels command Events-Store attach command allows to display 'events_store' channel content for debugging proposes ``` kubemq events_store attach [flags] ``` ``` kubemq events_store attach * kubemq events_store attach some-events-store kubemq events_store attach some-events-store1 some-events-store2 kubemq events_store attach some-events -i some* kubemq events_store attach some-events -e not-some* ``` ``` -e, --exclude stringArray set (regex) strings to exclude -h, --help help for attach -i, --include stringArray set (regex) strings to include ``` - Execute Kubemq 'Events-Store' Pub/Sub commands
Project: ClickHouse (App Definition and Development / Database)
File: v21.8.5.7-lts.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Allow symlinks for library dictionaty path. (). Backported in : Use Multipart copy upload for large S3 objects. (). Backported in : Do not allow creating StorageMaterializedPostgreSQL with bad arguments. Closes . (). Backported in : Bugfix for windowFunnel's "strict" mode. This fixes . (). Backported in : Fix column filtering with union distinct in subquery. Closes . (). Backported in : Prevent crashes for some formats when NULL (tombstone) message was coming from Kafka. Closes . (). Backported in : Fix a rare bug in `DROP PART` which can lead to the error `Unexpected merged part intersects drop range`. (). Backported in : Fix a couple of bugs that may cause replicas to diverge. (). Backported in : Fix selecting with extremes from a column of the type `LowCardinality(UUID)`. (). Backported in : Check cluster name before creating Distributed table, do not allow to create a table with incorrect cluster name. Fixes . (). Backported in : Fix cases, when read buffer fails with 'attempt to read after end of file'. Closes . (). Backported in : Temporarily switched ubuntu apt repository to mirror ru.archive.ubuntu.com as default one(archive.ubuntu.com) is not responding from our CI. (). Backported in : Fix handling null value with type of Nullable(String) in function JSONExtract. This fixes and . This was introduced in https://github.com/ClickHouse/ClickHouse/pull/25452 . (). Backported in : Fix extremely rare segfaults on shutdown due to incorrect order of context/config reloader shutdown. (). Backported in : Fixed possible excessive number of conditions moved from `WHERE` to `PREWHERE` (optimization controlled by settings `optimizemoveto_prewhere`). (). Backported in : Fix incorrect behavior in `clickhouse-keeper` when list watches (`getChildren`) triggered with `set` requests for children. (). Backported in : Fix a rare bug in `clickhouse-keeper` when the client can receive a watch response before request-response. (). Backported in : Fix possible read of uninitialized memory for queries with `Nullable(LowCardinality)` type and extremes. Fixes . (). Backported in : Fix inconsistent result in queries with `ORDER BY` and `Merge` tables with enabled setting `optimizereadin_order`. (). Backported in : Fix intersecting parts due to new part had been replaced with an empty part. (). Fix several bugs in ZooKeeper snapshots deserialization (). Fix prometheus metric name (). Fix flacky test (). Fix throw without exception in MySQL source. (). Fix race between REPLACE PARTITION and MOVE PARTITION (). Follow-up to (). Set version of tzlocal to 2.1 (). ODBC connection holder fix dangling reference (). Another try to fix BackgroundPoolTask decrement. (). More accurate check that zk root exists. ().
Project: Apache Hadoop (App Definition and Development / Database)
File: LibHdfs.md

<! Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. See accompanying LICENSE file. --> C API libhdfs ============= <!-- MACRO{toc|fromDepth=0|toDepth=3} --> Overview -- libhdfs is a JNI based C API for Hadoop's Distributed File System (HDFS). It provides C APIs to a subset of the HDFS APIs to manipulate HDFS files and the filesystem. libhdfs is part of the Hadoop distribution and comes pre-compiled in `$HADOOPHDFSHOME/lib/native/libhdfs.so` . libhdfs is compatible with Windows and can be built on Windows by running `mvn compile` within the `hadoop-hdfs-project/hadoop-hdfs` directory of the source tree. The APIs -- The libhdfs APIs are a subset of the . The header file for libhdfs describes each API in detail and is available in `$HADOOPHDFSHOME/include/hdfs.h`. A Sample Program ```c int main(int argc, char argv) { hdfsFS fs = hdfsConnect("default", 0); const char* writePath = "/tmp/testfile.txt"; hdfsFile writeFile = hdfsOpenFile(fs, writePath, OWRONLY |OCREAT, 0, 0, 0); if(!writeFile) { fprintf(stderr, "Failed to open %s for writing!\n", writePath); exit(-1); } char* buffer = "Hello, World!"; tSize numwrittenbytes = hdfsWrite(fs, writeFile, (void*)buffer, strlen(buffer)+1); if (hdfsFlush(fs, writeFile)) { fprintf(stderr, "Failed to 'flush' %s\n", writePath); exit(-1); } hdfsCloseFile(fs, writeFile); } ``` How To Link With The Library See the CMake file for `testlibhdfsops.c` in the libhdfs source directory (`hadoop-hdfs-project/hadoop-hdfs/src/CMakeLists.txt`) or something like: `gcc abovesample.c -I$HADOOPHDFSHOME/include -L$HADOOPHDFSHOME/lib/native -lhdfs -o abovesample` Common Problems The most common problem is the `CLASSPATH` is not set properly when calling a program that uses libhdfs. Make sure you set it to all the Hadoop jars needed to run Hadoop itself as well as the right configuration directory containing `hdfs-site.xml`. Wildcard entries in the `CLASSPATH` are now supported by libhdfs. Thread Safe -- libhdfs is thread safe. Concurrency and Hadoop FS "handles" The Hadoop FS implementation includes an FS handle cache which caches based on the URI of the namenode along with the user connecting. So, all calls to `hdfsConnect` will return the same handle but calls to `hdfsConnectAsUser` with different users will return different handles. But, since HDFS client handles are completely thread safe, this has no bearing on concurrency. Concurrency and libhdfs/JNI The libhdfs calls to JNI should always be creating thread local storage, so (in theory), libhdfs should be as thread safe as the underlying calls to the Hadoop FS.
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-ref-syntax-aux-resource-mgmt-add-jar.md

layout: global title: ADD JAR displayTitle: ADD JAR license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. `ADD JAR` adds a JAR file to the list of resources. The added JAR file can be listed using . ```sql ADD { JAR | JARS } file_name [ ... ] ``` file_name* The name of the JAR file to be added. It could be either on a local file system or a distributed file system or an Ivy URI. Apache Ivy is a popular dependency manager focusing on flexibility and simplicity. Now we support two parameter in URI query string: transitive: whether to download dependent jars related to your ivy URL. The parameter name is case-sensitive, and the parameter value is case-insensitive. If multiple transitive parameters are specified, the last one wins. exclude: exclusion list during downloading Ivy URI jar and dependent jars. User can write Ivy URI such as: ivy://group:module:version ivy://group:module:version?transitive=[true|false] ivy://group:module:version?transitive=[true|false]&exclude=group:module,group:module ```sql ADD JAR /tmp/test.jar; ADD JAR "/path/to/some.jar"; ADD JAR '/some/other.jar'; ADD JAR "/path with space/abc.jar"; ADD JARS "/path with space/def.jar" '/path with space/ghi.jar'; ADD JAR "ivy://group:module:version"; ADD JAR "ivy://group:module:version?transitive=false" ADD JAR "ivy://group:module:version?transitive=true" ADD JAR "ivy://group:module:version?exclude=group:module&transitive=true" ```
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_reset.md

title: "Command - devspace reset" sidebar_label: devspace reset Resets an cluster token ``` ``` ``` -h, --help help for reset ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: external-secrets (Provisioning / Security & Compliance)
File: delinea.md

External Secrets Operator integrates with . Please note that the product is NOT in scope of this integration. You need client ID, client secret and tenant to authenticate with DSV. Both client ID and client secret can be specified either directly in the config, or by referencing a kubernetes secret. To acquire client ID and client secret, refer to the and documentation. ```yaml apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: secret-store spec: provider: delinea: tenant: <TENANT> tld: <TLD> clientId: value: <CLIENT_ID> clientSecret: secretRef: name: <NAMEOFKUBE_SECRET> key: <KEYINKUBE_SECRET> ``` Both `clientId` and `clientSecret` can either be specified directly via the `value` field or can reference a kubernetes secret. The `tenant` field must correspond to the host name / site name of your DevOps vault. If you selected a region other than the US you must also specify the TLD, e.g. `tld: eu`. If required, the URL template (`urlTemplate`) can be customized as well. Secrets can be referenced by path. Getting a specific version of a secret is not yet supported. Note that because all DSV secrets are JSON objects, you must specify `remoteRef.property`. You can access nested values or arrays using . ```yaml apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: secret spec: refreshInterval: 20s secretStoreRef: kind: SecretStore name: secret-store data: secretKey: <KEYINKUBE_SECRET> remoteRef: key: <SECRET_PATH> property: <JSON_PROPERTY> ```
Project: YDB (App Definition and Development / Database)
File: definition.md

Redefinition of settings. Syntax `PRAGMA x.y = "z";` or `PRAGMA x.y("z", "z2", "z3");`: `x`: (optional) The category of the setting. `y`: The name of the setting. `z`: (optional for flags) The value of the setting. The following suffixes are acceptable: `Kb`, `Mb`, `Gb`: For the data amounts. `sec`, `min`, `h`, `d`: For the time values. Examples ```yql PRAGMA AutoCommit; ``` ```yql PRAGMA TablePathPrefix = "home/yql"; ``` ```yql PRAGMA Warning("disable", "1101"); ``` With some exceptions, you can return the settings values to their default states using `PRAGMA my_pragma = default;`. For the full list of available settings, . Unless otherwise specified, a pragma affects all the subsequent expressions up to the end of the module where it's used. If necessary and logically possible, you can change the value of this setting several times within a given query to make it different at different execution steps. There are also special scoped pragmas with the scope defined by the same rules as the scope of . Unlike scoped pragmas, regular pragmas can only be used in the global scope (not inside lambda functions, ACTION{% if feature_subquery %}, SUBQUERY{% endif %}, etc.).
Project: ScalarDB (App Definition and Development / Database)
File: multi-storage-transactions.md

ScalarDB transactions can span multiple storages or databases while maintaining ACID compliance by using a feature called multi-storage transactions. This page explains how multi-storage transactions work and how to configure the feature in ScalarDB. In ScalarDB, the `multi-storage` implementation holds multiple storage instances and has mappings from a namespace name to a proper storage instance. When an operation is executed, the multi-storage transactions feature chooses a proper storage instance from the specified namespace by using the namespace-storage mapping and uses that storage instance. To enable multi-storage transactions, you need to specify `consensus-commit` as the value for `scalar.db.transaction_manager`, `multi-storage` as the value for `scalar.db.storage`, and configure your databases in the ScalarDB properties file. The following is an example of configurations for multi-storage transactions: ```properties scalar.db.transaction_manager=consensus-commit scalar.db.storage=multi-storage scalar.db.multi_storage.storages=cassandra,mysql scalar.db.multi_storage.storages.cassandra.storage=cassandra scalar.db.multistorage.storages.cassandra.contactpoints=localhost scalar.db.multi_storage.storages.cassandra.username=cassandra scalar.db.multi_storage.storages.cassandra.password=cassandra scalar.db.multi_storage.storages.mysql.storage=jdbc scalar.db.multistorage.storages.mysql.contactpoints=jdbc:mysql://localhost:3306/ scalar.db.multi_storage.storages.mysql.username=root scalar.db.multi_storage.storages.mysql.password=mysql scalar.db.multistorage.storages.mysql.jdbc.connectionpool.min_idle=5 scalar.db.multistorage.storages.mysql.jdbc.connectionpool.max_idle=10 scalar.db.multistorage.storages.mysql.jdbc.connectionpool.max_total=25 scalar.db.multistorage.namespacemapping=user:cassandra,coordinator:mysql scalar.db.multistorage.defaultstorage=cassandra ``` For additional configurations, see . For a hands-on tutorial, see .
Project: KubeMQ (App Definition and Development / Streaming & Messaging)
File: kubemq_queues_attach.md

Queues attach to 'queues' channels command Queues attach command allows to display 'queues' channel content for debugging proposes ``` kubemq queues attach [flags] ``` ``` kubemq queue attach all kubemq queue attach some-queue kubemq queue attach some-queue1 some-queue2 kubemq queue attach some-queue -i some* kubemq queue attach some-queue -e not-some* ``` ``` -e, --exclude stringArray set (regex) strings to exclude -h, --help help for attach -i, --include stringArray aet (regex) strings to include ``` - Execute Kubemq 'queues' commands
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: feature-and-limit-list-mongodb.md

title: Full feature and limit list description: The full feature and limit list of KubeBlocks migration function for MongoDB keywords: [mongodb, migration, migrate data in MongoDB to KubeBlocks, full feature, limit] sidebar_position: 1 sidebar_label: Full feature and limit list Precheck Database connection Database version Whether the incremental migration is supported by a database Whether the table structure of the source database is supported Data initialization Supports all major data types Incremental data migration Supports all major data types Support the resumable upload capability of eventual consistency Overall limits If the incremental data migration is used, the source database should be the master node under the Replica Set structure. Except for the incremental data migration module, other modules do not support resumable upload, i.e. if an exception occurs in this module, such as pod failure caused by downtime and network disconnection, a re-migration is required. During the data transmission task, operations such as Drop, Rename, and DropDatabase on the migration objects in the source database is not supported. The database name and collection name cannot contain Chinese characters and special characters like a single quotation mark (') and a comma (,). During the migration process, the switchover of primary and secondary nodes in the source library is not supported, which may cause the connection string specified in the task configuration to change. This further leads to migration link failure. Precheck module: None Data initialization module The database character set other than UTF-8 is not supported. Data incremental migration module The database character set other than UTF-8 is not supported.
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_remove_provider.md

title: "Command - devspace remove provider" sidebar_label: devspace remove provider Removes a cloud provider from the configuration ``` devspace remove provider [flags] ``` ``` Removes a cloud provider. Example: devspace remove provider app.devspace.cloud ``` ``` -h, --help help for provider --name string Cloud provider name to use ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile string The devspace profile to use (if there is any) --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) ```
Project: OAuth2 Proxy (Provisioning / Key Management)
File: PULL_REQUEST_TEMPLATE.md

<! Provide a general summary of your changes in the Title above --> <! Describe your changes in detail --> <! Why is this change required? What problem does it solve? --> <! If it fixes an open issue, please link to the issue here. --> <! Please describe in detail how you tested your changes. --> <! Include details of your testing environment, and the tests you ran to --> <! see how your change affects other areas of the code, etc. --> <! Go over all the following points, and put an `x` in all the boxes that apply. --> <! If you're unsure about any of these, don't hesitate to ask. We're here to help! --> [ ] My change requires a change to the documentation or CHANGELOG. [ ] I have updated the documentation/CHANGELOG accordingly. [ ] I have created a feature (non-master) branch for my PR. [ ] I have written tests for my code changes.
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.47.md

layout: release date: 2023-01-31 tag: v0.6.47 language: en Update maintainers.md @nishantwrp (#6953) Fixed snackbar close button not working in UserPreference @suyashvsingh (#6958) [bug] Fix the missing "Add Cluster" button @theBeginner86 (#6949) [UI] Use new svg system in rjsf @Chadha93 (#6951) [bug] Fix the missing "Add Cluster" button @theBeginner86 (#6949) Revert go-git @acald-creator (#6959) [chore] Upgrade Kompose 1.28 @acald-creator (#6902) [bug] Fix the missing "Add Cluster" button @theBeginner86 (#6949) Thank you to our contributors for making this release possible: @Chadha93, @acald-creator, @leecalcote, @nishantwrp, @suyashvsingh, @theBeginner86 and l5io
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: v1.4.1.md

Sidecar-injector.dapr.io admission webhook deny access to Kubernetes nodes (https://github.com/dapr/dapr/issues/3699) PubSub routing fails when using event more than once (https://github.com/dapr/dapr/issues/3693) When trying to connect to an Kubernetes node, using the `kubectl debug` command (for example, `kubectl debug node/ -it --image=mcr.microsoft.com/aks/fundamental/base-ubuntu:v0.0.11`), the connection is denied due "sidecar-injector.dapr.io" admission webhook: ```txt Error from server: admission webhook "sidecar-injector.dapr.io" denied the request: service account 'xxxxxxx' not on the list of allowed controller accounts ``` The following CEL expression for PubSub Routing fails: `has(event.data.important) && event.data.important == true` Using event more than once causes an error because it tries to compile an underlying CEL program with the variable defined multiple times.