cwielenb/CNCF-Dataset huggingface dataset:
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: kubernetes-authorization.md

title: Kubernetes Authorization code: https://github.com/open-policy-agent/contrib/tree/main/k8s_authorization blogs: https://blog.styra.com/blog/kubernetes-authorization-webhook https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb https://itnext.io/optimizing-open-policy-agent-based-kubernetes-authorization-via-go-execution-tracer-7b439bb5dc5b inventors: styra docs_features: rest-api-integration: note: | The Kubernetes API server can be configured to use OPA as an authorization webhook. Such an integration can be configured by following in the contrib repo. kubernetes: note: | View showing how it's possible to integrate OPA with Kubernetes User Authorization. Kubernetes Authorization is a pluggable mechanism that lets administrators control which users can run which APIs and is often handled by builtin RBAC. OPA's policy language is more flexible than the RBAC, for example, writing policy using a prohibited list of APIs instead of the usual RBAC style of listing the permitted APIs.
Project: ArangoDB (App Definition and Development / Database)
File: outcome.md

+++ title = "`outcome<T, EC = varies, EP = varies, NoValuePolicy = policy::default_policy<T, EC, EP>>`" description = "A type alias to a `stdoutcome<T, EC, EP, NoValuePolicy>` (standalone edition) or `boostoutcome<T, EC, EP, NoValuePolicy>` (Boost edition)." +++ A type alias to either {{% api "stdoutcome<T, EC = std::errorcode, EP = std::exceptionptr, NoValuePolicy = policy::defaultpolicy<T, EC, EP>>" %}} (standalone edition) or {{% api "boostoutcome<T, EC = boost::system::errorcode, EP = boost::exceptionptr, NoValuePolicy = policy::defaultpolicy<T, EC, EP>>" %}} (Boost edition), and `policy::`{{% api "default_policy" %}}. This means that `outcome<T>` uses the appropriate default alias depending on which edition of Outcome is in use. Namespace: `BOOSTOUTCOMEV2_NAMESPACE` Header: `<boost/outcome/outcome.hpp>`
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: api-report-alpha.md

Do not edit this file. It is a report generated by . ```ts import { BackstagePlugin } from '@backstage/frontend-plugin-api'; import { ExtensionDefinition } from '@backstage/frontend-plugin-api'; import { RouteRef } from '@backstage/frontend-plugin-api'; import { TranslationRef } from '@backstage/core-plugin-api/alpha'; // @alpha (undocumented) const _default: BackstagePlugin< { root: RouteRef<undefined>; }, {} ; export default _default; // @alpha (undocumented) export const settingsNavItem: ExtensionDefinition<{ title: string; }>; // @alpha (undocumented) export const userSettingsTranslationRef: TranslationRef< 'user-settings', { readonly 'languageToggle.select': 'Select language {{language}}'; readonly 'languageToggle.title': 'Language'; readonly 'languageToggle.description': 'Change the language'; readonly 'themeToggle.select': 'Select theme {{theme}}'; readonly 'themeToggle.title': 'Theme'; readonly 'themeToggle.description': 'Change the theme mode'; readonly 'themeToggle.names.auto': 'Auto'; readonly 'themeToggle.names.dark': 'Dark'; readonly 'themeToggle.names.light': 'Light'; readonly 'themeToggle.selectAuto': 'Select Auto Theme'; } ; // (No @packageDocumentation comment for this package) ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-system-reset.1.md

% podman-system-reset 1 podman\-system\-reset - Reset storage back to initial state podman system reset [options] podman system reset removes all pods, containers, images, networks and volumes, and machines. It also removes the configured graphRoot and runRoot directories. Make sure these are not set to some important directory. This command must be run before changing any of the following fields in the `containers.conf` or `storage.conf` files: `driver`, `staticdir`, `tmpdir` or `volume_path`. `podman system reset` reads the current configuration and attempts to remove all of the relevant configurations. If the administrator modified the configuration files first, `podman system reset` might not be able to clean up the previous storage. Do not prompt for confirmation Print usage statement Reset all storage back to a clean initialized state. ``` $ podman system reset WARNING! This will remove: all containers all pods all images all networks all build cache all machines all volumes the graphRoot directory: /var/lib/containers/storage the runRoot directory: /run/containers/storage Are you sure you want to continue? [y/N] y ``` If the user ran rootless containers without having the `fuse-overlayfs` program installed, podman defaults to the `vfs` storage in their home directory. If they want to switch to use fuse-overlay, they must install the fuse-overlayfs package. The user needs to reset the storage to use overlayfs by default. Execute `podman system reset` as the user first to remove the VFS storage. Now the user can edit the `/etc/containers/storage.conf` to make any changes if necessary. If the system's default was already `overlay`, then no changes are necessary to switch to fuse-overlayfs. Podman looks for the existence of fuse-overlayfs to use it when set in the `overlay` driver, only falling back to vfs if the program does not exist. Users can run `podman info` to ensure Podman is using fuse-overlayfs and the overlay driver. , , , November 2019, Originally compiled by Dan Walsh (dwalsh at redhat dot com)
Project: KICS (Provisioning / Security & Compliance)
File: 6db6e0c2-32a3-4a2e-93b5-72c35f4119db.md

title: Copy With More Than Two Arguments Not Ending With Slash hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6db6e0c2-32a3-4a2e-93b5-72c35f4119db Query name: Copy With More Than Two Arguments Not Ending With Slash Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Build Process URL: When a COPY command has more than two arguments, the last one should end with a slash<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="2" FROM node:carbon2 COPY package.json yarn.lock my_app ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM node:carbon COPY package.json yarn.lock my_app/ ``` ```dockerfile title="Negative test num. 2 - dockerfile file" FROM node:carbon1 COPY package.json yarn.lock ```
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: README.md

This directory offers Kui as a plugin to the . You may use a precompiled binary. Pick one of the following three commands, based on your platform: ```bash ibmcloud plugin install https://github.com/IBM/kui/releases/latest/download/kui-ibmcloud-plugin-darwin-amd64 ibmcloud plugin install https://github.com/IBM/kui/releases/latest/download/kui-ibmcloud-plugin-linux-amd64 ibmcloud plugin install https://github.com/IBM/kui/releases/latest/download/kui-ibmcloud-plugin-windows-amd64 ``` Then, you can use Kui via commands such as `ibmcloud kui kubectl get pods`. After an initial one-time download (of the Kui UI component), you should see a window pop up. For example: ```bash ibmcloud kui kubectl get pods ``` If you wish to develop the plugin, first download and install the Bluemix CLI. See instructions . The plugin is written in , and depends on go 1.12+. To compile the plugin, you may leverage the Makefile: ```bash $ make ``` This should produce a binary `kui-ibmcloud-plugin`. You may then install the plugin: ```bash $ make install ``` To run unit tests: ```bash $ make test ``` If you wish to build for all supported Electron platforms, you may leverage the ```bash $ make build_all ```
Project: Beam (App Definition and Development / Streaming & Messaging)
File: sample.md

title: "Sample" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> {{< localstorage language language-py >}} {{< button-pydoc path="apache_beam.transforms.combiners" class="Sample" >}} Transforms for taking samples of the elements in a collection, or samples of the values associated with each key in a collection of key-value pairs. In the following example, we create a pipeline with a `PCollection`. Then, we get a random sample of elements in different ways. We use `Sample.FixedSizeGlobally()` to get a fixed-size random sample of elements from the entire `PCollection`. {{< playground height="700px" >}} {{< playgroundsnippet language="py" path="SDKPYTHONSampleFixedSizeGlobally" show="samplefixedsizeglobally" >}} {{< /playground >}} We use `Sample.FixedSizePerKey()` to get fixed-size random samples for each unique key in a `PCollection` of key-values. {{< playground height="700px" >}} {{< playgroundsnippet language="py" path="SDKPYTHONSampleFixedSizePerKey" show="samplefixedsizeper_key" >}} {{< /playground >}} finds the largest or smallest element. {{< button-pydoc path="apache_beam.transforms.combiners" class="Sample" >}}
Project: Cadence Workflow (Provisioning / Automation & Configuration)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: '' assignees: '' Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] Proposed Solution A clear and concise description of what you want to happen. Additional context Add any other context or screenshots about the feature request here.
Project: Digital Rebar (Provisioning / Automation & Configuration)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at digitalrebar@googlegroups.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at
Project: Meshery (Provisioning / Automation & Configuration)
File: 1.11.1.md

component: 1.11.1 integrations: consulmesh.meshery consulmesh_definition.json exportedservices.meshery exportedservices.meshery ingressgateway.meshery ingressgateway.meshery mesh.meshery mesh.meshery proxydefaults.meshery proxydefaults.meshery servicedefaults.meshery servicedefaults.meshery serviceintentions.meshery serviceintentions.meshery serviceresolver.meshery serviceresolver.meshery servicerouter.meshery servicerouter.meshery servicesplitter.meshery servicesplitter.meshery terminatinggateway.meshery terminatinggateway.meshery
Project: KICS (Provisioning / Security & Compliance)
File: 38fa11ef-dbcc-4da8-9680-7e1fd855b6fb.md

title: RBAC Roles with Port-Forwarding Permission hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 38fa11ef-dbcc-4da8-9680-7e1fd855b6fb Query name: RBAC Roles with Port-Forwarding Permission Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Roles or ClusterRoles with RBAC permissions to port-forward into pods can open socket-level communication channels to containers. In case of compromise, attackers may abuse this for direct communication that bypasses network security restrictions<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: my-namespace name: allow-port-forward rules: apiGroups: [""] resources: ["pods", "pods/portforward"] verbs: ["get", "list", "create"] apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: allow-port-forward namespace: my-namespace subjects: kind: User name: bob apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: allow-port-forward apiGroup: "" ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: my-namespace name: allow-port-forward-neg rules: apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "create"] apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: allow-port-forward-neg namespace: my-namespace subjects: kind: User name: bob apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: allow-port-forward-neg apiGroup: "" ```
Project: StarRocks (App Definition and Development / Database)
File: day.md

displayed_sidebar: "English" Extracts the day part of a date or datetime expression and returns a value that ranges from 1 to 31. The `date` parameter must be of the DATE or DATETIME type. ```Haskell INT DAY(DATETIME|DATE date) ``` ```Plain Text MySQL > select day('1987-01-31'); +-+ | day('1987-01-31 00:00:00') | +-+ | 31 | +-+ MySQL > select day('1987-01-31 20:10:59'); +-+ | day('1987-01-31 20:10:59') | +-+ | 31 | +-+ ``` DAY, day
Project: Druid (App Definition and Development / Database)
File: google.md

id: google title: "Google Cloud Storage" <!-- ~ Licensed to the Apache Software Foundation (ASF) under one ~ or more contributor license agreements. See the NOTICE file ~ distributed with this work for additional information ~ regarding copyright ownership. The ASF licenses this file ~ to you under the Apache License, Version 2.0 (the ~ "License"); you may not use this file except in compliance ~ with the License. You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, ~ software distributed under the License is distributed on an ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ~ KIND, either express or implied. See the License for the ~ specific language governing permissions and limitations ~ under the License. --> This extension allows you to do 2 things: from files stored in Google Cloud Storage. Write segments to in GCS. To use this Apache Druid extension, `druid-google-extensions` in the extensions load list. To configure connectivity to google cloud, run druid processes with `GOOGLEAPPLICATIONCREDENTIALS=/path/to/serviceaccountkeyfile` in the environment. The is supported by the to read objects directly from Google Cloud Storage. If you use the , you can read data from Google Cloud Storage by specifying the paths in your . Deep storage can be written to Google Cloud Storage either via this extension or the . To configure connectivity to google cloud, run druid processes with `GOOGLEAPPLICATIONCREDENTIALS=/path/to/serviceaccountkeyfile` in the environment. |Property|Description|Possible Values|Default| |--||--|-| |`druid.storage.type`|google||Must be set.| |`druid.google.bucket`||Google Storage bucket name.|Must be set.| |`druid.google.prefix`|A prefix string that will be prepended to the blob names for the segments published to Google deep storage| |""| |`druid.google.maxListingLength`|maximum number of input files matching a given prefix to retrieve at a time| |1024|
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.69.md

layout: release date: 2023-03-30 tag: v0.6.69 Add helm URLs in component level data @Revolyssup (#7418) Fix wrong modelDisplayName/modelName logic at component level(spreadsheet) @Revolyssup (#7414) removed second condition from if statement @vishalvivekm (#7417) Leftover changes in Component generator @Revolyssup (#7408) Updated CONTRIBUTING.md commands @Ambareen09 (#7405) Mesherycontrollerhelper sync @Azanul (#7297) [Batch0] Update Performance+Conformance capabilities @theBeginner86 (#7420) [chore] Send Meshery Version @theBeginner86 (#7412) Add Meshmodel components in spreadsheet while generation @Revolyssup (#7406) bug fixes across meshery docs @sudhanshutech (#7411) Thank you to our contributors for making this release possible: @Ambareen09, @Azanul, @Revolyssup, @leecalcote, @sudhanshutech, @theBeginner86 and @vishalvivekm
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: gloo-api-gateway.md

title: Gloo API Gateway labels: category: servicemesh layer: gateway blogs: https://medium.com/solo-io/5-min-with-gloo-api-gateway-configuration-with-open-policy-agent-53da276a6534 https://docs.solo.io/gloo/latest/security/auth/opa/ Gloo is an open-source Kubernetes-native ingress controller, and next-generation API gateway. OPA can be used to implement authorization policies for those APIs.
Project: ShardingSphere (App Definition and Development / Database)
File: narayana.en.md

+++ title = "Narayana Transaction" weight = 5 +++ Apache ShardingSphere provides XA transactions that integrate with the Narayana implementation. Introducing Maven dependency ```xml <properties> <narayana.version>5.12.7.Final</narayana.version> <jboss-transaction-spi.version>7.6.1.Final</jboss-transaction-spi.version> <jboss-logging.version>3.2.1.Final</jboss-logging.version> </properties> <dependency> <groupId>org.apache.shardingsphere</groupId> <artifactId>shardingsphere-jdbc</artifactId> <version>${shardingsphere.version}</version> </dependency> <!-- This module is required when using XA transactions --> <dependency> <groupId>org.apache.shardingsphere</groupId> <artifactId>shardingsphere-transaction-xa-core</artifactId> <version>${shardingsphere.version}</version> </dependency> <dependency> <groupId>org.apache.shardingsphere</groupId> <artifactId>shardingsphere-transaction-xa-narayana</artifactId> <version>${shardingsphere.version}</version> </dependency> <dependency> <groupId>org.jboss.narayana.jta</groupId> <artifactId>jta</artifactId> <version>${narayana.version}</version> </dependency> <dependency> <groupId>org.jboss.narayana.jts</groupId> <artifactId>narayana-jts-integration</artifactId> <version>${narayana.version}</version> </dependency> <dependency> <groupId>org.jboss</groupId> <artifactId>jboss-transaction-spi</artifactId> <version>${jboss-transaction-spi.version}</version> </dependency> <dependency> <groupId>org.jboss.logging</groupId> <artifactId>jboss-logging</artifactId> <version>${jboss-logging.version}</version> </dependency> ``` Configure Narayana Set the XA transaction type Narayana configuration items can be customized by adding `jbossts-properties.xml` to the project's classpath. See for more details. For the minimum configuration of `jbossts-properties.xml`, ShardingSphere requires that Narayana's `CoreEnvironmentBean.nodeIdentifier` property be defined. If Narayana 's object store is not shared between different Narayana instances, you can set this value to `1`. A possible `jbossts-properties.xml` configuration is as follows, ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd"> <properties> <entry key="CoreEnvironmentBean.nodeIdentifier">1</entry> </properties> ``` In certain cases, you may not want to use XML files, then you need to manually set `CoreEnvironmentBean.nodeIdentifier` in the bootstrap class of your own Java project. You can refer to the following methods to call Narayana Java API. ```java import com.arjuna.ats.arjuna.common.CoreEnvironmentBeanException; import com.arjuna.ats.arjuna.common.arjPropertyManager; public class ExampleUtils { public void initNarayanaInstance() { try { arjPropertyManager.getCoreEnvironmentBean().setNodeIdentifier("1"); } catch (CoreEnvironmentBeanException e) { throw new RuntimeException(e); } } } ``` Yaml: ```yaml transaction: defaultType: XA providerType: Narayana ```
Project: KICS (Provisioning / Security & Compliance)
File: 530e8291-2f22-4bab-b7ea-306f1bc2a308.md

title: SQL Server Predictable Active Directory Account Name hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 530e8291-2f22-4bab-b7ea-306f1bc2a308 Query name: SQL Server Predictable Active Directory Account Name Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: Azure SQL Server must avoid using predictable Active Directory Administrator Account names, like 'Admin', which means the attribute 'ad_user' must be set to a name that is not easy to predict<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="19 13 7" name: create ad sp azureadserviceprincipal: appid: "{{ appid }}" state: present tenant: "{{ tenant_id }}" ad_user: admin name: create ad sp2 azureadserviceprincipal: appid: "{{ appid2 }}" state: present tenant: "{{ tenant_id2 }}" ad_user: "" name: create ad sp3 azureadserviceprincipal: appid: "{{ appid3 }}" state: present tenant: "{{ tenant_id3 }}" ad_user: ``` ```yaml title="Negative test num. 1 - yaml file" name: create ad sp azureadserviceprincipal: appid: '{{ appid }}' state: present tenant: '{{ tenant_id }}' ad_user: unpredictableName ```