cwielenb/CNCF-Dataset huggingface dataset:
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_infra.md

title: kbcli infra infra command ``` -h, --help help for infra ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - create kubernetes cluster. - delete kubernetes cluster.
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_debug.md

title: Kubectl-Dba Debug menu: docs_{{ .version }}: identifier: kubectl-dba-debug name: Kubectl-Dba Debug parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Debug any Database issue Collect all the logs and yamls of a specific database in just one command ``` kubectl-dba debug ``` ``` kubectl dba debug mongodb -n demo sample-mongodb --operator-namespace kubedb Valid resource types include: elasticsearch mongodb mariadb mysql postgres redis ``` ``` -h, --help help for debug ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - kubectl plugin for KubeDB - Debug helper for elasticsearch database - Debug helper for mariadb database - Debug helper for mongodb database - Debug helper for mysql database - Debug helper for postgres database - Debug helper for redis database
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: LICENSE.md

Copyright (C) 2014 by Oleku Konko Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_plugin.md

Manage your installed plugins ``` -h, --help help for plugin ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Generate reports on your Kubernetes cluster by running plugins - Install a plugin so that it can be run via just its filename rather than a full path or URL. - List all installed plugins - Print the full definition of the named plugin file - Uninstall a plugin. You can continue to run any plugin via specifying a file or URL.
Project: KICS (Provisioning / Security & Compliance)
File: 41c195f4-fc31-4a5c-8a1b-90605538d49f.md

title: Multiple CMD Instructions Listed hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 41c195f4-fc31-4a5c-8a1b-90605538d49f Query name: Multiple CMD Instructions Listed Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Build Process URL: There can only be one CMD instruction in a Dockerfile. If you list more than one CMD then only the last CMD will take effect<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="11" FROM golang:1.7.3 WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go . RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=0 /go/src/github.com/foo/href-counter/app . CMD ["./app"] CMD ["./apps"] ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM golang:1.7.3 WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go . RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . CMD ["./app"] FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=0 /go/src/github.com/foo/href-counter/app . CMD ["./app"] ``` ```dockerfile title="Negative test num. 2 - dockerfile file" FROM golang:1.16 AS builder WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go ./ RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . CMD ["./app"] CMD ["./apps"] FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=builder /go/src/github.com/foo/href-counter/app ./ CMD ["./app"] RUN useradd -ms /bin/bash patrick USER patrick ```
Project: KICS (Provisioning / Security & Compliance)
File: b03a748a-542d-44f4-bb86-9199ab4fd2d5.md

title: Healthcheck Instruction Missing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b03a748a-542d-44f4-bb86-9199ab4fd2d5 Query name: Healthcheck Instruction Missing Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="1" FROM node:alpine WORKDIR /usr/src/app COPY package*.json ./ RUN npm install COPY . . EXPOSE 3000 CMD ["node","app.js"] ``` ```dockerfile title="Positive test num. 2 - dockerfile file" hl_lines="7" FROM golang:1.16 AS builder WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go ./ RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=builder /go/src/github.com/foo/href-counter/app ./ CMD ["./app"] RUN useradd -ms /bin/bash patrick USER patrick ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM node:alpine WORKDIR /usr/src/app COPY package*.json ./ RUN npm install COPY . . EXPOSE 3000 HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 CMD ["node","app.js"] ``` ```dockerfile title="Negative test num. 2 - dockerfile file" FROM golang:1.16 AS builder WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go ./ RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=builder /go/src/github.com/foo/href-counter/app ./ CMD ["./app"] RUN useradd -ms /bin/bash patrick USER patrick HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 ```
Project: Apache Heron (App Definition and Development / Streaming & Messaging)
File: 2021-05-27-0.20.4-incubating-release.md

title: 0.20.4-incubating Release author: Josh Fischer authorURL: https://www.linkedin.com/in/joshfischer1108/ <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> The Heron community is pleased to announce the release of version 0.20.4-incubating. We are excited as this is the first release the Heron community has distributed a full set of convenience binaries from the released source code while under the Apache Foundation. Heron has had several improvements implemented while in incubation, and the community has learned much along the way. This is a major milestone in the incubation process at the Apache Incubator for Heron. We expect the release of convenience binaries to ease the adoption of Heron in organizations across the world. This goal could not have been achieved without the solid community behind Heron. Here are a few updates since the last release: To download Apache Heron 0.20.4-incubating, click To view the official Heron Docker Image repository click Maven artifacts can be found For more information about Apache Heron 0.20.4-incubating, see and
Project: GraphScope (App Definition and Development / Database)
File: interactive_intro.md

GraphScope Interactive is a specialized construction of GraphScope Flex, designed to handle concurrent graph queries at an . Its primary goal is to process as many queries as possible within a given timeframe, emphasizing a high query throughput rate. Explore GraphScope Interactive with following documents: ```{toctree} arguments caption: maxdepth: 2 interactive/overview interactive/installation interactive/deployment interactive/getting_started interactive/customgraphdata interactive/stored_procedures interactive/configuration interactive/data_model interactive/data_import interactive/dev_guide interactive/glossary interactive/tools ```
Project: openGauss (App Definition and Development / Database)
File: ISSUE_TEMPLATE.en.md

Is this a BUG REPORT or FEATURE REQUEST?: Uncomment only one, leave it on its own line: bug feature What happened: What you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Version: OS (e.g. from /etc/os-release): Kernel (e.g. `uname -a`): Install tools: Others:
Project: Meshery (Provisioning / Automation & Configuration)
File: dragonfly.md

layout: integration title: Dragonfly subtitle: Collaborative and visual infrastructure as code for Dragonfly image: /assets/img/integrations/dragonfly/icons/color/dragonfly-color.svg permalink: extensibility/integrations/dragonfly docURL: https://docs.meshery.io/extensibility/integrations/dragonfly description: integrations-category: Provisioning integrations-subcategory: Container Registry registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: v0.3.7.md

sidebar_label: v0.3.7 backuppolicytemplate improvement (, @dengshaojiang) support postgresql (, @ZhaoDiankui) add postgresql grafana dashboards (, @yimeisun) add postgresql alert rules (, @yimeisun) cli support to connect to postgresql (, @ldming) cli version output correctly when kubernetes cluster does not work (, @ldming) build kbcli with CGO_ENABLED=0 (, @ldming)
Project: KICS (Provisioning / Security & Compliance)
File: 6deb34e2-5d9c-499a-801b-ea6d9eda894f.md

title: User With Privilege Escalation By Actions 'iam:UpdateLoginProfile' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6deb34e2-5d9c-499a-801b-ea6d9eda894f Query name: User With Privilege Escalation By Actions 'iam:UpdateLoginProfile' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: User with privilege escalation by actions 'iam:UpdateLoginProfile' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamuser" "cosmic" { name = "cosmic" } resource "awsiamuserpolicy" "testinline_policy" { name = "testinlinepolicy" user = awsiamuser.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:UpdateLoginProfile", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" users = [awsiamuser.cosmic.name] roles = [awsiamrole.role.name] groups = [awsiamgroup.group.name] } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: KICS (Provisioning / Security & Compliance)
File: 7750fcca-dd03-4d38-b663-4b70289bcfd4.md

title: Small Flow Logs Retention Period hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 7750fcca-dd03-4d38-b663-4b70289bcfd4 Query name: Small Flow Logs Retention Period Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Flow logs enable capturing information about IP traffic flowing in and out of the network security groups. Network Security Group Flow Logs must be enabled with retention period greater than or equal to 90 days. This is important, because these logs are used to check for anomalies and give information of suspected breaches<br> ```tf title="Positive test num. 1 - tf file" hl_lines="43 10 27 23" resource "azurermnetworkwatcherflowlog" "positive1" { networkwatchername = azurermnetworkwatcher.test.name resourcegroupname = azurermresourcegroup.test.name networksecuritygroupid = azurermnetworksecuritygroup.test.id storageaccountid = azurermstorageaccount.test.id enabled = true retention_policy { enabled = true days = 89 } } resource "azurermnetworkwatcherflowlog" "positive2" { networkwatchername = azurermnetworkwatcher.test.name resourcegroupname = azurermresourcegroup.test.name networksecuritygroupid = azurermnetworksecuritygroup.test.id storageaccountid = azurermstorageaccount.test.id enabled = true retention_policy { enabled = true days = 3 } } resource "azurermnetworkwatcherflowlog" "positive3" { networkwatchername = azurermnetworkwatcher.test.name resourcegroupname = azurermresourcegroup.test.name networksecuritygroupid = azurermnetworksecuritygroup.test.id storageaccountid = azurermstorageaccount.test.id enabled = true } resource "azurermnetworkwatcherflowlog" "positive4" { networkwatchername = azurermnetworkwatcher.test.name resourcegroupname = azurermresourcegroup.test.name networksecuritygroupid = azurermnetworksecuritygroup.test.id storageaccountid = azurermstorageaccount.test.id enabled = true retention_policy { enabled = false days = 900 } } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermnetworkwatcherflowlog" "negative1" { networkwatchername = azurermnetworkwatcher.test.name resourcegroupname = azurermresourcegroup.test.name networksecuritygroupid = azurermnetworksecuritygroup.test.id storageaccountid = azurermstorageaccount.test.id enabled = true retention_policy { enabled = true days = 90 } } resource "azurermnetworkwatcherflowlog" "negative2" { networkwatchername = azurermnetworkwatcher.test.name resourcegroupname = azurermresourcegroup.test.name networksecuritygroupid = azurermnetworksecuritygroup.test.id storageaccountid = azurermstorageaccount.test.id enabled = true retention_policy { enabled = true days = 900 } } ```
Project: Cadence Workflow (Provisioning / Automation & Configuration)
File: cassandra-fql.md

Run cadence components via docker compose ``` docker-compose docker/docker-compose.yml up ``` First enable fql via nodetool () ``` docker exec $(docker inspect --format="{{.Id}}" docker-cassandra-1) nodetool enablefullquerylog --path /tmp/cassandra_fql ``` Check `/tmp/cassandra_fql` folder exists ``` docker exec $(docker inspect --format="{{.Id}}" docker-cassandra-1) ls /tmp/cassandra_fql ``` Run some workflows to generate queries (optional) Inspect the full query log dump via fqltool (it's under tools/bin in default apache cassandra installation) ``` docker cp $(docker inspect --format="{{.Id}}" docker-cassandra-1):/tmp/cassandrafql/ /tmp/cassandrafql/ && fqltool dump /tmp/cassandra_fql | less ```
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: feat-11971.en.md

Made `/api/v5/loadrebalance/availabilitycheck` public, i.e. not requiring authentication. This simplifies load balancer setup. Made rebalance/evacuation more graceful during the wait health check phase. The connections to nodes marked for eviction are now not prohibited during this phase. During this phase it is unknown whether these nodes are all marked unhealthy by the load balancer, so prohibiting connections to them may cause multiple unssuccessful attempts to reconnect.
Project: Tetragon (Provisioning / Security & Compliance)
File: DEVELOP.md

The latest `tetragon` Helm chart from the main branch is published as version `9999.9999.9999-dev`. You can use the latest chart as a "standalone" chart for testing. For example, to install the latest Tetragon with the latest `tetragon` Helm chart on minikube: Start minikube. Something like this: minikube start --network-plugin=cni --memory=4096 --driver=virtualbox \ --iso-url=https://github.com/kubernetes/minikube/releases/download/v1.15.0/minikube-v1.15.0.iso minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf Check https://docs.cilium.io/quick-start/connectivity_visibility.html#start-minikube for the up-to-date instructions on how to start minikube. Install `tetragon`, specifying the image tag you are using: helm install -n kube-system tetragon install/kubernetes/tetragon \ --set tetragon.image.tag=latest --set imagePullPolicy=Always Alternatively, if you want to use the local chart to test your change, run: helm install -n kube-system tetragon . \ --set tetragonOperator.image.tag=latest --set imagePullPolicy=Always
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: feat-12201.en.md

Support hot update of TCP/SSL/WS/WSS MQTT listeners configuration, which allows changing most of the configuration parameters without restarting the listener and disconnecting the clients. In case of TCP/SSL listeners, changes to the following parameters still require full listener restart: `bind` `tcp_options.backlog` In case of WS/WSS listeners, any parameter can be freely changed without losing the connected clients. However, changing transport related parameters will cause listening socket to be re-opened, namely: `bind` `tcp_options.` `ssl_options.`
Project: Kyverno (Provisioning / Security & Compliance)
File: kyverno_version.md

Prints the version of Kyverno CLI. Prints the version of Kyverno CLI. For more information visit https://kyverno.io/docs/kyverno-cli/#version ``` kyverno version [flags] ``` ``` kyverno version ``` ``` -h, --help help for version ``` ``` --adddirheader If true, adds the file directory to the header of the log messages --alsologtostderr log to standard error as well as files (no effect when -logtostderr=true) --logbacktraceat traceLocation when logging hits line file:N, emit a stack trace (default :0) --log_dir string If non-empty, write log files in this directory (no effect when -logtostderr=true) --log_file string If non-empty, use this log file (no effect when -logtostderr=true) --logfilemax_size uint Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) --logtostderr log to standard error instead of files (default true) --one_output If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true) --skip_headers If true, avoid header prefixes in the log messages --skiplogheaders If true, avoid headers when opening log files (no effect when -logtostderr=true) --stderrthreshold severity logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2) -v, --v Level number for the log level verbosity --vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging ``` - Kubernetes Native Policy Management.