cwielenb/CNCF-Dataset huggingface dataset:
Project: YugabyteDB (App Definition and Development / Database)
File: default-ports.md

title: Default ports reference headerTitle: Default ports linkTitle: Default ports description: Default ports for YugabyteDB including client APIs, RPC communication, and monitoring. menu: v2.18: identifier: default-ports parent: configuration weight: 2740 type: docs Application clients connect to the following addresses: | API | Port | Server | Flag (default) | | - | -- | - || | YSQL | 5433 | YB-TServer | | | YCQL | 9042 | YB-TServer | | | YEDIS | 6379 | YB-TServer | | Internode (server-to-server or node-to-node) communication, including xCluster, is managed using RPC calls on the following addresses: | Server | Port | Flag (default) | | - | - | | | YB-Master | 7100 | | | YB-TServer | 9100 | <br/><br/> | To enable login to the machines running these servers, the SSH port 22 should be opened. xCluster uses the YB-Master port 7100 for the initial communication, and then uses the YB-TServer port 9100 to get data changes. Note that YugabyteDB Anywhere obtains the replication lag information using Prometheus metrics from YB-TServer at port 9000. If this port is closed, the xCluster replication is not affected, but YugabyteDB Anywhere would not be able to display the replication lag. Before installing YugabyteDB or YugabyteDB Anywhere, or upgrading the YugabyteDB software on YugabyteDB Anywhere, the following ports must be open on all YugabyteDB nodes, and be reachable from YugabyteDB Anywhere nodes: | Service | Port | | - | -- | | YB Controller | 18018 | | | 9070 | Admin web server UI can be viewed at the following addresses: | Server | Port | Flag (default) | | - | -- | | | YB-Master | 7000 | <br> | | YB-TServer | 9000 | <br> | The following common ports are required for firewall rules: | Service | Port | - | - | | SSH | 22 | | HTTP for YugabyteDB Anywhere | 80 | | HTTP for YugabyteDB Anywhere (alternate) | 8080 | | HTTPS for YugabyteDB Anywhere | 443 | | HTTP for Replicated | 8800 | | SSH | 54422 | 54422 is a custom SSH port for universe nodes. YugabyteDB servers expose time series performance metrics in the on multiple HTTP endpoints that have the following structure: ```output <target>/prometheus-metrics ``` You can access the Prometheus server on port `9090` of the YugabyteDB Anywhere node, and you can see the list of targets at the `http://<yugaware-ip>:9090/targets`. In particular, note port `9300` for node-level metrics: | Service | Port | | | - | | Node metrics | 9300 | Use the following targets to monitor YB-TServer and YB-Master server metrics: | Server | Target | | - | | | YB-Master | `<yb-master-address>:7000` | | YB-TServer | `<yb-tserver-address>:9000` | Use the following YB-TServer targets for the various API metrics: | API | Target | - | - | | YSQL | `<yb-tserver-address>:13000` | | YCQL | `<yb-tserver-address>:12000` | | YEDIS | `<yb-tserver-address>:11000` | For information on using Prometheus with YugabyteDB, see .
Project: secureCodeBox (Provisioning / Security & Compliance)
File: parse-definition.md

title: "ParseDefinition" sidebar_position: 5 ParseDefinitions are Custom Resource Definitions (CRD's) used to describe to the secureCodeBox how it can convert a raw finding report (e.g. XML report from nmap) into the generic . ParseDefinitions are generally packaged together with a . A scanType will reference the name of a ParseDefinition via the . `image` is the reference to the parser container image which can transform the raw scan report into findings. To see how to write parsers and package them into images, check out the . `imagePullSecrets` can be used to integrate private parser images. This uses the kubernetes default . `ttlSecondsAfterFinished` can be used to automatically delete the completed Kubernetes job used to run the parser. This sets the `ttlSecondsAfterFinished` field on the created job. This requires your cluster to have the feature gate enabled in your cluster. `scopeLimiterAliases` can be used in combination with `scopeLimiter` to create aliases for fields in findings. The goal of this field is to ensure that the `scopeSelector` can always select an alias, regardless of the underlying representation of the data in a finding. This field supports Mustache templating and has access to the finding object. See the for more information. and can be used to control which nodes the parser is executed on. The values should be set via Helm values (during install) or by specifying `affinity` and/or `tolerations` in the `Scan` specification. `resources` lets you overwrite the resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ```yaml resources: requests: cpu: 42mi memory: 256Mi limits: cpu: 4 memory: 4Gi ``` If no resources are set the following defaults are applied: ```yaml resources: requests: cpu: 200m memory: 100Mi limits: cpu: 400m memory: 200Mi ``` When you only want to set either requests or limits, you will have to set the other one explicitly to null to avoid the defaulting applied via the Kubernetes API, e.g. to disable the resource limits: ```yaml resources: requests: cpu: 200m memory: 100Mi limits: null ``` ```yaml apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition metadata: name: zap-json spec: image: docker.io/securecodebox/parser-zap imagePullSecrets: name: dockerhub-token ttlSecondsAfterFinished: 60 scopeLimiterAliases: domain: "{{attributes.host}}" resources: requests: cpu: 42mi memory: 256Mi limits: cpu: 4 memory: 4Gi ``` The Parse definition is different when integrating a new scanner. We use specific conventions when adding new ParseDefinitions to the secureCodeBox repository. More information can be found on the
Project: Dragonfly (Provisioning / Container Registry)
File: dfcache.md

% DFCACHE(1) Version v2.1.0 | Frivolous "Dfcache" Documentation dfcache the P2P cache client of dragonfly dfcache is the cache client to of dragonfly that communicates with dfdaemon and operates on files in P2P network, where the P2P network acts as a cache system. The difference between dfcache and dfget is that, dfget downloads file from a given URL, the file might be on other peers in P2P network or a seed peer, it's the P2P network's responsibility to download file from source; but dfcache could only export or download a file that has been imported or added into P2P network by other peer, it's the user's responsibility to go back to source and add file into P2P network. ``` -i, --cid string content or cache ID, e.g. sha256 digest of the content --config string the path of configuration file with yaml extension name, default is /etc/dragonfly/dfcache.yaml, it can also be set by env var: DFCACHE_CONFIG --console whether logger output records to the stdout -h, --help help for dfcache --jaeger string jaeger endpoint url, like: http://localhost:14250/api/traces --logdir string Dfcache log directory --pprof-port int listen port for pprof, 0 represents random port (default -1) --service-name string name of the service for tracer (default "dragonfly-dfcache") -t, --tag string different tags for the same cid will be recognized as different files in P2P network --timeout duration Timeout for this cache operation, 0 is infinite --verbose whether logger use debug level --workhome string Dfcache working directory ``` - generate the autocompletion script for the specified shell - delete file from P2P cache system - generate documents - export file from P2P cache system - import file into P2P cache system - show plugin - stat checks if a file exists in P2P cache system - show version See GitHub Issues: <https://github.com/dragonflyoss/Dragonfly2/issues>
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: fairwinds-insights.md

title: Fairwinds Insights Configuration Validation Software labels: category: kubernetes layer: cicd inventors: fairwinds software: kubernetes docker helm tutorials: https://insights.docs.fairwinds.com/features/policy/ https://insights.docs.fairwinds.com/reports/opa/ https://insights.docs.fairwinds.com/features/admission-controller/ https://insights.docs.fairwinds.com/features/continuous-integration/ videos: https://youtu.be/kmvPYjx1bpU https://youtu.be/gxE_Tkj6d40 blogs: https://www.fairwinds.com/blog/managing-opa-policies-with-fairwinds-insights https://www.fairwinds.com/blog/manage-open-policy-agent-opa-consistently https://www.fairwinds.com/blog/kubernetes-multi-cluster-visibility-why-how-to-get-it https://www.fairwinds.com/blog/what-is-kubernetes-policy-as-code https://www.fairwinds.com/blog/why-kubernetes-policy-enforcement https://www.fairwinds.com/blog/an-interview-with-flatfile-on-why-fairwinds-insights-kubernetes-configuration-validation docs_features: kubernetes: note: | Implements auditing and admission checking of Kubernetes resources using Rego policy using . allowmissingimage: true Automate, monitor and enforce OPA policies with visibility across multiple clusters and multiple teams. It ensures the same policies are applied across all your clusters and gives some flexibility if you want certain policies to apply to only certain workloads. Run the same policies in CI/CD, Admission Control, and In-cluster scanning to apply policy consistently throughout the development and deployment process.
Project: KusionStack (Provisioning / Automation & Configuration)
File: kusion.md

Kusion is the Platform Orchestrator of Internal Developer Platform As a Platform Orchestrator, Kusion delivers user intentions to Kubernetes, Clouds and On-Premise resources. Also enables asynchronous cooperation between the development and the platform team and drives separation of concerns. Find more information at: https://www.kusionstack.io/docs/user_docs/reference/cli/kusion/ ``` kusion [flags] ``` ``` -h, --help help for kusion --profile string Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex) (default "none") --profile-output string Name of the file to write the profile to (default "profile.pprof") ``` - Apply the operational intent of various resources to multiple runtimes - Build Kusion modules in a Stack to the Intent - Deprecated: Use 'kusion build' to generate the Intent instead - Show KCL file dependency information - Destroy resources within the stack. - Initialize the scaffolding for a project - Preview a series of resource changes within the stack - Print the Kusion version information for the current context - Workspace is a logical concept representing a target that stacks will be deployed to
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.7.19.md

RabbitMQ `3.7.19` is a maintenance release that focuses on bug fixes. RabbitMQ `3.7.x` series is supported . Per the new Erlang version support policy in effect starting with January 2019, this release . Make sure a is used before upgrading. explains what package repositories and tools can be used to provision latest patch versions of Erlang `21.3.x` and `22.x`. When upgrading to this release and upgrading Erlang to 21.x or later at the same time, extra care has to be taken. Since CLI tools from RabbitMQ releases older than 3.7.7 will fail on Erlang 21 or later, RabbitMQ must be upgraded before Erlang. See upgrade and compatibility notes first if upgrading from an earlier release. See the for general documentation on upgrades and for release notes of other releases. Any questions about this release, upgrades or RabbitMQ in general are welcome on the . `rabbitdiagnostics:binaryrefs/1`, a predecessor to Recon used for binary heap inspection, could fail with an exception due to a race condition. Contributed by John Eckersberg (@jeckersb). GitHub issue: It was not possible to set `ERLMAXPORTS` in `rabbitmq-env-conf.bat`. GitHub issue: Import of large definition files submitted via management UI form could fail. GitHub issue: `rabbitmq-diagnostics nodehealthcheck` would pass even when some cluster nodes had network partitions in effect. Contributed by Lajos Gerecs (@luos). GitHub issue: `rabbitmqctl set_parameter` output could be misleading. Contributed by @Whitespirit0. GitHub issue: Cleanup of a subscription after a server-initiated failed with an exception. GitHub issue: Events could fail to be emitted in multi-node clusters. GitHub issue: The plugin was not updated to correctly fetch a list of TCP and TLS listeners used by the management plugin. GitHub issue: Warning: The source code archive provided by GitHub only contains the source of the broker, not the plugins or the client libraries. Please download the archive named `rabbitmq-server-3.7.19.tar.xz`.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_iam_organization_custom_role.md

+++ title = "googleiamorganizationcustomrole resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleiamorganizationcustomrole" identifier = "inspec/resources/gcp/googleiamorganizationcustomrole.md googleiamorganizationcustomrole resource" parent = "inspec/resources/gcp" +++ A `googleiamorganizationcustomrole` is used to test a Google OrganizationCustomRole resource ```ruby describe googleiamorganizationcustomrole(org_id: '12345', name: 'org-role') do it { should exist } its('stage') { should eq 'GA' } its('included_permissions') { should eq ["iam.roles.list"] } end describe googleiamorganizationcustomrole(org_id: '12345', name: 'org-role', name: 'nonexistent') do it { should_not exist } end ``` Properties that can be accessed from the `googleiamorganizationcustomrole` resource: `name` : The name of the role. `title` : A human-readable title for the role. Typically this is limited to 100 UTF-8 bytes. `description` : Human-readable description for the role `included_permissions` : Names of permissions this role grants when bound in an IAM policy. `stage` : The current launch stage of the role. Possible values: ALPHA BETA GA DEPRECATED DISABLED EAP `deleted` : The current deleted state of the role Ensure the is enabled for the current project.
Project: Druid (App Definition and Development / Database)
File: limitspec.md

id: limitspec title: "Sorting and limiting (groupBy)" <!-- ~ Licensed to the Apache Software Foundation (ASF) under one ~ or more contributor license agreements. See the NOTICE file ~ distributed with this work for additional information ~ regarding copyright ownership. The ASF licenses this file ~ to you under the Apache License, Version 2.0 (the ~ "License"); you may not use this file except in compliance ~ with the License. You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, ~ software distributed under the License is distributed on an ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ~ KIND, either express or implied. See the License for the ~ specific language governing permissions and limitations ~ under the License. --> :::info Apache Druid supports two query languages: and . This document describes the native language. For information about sorting in SQL, refer to the . ::: The limitSpec field provides the functionality to sort and limit the set of results from a groupBy query. If you group by a single dimension and are ordering by a single metric, we highly recommend using instead. The performance will be substantially better. Available options are: The default limit spec takes a limit and the list of columns to do an orderBy operation over. The grammar is: ```json { "type" : "default", "limit" : <optional integer>, "offset" : <optional integer>, "columns" : [<optional list of OrderByColumnSpec>], } ``` The "limit" parameter is the maximum number of rows to return. The "offset" parameter tells Druid to skip this many rows when returning results. If both "limit" and "offset" are provided, then "offset" will be applied first, followed by "limit". For example, a spec with limit 100 and offset 10 will return 100 rows starting from row number 10. Internally, the query is executed by extending the limit by the offset and then discarding a number of rows equal to the offset. This means that raising the offset will increase resource usage by an amount similar to increasing the limit. Together, "limit" and "offset" can be used to implement pagination. However, note that if the underlying datasource is modified in between page fetches in ways that affect overall query results, then the different pages will not necessarily align with each other. OrderByColumnSpecs indicate how to do order by operations. Each order-by condition can be a `jsonString` or a map of the following form: ```json { "dimension" : "<Any dimension or metric name>", "direction" : <"ascending"|"descending">, "dimensionOrder" : <"lexicographic"(default)|"alphanumeric"|"strlen"|"numeric"> } ``` If only the dimension is provided (as a JSON string), the default order-by is ascending with lexicographic sorting. See for more information on the sorting orders specified by "dimensionOrder".
Project: KICS (Provisioning / Security & Compliance)
File: babdedcf-d859-43da-9a7b-6d72e661a8fd.md

title: IAM Role Allows All Principals To Assume hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: babdedcf-d859-43da-9a7b-6d72e661a8fd Query name: IAM Role Allows All Principals To Assume Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: IAM role allows all services or principals to assume it<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17 4" name: Create IAM Managed Policy community.aws.iammanagedpolicy: policy_name: "ManagedPolicy" policy: Version: "2012-10-17" Statement: Effect: "Allow" Action: "logs:CreateLogGroup" Resource: "*" Principal: AWS: "arn:aws:iam::root" make_default: false state: present name: Create2 IAM Managed Policy community.aws.iammanagedpolicy: policy_name: "ManagedPolicy2" policy: > { "Version": "2012-10-17", "Statement":[{ "Effect": "Allow", "Action": "logs:PutRetentionPolicy", "Resource": "*", "Principal" : { "AWS" : "arn:aws:iam::root" } }] } only_version: true state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: Create IAM Managed Policy community.aws.iammanagedpolicy: policy_name: ManagedPolicy policy: Version: '2012-10-17' Statement: Effect: Allow Action: logs:CreateLogGroup Resource: '*' make_default: false state: present ```
Project: Goldilocks (Provisioning / Security & Compliance)
File: DESIGN.md

Owner: @sudermanjr Only other main contributor: @davekonopka The intent of goldilocks is to utilize an already somewhat-stable resource recommendation engine and aggregate the results into a nice dashboard. The goal is to allow end-users to easily see a sane recommendation for how to set their resource requests and limits on their containers. is the core of the project. It will be utilized to provide the resource recommendations. Controller - manage the creation and deletion of VPA objects in specified namespaces. Dashboard - Aggregate and display the results CLI - Manually manage VPA creation, deletion, and provide a JSON summary. Aggregating resource recommednations from existing sources. Writing our own recommendation engine. Right now, goldilocks labels all VPA objects that are created with two unique labels. These are used to keep track of the objects that it creates. In addition, namespace labels are utilized. The label `goldilocks.fairwinds.com/enabled=true` is used to signify that the deployments in a namespace should be given VPAs. The controller watches Kubernetes events for Deployments and Namespaces that have been modified, created, or deleted. When one of these is changed, the namespace that is involved is "reconciled". This means checking to see if the namespace is labelled for goldilocks usage and then making sure there is a VPA object for every deployment in that namespace. All VPA objects are set in recommendation mode only. The cli has three main features: It can create VPA objects in a namespace for each deployment in that namespace. It can delete all the VPA objects that it created in a namespace. It can provide a JSON summary of all the existing resource limits/requests, all the VPA recommendations, and a list of the namespaces in which there are VPAs owned by goldilocks. This summary package is reused by the dashboard. In the future, this can be used to send the data somewhere else if desired. The dashboard is an HTML/CSS/JS webpage that utilizes go templating to present the data generated by the summary. This package looks for all VPA objects in the cluster that are owned by goldilocks and summarizes them, along with adding information about the existing deployment such as resource requests and limits. There are other resource-tuning efforts out there. None of them are as simple, free, or easy to use. - Requires prometheus and a bunch of other stuff (vpa has optional prometheus). Not open source entirely. - Resource tuning is not their main focus. Also not free. Vertical pod autoscaler recommendations are not perfect. This could lead to some uncertainty as to the validity of the recommendations.
Project: Fluvio (App Definition and Development / Streaming & Messaging)
File: CONTRIBUTING.md

Thank you for contributing. No matter how large or small, contributions are always welcome. Before contributing, please read Familiarity with Currently, flv-kf-protocol supports the following platforms: macOS X Linux Please open an Issue on GitHub with the label `question`. To report a bug, open an issue on GitHub with the label `bug`. Please ensure the issue has not already been reported. To suggest an enhancement, please create an issue on GitHub with the label `enhancement`. Fork the `fluvio-protocol` repository to your GitHub Account. Create a branch, submit a PR when your changes are tested and ready for review If youd like to implement a new feature, please consider creating a `feature request` issue first to start a discussion about the feature. This project is licensed under the . Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in Fluvio by you, shall be licensed as Apache, without any additional terms or conditions.
Project: Druid (App Definition and Development / Database)
File: backport.md

<!-- ~ Licensed to the Apache Software Foundation (ASF) under one ~ or more contributor license agreements. See the NOTICE file ~ distributed with this work for additional information ~ regarding copyright ownership. The ASF licenses this file ~ to you under the Apache License, Version 2.0 (the ~ "License"); you may not use this file except in compliance ~ with the License. You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, ~ software distributed under the License is distributed on an ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ~ KIND, either express or implied. See the License for the ~ specific language governing permissions and limitations ~ under the License. --> This document contains some examples of how to backport a change from master to another branch. This is not meant to be an exhaustive list of how to backport a change. This is a CLI tool that automates the backport process for you once a change is in master. To setup, follow the instructions in the A `.backportrc.json` file is maintained in the root of this repository to keep track of the branches that can be backported to. ]
Project: Athenz (Provisioning / Key Management)
File: acceptance-test.md

<a id="markdown-acceptance-test" name="acceptance-test"></a> <!-- TOC --> - - <!-- /TOC --> <a id="markdown-prerequisites" name="prerequisites"></a> Env. setup done. () Bootstrap setup done. () ZMS is running. () ZTS is running. () All the setup commands below are expected to run inside container. ```bash docker run --rm -it \ --network="${DOCKER_NETWORK}" \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh ``` <a id="markdown-test" name="test"></a> ```bash sh /athenz/docker/deploy-scripts/acceptance-test.sh ``` <a id="markdown-expected-output-castcast" name="expected-output-castcast"></a> ](https://asciinema.org/a/330038)