cwielenb/CNCF-Dataset huggingface dataset:
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_runtime_config_config_iam_policy.md

+++ title = "googleruntimeconfigconfigiam_policy resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleruntimeconfigconfigiam_policy" identifier = "inspec/resources/gcp/googleruntimeconfigconfigiampolicy.md googleruntimeconfigconfigiampolicy resource" parent = "inspec/resources/gcp" +++ A `googleruntimeconfigconfigiam_policy` is used to test a Google Config IAM Policy resource ```ruby describe googleruntimeconfigconfigiam_policy(project: "project", name: "name") do it { should exist } end googleruntimeconfigconfigiam_policy(project: "project", name: "name").bindings.each do |binding| describe binding do its('role') { should eq 'roles/editor'} its('members') { should include 'user:testuser@example.com'} end end ``` Properties that can be accessed from the `googleruntimeconfigconfigiam_policy` resource: `iambindingroles` : The list of roles that exist on the policy. `bindings` : Associates a list of members to a role. `role` : Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. `members` : Specifies the identities requesting access for a Cloud Platform resource. `audit_configs` : Specifies cloud audit logging configuration for this policy. `service` : Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services. `auditlogconfigs` : The configuration for logging of each type of permission. `log_type` : The log type that this config enables. For example, ADMINREAD, DATAWRITE or DATA_READ `exempted_members` : Specifies the identities that do not cause logging for this type of permission. Ensure the is enabled for the current project.
Project: KICS (Provisioning / Security & Compliance)
File: 94690d79-b3b0-43de-b656-84ebef5753e5.md

title: CloudFront Logging Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 94690d79-b3b0-43de-b656-84ebef5753e5 Query name: CloudFront Logging Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: AWS CloudFront distributions should have logging enabled to collect all viewer requests, which means the attribute 'logging_config' should be defined<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awscloudfrontdistribution" "positive1" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" } ``` ```tf title="Negative test num. 1 - tf file" resource "awscloudfrontdistribution" "negative1" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } } ```
Project: ClickHouse (App Definition and Development / Database)
File: quantiletdigest.md

slug: /en/sql-reference/aggregate-functions/reference/quantiletdigest sidebar_position: 207 Computes an approximate of a numeric data sequence using the algorithm. Memory consumption is `log(n)`, where `n` is a number of values. The result depends on the order of running the query, and is nondeterministic. The performance of the function is lower than performance of or . In terms of the ratio of State size to precision, this function is much better than `quantile`. When using multiple `quantile*` functions with different levels in a query, the internal states are not combined (that is, the query works less efficiently than it could). In this case, use the function. Syntax ``` sql quantileTDigest(level)(expr) ``` Alias: `medianTDigest`. Arguments `level` Level of quantile. Optional parameter. Constant floating-point number from 0 to 1. We recommend using a `level` value in the range of `. `expr` Expression over the column values resulting in numeric , or . Returned value Approximate quantile of the specified level. Type: for numeric data type input. if input values have the `Date` type. if input values have the `DateTime` type. Example Query: ``` sql SELECT quantileTDigest(number) FROM numbers(10) ``` Result: ``` text quantileTDigest(number) 4.5 ``` See Also
Project: Meshery (Provisioning / Automation & Configuration)
File: aperture-agent.md

layout: integration title: Aperture Agent subtitle: Collaborative and visual infrastructure as code for Aperture Agent image: /assets/img/integrations/aperture-agent/icons/color/aperture-agent-color.svg permalink: extensibility/integrations/aperture-agent docURL: https://docs.meshery.io/extensibility/integrations/aperture-agent description: integrations-category: Orchestration & Management integrations-subcategory: Scheduling & Orchestration registrant: Artifact Hub components: name: agent colorIcon: assets/img/integrations/aperture-agent/components/agent/icons/color/agent-color.svg whiteIcon: assets/img/integrations/aperture-agent/components/agent/icons/white/agent-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.110.md

layout: release date: 2023-07-21 tag: v0.6.110 update wasm filter metdata @Abhishek-kumar09 (#8252) [chore] Fix go.sum entry @MUzairS15 (#8243) Update hierarchicalinvwasm_filters.json @MUzairS15 (#8239) remove hardcoded filter name @MUzairS15 (#8236) Bump word-wrap from 1.2.3 to 1.2.4 in /storybook @dependabot (#8230) [Docs] reverting lockfile update @thisiskaransgit (#8237) docs: updated command reference for mesheryctl filter @Yana-Gupta (#8235) Thank you to our contributors for making this release possible: @Abhishek-kumar09, @MUzairS15, @Yana-Gupta, @dependabot, @leecalcote and @thisiskaransgit
Project: KICS (Provisioning / Security & Compliance)
File: 35e2f133-a395-40de-a79d-b260d973d1bd.md

title: Public Storage Account hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 35e2f133-a395-40de-a79d-b260d973d1bd Query name: Public Storage Account Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Storage Account should not be public to grant the principle of least privileges<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9 19" name: configure firewall and virtual networks azurermstorageaccount: resource_group: myResourceGroup name: clh0002 type: Standard_RAGRS network_acls: bypass: AzureServices,Metrics default_action: Deny ip_rules: value: 0.0.0.0/0 action: Allow name: configure firewall and more virtual networks azurermstorageaccount: resource_group: myResourceGroup name: clh0003 type: Standard_RAGRS network_acls: bypass: AzureServices,Metrics default_action: Allow ``` ```yaml title="Negative test num. 1 - yaml file" name: configure firewall and virtual networks azurermstorageaccount: resource_group: myResourceGroup name: clh0002 type: Standard_RAGRS network_acls: bypass: AzureServices,Metrics default_action: Deny ip_rules: value: 1.2.3.4 action: Allow ```
Project: Pinniped (Provisioning / Key Management)
File: GOVERNANCE.md

This document defines the project governance for Pinniped. Pinniped is committed to building an open, inclusive, productive and self-governing open source community focused on building authentication services for Kubernetes clusters. The community is governed by this document which defines how all members should work together to achieve this goal. The Pinniped community abides by this . Users:* Members that engage with the Pinniped community via any medium (Slack, GitHub, mailing lists, etc.). Contributors:* Do regular contributions to the Pinniped project (documentation, code reviews, responding to issues, participating in proposal discussions, contributing code, etc.). Maintainers:* Responsible for the overall health and direction of the project. They are the final reviewers of PRs and responsible for Pinniped releases. New maintainers must be nominated by an existing maintainer and must be elected by a supermajority of existing maintainers. Likewise, maintainers can be removed by a supermajority of the existing maintainers or can resign by notifying one of the maintainers. Note: If a maintainer leaves their employer they are still considered a maintainer of Pinniped, unless they voluntarily resign. Employment is not taken into consideration when determining maintainer eligibility unless the company itself violates our . Ideally, all project decisions are resolved by consensus. If impossible, any maintainer may call a vote. Unless otherwise specified in this document, any vote will be decided by a supermajority of maintainers. A supermajority is defined as two-thirds of members in the group. A supermajority of maintainers is required for certain decisions as outlined in this document. A supermajority vote is equivalent to the number of votes in favor being at least twice the number of votes against. A vote to abstain equals not voting at all. For example, if you have 5 maintainers who all cast non-abstaining votes, then a supermajority vote is at least 4 votes in favor. Voting on decisions can happen on the mailing list, GitHub, Slack, email, or via a voting service, when appropriate. Maintainers can either vote "agree, yes, +1", "disagree, no, -1", or "abstain". A vote passes when supermajority is met. To maintain velocity in Pinniped, the concept of is practiced. Other maintainers may chime in and request additional time for review, but should remain cognizant of blocking progress and abstain from delaying progress unless absolutely needed. The expectation is that blocking progress is accompanied by a guarantee to review and respond to the relevant action in short order. Lazy consensus does not apply to the process of: Removal of maintainers from Pinniped All substantive changes in Governance, including substantive changes to the proposal process, require a supermajority agreement by all maintainers. The proposal process is defined in .
Project: KICS (Provisioning / Security & Compliance)
File: 583053b7-e632-46f0-b989-f81ff8045385.md

title: Invalid Image Tag hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 583053b7-e632-46f0-b989-f81ff8045385 Query name: Invalid Image Tag Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Supply-Chain URL: Image tag must be defined and not be empty or equal to latest.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8 19" apiVersion: v1 kind: Pod metadata: name: private-image-test-3 spec: containers: name: uses-private-image-container image: nginx imagePullPolicy: Always command: [ "echo", "SUCCESS" ] apiVersion: v1 kind: Pod metadata: name: private-image-test-33 spec: containers: name: uses-private-image-container image: nginx:latest imagePullPolicy: Always command: [ "echo", "SUCCESS" ] ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: private-image-test-1 spec: containers: name: uses-private-image image: nginx:1.21 imagePullPolicy: Always command: [ "echo", "SUCCESS" ] ```
Project: YDB (App Definition and Development / Database)
File: auth-access-token.md

{% include %} Below are examples of the code for authentication using a token in different {{ ydb-short-name }} SDKs. {% list tabs %} Go (native) ```go package main import ( "context" "os" "github.com/ydb-platform/ydb-go-sdk/v3" ) func main() { ctx, cancel := context.WithCancel(context.Background()) defer cancel() db, err := ydb.Open(ctx, os.Getenv("YDBCONNECTIONSTRING"), ydb.WithAccessTokenCredentials(os.Getenv("YDB_TOKEN")), ) if err != nil { panic(err) } defer db.Close(ctx) ... } ``` Go (database/sql) {% cut "If you use a connector to create a connection to {{ ydb-short-name }}" %} ```go package main import ( "context" "database/sql" "os" "github.com/ydb-platform/ydb-go-sdk/v3" ) func main() { ctx, cancel := context.WithCancel(context.Background()) defer cancel() nativeDriver, err := ydb.Open(ctx, os.Getenv("YDBCONNECTIONSTRING"), ydb.WithAccessTokenCredentials(os.Getenv("YDB_TOKEN")), ) if err != nil { panic(err) } defer nativeDriver.Close(ctx) connector, err := ydb.Connector(nativeDriver) if err != nil { panic(err) } db := sql.OpenDB(connector) defer db.Close() ... } ``` {% endcut %} {% cut "If you use a connection string" %} ```go package main import ( "context" "database/sql" "os" _ "github.com/ydb-platform/ydb-go-sdk/v3" ) func main() { db, err := sql.Open("ydb", "grpcs://localohost:2135/local?token="+os.Getenv("YDB_TOKEN")) if err != nil { panic(err) } defer db.Close() ... } ``` {% endcut %} Java ```java public void work(String connectionString, String accessToken) { AuthProvider authProvider = new TokenAuthProvider(accessToken); GrpcTransport transport = GrpcTransport.forConnectionString(connectionString) .withAuthProvider(authProvider) .build(); TableClient tableClient = TableClient.newClient(transport).build(); doWork(tableClient); tableClient.close(); transport.close(); } ``` Node.js {% include %} Python {% include %} Python (asyncio) {% include %} C# (.NET) ```C# using Ydb.Sdk; using Ydb.Sdk.Auth; const string endpoint = "grpc://localhost:2136"; const string database = "/local"; const string token = "MYVERYSECURE_TOKEN"; var config = new DriverConfig( endpoint: endpoint, database: database, credentials: new TokenProvider(token) ); await using var driver = await Driver.CreateInitialized(config); ``` PHP ```php <?php use YdbPlatform\Ydb\Ydb; use YdbPlatform\Ydb\Auth\Implement\AccessTokenAuthentication; $config = [ // Database path 'database' => '/local', // Database endpoint 'endpoint' => 'localhost:2136', // Auto discovery (dedicated server only) 'discovery' => false, // IAM config 'iam_config' => [ 'insecure' => true, // 'rootcertfile' => './CA.pem', // Root CA file (uncomment for dedicated server) ], 'credentials' => new AccessTokenAuthentication('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA') ]; $ydb = new Ydb($config); ``` {% endlist %}
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-load.1.md

% podman-load 1 podman\-load - Load image(s) from a tar archive into container storage podman load [options] podman image load [options] podman load loads an image from either an oci-archive or a docker-archive stored on the local machine into container storage. podman load reads from stdin by default or a file if the input option is set. podman load is used for loading from the archive generated by podman save, that includes the image parent layers. To load the archive of container's filesystem created by podman export, use podman import. The local client further supports loading an oci-dir or a docker-dir as created with podman save (1). The quiet option suppresses the progress output when set. Note: `:` is a restricted character and cannot be part of the file name. podman [GLOBAL OPTIONS] podman load [GLOBAL OPTIONS] podman load [OPTIONS] Print usage statement Load the specified input file instead of from stdin. The file can be on the local file system or on a server (e.g., https://server.com/archive.tar). Also supports loading in compressed files. The remote client, including Mac and Windows (excluding WSL2) machines, requires the use of this option. NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of container images. Podman defaults to use `/var/tmp`. Suppress the progress output Create an image from a compressed tar file, without showing progress. ``` $ podman load --quiet -i fedora.tar.gz ``` Create an image from the archive.tar file pulled from a URL, without showing progress. ``` $ podman load -q -i https://server.com/archive.tar ``` Create an image from stdin using bash redirection from a tar file. ``` $ podman load < fedora.tar Getting image source signatures Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 0 B / 4.03 MB [] Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 0 B / 1.48 KB [] Writing manifest to image destination Storing signatures Loaded image: registry.fedoraproject.org/fedora:latest ``` Create an image from stdin using a pipe. ``` $ cat fedora.tar | podman load Getting image source signatures Copying blob sha256:5bef08742407efd622d243692b79ba0055383bbce12900324f75e56f589aedb0 0 B / 4.03 MB [] Copying config sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d624560 0 B / 1.48 KB [] Writing manifest to image destination Storing signatures Loaded image: registry.fedoraproject.org/fedora:latest ``` , July 2017, Originally compiled by Urvashi Mohnani <umohnani@redhat.com>
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.5.21.md

layout: release date: 2021-06-10 tag: v0.5.21 Kumarabd/feature/fix @kumarabd (#3165) Kumarabd/feature/fixes @kumarabd (#3171) Corrected some commands in the mesheryctl installation page @sayantan1413 (#3154) Updated the favicon of Meshery Docs w/signoff @debjani1413 (#3141) recommiting mesheryctl system missing pages @Anita-ihuman (#3142) Created the release for v.0.5.15 @Anita-ihuman (#3160)
Project: ShardingSphere (App Definition and Development / Database)
File: show-load-balance-algorithm-plugins.en.md

+++ title = "SHOW LOAD BALANCE ALGORITHM PLUGINS" weight = 3 +++ The `SHOW LOAD BALANCE ALGORITHM PLUGINS` syntax is used to query all the implementations of the interface `org.apache.shardingsphere.infra.algorithm.loadbalancer.core.LoadBalanceAlgorithm`. {{< tabs >}} {{% tab name="Grammar" %}} ```sql showLoadBalanceAlgorithmPlugins ::= 'SHOW' 'LOAD' 'BALANCE' 'ALGORITHM' 'PLUGINS' ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} | Columns | Description | |--|--| | type | type | | type_aliases | type aliases | | description | description | Query all the implementations for `org.apache.shardingsphere.infra.algorithm.loadbalancer.core.LoadBalanceAlgorithm` interface ```sql SHOW LOAD BALANCE ALGORITHM PLUGINS ``` ```sql SHOW LOAD BALANCE ALGORITHM PLUGINS; +-+--+-+ | type | type_aliases | description | +-+--+-+ | ROUND_ROBIN | | | | RANDOM | | | | WEIGHT | | | +-+--+-+ 3 rows in set (0.03 sec) ``` `SHOW`, `LOAD`, `BALANCE`, `ALGORITHM`, `PLUGINS`
Project: ClickHouse (App Definition and Development / Database)
File: http.md

slug: /en/operations/external-authenticators/http title: "HTTP" import SelfManaged from '@site/docs/en/snippets/selfmanagedonlynoroadmap.md'; <SelfManaged /> HTTP server can be used to authenticate ClickHouse users. HTTP authentication can only be used as an external authenticator for existing users, which are defined in `users.xml` or in local access control paths. Currently, authentication scheme using GET method is supported. To define HTTP authentication server you must add `httpauthenticationservers` section to the `config.xml`. Example ```xml <clickhouse> <!- ... --> <httpauthenticationservers> <basicauthserver> <uri>http://localhost:8000/auth</uri> <connectiontimeoutms>1000</connectiontimeoutms> <receivetimeoutms>1000</receivetimeoutms> <sendtimeoutms>1000</sendtimeoutms> <maxtries>3</maxtries> <retryinitialbackoffms>50</retryinitialbackoffms> <retrymaxbackoffms>1000</retrymaxbackoffms> </basicauthserver> </httpauthenticationservers> </clickhouse> ``` Note, that you can define multiple HTTP servers inside the `httpauthenticationservers` section using distinct names. Parameters `uri` - URI for making authentication request Timeouts in milliseconds on the socket used for communicating with the server: `connectiontimeoutms` - Default: 1000 ms. `receivetimeoutms` - Default: 1000 ms. `sendtimeoutms` - Default: 1000 ms. Retry parameters: `max_tries` - The maximum number of attempts to make an authentication request. Default: 3 `retryinitialbackoff_ms` - The backoff initial interval on retry. Default: 50 ms `retrymaxbackoff_ms` - The maximum backoff interval. Default: 1000 ms In order to enable HTTP authentication for the user, specify `http_authentication` section instead of `password` or similar sections in the user definition. Parameters: `server` - Name of the HTTP authentication server configured in the main `config.xml` file as described previously. `scheme` - HTTP authentication scheme. `Basic` is only supported now. Default: Basic Example (goes into `users.xml`): ```xml <clickhouse> <!- ... --> <my_user> <!- ... --> <http_authentication> <server>basic_server</server> <scheme>basic</scheme> </http_authentication> </testuser2> </clickhouse> ``` :::note Note that HTTP authentication cannot be used alongside with any other authentication mechanism. The presence of any other sections like `password` alongside `http_authentication` will force ClickHouse to shutdown. ::: When is enabled in ClickHouse, users identified by HTTP authentication can also be created using SQL statements. ```sql CREATE USER myuser IDENTIFIED WITH HTTP SERVER 'basicserver' SCHEME 'Basic' ``` ...or, `Basic` is default without explicit scheme definition ```sql CREATE USER myuser IDENTIFIED WITH HTTP SERVER 'basicserver' ``` If a response body from HTTP authentication server has JSON format and contains `settings` sub-object, ClickHouse will try parse its key: value pairs as string values and set them as session settings for authenticated user's current session. If parsing is failed, a response body from server will be ignored.