cwielenb/CNCF-Dataset huggingface dataset:
Project: ClickHouse (App Definition and Development / Database)
File: format.md

slug: /en/sql-reference/statements/select/format sidebar_label: FORMAT ClickHouse supports a wide range of that can be used on query results among other things. There are multiple ways to choose a format for `SELECT` output, one of them is to specify `FORMAT format` at the end of query to get resulting data in any specific format. Specific format might be used either for convenience, integration with other systems or performance gain. If the `FORMAT` clause is omitted, the default format is used, which depends on both the settings and the interface used for accessing the ClickHouse server. For the and the in batch mode, the default format is `TabSeparated`. For the command-line client in interactive mode, the default format is `PrettyCompact` (it produces compact human-readable tables). When using the command-line client, data is always passed over the network in an internal efficient format (`Native`). The client independently interprets the `FORMAT` clause of the query and formats the data itself (thus relieving the network and the server from the extra load).
Project: Chef InSpec (Provisioning / Security & Compliance)
File: postgres_session.md

+++ title = "postgres_session resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "postgres_session" identifier = "inspec/resources/os/postgressession.md postgressession resource" parent = "inspec/resources/os" +++ Use the `postgres_session` Chef InSpec audit resource to test SQL commands run against a PostgreSQL database. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `postgres_session` resource block declares the username and password to use for the session, and then the command to be run: sql = postgres_session('username', 'password', 'host', 'port', 'socketpath') sql.query('sqlquery', ['databasename'])` A full example is: sql = postgres_session('username', 'password', 'host', 'port', 'socketpath') describe sql.query('SELECT * FROM pg_shadow WHERE passwd IS NULL;') do its('output') { should eq '' } end where `its('output') { should eq '' }` compares the results of the query against the expected result in the test `socketpath` is an optional parameter. Use `socketpath` to establish a socket connection with Postgres by specifying one of the Postgres Unix domain socket paths. Only supported on Unix-based platforms. The `output` property tests the results of the query: its('output') { should eq(/^0/) } The following examples show how to use this Chef InSpec audit resource. sql = postgressession('myuser', 'password', '192.168.1.2', 5432) describe sql.query('SELECT * FROM pg_shadow WHERE passwd IS NULL;', ['testdb']) do its('output') { should eq('') } end describe postgressession('myuser', 'password').query('SELECT count (*) FROM pg_language WHERE lanpltrusted = \'f\' AND lanname!=\'internal\' AND lanname!=\'c\';', ['postgres']) do its('output') { should eq '0' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: SuperEdge (Provisioning / Automation & Configuration)
File: edge-health.md

edge-health runs on every edge node by default for accurately determine the actual operation status of edge nodes. It introduces distributed health check for the first time to achieve independent health check for each node group, which allows each node to detect and monitor nodes within the same group and eliminates the false alerts caused by the unstable cloud-to-edge network. healthcheckperiod: detection period (unit is second, and the default value is 10) healthcheckscoreline: The score line to determine the node is normal (the default value is 100) The following parameters are supported in the plugin: timeout: specify the timeout period for a request retrytime: specify the number of retries for probe failure weight: specify the proportion of the detection method to the detection score, the maximum is 1 port: specify the port for detection Two plugins currently supported: Detcet kubelet security authentication port: `--kubeletauthplugin=timeout=5,retrytime=3,weight=1,port=10250` Detcet kubelet non-secure authentication port: `--kubeletplugin=timeout=5,retrytime=3,port=10255,weight=1` communicateperiod: specify the interaction period (in seconds, and the default value is 10) communicatetimetout: specify the timeout period for sending interactive information (unit is seconds, and the default value is 3) communicateretrytime: specify the number of retries when sending interactive information fails (the default value is 1) communicateserverport: the port for receiving and sending interactive information (the default port is 51005) voteperiod: specify the voting period (unit is seconds, and the default value is 10) votetimeout: specify the valid time for voting, invalid voting is longer than this time (unit is second, and the default value is 60) Turn On Label the nodes according to the region with `check-units:<units>`, `<units>` can specify multi node unit name, split by ',' like `check-units: unit1,unit2,unit3`. Create a configmap named `edge-health-config` in the `edge-system` namespace, specify the value of `unit-internal-check` as `true`, you can directly use the following yaml to create ```yaml apiVersion: v1 kind: ConfigMap metadata: name: edge-health-config namespace: edge-system labels: name: edge-health data: unit-internal-check: true check-units: unit1,unit2,unit3 ``` Turn Off Change the value of `unit-internal-check` to `false` or delete the configmap of `edge-health-config` Note: If multiple regions are enabled but the node is not marked with a region label, the node will only detect itself when detecting
Project: KICS (Provisioning / Security & Compliance)
File: b7c9a40c-23e4-4a2d-8d39-a3352f10f288.md

title: API Gateway Method Settings Cache Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b7c9a40c-23e4-4a2d-8d39-a3352f10f288 Query name: API Gateway Method Settings Cache Not Encrypted Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: API Gateway Method Settings Cache should be encrypted<br> ```tf title="Positive test num. 1 - tf file" hl_lines="40 48" resource "awsapigatewayrestapi" "example" { body = jsonencode({ openapi = "3.0.1" info = { title = "example" version = "1.0" } paths = { "/path1" = { get = { x-amazon-apigateway-integration = { httpMethod = "GET" payloadFormatVersion = "1.0" type = "HTTP_PROXY" uri = "https://ip-ranges.amazonaws.com/ip-ranges.json" } } } } }) name = "example" } resource "awsapigateway_stage" "example" { deploymentid = awsapigatewaydeployment.example.id restapiid = awsapigatewayrestapi.example.id stage_name = "example" } resource "awsapigatewaymethodsettings" "path_specific" { restapiid = awsapigatewayrestapi.example.id stagename = awsapigatewaystage.example.stage_name method_path = "path1/GET" settings { metrics_enabled = true logging_level = "INFO" caching_enabled = true cachedataencrypted = false } } resource "awsapigatewaymethodsettings" "pathspecific2" { restapiid = awsapigatewayrestapi.example.id stagename = awsapigatewaystage.example.stage_name method_path = "path1/GET" settings { metrics_enabled = true logging_level = "INFO" caching_enabled = true } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsapigatewayrestapi" "example" { body = jsonencode({ openapi = "3.0.1" info = { title = "example" version = "1.0" } paths = { "/path1" = { get = { x-amazon-apigateway-integration = { httpMethod = "GET" payloadFormatVersion = "1.0" type = "HTTP_PROXY" uri = "https://ip-ranges.amazonaws.com/ip-ranges.json" } } } } }) name = "example" } resource "awsapigateway_stage" "example" { deploymentid = awsapigatewaydeployment.example.id restapiid = awsapigatewayrestapi.example.id stage_name = "example" } resource "awsapigatewaymethodsettings" "path_specific" { restapiid = awsapigatewayrestapi.example.id stagename = awsapigatewaystage.example.stage_name method_path = "path1/GET" settings { metrics_enabled = true logging_level = "INFO" caching_enabled = true cachedataencrypted = true } } resource "awsapigatewaymethodsettings" "pathspecific2" { restapiid = awsapigatewayrestapi.example.id stagename = awsapigatewaystage.example.stage_name method_path = "path1/GET" settings { metrics_enabled = true logging_level = "INFO" } } resource "awsapigatewaymethodsettings" "pathspecific3" { restapiid = awsapigatewayrestapi.example.id stagename = awsapigatewaystage.example.stage_name method_path = "path1/GET" settings { metrics_enabled = true logging_level = "INFO" caching_enabled = false } } ```
Project: KOTS (App Definition and Development / Application Definition & Image Build)
File: yaml_file_errors.md

When the output of a rendered file results in invalid YAML, the resource is not included in base and not deployed. Additionally, the file name and error is included in the kots.io/v1beta1.Installer yaml (see the example below). The error often references a line number in the rendered content which is inaccessible to the user. This proposal attempts to make the rendered output available to the user so that it is easier to debug the issue. Surface the rendered YAML content to the user when unmarshalling fails Attempt to automate fixing any common errors such as unescaped quotes or line breaks Any additional UI work. This will just focus on surfacing information in the release Add a new directory at the root of the file tree `skippedFiles` that will include the raw content of all rendered output for yaml files that failed unmarshalling. An example installation.yaml file: ```yaml apiVersion: kots.io/v1beta1 kind: Installation metadata: name: sentry-enterprise spec: channelName: Stable knownImages: image: docker.io/sentry-enterprise/app:1.0 isPrivate: true releaseNotes: | Release 1.0.3 updateCursor: "3" versionLabel: 1.0.3 yamlErrors: error: 'yaml: line 26: did not find expected key' path: deployment.yaml ``` An example file tree: ``` upstream base overlays v skippedFiles _index.yaml deployment.yaml ``` skippedFiles/\_index.yaml: ```yaml skippedFiles: reason: 'yaml: line 26: did not find expected key' path: deployment.yaml ```
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.102.md

layout: release date: 2023-06-30 tag: v0.6.102 248e8a99d Bump github.com/jinzhu/copier 022734296 Merge branch 'master' into wasm-ui-support 158b76bdb Merge pull request #7942 from meshery/dependabot/go_modules/github.com/jinzhu/copier-0.3.5 5b153a4e8 Merge pull request #7969 from Chadha93/wasm-ui-support a70f20651 Merge pull request #7991 from theBeginner86/theBeginner86/bug/7 f5068134e Merge pull request #7992 from theBeginner86/theBeginner86/bug/8 6eef6d6bf Update ui/components/MesheryFilters/FiltersGrid.js b8a2a0878 [Docs] Release Notes for Meshery 2bbdb197f add filters catalog enum 194da0f55 add missing request to update config in filter 544cc4820 add update btn 92eddf19a download wasm support 6cd5698c8 fix-lint 5a67e788d fixes 8000 c063a2809 lint fix f2ad8d775 rm deploy/undeploy 16f4ddb6b rm deploy/undeploy 1ee096912 rm pass update handler 44b258b28 update 3c0f89f08 update wasm filters ui ff2958443 use config from payload d1a791a0a webrick needed
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: setup-dapr-development-env.md

This document helps you get started developing Dapr. If you find any problems while following this guide, please create a Pull Request to update this document. Install > On Windows, the Dapr build environment depends on Git BASH that comes as a part of . > > Ensure that the Git and Unix tools are part of the `PATH` environment variable, and that the editor experience is integrated with the Windows Terminal. For example, if , you may want to specify: > > ```cmd > choco install git -y --package-parameters="/GitAndUnixToolsOnPath /WindowsTerminal" > ``` Install > For Linux, you'll have to configure docker to run without `sudo` for the dapr build scripts to work. Follow the instructions to . Create your if you don't already have one. Download and install . Install for Go debugging, if desired. Install version 1.55.2. Follow the guide on . For development purposes, you will also want to follow the optional steps to install . Dapr uses `make` for a variety of build and test actions, and needs to be installed as appropriate for your platform: Install the `build-essential` package: ```bash sudo apt-get install build-essential ``` Ensure that build tools are installed: ```sh xcode-select --install ``` When completed, you should see `make` and other command line developer tools in `/usr/bin`. Install MinGW and make with : ```cmd choco install mingw choco install make ```
Project: Apache Storm (App Definition and Development / Streaming & Messaging)
File: windows-users-guide.md

title: Windows Users Guide layout: documentation documentation: true This page guides how to set up environment on Windows for Apache Storm. Starting at 1.0.0, Apache Storm utilizes `symbolic link` to aggregate log directory and resource directory into worker directory. Unfortunately, `creating symbolic link` on Windows needs non-default privilege, so users should configure it manually to make sure Storm processes can create symbolic link on runtime. Depending on the Windows version (i.e. non-professional), setting symbolic links privilege by a security policy is not possible since the tool is not installed. When creating a symbolic link is not possible, the Supervisor process will stop as soon as it tries to start workers since the permission exception is considered a fatal error. Below pages (MS technet) guide how to configure that policy to the account which Storm runs on. One tricky point is, `administrator` group already has this privilege, but it's activated only process is run as `administrator` account. So if your account belongs to `administrator` group (and you don't want to change it), you may want to open `command prompt` with `run as administrator` and execute processes within that console. If you don't want to execute Storm processes directly (not on command prompt), please execute processes with `runas /user:administrator` to run as administrator account. Starting with Windows 10 Creators Update, it will be possible to activate a Developer Mode that supports creating symbolic links without `run as administrator` Alternatively you can disable usage of symbolic links by setting the config `storm.disable.symlinks` to `true` on Nimbus and all of the Supervisor nodes. This will also disable features that require symlinks. Currently this is only downloading dependent blobs, but may change in the future. Some topologies may rely on symbolic links to resources in the current working directory of the worker that are created as a convienence, so it is not a 100% backwards compatible change.
Project: SPIRE (Provisioning / Key Management)
File: SECURITY.md

The project supports security releases for the current minor release series and the previous minor release series, i.e. v1.X and v1.X-1. Example: if the current release series is v1.5, security fixes will be supported for both the v1.4 and v1.5 series. If you've found a vulnerability or a potential vulnerability in SPIRE please let us know at <security@spiffe.io>. We'll send a confirmation email to acknowledge your report, and we'll send an additional email when we've identified the issue positively or negatively.
Project: Pinniped (Provisioning / Key Management)
File: configure-supervisor-with-activedirectory.md

title: Configure the Pinniped Supervisor to use Microsoft Active Directory as an ActiveDirectoryIdentityProvider description: Set up the Pinniped Supervisor to use Microsoft Active Directory cascade: layout: docs menu: docs: name: With Active Directory weight: 150 parent: howto-configure-supervisor aliases: /docs/howto/configure-supervisor-with-activedirectory/ The Supervisor is an issuer that supports connecting "upstream" identity providers to many "downstream" cluster clients. This guide shows you how to configure the Supervisor so that users can authenticate to their Kubernetes cluster using their identity from Active Directory. This how-to guide assumes that you have already with working ingress, and that you have . Create an in the same namespace as the Supervisor. This ActiveDirectoryIdentityProvider uses all the default configuration options. The default configuration options are documented in the . ```yaml apiVersion: idp.supervisor.pinniped.dev/v1alpha1 kind: ActiveDirectoryIdentityProvider metadata: name: my-active-directory-idp namespace: pinniped-supervisor spec: host: "activedirectory.example.com:636" bind: secretName: "active-directory-bind-account" apiVersion: v1 kind: Secret metadata: name: active-directory-bind-account namespace: pinniped-supervisor type: kubernetes.io/basic-auth stringData: username: "CN=Bind User,OU=Users,DC=activedirectory,DC=example,dc=com" password: "YOUR_PASSWORD" ``` Note that the `metadata.name` of the ActiveDirectoryIdentityProvider resource may be visible to end users at login prompts, so choose a name which will be understood by your end users. For example, if you work at Acme Corp, choose something like `acme-corporate-active-directory` over `my-idp`. If you've saved this into a file `activedirectory.yaml`, then install it into your cluster using: ```sh kubectl apply -f activedirectory.yaml ``` Once your ActiveDirectoryIdentityProvider has been created, you can validate your configuration by running: ```sh kubectl describe ActiveDirectoryIdentityProvider -n pinniped-supervisor my-active-directory-idp ``` Look at the `status` field. If it was configured correctly, you should see `phase: Ready`. You can also override the default `userSearch` and `groupSearch` options with other values. ```yaml apiVersion: idp.supervisor.pinniped.dev/v1alpha1 kind: ActiveDirectoryIdentityProvider metadata: name: my-active-directory-idp namespace: pinniped-supervisor spec: host: "activedirectory.example.com:636" userSearch: base: "OU=my-department,OU=Users,DC=activedirectory,DC=example,DC=com" filter: "&(objectClass=person)(userPrincipalName={})" attributes: username: "mail" uid: "objectGUID" groupSearch: base: "ou=Groups,DC=activedirectory,DC=example,DC=com" filter: "&(objectClass=group)(member={})" userAttributeForFilter: "dn" attributes: groupName: "dn" bind: secretName: "active-directory-bind-account" ``` More information about the defaults for these configuration options can be found in the . Next, ! Then you'll be able to log into those clusters as your users from Active Directory.
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: service-account.eg.md

```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: vela-doc namespace: vela-system spec: components: name: frontend type: webservice properties: image: oamdev/vela-cli:v1.5.0-beta.1 cmd: ["/bin/vela","show"] ports: port: 18081 expose: true traits: type: service-account properties: name: kubevela-vela-core ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_kms_key_ring_iam_bindings.md

+++ title = "googlekmskeyringiam_bindings resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlekmskeyringiam_bindings" identifier = "inspec/resources/gcp/googlekmskeyringiambindings.md googlekmskeyringiambindings resource" parent = "inspec/resources/gcp" +++ This resource is deprecated. Please use `google_kms_key_ring_iam_policy` instead Use the `googlekmskeyringiam_bindings` InSpec audit resource to test properties of all, or a filtered group of, GCP KMS key ring IAM bindings. A `googlekmskeyringiam_bindings` resource block collects GCP KMS key ring IAM bindings then tests that group. describe googlekmskeyringiambindings(keyring_url: 'projects/project/locations/europe-west2/keyRings/key-ring') do it { should exist } end Use this InSpec resource to enumerate roles then test in-depth using `googlekmskeyringiam_binding`. googlekmskeyringiambindings(keyringurl: 'projects/project/locations/europe-west2/keyRings/key-ring').iambindingroles.each do |iambinding_role| describe googlekmskeyringiambinding(keyring_url: 'projects/project/locations/europe-west2/keyRings/key-ring', role: "roles/owner") do it { should exist } its('members') {should include 'user:someuser@domain.com' } end end The following examples show how to use this InSpec audit resource. describe googlekmskeyringiambindings(keyring_url: 'projects/project/locations/europe-west2/keyRings/key-ring') do its('count') { should be <= 100} end describe googlekmskeyringiambindings(keyring_url: 'projects/project/locations/europe-west2/keyRings/key-ring') do its('iambindingroles') { should include "roles/storage.admin" } end describe googlekmskeyringiambindings(keyringurl: 'projects/project/locations/europe-west2/keyRings/key-ring').where(iambinding_role: "roles/iam.securityReviewer") do it { should_not exist } end This resource supports the following filter criteria: `iambindingrole`. This may be used with `where`, as a block or as a method. `iambindingroles` - an array of googlekmskeyringiam_binding role strings e.g. `["roles/compute.admin", "roles/owner"]` Ensure the is enabled for the project where the resource is located.s
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: discord.md

Our official community meeting space is the Lagoon . Were starting this community as a place for all Lagoon users to collaborate, solve problems, share ideas, and contribute back to the Lagoon project. Were working to consolidate our community as its currently spread out over Slack and various other places. We also wanted to invite all of our users and customers to join so that everyone can benefit from the community, no matter how theyre using Lagoon. Please remember that this is not to replace your current support channels - those will remain the same. This is a place to connect with other users as well as the Lagoon maintainers. We ask that all community members review our and Guidelines, as well as the . Our Community hours are currently on hold as we survey the community to better determine the community's needs. . If you need a hand with Lagoon, please reach out on or shoot us an email at .
Project: YugabyteDB (App Definition and Development / Database)
File: yba_provider_onprem_describe.md

Describe an On-premises YugabyteDB Anywhere provider Describe an On-premises provider in YugabyteDB Anywhere ``` yba provider onprem describe [flags] ``` ``` -h, --help help for describe ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -n, --name string [Optional] The name of the provider for the action. Required for create, delete, describe, instance-types and nodes. -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Manage a YugabyteDB Anywhere on-premises provider
Project: Cloud Custodian (Provisioning / Automation & Configuration)
File: ROADMAP.md

The roadmap for Cloud Custodian is maintained at the org level at this board: Custodian is an Open Source project primarily run on volunteer time, as such the Roadmap is aspirational and purposely not milestoned or guaranteed to be implemented within a certain amount of time. We welcome contributions to these items, and also welcome community feedback as to what kind of features/fixes and priority of these features users would like to see. If you want to help out check the , file issues and dive in!