cwielenb/CNCF-Dataset huggingface dataset:
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.11.6.md

RabbitMQ `3.11.6` is a maintenance release in the `3.11.x` . Please refer to the upgrade section from if upgrading from a version prior to 3.11.0. This release requires Erlang 25. has more details on Erlang version requirements for RabbitMQ. As of 3.11.0, RabbitMQ requires Erlang 25. Nodes will fail to start on older Erlang releases. Erlang 25 as our new baseline means much improved performance on ARM64 architectures, across all architectures, and the most recent TLS 1.3 implementation available to all RabbitMQ 3.11 users. Release notes can be found on GitHub at . Lower per-queue memory footprint. This optimization saves about 1 GiB of memory for every 100K classic queues, so, for 3M MQTT connections the savings would add up to 30 GiB. GitHub issue: It is now possible to configure default operator policies for virtual hosts that match a naming pattern: ``` ini defaultoperatorpolicies.1.vhost_pattern = ^device defaultoperatorpolicies.1.queue_pattern = .* defaultoperatorpolicies.1.maxlengthbytes = 1GB defaultoperatorpolicies.1.max_length = 1000000 ``` Contributed by @illotum (AWS). GitHub issues: , Preserve additional information in the log message when heartbeat frame cannot be sent due to a TCP timeout. GitHub issue: Nodes will no longer considered for stream replica placement. GitHub issue: Feature flag operations logged incorrect module name in some cases. GitHub issue: `rabbitmq-upgrade awaitonlinequorumplusone` will now consider stream replicas in addition to quorum queue replicas. GitHub issue: Listing listeners (including via `rabbitmq-diagnostics status`) could fail with an exception if target node was shutting down. Contributed by @gomoripeti (CloudAMQP). GitHub issue: Support for Identity Provider-initiated Login (IDP). GitHub issues: , , Use a more modern method (browser feature) for definition file downloads. GitHub issue: Perform HTML escaping of a user-provided error parameter used by some UI states. Contributed by @dentarg (CloudAMQP). GitHub issue: `ra` was upgraded To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.11.6.tar.xz` instead of the source tarball produced by GitHub.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_storage_default_object_acl.md

+++ title = "googlestoragedefaultobjectacl resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlestoragedefaultobjectacl" identifier = "inspec/resources/gcp/googlestoragedefaultobjectacl.md googlestoragedefaultobjectacl resource" parent = "inspec/resources/gcp" +++ A `googlestoragedefaultobjectacl` is used to test a Google DefaultObjectACL resource ```ruby describe googlestoragedefaultobjectacl(bucket: 'gcp-inspec-storage-bucket', entity: user-email) do it { should exist } its('role') { should cmp "OWNER" } its('bucket') { should eq 'gcp-inspec-storage-bucket' } its('email') { should include entity-email.com } end describe googlestoragedefaultobjectacl(bucket: 'gcp-inspec-storage-bucket', entity: "allUsers") do it { should_not exist } end ``` describe googlestoragedefaultobjectacl(bucket: 'bucket-buvsjjcndqz', entity: 'user-object-viewer@spaterson-project.iam.gserviceaccount.com') do it { should exist } end describe googlestoragedefaultobjectacl(bucket: 'bucket-buvsjjcndqz', entity: 'user-object-viewer@spaterson-project.iam.gserviceaccount.com') do its('role') { should eq 'OWNER' } end Properties that can be accessed from the `googlestoragedefaultobjectacl` resource: `domain` : The domain associated with the entity. `email` : The email address associated with the entity. `entity` : The entity holding the permission, in one of the following forms: user-{{userId}} user-{{email}} (such as "user-liz@example.com") group-{{groupId}} group-{{email}} (such as "group-example@googlegroups.com") domain-{{domain}} (such as "domain-example.com") project-team-{{projectId}} allUsers allAuthenticatedUsers `entity_id` : The ID for the entity `generation` : The content generation of the object, if applied to an object. `id` : The ID of the access-control entry. `object` : The name of the object, if applied to an object. `project_team` : The project team associated with the entity `project_number` : The project team associated with the entity `team` : The team. Possible values: editors owners viewers `role` : The access permission for the entity. Possible values: OWNER READER Ensure the is enabled for the current project.
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: CHANGELOG-v2020.10.27-rc.0.md

title: Changelog | KubeDB description: Changelog menu: docs_{{.version}}: identifier: changelog-kubedb-v2020.10.27-rc.0 name: Changelog-v2020.10.27-rc.0 parent: welcome weight: 20201027 product_name: kubedb menuname: docs{{.version}} sectionmenuid: welcome url: /docs/{{.version}}/welcome/changelog-v2020.10.27-rc.0/ aliases: /docs/{{.version}}/CHANGELOG-v2020.10.27-rc.0/ Prepare for release v0.1.0-beta.6 (#82) Update MergeServicePort and PatchServicePort apis Prepare for release v0.14.0-beta.6 (#531) Update KubeDB api (#530) Prepare for release v0.14.0-beta.6 (#394) Update MergeServicePort and PatchServicePort apis (#393) Always set protocol for service ports Create SRV records for governing service (#392) Prepare for release v0.14.0-beta.6 (#174) Update KubeDB api (#173) Use kubedb-community release name for community chart Update Kubernetes v1.18.9 dependencies (#172) Update KubeDB api (#171) Prepare for release v0.7.0-beta.6 (#226) Create SRV records for governing service (#225) Prepare for release v0.7.0-beta.6 (#296) Update MergeServicePort and PatchServicePort apis (#295) Create SRV records for governing service (#294) Make database's phase NotReady as soon as the halted is removed (#293) Prepare for release v0.7.0-beta.6 (#286) Create SRV records for governing service (#285) Prepare for release v0.1.0-beta.6 (#74) Update KubeDB api (#73) Prepare for release v0.14.0-beta.6 (#334) Update KubeDB api (#333) Update Kubernetes v1.18.9 dependencies (#332) Prepare for release v0.1.0-beta.6 (#118) Create SRV records for governing service (#117) Update KubeDB api (#37) Prepare for release v0.1.0-beta.6 (#91) Create SRV records for governing service (#90) Prepare for release v0.14.0-beta.6 (#404) Create SRV records for governing service (#402) Prepare for release v0.1.0-beta.6 (#100) Create SRV records for governing service (#99) Prepare for release v0.7.0-beta.6 (#245) Create SRV records for governing service (#244)
Project: Beam (App Definition and Development / Streaming & Messaging)
File: youtube-channel.md

title: 'Beam YouTube channel' <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> The goal of the is have a central repository with all the videos on or related to the Apache Beam project. This can range from very tech-focused talks, to more business- and use case-focused talks; talks delivered at meet ups, conferences or on a webcast. People who have a recording related to Apache Beam can share this on the channel. The process is documented below. The YouTube channel found is owned by the Apache Beam PMC. When recording a session, make sure you have the following: Get a verbal/written agreement of the people talking, allowing you to record and share the session. Get a verbal/written agreement of the premises where you are filming to record and share the session. Get a verbal/written agreement of the person recording the video that you can share the recording afterwards. Check with local laws if any extra agreements need to be in place to allow to record and share the session. When you want to add your recording to the channel, do the following: Send an e-mail to mailing list with: Subject: "[Youtube channel] Add video: your video title". The video or link to the video. The above agreements. The description that you want the video to be accompanied with on YouTube. A brief explanation of the contents. Once at least one committer or PMC members agrees and nobody objects within 1 business day, publish it and close the email thread.
Project: KICS (Provisioning / Security & Compliance)
File: 0afa6ab8-a047-48cf-be07-93a2f8c34cf7.md

title: ALB Is Not Integrated With WAF hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0afa6ab8-a047-48cf-be07-93a2f8c34cf7 Query name: ALB Is Not Integrated With WAF Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: All Application Load Balancers (ALB) must be protected with Web Application Firewall (WAF) service<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "aws_alb" "foo" { internal = false subnets = [awssubnet.foo.id, awssubnet.bar.id] } resource "awswafregionalwebaclassociation" "foo_waf" { resourcearn = awsalb.fooooo.arn webaclid = awswafregionalweb_acl.foo.id } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "aws_lb" "alb" { name = "test-lb-tf" internal = false loadbalancertype = "application" securitygroups = [awssecuritygroup.lbsg.id] subnets = [for subnet in aws_subnet.public : subnet.id] } resource "awswafv2webaclassociation" "albwafassociation" { resourcearn = awslb.alba.arn webaclarn = awswafv2web_acl.example.arn } ``` ```tf title="Negative test num. 1 - tf file" resource "aws_alb" "foo33" { internal = false subnets = [awssubnet.foo.id, awssubnet.bar.id] } resource "awswafregionalwebaclassociation" "foo_waf33" { resourcearn = awsalb.foo33.arn webaclid = awswafregionalweb_acl.foo.id } ``` ```tf title="Negative test num. 2 - tf file" resource "aws_lb" "alb" { name = "test-lb-tf" internal = false loadbalancertype = "application" securitygroups = [awssecuritygroup.lbsg.id] subnets = [for subnet in aws_subnet.public : subnet.id] } resource "awswafv2webaclassociation" "albwafassociation" { resourcearn = awslb.alb.arn webaclarn = awswafv2web_acl.example.arn } ```
Project: ClickHouse (App Definition and Development / Database)
File: quotas.md

slug: /en/operations/system-tables/quotas Contains information about . Columns: `name` () Quota name. `id` () Quota ID. `storage`() Storage of quotas. Possible value: users.xml if a quota configured in the users.xml file, disk if a quota configured by an SQL-query. `keys` (()) Key specifies how the quota should be shared. If two connections use the same quota and key, they share the same amounts of resources. Values: `[]` All users share the same quota. `['user_name']` Connections with the same user name share the same quota. `['ip_address']` Connections from the same IP share the same quota. `, pass a key value in the `--quotakey` parameter, or use the `quotakey` parameter in the client configuration file. When using HTTP interface, use the `X-ClickHouse-Quota` header. `['username', 'clientkey']` Connections with the same `clientkey` share the same quota. If a key isnt provided by a client, the quota is tracked for `username`. `['clientkey', 'ipaddress']` Connections with the same `clientkey` share the same quota. If a key isnt provided by a client, the quota is tracked for `ipaddress`. `durations` (()) Time interval lengths in seconds. `applytoall` () Logical value. It shows which users the quota is applied to. Values: `0` The quota applies to users specify in the `applytolist`. `1` The quota applies to all users except those listed in `applytoexcept`. `applytolist` (()) List of user names/ that the quota should be applied to. `applytoexcept` (()) List of user names/roles that the quota should not apply to.
Project: Meshery (Provisioning / Automation & Configuration)
File: istio-operator.md

layout: integration title: Istio Operator subtitle: The easiest way to get production-grade Istio service mesh up and running image: /assets/img/integrations/istio-operator/icons/color/istio-operator-color.svg permalink: extensibility/integrations/istio-operator docURL: https://docs.meshery.io/extensibility/adapters/istio description: integrations-category: Cloud Native Network integrations-subcategory: Service Mesh registrant: Artifact Hub components: name: istio-control-plane colorIcon: assets/img/integrations/istio-operator/components/istio-control-plane/icons/color/istio-control-plane-color.svg whiteIcon: assets/img/integrations/istio-operator/components/istio-control-plane/icons/white/istio-control-plane-white.svg description: name: peer-istio-control-plane colorIcon: assets/img/integrations/istio-operator/components/peer-istio-control-plane/icons/color/peer-istio-control-plane-color.svg whiteIcon: assets/img/integrations/istio-operator/components/peer-istio-control-plane/icons/white/peer-istio-control-plane-white.svg description: name: istio-mesh colorIcon: assets/img/integrations/istio-operator/components/istio-mesh/icons/color/istio-mesh-color.svg whiteIcon: assets/img/integrations/istio-operator/components/istio-mesh/icons/white/istio-mesh-white.svg description: name: istio-mesh-gateway colorIcon: assets/img/integrations/istio-operator/components/istio-mesh-gateway/icons/color/istio-mesh-gateway-color.svg whiteIcon: assets/img/integrations/istio-operator/components/istio-mesh-gateway/icons/white/istio-mesh-gateway-white.svg description: name: istio-operator colorIcon: assets/img/integrations/istio-operator/components/istio-operator/icons/color/istio-operator-color.svg whiteIcon: assets/img/integrations/istio-operator/components/istio-operator/icons/white/istio-operator-white.svg description: featureList: [ "Enable and enforce mutual TLS between your clusters", "Analyze Istio Destination Rules", "Design Istio Virtual Services" ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Couler (Provisioning / Automation & Configuration)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at terrytangyuan@gmail.com. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq
Project: KICS (Provisioning / Security & Compliance)
File: 63ebcb19-2739-4d3f-aa5c-e8bbb9b85281.md

title: EKS Cluster Encryption Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 63ebcb19-2739-4d3f-aa5c-e8bbb9b85281 Query name: EKS Cluster Encryption Disabled Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: EKS Cluster should be encrypted<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" variable "cluster_name" { default = "example" type = string } resource "awsekscluster" "positive1" { dependson = [awscloudwatchloggroup.example] name = var.cluster_name } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="11" variable "cluster_name" { default = "example" type = string } resource "awsekscluster" "positive2" { dependson = [awscloudwatchloggroup.example] name = var.cluster_name encryption_config { resources = ["s"] provider { key_arn = "test" } } } ``` ```tf title="Negative test num. 1 - tf file" variable "cluster_name" { default = "example" type = string } resource "awsekscluster" "negative1" { dependson = [awscloudwatchloggroup.example] name = var.cluster_name encryption_config { resources = ["secrets"] provider { key_arn = "test" } } } ```
Project: OpenAPI (App Definition and Development / Application Definition & Image Build)
File: SECURITY_CONSIDERATIONS.md

OpenAPI documents use JSON, YAML, and JSON Schema, and therefore share their security considerations: In addition, OpenAPI documents are processed by a wide variety of tooling for numerous different purposes, such as client code generation, documentation generation, server side routing, and API testing. OpenAPI document authors must consider the risks of the scenarios where the OpenAPI document may be used. An OpenAPI document describes the security schemes used to protect the resources it defines. The security schemes available offer varying degrees of protection. Factors such as the sensitivity of the data and the potential impact of a security breach should guide the selection of security schemes for the API resources. Some security schemes, such as basic auth and OAuth Implicit flow, are supported for compatibility with existing APIs. However, their inclusion in OpenAPI does not constitute an endorsement of their use, particularly for highly sensitive data or operations. OpenAPI documents may contain references to external resources that may be dereferenced automatically by consuming tools. External resources may be hosted on different domains that may be untrusted. References in an OpenAPI document, or across OpenAPI documents may cause a cycle. Tooling must detect and handle cycles to prevent resource exhaustion. Certain properties allow the use of Markdown which can contain HTML including script. It is the responsibility of tooling to appropriately sanitize the Markdown.
Project: YDB (App Definition and Development / Database)
File: moving_vdisks.md

Sometimes you may need to free up a block store volume to replace equipment. Or a VDisk may be in active use, affecting the performance of other VDisks running on the same PDisk. In cases like this, VDisks need to be moved. Get a list of VDisk IDs using : ```bash ydb-dstool -e <bs_endpoint> vdisk list --format tsv --columns VDiskId --no-header ``` To move a VDisk from a block store volume, run the following commands on the cluster node: ```bash ydb-dstool -e <bsendpoint> vdisk evict --vdisk-ids VDISKID1 ... VDISK_IDN ydbd admin bs config invoke --proto 'Command { ReassignGroupDisk { GroupId: <Storage group ID> GroupGeneration: <Storage group generation> FailRealmIdx: <FailRealm> FailDomainIdx: <FailDomain> VDiskIdx: <Slot number> } }' ``` `VDISKID1 ... VDISKIDN`: The list of VDisk IDs like `[GroupId:GroupGeneration:FailRealmIdx:FailDomainIdx:VDiskIdx]`. The IDs are separated by a space. `GroupId`: The ID of the storage group. `GroupGeneration`: Storage group generation. `FailRealmIdx`: Fail realm number. `FailDomainIdx`: Fail domain number. `VDiskIdx`: Slot number. If SelfHeal is disabled or fails to move VDisks automatically, you'll have to run this operation manually: Go to and make sure that the VDisk has actually failed. Get the appropriate `: ```bash ydb-dstool -e <bsendpoint> vdisk list | fgrep VDISKID ``` Move the VDisk: ```bash ydb-dstool -e <bs_endpoint> pdisk set --status BROKEN --pdisk-ids "[NodeId:PDiskId]" ``` To enable the VDisk back after reassignment: Go to and make sure that the VDisk is actually operable. Get the appropriate `: ```bash ydb-dstool -e <bs_endpoint> pdisk list ``` Enable the PDisk back: ```bash ydb-dstool -e <bs_endpoint> pdisk set --status ACTIVE --pdisk-ids "[NodeId:PDiskId]" ```
Project: KICS (Provisioning / Security & Compliance)
File: 698ed579-b239-4f8f-a388-baa4bcb13ef8.md

title: Healthcheck Not Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 698ed579-b239-4f8f-a388-baa4bcb13ef8 Query name: Healthcheck Not Set Platform: DockerCompose Severity: <span style="color:#ff7213">Medium</span> Category: Availability URL: Check containers periodically to see if they are running properly.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4" version: '2.1' services: lelele-service: build: ./ image: lelele-service restart: always container_name: lelele network_mode: "host" hostname: localhost ports: 8092:8092 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="14" version: '2.1' services: lelele-service: build: ./ image: lelele-service restart: always container_name: lelele network_mode: "host" hostname: localhost ports: 8092:8092 healthcheck: disable: true ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="14" version: '2.1' services: lelele-service: build: ./ image: lelele-service restart: always container_name: lelele network_mode: "host" hostname: localhost ports: 8092:8092 healthcheck: test: ["NONE"] ``` ```yaml title="Negative test num. 1 - yaml file" version: '3.1' services: lelele-service: build: ./ image: lelele-service restart: always container_name: lelele network_mode: "host" hostname: localhost ports: 8092:8092 healthcheck: test: ["CMD", "curl", "-f", "http://localhost"] interval: 1m30s timeout: 10s retries: 3 start_period: 40s ``` ```yaml title="Negative test num. 2 - yaml file" version: '3.1' services: lelele-service: build: ./ image: lelele-service restart: always container_name: lelele network_mode: "host" hostname: localhost ports: 8092:8092 healthcheck: test: ["CMD", "curl", "-f", "http://localhost"] ```