cwielenb/CNCF-Dataset huggingface dataset:
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: v1.22.0.md

id: v1.22.0 title: v1.22.0 description: Backstage Release v1.22.0 These are the release notes for the v1.22.0 release of . A huge thanks to the whole team of maintainers and contributors as well as the amazing Backstage Community for the hard work in getting this release developed and done. There have been several updates to alpha packages in the new frontend system including a breaking change where the `app/router` extension was renamed to `app/root`. Furthermore `elements`, `wrappers`, and `router` were added as inputs to `app/root` making it possible to pass extensions into the root of the app. Some more features have been migrated to the new backend system: `@backstage/plugin-auth-backend-module-microsoft-provider` `@backstage/plugin-auth-backend-module-pinniped-provider` `@backstage/plugin-catalog-backend-module-openapi` `@backstage/plugin-events-backend-module-azure` `@backstage/plugin-events-backend-module-bitbucket-cloud` `@backstage/plugin-events-backend-module-gerrit` `@backstage/plugin-linguist` This release includes the new `@backstage/plugin-app-visualizer` package. This plugin for the new frontend system lets you browse and view the extension structure of your app as a graph, detailed list, or in text form. This release includes the new `@backstage/backend-dynamic-feature-service` package. It is a new and experimental service that lets you dynamically detect and load local plugins and modules in your Backstage instance. Contributed by in You can now create GitLab issues in your scaffolder flows! Contributed by in You can now push raw branches to GitLab in your scaffolder flows! Contributed by in This release does not contain any security fixes. However, some updates were made to the build facilities in the CLI and the caches in the backend system, such that you can now perform builds on FIPS compliant systems. This may lead to some internal cache invalidation happening, since the hashing algorithms used were updated. This should not pose a problem unless caches were being used as reliable persistent storage systems. Please let us know if you encounter any issues that may be related to this. We recommend that you keep your Backstage project up to date with this latest release. For more guidance on how to upgrade, check out the documentation for . Below you can find a list of links and references to help you learn about and start using this new release. , , and Backstage's for discussions and support Backstage , , and Sign up for our if you want to be informed about what is happening in the world of Backstage.
Project: Hazelcast Jet (App Definition and Development / Streaming & Messaging)
File: 013-system-time-watermarks.md

title: 013 - Resolving Sparse Events Issue with System-Time Watermarks description: Make the time progress independently from the event rate id: version-4.4-013-system-time-watermarks original_id: 013-system-time-watermarks Since: 4.3 When using event time, time progresses only through the ingestion of new events. If the events are sparse, time will effectively stop until a newer event arrives. This causes high latency for time-sensitive operations such as window aggregation. In addition, Jet tracks event time for every source partition separately, and if just one partition has sparse events, time progress in the whole job is hindered. When you use `withIngestionTime()` on the pipeline, Jet won't extract the timestamp from the event, but will set it according to the local system time on the server. This way of assigning timestamps is inferior because the event isn't associated with the time at which it occurred, but at which Jet received it, causing inaccuracy in the calculations. A specifically bad problem is that, if the job restarts due to a crash, Jet must receive again some of the events it already received and processed before the crash. These events will now get different timestamps, affecting a different piece of the aggregation state. On the other hand, this timestamping approach provides the best latency: the job will never wait for delayed items, there's no need to allow any event lag as with event-time processing. We first implemented `WatermarkPolicy.limitingRealTimeLag()`. This policy emits a watermark that lags behind the system clock by a fixed amount. This policy doesn't depend on the events processed, it depends solely on the system clock. Currently, this policy is available only in Core API. Second, we made `StreamSourceStage.withIngestionTimestamps()` use this policy with zero lag. We can do this because the events are assigned with system time and we're sure that there will never be an event with an older timestamp. Further work is to allow the use of real-time watermarks in Pipeline API even for event-time processing: this will solve the sparse events issue and will give fixed latency relative to the real time, but in case the job is down for more than the real time lag, some events will be dropped as late.
Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: issue-lifecycle.md

title: Issue Lifecycle weight: 30 The Operator SDK project tracks bugs, feature requests, and questions with . Each week, there is a to review new issues. Each issue that has been filed since the previous meeting is discussed, GitHub labels are applied, and the issue is added to a . Additionally, anyone can request that a previously triaged issue can be retriaged. Following a release, there is a to review issues that are desired in the next release. Issues are discussed in the following order: Issues in the next release milestone Issues labeled as `priority/important-soon` Issues in other milestones/backlog if specifically requested
Project: CDK for Kubernetes (CDK8s) (Provisioning / Automation & Configuration)
File: ADOPTERS.md

cdk8s has a variety of users and use cases. Many customers want to learn from others who have already implemented cdk8s in their environments. The following is a self-reported list of users to help identify adoption and points of contact. We have two slack channels where you can ask questions and share ideas. We hang out in both pretty often. on the . on the If you are using cdk8s please consider adding yourself as a user by opening a pull request to this file. If you are open to others contacting you about your use of cdk8s, add your Slack name or email address. | Organization | Description | Contacts | Link | | | | | | | | | 8gears Container Registry | With cdk8s we dynamically generate manifests for different destinations of our Harbor-based SaaS. Multi-Cloud, Edge. | `@vad1mo` | | | Canida | Using cdk8s to generate Kubernetes manifests which are deployed to AWS EKS via ArgoCD | `nico@canida.io` | | | Cloudflare | Using cdk8s to manage large multi-tenant clusters with low drift and high velocity | `@heckler1` | | | Concrete Genius | CDK and cdk8s are used to manage our AWS and local development infrastructure | `@njlaw` | | | Datamole | Relying on seamless CDK - CDK8s interoperability to manage AWS EKS workloads | `@datamole-ai` | | | Finimize | Using both CDK and cdk8s to create a consistent experience when describing our IaC | `@pykita` | | | Griffin | Using CDK, CDK8s, and CDK8s+ to manage our AWS infra and EKS workloads | `@dancmeyers` | | | PreciseTarget | We use cdk8s to manage all applications running in kubernetes across mulitple clusters. | `@steven-esser` | | | The Home Depot | Using cdk8s to manage large, multi-tenant Kubernetes clusters with strong consistency across teams. | `@shinebayar-g` | |
Project: Krator (App Definition and Development / Application Definition & Image Build)
File: CONTRIBUTING.md

This document describes the requirements for committing to this repository. This repository is governed under a [Contributor License Agreement](https://cla.opensource.microsoft.com/deislabs/krustlet). All PR submitters must accept the CLA before their contributions can be merged. All code that is contributed to Krustlet must go through the Pull Request (PR) process. To contribute a PR, fork this project, create a new branch, make changes on that branch, and then use GitHub to open a pull request with your changes. Every PR must be reviewed by at least one Core Maintainer of the project. Once a PR has been marked "Approved" by a Core Maintainer (and no other core maintainer has an open "Rejected" vote), the PR may be merged. While it is fine for non-maintainers to contribute their own code reviews, those reviews do not satisfy the above requirement. This project has adopted the . For more information see the or contact with any additional questions or comments.
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_test.md

/ @kui-shell/test MMRExpectMode: `Label` & `PlainTextContent` \| `YamlContentWithEditor` \| `TableContent` \| `ReactContent` Keys: `Object` | Name | Type | | : | :-- | | `BACKSPACE` | `string` | | `CONTROL` | `string` | | `DELETE` | `string` | | `Delete` | `string` | | `ENTER` | `string` | | `ESCAPE` | `string` | | `End` | `string` | | `Home` | `string` | | `META` | `string` | | `Numpad1` | `string` | | `Numpad2` | `string` | | `PageDown` | `string` | | `PageUp` | `string` | | `TAB` | `string` | | `ctrlC` | `string`[] | | `ctrlN` | `string`[] | | `ctrlOrMeta` | `string` | | `ctrlP` | `string`[] | | `holdDownKey` | (`character`: `string`) => `Promise`<`void`\> | | `releaseKey` | (`character`: `string`) => `Promise`<`void`\> | `Const` testAbout(`self`): `void` | Name | Type | | :-- | :-- | | `self` | | `void`
Project: KICS (Provisioning / Security & Compliance)
File: 7289eebd-a477-4064-8ad4-3c044bd70b00.md

title: Google Compute Network Using Firewall Rule that Allows Port Range hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 7289eebd-a477-4064-8ad4-3c044bd70b00 Query name: Google Compute Network Using Firewall Rule that Allows Port Range Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: Google Compute Network should not use a firewall rule that allows port range<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="19" name: create a firewall2 google.cloud.gcpcomputefirewall: name: test_object allowed: ip_protocol: tcp ports: '20-1000' target_tags: test-ssh-server staging-ssh-server source_tags: test-ssh-clients project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present network: "{{ my_network2 }}" name: create a network2 google.cloud.gcpcomputenetwork: name: test_object autocreatesubnetworks: 'true' project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present register: my_network2 ``` ```yaml title="Negative test num. 1 - yaml file" name: create a firewall google.cloud.gcpcomputefirewall: name: test_object allowed: ip_protocol: tcp ports: '22' target_tags: test-ssh-server staging-ssh-server source_tags: test-ssh-clients project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present network: "{{ my_network }}" name: create a network google.cloud.gcpcomputenetwork: name: test_object autocreatesubnetworks: 'true' project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present register: my_network ```
Project: KOTS (App Definition and Development / Application Definition & Image Build)
File: conditional-status-informers.md

Currently, KOTS does not support having conditional application status informers. This proposal makes it possible to have a status informer disappear/appear if a specific config option is set to a certain value. Add the ability to exclude specific status informers based on the applications's config values Make the application status informers support additional kinds/objects. For example, many vendors have an embedded vs. external database option. They have a status informer set up on the database object, but this only works when using the embedded option. Many of them have requested the ability to have conditional status informers so that the status informer can be excluded when selecting the external db option. Add the ability to render/template the `statusInformers` array in the kots application spec (`kind: Application`). This way, config template functions (e.g. ConfigOptionEquals) can be used to decide whether or not an informer should be included/applied. Getting the list of status informers happens during the app deploy loop in TypeScript. The list of informers is then sent through a socket to the operator to be applied. 1- To add the ability to exclude specific status informers, the `statusInformers` array will be rendered using the `RenderFile` function from kots ffi before it's sent to the operator (the `RenderFile` function can take any string as input to render). 2- This way, conditional template functions can be used as an entry in the `statusInformers` array in the kots application spec. 3- The template function will then resolve to either a valid status informer entry, or not (an empty string `""` for example). 4- Invalid status informers (entries) will be excluded from the array by the operator. Note: the pattern of rendering a kotskinds file on the fly already exists and used for preflights where the preflight spec is rendered before loading and executing preflights. For reference: https://github.com/replicatedhq/kots/blob/7f621f7e/kotsadm/pkg/preflight/preflight.go#L59
Project: KICS (Provisioning / Security & Compliance)
File: ffdf4b37-7703-4dfe-a682-9d2e99bc6c09.md

title: S3 Bucket Allows Delete Action From All Principals hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ffdf4b37-7703-4dfe-a682-9d2e99bc6c09 Query name: S3 Bucket Allows Delete Action From All Principals Platform: Terraform Severity: <span style="color:#ff0000">Critical</span> Category: Access Control URL: S3 Buckets must not allow Delete Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Delete, for all Principals.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4" resource "awss3bucket_policy" "positive1" { bucket = awss3bucket.b.id policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": "*", "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="4" resource "awss3bucket_policy" "positive2" { bucket = awss3bucket.b.id policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="12" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": "*", "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` ```tf title="Negative test num. 1 - tf file" resource "awss3bucket_policy" "negative1" { bucket = awss3bucket.b.id policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Action": "s3:*", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ``` ```tf title="Negative test num. 2 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning = { enabled = true } policy = <<POLICY { "Version": "2012-10-17", "Id": "MYBUCKETPOLICY", "Statement": [ { "Sid": "IPAllow", "Effect": "Deny", "Action": "s3:*", "Resource": "arn:aws:s3:::mytftest_bucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "8.8.8.8/32"} } } ] } POLICY } ```
Project: FOSSA (Provisioning / Security & Compliance)
File: attribution.md

Some of the data used for CLI-side license scanning is provided by nexB under a license. This data can be found here: https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data. The licensing data is Copyright (c) nexB Inc. and others. All rights reserved. ScanCode is a trademark of nexB Inc. SPDX-License-Identifier: CC-BY-4.0 See https://creativecommons.org/licenses/by/4.0/legalcode for the license text. See https://github.com/nexB/scancode-toolkit for support or download. See https://aboutcode.org for more information about nexB OSS projects.
Project: Apache Hadoop (App Definition and Development / Database)
File: CHANGELOG.0.11.1.md

<! --> | JIRA | Summary | Priority | Component | Reporter | Contributor | |:- |:- | : |:- |:- |:- | | | SequenceFile.Metadata class should be public | Major | . | Runping Qi | Runping Qi | | | NPE in org.apache.hadoop.io.SequenceFile$Sorter$MergeQueue | Major | io | Sami Siren | Owen O'Malley | | | Exception while retrieving a map output index file is not reported to JobTracker | Critical | . | Nigel Daley | Arun C Murthy | | | pendingTransfer does not remove a block from neededReplications correctly after targets are chosen | Major | . | Hairong Kuang | Hairong Kuang |
Project: Timescale (App Definition and Development / Database)
File: subspace_store.README.md

A subspace store allows you to save data associated with a multidimensional-subspace. We use this to cache per-chunk values, such as `chunk`s or `chunkinsertstate`. Subspaces are defined conceptually via a Hypercube (that is a collection of slices -- one for each dimension). Thus, a subspace is a "rectangular" cutout in a multidimensional space. that is given a hypertable with (ts Timestamp, i int) with intervals of one hour and 2 hash-partitions the subspaces could be: ``` 00:00 01:00 02:00 03:00 |-|-|-|-| - - 1 | | | | | |-|-|-|-| - - 2 | | | | | |-|-|-|-| - - 3 | | | | | |-|-|-|-| - - ``` Each subspace is cached in a tree structure, with each level of the tree corresponding to a dimension the hypertable is partitioned on, with the first level always being an open (time) dimension time dimension. Thus, the aforementioned hypertable will have the following tree: ``` SubspaceStore | V SubspaceStoreInternalNode (time) | (.vector) V | o | ... | ... | ... | | V DimensionSlice (00:00 - 01:00) | V SubspaceStoreInternalNode (dim 1) | V . . . | V ChunkInsertState (or other leaf object) ``` Each `SubspaceStoreInternalNode` has a field `descendants` storing a count of the number of leaf objects for that subtree, which we used to ensure `SubspaceStore`s don't grow beyond their maximum size. Currently our strategy when adding to a full `SubspaceStore` is to evict the all elements referenced from the first entry of the top-most vector. The assumption is that the topmost vector indexes based on time, and that the first element stores state for those chunks with the earliest time. If we usually perform operations in time-order, these are the elements least likely to be reused. This eviction-strategy is the only reason that the first level of a `SubspaceStore` is always a open (time) dimension.
Project: KICS (Provisioning / Security & Compliance)
File: 80b15fb1-6207-40f4-a803-6915ae619a03.md

title: Cloud DNS Without DNSSEC hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 80b15fb1-6207-40f4-a803-6915ae619a03 Query name: Cloud DNS Without DNSSEC Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: DNSSEC must be enabled for Cloud DNS<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="33 3 20" name: create a managed zone google.cloud.gcpdnsmanaged_zone: name: test_object dns_name: test.somewild2.example.com. description: test zone project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a second managed zone google.cloud.gcpdnsmanaged_zone: name: test_object dns_name: test.somewild2.example.com. description: test zone project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present dnssec_config: kind: some_kind name: create a third managed zone google.cloud.gcpdnsmanaged_zone: name: test_object dns_name: test.somewild2.example.com. description: test zone project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present dnssec_config: kind: some_kind state: off ``` ```yaml title="Negative test num. 1 - yaml file" name: create a managed zone google.cloud.gcpdnsmanaged_zone: name: test_object dns_name: test.somewild2.example.com. description: test zone project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present dnssec_config: kind: some_kind state: on ```
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: api-debugging.md

1 . Ensure the `dev` script at `services/api/package.json` includes the following: ```javascript title="services/api/package.json" node --inspect=0.0.0.0:9229 ``` 2 . Update `docker-compose.yml` to map the `dist` folder and expose the `9229` port: ```yaml title="docker-compose.yml" api: image: ${IMAGE_REPO:-lagoon}/api command: yarn run dev volumes: ./services/api/src:/app/services/api/src ./services/api/dist:/app/services/api/dist depends_on: api-db local-api-data-watcher-pusher keycloak ports: '3000:3000' '9229:9229' ``` 3 . Add the following to `.vscode/launch.json`: ```javascript title=".vscode/launch.json" { // Use IntelliSense to learn about possible attributes. // Hover to view descriptions of existing attributes. // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387. "version": "0.2.0", "configurations": [ { "name": "Docker: Attach to Node", "type": "node", "request": "attach", "port": 9229, "address": "localhost", "outFiles": ["${workspaceRoot}/app/services/api/dist//*.js"], "localRoot": "${workspaceFolder}/services/api", "remoteRoot": "/app/services/api", "sourceMaps": true, "protocol": "inspector" } ] } ``` 4 . Rebuild/restart the containers: ```bash title="Restart containers" rm build/api && make build/api && docker-compose restart api ``` 5 . Restart VScode.
Project: Fluvio (App Definition and Development / Streaming & Messaging)
File: DEVELOP.md

Set up Local Proxy to minikube. It's easy to confingure for other K8 cluster as well: ```bash kubectl proxy --context=minikube Starting to serve on 127.0.0.1:8001 ``` Add proxy cluster configuration to `~/.kube/config` ```yml clusters: cluster: server: http://localhost:8001 name: proxy contexts: context: cluster: proxy user: minikube name: proxy ``` Use `tcpdump` to inspect: ```bash sudo tcpdump -i any port 8001 -A ```