cwielenb/CNCF-Dataset huggingface dataset:
Project: YugabyteDB (App Definition and Development / Database)
File: build-from-src-macos.md

title: Build from source code on macOS headerTitle: Build the source code linkTitle: Build the source description: Build YugabyteDB from source code on macOS. headcontent: Build the source code. menu: preview: identifier: build-from-src-2-macos parent: core-database weight: 2912 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li > <a href="{{< relref "./build-from-src-almalinux.md" >}}" class="nav-link"> <i class="fa-brands fa-linux" aria-hidden="true"></i> AlmaLinux </a> </li> <li > <a href="{{< relref "./build-from-src-macos.md" >}}" class="nav-link active"> <i class="fa-brands fa-apple" aria-hidden="true"></i> macOS </a> </li> <li > <a href="{{< relref "./build-from-src-centos.md" >}}" class="nav-link"> <i class="fa-brands fa-linux" aria-hidden="true"></i> CentOS </a> </li> <li > <a href="{{< relref "./build-from-src-ubuntu.md" >}}" class="nav-link"> <i class="fa-brands fa-linux" aria-hidden="true"></i> Ubuntu </a> </li> </ul> {{< note title="Note" >}} AlmaLinux 8 is the recommended Linux development platform for YugabyteDB. {{< /note >}} First, install , if you do not already have it. Homebrew is used to install the other required packages. ```sh /usr/bin/ruby -e "$( curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" ``` Install the following packages using Homebrew: ```sh brew install autoconf automake bash ccache cmake coreutils gnu-tar libtool \ ninja pkg-config pstree wget python ``` {{< note title="Note" >}} YugabyteDB build scripts require at least Bash version 4. Make sure that `bash --version` outputs a version of 4 or higher before proceeding. You may need to put `/usr/local/bin` (Intel) or `/opt/homebrew/bin` (Apple Silicon) as the first directory on `PATH` in your `~/.bashrc` to achieve that. {{< /note >}} {{% readfile "includes/opt-yb-build.md" %}} {{% readfile "includes/java.md" %}} Install the following packages to satisfy those requirements: ```sh brew install openjdk@11 maven ``` Don't forget to add JDK binaries to `PATH`, ensuring this version takes precedence. For example, ```sh echo 'export PATH="/opt/local/homebrew/opt/openjdk@11/bin:$PATH"' >>~/.bashrc echo 'export PATH="/usr/local/opt/openjdk@11/bin:$PATH"' >>~/.bashrc ``` {{% readfile "includes/yugabyted-ui.md" %}} {{% readfile "includes/build-the-code.md" %}} Perform the following steps to build a release package: . Run the `yb_release` script using the following command: ```sh ./yb_release ``` ```output.sh ...... 2020-10-27 13:55:40,856 [ybrelease.py:283 INFO] Generated a package at '/Users/me/code/yugabyte-db/build/yugabyte-2.5.1.0-6ab8013159fdca00ced7e6f5d2f98cacac6a536a-release-darwin-x8664.tar.gz' ```
Project: Meshery (Provisioning / Automation & Configuration)
File: contributing-docker-extension.md

layout: page title: Contributing to Meshery Docker Extension permalink: project/contributing/contributing-docker-extension abstract: How to contribute to Meshery Docker Extension language: en type: project category: contributing list: include To start contributing to Meshery Docker Extension, make sure you have installed on your system. The Docker Extension for Meshery extends Docker Desktops position as the cloud native developers go-to Kubernetes environment with easy access to the next layer of cloud native infrastructure. The extension provides a seamless experience for developers to manage and monitor their Kubernetes applications and services. 1) Navigate to the Extensions Marketplace of Docker Desktop. 2) From the Dashboard, select Add Extensions in the menu bar or open the Extensions Marketplace from the menu options. <a href="{{ site.baseurl }}/assets/img/platforms/docker-extension-browse.png"> <img style="width:350px;" src="{{ site.baseurl }}/assets/img/platforms/docker-extension-browse.png"> </a> 3) Navigate to Meshery in the Marketplace and press install. <a href="{{ site.baseurl }}/assets/img/platforms/docker-extension.png"> <img style="width:90%" src="{{ site.baseurl }}/assets/img/platforms/docker-extension.png"> </a> OR You can visit the marketplace to directly install Meshery extension in your Docker Desktop. Meshery runs as a set of containers inside your Docker Desktop virtual machine. {% capture code_content %}docker extension install meshery/docker-extension-meshery{% endcapture %} {% include code.html code=code_content %} In the root directory of meshery, run the following command: {% capture code_content %}make ui-setup{% endcapture %} {% include code.html code=code_content %} {% capture code_content %}make server{% endcapture %} {% include code.html code=code_content %} This will ensure that the server is up and running at port 9081 Open another terminal while the server is running, Go inside the docker-extension directory {% capture code_content %}cd install/docker-extension{% endcapture %} {% include code.html code=code_content %} {% capture code_content %}make ui-build{% endcapture %} {% include code.html code=code_content %} If you want to work on the Docker UI, it will be a good idea to use the included UI development server. You can run the UI development server by running the following command: {% capture code_content %}make ui{% endcapture %} {% include code.html code=code_content %} Now the meshery docker-extension is up and running. To see the changes reflected in the docker extension locally and open the devTools window, we can run the command: {% capture code_content %}make link{% endcapture %} {% include code.html code=code_content %} Now that our local development environment is connected with the meshery docker extension, we can start contributing to it.
Project: SPIFFE (Provisioning / Key Management)
File: KEVIN_FOX.md

Kevin Fox is one of the active contributors to multiple SPIFFE community projects. He is a top contributor to SPIRE Helm charts and has been instrumental in the development of the SPIRE Helm chart for Kubernetes. Kevin has been active community member and always willing to help others in the community. He has been a great advocate for SPIFFE and SPIRE and has very practical perspective on how to run it in bare-metal and air-gapped environments. Kevin has been a great asset to the SPIFFE community and has been a great help in the development of different SPIFFE projects. Be sure to preserve the two empty spaces at the end of each line below. GitHub Handle: @kfox1111 Email Address: kfox1111@gmail.com LinkedIn Profile: https://www.pnnl.gov/people/kevin-fox Current Affiliation: Pacific Northwest National Laboratory
Project: Metal³ (Provisioning / Automation & Configuration)
File: publishing-images.md

Publishing Images ================= Images for changes merged into main are automatically built through the [metal3-io org on quay.io](https://quay.io/repository/metal3-io/baremetal-operator). It is also easy to set up your own builds to test images from branches in your development fork. Fork `metal3-io/baremetal-operator` on GitHub. Set up your account on . Link your repository from step 1 to quay.io by following the instructions to "Create New Repository" from <https://quay.io/repository/> Enter the quay.io repository name. It is good practice to use the same name as the github repo. Make the repository public. Select "Link to a GitHub Repository Push" option at the bottom of the screen. Click "Create Public Repository" When prompted, authenticate to GitHub to allow quay.io to see your repositories. Select the GitHub organization, usually your personal repo org. Select the repository from the list. If you have a lot of repos, it may help to type part of the name into the filter box to reduce the length of the list. Click "Continue" Configure your trigger. Selecting "Trigger for all branches and tags" allows you to build images from branches automatically, and is good for a developer configuraiton. Click "Continue" Enter the Dockerfile name: `build/Dockerfile` Enter the "context" where Docker will run the build. This is usually `/`, to indicate the root of your repository. Click "Continue" Skip setting up a robot account and click "Continue" again. Click "Continue" again (yes, 3 times in a row). At this point, quay.io adds an ssh key to your repository. Click the "Return to ..." link. Test a build Click "Start New Build" Click "Run Trigger Now" in the modal popup Select "main" from the list of branches. Click "Start Build" At this point you may have to refresh your browser to see the build because the UI seems to cache pretty aggressively. Create a dev deployment file that uses your image instead of the one from the metal3-io organization. Copy `deploy/operator.yaml` to `deploy/dev-operator.yaml`. Edit `deploy/dev-operator.yaml` and change the `image` setting so it points to your account on quay.io. Builds from main will have the default "latest" tag, but in order to test from a branch you will need to modify the image name to include the branch at the end, like this: quay.io/dhellmann/baremetal-operator:update-operator-deployment Launch the deployment by applying the new file. Make sure you have run the to set up the service account, role, and mapping. Apply the new deployment: kubectl apply -f deploy/dev-operator.yaml To monitor the operator, use `kubectl get pods` to find the pod name for the deployment (it will start with `baremetal-operator`) and then use `kubectl log -f $podname` to see the console log output.
Project: Kyverno (Provisioning / Security & Compliance)
File: kyverno_create_test.md

Create a Kyverno test file. Create a Kyverno test file. ``` kyverno create test [flags] ``` ``` kyverno create test -p policy.yaml -r resource.yaml -f values.yaml --pass policy-name,rule-name,resource-name,resource-namespace,resource-kind ``` ``` --fail fail Expected fail results -h, --help help for test -n, --name string Test name (default "test-name") -o, --output string Output path (uses standard console output if not set) --pass pass Expected pass results -p, --policy strings List of policy files -r, --resource strings List of resource files --skip skip Expected skip results -f, --values string Values file ``` ``` --adddirheader If true, adds the file directory to the header of the log messages --alsologtostderr log to standard error as well as files (no effect when -logtostderr=true) --logbacktraceat traceLocation when logging hits line file:N, emit a stack trace (default :0) --log_dir string If non-empty, write log files in this directory (no effect when -logtostderr=true) --log_file string If non-empty, use this log file (no effect when -logtostderr=true) --logfilemax_size uint Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) --logtostderr log to standard error instead of files (default true) --one_output If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true) --skip_headers If true, avoid header prefixes in the log messages --skiplogheaders If true, avoid headers when opening log files (no effect when -logtostderr=true) --stderrthreshold severity logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2) -v, --v Level number for the log level verbosity --vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging ``` - Helps with the creation of various Kyverno resources.
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: rond.md

title: Rnd software: rond labels: category: authorization layer: application code: https://github.com/rond-authz/rond tutorials: https://github.com/rond-authz/example videos: title: Rnd - The Open Source K8s sidecar that defines security policies over your APIs speakers: name: Federico Maggi organization: mia-platform link: https://youtu.be/ubT31NtHV8w inventors: mia-platform blogs: https://mia-platform.eu/blog/rond-open-source-api-enforcement/ https://mia-platform.eu/blog/role-based-access-control-rbac/ https://resources.mia-platform.eu/en/white-paper-rbac-platform-engineering docs_features: go-integration: note: | The Rnd sidecar uses the OPA Rego API to make API-access authorization decisions. See the code. Rnd is a lightweight container that distributes security policy enforcement throughout your application.
Project: GraphScope (App Definition and Development / Database)
File: dev_and_test.md

This document describes how to build and test GraphScope Learning Engine from source code. To build the learning engine from source code, you need to prepare a development environment with many dependencies and build toolchains. You have two options to prepare the development environment, install all tools and dependencies on your local machine, or build it in our provided docker image. To install all dependencies on your local, use the GraphScope command-line utility `gs` with the subcommand `install-deps` like this ```bash python3 gsctl.py install-deps dev ``` We provided a docker image `graphscope-dev` with all tools and dependencies included. ```bash docker run --rm -it --shm-size=4096m REGISTRY/graphscope/graphscope-dev:latest ``` Since we are going to build GraphScope within the container, here we assign `shm-size` of 4G, which refers to the amount of shared memory allocated to a docker container. More options about `docker` command can be found . You can build all targets for GraphScope Learning Engine with a single command. ```bash python3 gsctl.py make learning ``` You could install it to a location by: ```bash python3 gsctl.py make learning-install --install-prefix /opt/graphscope ``` Test with the new artifacts.
Project: YugabyteDB (App Definition and Development / Database)
File: yba_universe_node.md

Manage YugabyteDB Anywhere universe nodes Manage YugabyteDB Anywhere universe nodes. Operations allowed for AWS, Azure, GCP and On-premises universes. ``` yba universe node [flags] ``` ``` -n, --name string [Required] The name of the universe for the corresponding node operations. --node-name string [Optional] The name of the universe node for the corresponding node operations. Required for add, reboot, release, remove, reprovision, start, stop. -h, --help help for node ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Manage YugabyteDB Anywhere universes - Add a node instance to YugabyteDB Anywhere universe - List YugabyteDB Anywhere universe nodes - Reboot a node instance in YugabyteDB Anywhere universe - Release a node instance from YugabyteDB Anywhere universe - Remove a node instance to YugabyteDB Anywhere universe - Reprovision a node instance in YugabyteDB Anywhere universe - Start a node instance in YugabyteDB Anywhere universe - Stop a node instance in YugabyteDB Anywhere universe
Project: KICS (Provisioning / Security & Compliance)
File: 3602d273-3290-47b2-80fa-720162b1a8af.md

title: Google Compute Network Using Firewall Rule that Allows All Ports hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3602d273-3290-47b2-80fa-720162b1a8af Query name: Google Compute Network Using Firewall Rule that Allows All Ports Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Google Compute Network should not use a firewall rule that allows all ports<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="19" name: create a firewall2 google.cloud.gcpcomputefirewall: name: test_object allowed: ip_protocol: tcp ports: '0-65535' target_tags: test-ssh-server staging-ssh-server source_tags: test-ssh-clients project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present network: "{{ my_network2 }}" name: create a network2 google.cloud.gcpcomputenetwork: name: test_object autocreatesubnetworks: 'true' project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present register: my_network2 ``` ```yaml title="Negative test num. 1 - yaml file" name: create a firewall google.cloud.gcpcomputefirewall: name: test_object allowed: ip_protocol: tcp ports: '22' target_tags: test-ssh-server staging-ssh-server source_tags: test-ssh-clients project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present network: "{{ my_network }}" name: create a network google.cloud.gcpcomputenetwork: name: test_object autocreatesubnetworks: 'true' project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present register: my_network ```
Project: KICS (Provisioning / Security & Compliance)
File: 0ce1ba20-8ba8-4364-836f-40c24b8cb0ab.md

title: MSK Broker Is Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0ce1ba20-8ba8-4364-836f-40c24b8cb0ab Query name: MSK Broker Is Publicly Accessible Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Public AWS MSK allows anyone to interact with the Apache Kafka broker, therefore increasing the opportunity for malicious activity. To prevent such a scenario, it is recommended for AWS MSK to not be publicly accessible<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="18" AWSTemplateFormatVersion: "2010-09-09" Description: MSK Cluster with required properties. Resources: TestCluster: Type: "AWS::MSK::Cluster" Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: ReplaceWithSubnetId1 ReplaceWithSubnetId2 ReplaceWithSubnetId3 ConnectivityInfo: PublicAccess: Type: SERVICEPROVIDEDEIPS ``` ```json title="Positive test num. 2 - json file" hl_lines="15" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "MSK Cluster with required properties.", "Resources": { "TestCluster": { "Properties": { "BrokerNodeGroupInfo": { "ClientSubnets": [ "ReplaceWithSubnetId1", "ReplaceWithSubnetId2", "ReplaceWithSubnetId3" ], "ConnectivityInfo": { "PublicAccess": { "Type": "SERVICEPROVIDEDEIPS" } }, "InstanceType": "kafka.m5.large" }, "ClusterName": "ClusterWithRequiredProperties", "KafkaVersion": "2.2.1", "NumberOfBrokerNodes": 3 }, "Type": "AWS::MSK::Cluster" } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: MSK Cluster with required properties. Resources: TestCluster0: Type: "AWS::MSK::Cluster" Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: ReplaceWithSubnetId1 ReplaceWithSubnetId2 ReplaceWithSubnetId3 ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "MSK Cluster with required properties.", "Resources": { "TestCluster": { "Properties": { "BrokerNodeGroupInfo": { "ClientSubnets": [ "ReplaceWithSubnetId1", "ReplaceWithSubnetId2", "ReplaceWithSubnetId3" ], "ConnectivityInfo": { "PublicAccess": { "Type": "DISABLED" } }, "InstanceType": "kafka.m5.large" }, "ClusterName": "ClusterWithRequiredProperties", "KafkaVersion": "2.2.1", "NumberOfBrokerNodes": 3 }, "Type": "AWS::MSK::Cluster" } } } ```
Project: KICS (Provisioning / Security & Compliance)
File: 1acd93f1-5a37-45c0-aaac-82ece818be7d.md

title: Use Service Account Credentials Not Set To True hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1acd93f1-5a37-45c0-aaac-82ece818be7d Query name: Use Service Account Credentials Not Set To True Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: When using kube-controller-manager commands, the '--use-service-account-credentials' should be set to true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager","--use-service-account-credentials=false"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager"] args: [] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager"] args: ["--use-service-account-credentials=true"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager","--use-service-account-credentials=true"] args: [] restartPolicy: OnFailure ```
Project: KICS (Provisioning / Security & Compliance)
File: 88d55d94-315d-4564-beee-d2d725feab11.md

title: SageMaker Enabling Internet Access hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 88d55d94-315d-4564-beee-d2d725feab11 Query name: SageMaker Enabling Internet Access Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: SageMaker must have disabled internet access and root access for Creating Notebook Instances.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: "2010-09-09" Description: "Internet access and root access for Creating Notebook Instances" Resources: Notebook: Type: AWS::SageMaker::NotebookInstance Properties: DirectInternetAccess: "Enabled" InstanceType: "ml.c4.2xlarge" RoleArn: "role" ``` ```json title="Positive test num. 2 - json file" hl_lines="8" { "Resources": { "Notebook": { "Type": "AWS::SageMaker::NotebookInstance", "Properties": { "InstanceType": "ml.c4.2xlarge", "RoleArn": "role", "DirectInternetAccess": "Enabled" } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Internet access and root access for Creating Notebook Instances" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: "Internet access and root access for Creating Notebook Instances" Resources: Notebook: Type: AWS::SageMaker::NotebookInstance Properties: DirectInternetAccess: "Disabled" InstanceType: "ml.c4.2xlarge" RoleArn: "role" ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Internet access and root access for Creating Notebook Instances", "Resources": { "Notebook": { "Type": "AWS::SageMaker::NotebookInstance", "Properties": { "DirectInternetAccess": "Disabled", "InstanceType": "ml.c4.2xlarge", "RoleArn": "role" } } } } ```