cwielenb/CNCF-Dataset huggingface dataset:
Project: ORY Hydra (Provisioning / Key Management)
File: HealthStatus.md

Name | Type | Description | Notes | - | - | - Status | Pointer to string | Status always contains \&quot;ok\&quot;. | [optional] `func NewHealthStatus() *HealthStatus` NewHealthStatus instantiates a new HealthStatus object This constructor will assign default values to properties that have it defined, and makes sure properties required by API are set, but the set of arguments will change when the set of required properties is changed `func NewHealthStatusWithDefaults() *HealthStatus` NewHealthStatusWithDefaults instantiates a new HealthStatus object This constructor will only assign default values to properties that have it defined, but it doesn't guarantee that properties required by API are set `func (o *HealthStatus) GetStatus() string` GetStatus returns the Status field if non-nil, zero value otherwise. `func (o HealthStatus) GetStatusOk() (string, bool)` GetStatusOk returns a tuple with the Status field if it's non-nil, zero value otherwise and a boolean to check if the value has been set. `func (o *HealthStatus) SetStatus(v string)` SetStatus sets Status field to given value. `func (o *HealthStatus) HasStatus() bool` HasStatus returns a boolean if a field has been set.
Project: KubeDL (Provisioning / Automation & Configuration)
File: xdljob.md

This tutorial walks you through an example to run a XDLJob. is an open sourced deep learning engine from Alibab Before starting this tutorial, you should and . XDLJob depends on ZooKeeper to make its pods communicate with each other. Below installs a single instance of ZooKeeper. ```bash kubectl apply -f https://raw.githubusercontent.com/alibaba/kubedl/master/docs/tutorial/v1/xdl-zk.yaml ``` For production environment, you can follow the to install a three-node ZooKeeper ensemble. We need to set `ZooKeeper server address` and `ConfigMap` accordingly in the . For every container in XDLJob, KubeDL operator will substitute the environment variables ```TASKNAME``` and ```TASKINDEX``` to identify every pod. Also, KubeDL operator will modify the `ZK_ADDR` env to add job UUID. Below runs a XDL job. ```bash kubectl apply -f https://raw.githubusercontent.com/alibaba/kubedl/master/docs/tutorial/v1/xdl-job.yaml ``` Check the XDLJob is started, and all pods are Running. ```bash kubectl get xdljob NAME STATE AGE TTL-AFTER-FINISHED MAX-LIFETIME xdl-mnist-example Running 70s 3600 kubectl get po NAME READY STATUS RESTARTS AGE xdl-mnist-example-ps-0 1/1 Running 0 116s xdl-mnist-example-scheduler-0 1/1 Running 0 116s xdl-mnist-example-worker-0 1/1 Running 0 116s xdl-mnist-example-worker-1 1/1 Running 0 116s zk-c5cc46c8d-s6bkc 1/1 Running 0 2m26s ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.10.4.md

RabbitMQ `3.10.4` is a maintenance release in the `3.10.x` release series. Please refer to the upgrade section from if upgrading from a version prior to 3.10.0. This release requires at least Erlang 23.2, and supports Erlang 24 and 25. has more details on Erlang version requirements for RabbitMQ. Release notes can be found on GitHub at . A minor quorum queue optimization. GitHub issue: Avoid seeding default user in old clusters that still use the deprecated `management.load_definitions` option. This could result in an extra user, `guest` or under an , to appear in addition to the user accounts imported from definitions. Note that the default user with well-known name , so this would not expose reasonably configured production nodes to remote connections. GitHub issue: Streams could run into an exception or fetch stale stream position data in some scenarios. GitHub issue: `rabbitmqctl setloglevel` did not have any effect on logging via (the system exchange for logging) Contributed by Pter @gomoripeti Gmri (CloudAMQP). GitHub issue: `rabbitmq-diagnostics status` is now more resilient and won't fail if free disk space monitoring repeatedly fails (gets disabled) on the node. GitHub issue: `ra` upgraded from To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.10.4.tar.xz` instead of the source tarball produced by GitHub.
Project: YugabyteDB (App Definition and Development / Database)
File: drop_type.diagram.md

<svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="565" height="100" viewbox="0 0 565 100"><path class="connector" d="M0 52h15m53 0h10m49 0h30m32 0h10m64 0h20m-141 0q5 0 5 5v8q0 5 5 5h116q5 0 5-5v-8q0-5 5-5m5 0h30m-5 0q-5 0-5-5v-20q0-5 5-5h37m24 0h37q5 0 5 5v20q0 5-5 5m-5 0h50m77 0h22m-109 25q0 5 5 5h5m79 0h5q5 0 5-5m-104-25q5 0 5 5v33q0 5 5 5h89q5 0 5-5v-33q0-5 5-5m5 0h15"/><polygon points="0,59 5,52 0,45" style="fill:black;stroke-width:0"/><rect class="literal" x="15" y="35" width="53" height="25" rx="7"/><text class="text" x="25" y="52">DROP</text><rect class="literal" x="78" y="35" width="49" height="25" rx="7"/><text class="text" x="88" y="52">TYPE</text><rect class="literal" x="157" y="35" width="32" height="25" rx="7"/><text class="text" x="167" y="52">IF</text><rect class="literal" x="199" y="35" width="64" height="25" rx="7"/><text class="text" x="209" y="52">EXISTS</text><rect class="literal" x="345" y="5" width="24" height="25" rx="7"/><text class="text" x="355" y="22">,</text><a xlink:href="../../../syntaxresources/grammardiagrams#type-name"><rect class="rule" x="313" y="35" width="88" height="25"/><text class="text" x="323" y="52">type_name</text></a><rect class="literal" x="451" y="35" width="77" height="25" rx="7"/><text class="text" x="461" y="52">CASCADE</text><rect class="literal" x="451" y="65" width="79" height="25" rx="7"/><text class="text" x="461" y="82">RESTRICT</text><polygon points="561,59 565,59 565,45 561,45" style="fill:black;stroke-width:0"/></svg>
Project: SPIRE (Provisioning / Key Management)
File: plugin_server_upstreamauthority_gcp_cas.md

The `gcp_cas` plugin uses the Certificate Authority from Google Cloud Platform, known as "Certificate Authority Service" (CAS), to generate intermediate signing certificates for SPIRE Server. The plugin has a mandatory rootcertspec section. It is used to specify which CAs are used for signing intermediate CAs as well as being part of the trusted root bundle. If it matches multiple CAs, the earliest expiring CA is used for signing. "rootcertspec" requires the following attributes: | Configuration | Description | ||| | project_name | Project in GCP that has the root CA certificate | | region_name | The name of the region within GCP | | ca_pool | The name of the CA Pool that has the root CA certificate | | label_key | Label key - value pair is used to filter and select the relevant certificate | | label_value | Label key - value pair is used to filter and select the relevant certificate | ```yaml UpstreamAuthority "gcp_cas" { plugin_data { rootcertspec { project_name = "MyProject" region_name = "us-central1" ca_pool = "mypool" label_key = "myapp-identity-root" label_value = "true" } } } ``` The plugin retrieves the CAs in GCPs that are in ENABLED state and match the root cert spec parameters specified in the plugin configuration. Among the matching certificates, the CA with the earliest expiry time is selected and used to create and sign an intermediate CA. The trust bundle contains the root CAs of all the CAs in GCP that matched the rootcertspec label Steady state: Config label matches CA X and CA Y in CAS; plugin has been signing with CA X and all agents are trusting CA X and CA Y. Now create CA Z with the same label in CAS. Disable and optionally delete CA X in CAS. The plugin returns Y and Z's root certificates as UpstreamX509Roots. It also signs the issuing CA with Y which is now the earliest expiring CA. This doesn't impact existing workloads because they have been trusting Y even before SPIRE started to sign with Y. This plugin connects and authenticates with Google Cloud Platform's CAS implicitly using Application Default Credentials (ADC). The ADC mechanism is documented at <https://cloud.google.com/docs/authentication/production#automatically>. ADC looks for service account credentials in the following order: If the environment variable GOOGLEAPPLICATIONCREDENTIALS is set, ADC uses the service account file that the variable points to. If the environment variable GOOGLEAPPLICATIONCREDENTIALS isn't set, ADC uses the service account that is attached to the resource that is running your code. If the environment variable GOOGLEAPPLICATIONCREDENTIALS isn't set, and there is no service account attached to the resource that is running your code, ADC uses the default service account that Compute Engine, Google Kubernetes Engine, App Engine, Cloud Run, and Cloud Functions provide. If ADC can't use any of the above credentials, an error occurs.
Project: Meshery (Provisioning / Automation & Configuration)
File: kubevault-metrics.md

layout: integration title: Kubevault Metrics subtitle: Collaborative and visual infrastructure as code for Kubevault Metrics image: /assets/img/integrations/kubevault-metrics/icons/color/kubevault-metrics-color.svg permalink: extensibility/integrations/kubevault-metrics docURL: https://docs.meshery.io/extensibility/integrations/kubevault-metrics description: integrations-category: Security & Compliance integrations-subcategory: Uncategorized registrant: Artifact Hub components: featureList: [ "Deploy TLS secured Vault Servers on Kubernetes using KubeVault. You can use cert-manager to manage VaultServer TLS or you can manage TLS with self-signed.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: ORY Hydra (Provisioning / Key Management)
File: WellknownApi.md

All URIs are relative to http://localhost Method | HTTP request | Description | - | - | Get /.well-known/jwks.json | Discover Well-Known JSON Web Keys JsonWebKeySet DiscoverJsonWebKeys(ctx).Execute() Discover Well-Known JSON Web Keys ```go package main import ( "context" "fmt" "os" openapiclient "github.com/ory/hydra-client-go/v2" ) func main() { configuration := openapiclient.NewConfiguration() apiClient := openapiclient.NewAPIClient(configuration) resp, r, err := apiClient.WellknownApi.DiscoverJsonWebKeys(context.Background()).Execute() if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `WellknownApi.DiscoverJsonWebKeys``: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } // response from `DiscoverJsonWebKeys`: JsonWebKeySet fmt.Fprintf(os.Stdout, "Response from `WellknownApi.DiscoverJsonWebKeys`: %v\n", resp) } ``` This endpoint does not need any parameter. Other parameters are passed through a pointer to a apiDiscoverJsonWebKeysRequest struct via the builder pattern No authorization required Content-Type: Not defined Accept: application/json
Project: ORY Hydra (Provisioning / Key Management)
File: SECURITY.md

<!-- AUTO-GENERATED, DO NOT EDIT! --> <!-- Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/SECURITY.md --> <!-- START doctoc generated TOC please keep comment here to allow auto update --> <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --> - <!-- END doctoc generated TOC please keep comment here to allow auto update --> We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating: | CVSS v3.0 | Supported Versions | | | -- | | 9.0-10.0 | Releases within the previous three months | | 4.0-8.9 | Most recent release | Please report (suspected) security vulnerabilities to . You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.
Project: KICS (Provisioning / Security & Compliance)
File: 09c35abf-5852-4622-ac7a-b987b331232e.md

title: Cross-Account IAM Assume Role Policy Without ExternalId or MFA hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 09c35abf-5852-4622-ac7a-b987b331232e Query name: Cross-Account IAM Assume Role Policy Without ExternalId or MFA Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Cross-Account IAM Assume Role Policy should require external ID or MFA to protect cross-account access<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4" resource "awsiamrole" "positive1" { name = "test_role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "AWS": "arn:aws:iam::987654321145:root" }, "Effect": "Allow", "Resource": "*", "Sid": "" } ] } EOF tags = { tag-key = "tag-value" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="4" resource "awsiamrole" "positive2" { name = "test_role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": { "Action": "sts:AssumeRole", "Principal": { "AWS": "arn:aws:iam::987654321145:root" }, "Effect": "Allow", "Resource": "*", "Sid": "", "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "false" } } } } EOF tags = { tag-key = "tag-value" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="4" resource "awsiamrole" "positive3" { name = "test_role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": { "Action": "sts:AssumeRole", "Principal": { "AWS": "arn:aws:iam::987654321145:root" }, "Effect": "Allow", "Resource": "*", "Sid": "", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } } EOF tags = { tag-key = "tag-value" } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamrole" "negative1" { name = "test_role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "AWS": "arn:aws:iam::987654321145:root" }, "Effect": "Allow", "Resource": "*", "Sid": "", "Condition": { "StringEquals": { "sts:ExternalId": "98765" } } } ] } EOF tags = { tag-key = "tag-value" } } ``` ```tf title="Negative test num. 2 - tf file" resource "awsiamrole" "negative2" { name = "test_role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "AWS": "arn:aws:iam::987654321145:root" }, "Effect": "Allow", "Resource": "*", "Sid": "", "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } } } ] } EOF tags = { tag-key = "tag-value" } } ```
Project: ArangoDB (App Definition and Development / Database)
File: explicit_inplace_error_constructor.md

+++ title = "`explicit basicresult(inplacetypet<errortypeif_enabled>, Args ...)`" description = "Explicit inplace error constructor. Available if `predicate::enableinplaceerror_constructor<Args ...>` is true. Constexpr, triviality and noexcept propagating." categories = ["constructors", "explicit-constructors", "inplace-constructors"] weight = 420 +++ Explicit inplace error constructor. Calls {{% api "void onresultinplaceconstruction(T *, inplacetypet<U>, Args &&...) noexcept" %}} with `this`, `inplacetype<errortype>` and `Args ...`. Requires: `predicate::enableinplaceerror_constructor<Args ...>` is true. Complexity: Same as for the `error_type` constructor which accepts `Args ...`. Constexpr, triviality and noexcept of underlying operations is propagated. Guarantees: If an exception is thrown during the operation, the state of the Args is left indeterminate.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: unity.md

title: "Unity" icon: /images/logos/powered-by/unity.png hasLink: "https://unity.com/" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: sso (Provisioning / Key Management)
File: sso_proxy_config.md

We currently use environment variables to read configuration options, below is a list of environment variables and their corresponding types that the sso proxy will read. Defaults for the below settings can be found here: https://github.com/buzzfeed/sso/blob/main/internal/proxy/configuration.go#L61-L105 ``` SESSIONCOOKIENAME - string - name associated with the session cookie SESSIONCOOKIESECRET - string - seed string for secure cookies SESSIONCOOKIEDOMAIN - string - cookie domain to force cookies to (ie: .yourcompany.com)* SESSIONCOOKIESECURE - bool - set secure (HTTPS) cookie flag SESSIONCOOKIEHTTPONLY - bool - set 'httponly' cookie flag SESSIONTTLLIFETIME - time.Duration - 'time-to-live' of a session lifetime SESSIONTTLVALID - time.Duration - 'time-to-live' of a valid session SESSIONTTLGRACEPERIOD - time.Duration - time period in which session data can be reused while the provider is unavailable. ``` ``` SERVER_PORT - string - port the http server listens on SERVERTIMEOUTSHUTDOWN - time.Duration - time to allow in-flight requests to complete before server shutdown SERVERTIMEOUTREAD - time.Duration - read request timeout SERVERTIMEOUTWRITE - time.Duration - write request timeout ``` ``` CLIENT_ID - string - the OAuth Client ID: ie: "123456.apps.googleusercontent.com" CLIENT_SECRET - string - the OAuth Client secret ``` ``` REQUESTSIGNER_KEY - string - RSA private key used for digitally signing requests ``` For further upstream configuration, see https://github.com/buzzfeed/sso/blob/main/docs/sso_config.md. ``` UPSTREAMDEFAULTEMAILDOMAINS - []string - default setting for upstream `allowedemail_domains` variable UPSTREAMDEFAULTEMAILADDRESSES - []string - default setting for upstream `allowedemail_addresses` variable UPSTREAMDEFAULTGROUPS - []string - default setting for upstream `allowed groups` variable UPSTREAMDEFAULTTIMEOUT - time.Duration - default setting for upstream `timeout` variable UPSTREAMDEFAULTTCPRESETDEADLINE - time.Duration - default time period to wait for a response from an upstream UPSTREAMDEFAULTPROVIDER - string - default setting for the upstream `provider_slug` variable UPSTREAMCONFIGSFILE - string - path to the file containing upstream configurations UPSTREAM_SCHEME - string - the scheme used for upstreams (e.g. `https`) UPSTREAM_CLUSTER - string - the cluster in which this is running, used within upstream configuration ``` ``` PROVIDER_TYPE - string - string - the 'type' of upstream provider to use (at this time, only a provider type of 'sso' is supported) PROVIDERURLEXTERNAL - string - the external URL for the upstream provider in this environment (e.g. "https://sso-auth.example.com") PROVIDERURLINTERNAL - string - the internal URL for the upstream provider in this environment (e.g. "https://sso-auth-int.example.com") PROVIDER_SCOPE - string - OAuth `scope` sent with provider requests ``` ``` METRICSSTATSDPORT - int - port that statsdclient listens on METRICSSTATSDHOST - string - hostname that statsd client uses ``` ``` LOGGING_ENABLE - bool - enable request logging ```
Project: YugabyteDB (App Definition and Development / Database)
File: dcl_drop_role.md

title: DROP ROLE statement [YSQL] headerTitle: DROP ROLE linkTitle: DROP ROLE description: Use the DROP ROLE statement to remove the specified roles. menu: v2.18: identifier: dcldroprole parent: statements type: docs Use the `DROP ROLE` statement to remove the specified roles. {{%ebnf%}} drop_role {{%/ebnf%}} Where `role_name` is the name of the role to be removed. To drop a superuser role, you must be a superuser yourself. To drop non-superuser roles, you must have CREATEROLE privilege. Before dropping the role, you must drop all the objects it owns (or reassign their ownership) and revoke any privileges the role has been granted on other objects. The `REASSIGN OWNED` and `DROP OWNED` commands can be used for this purpose. It is, however, not necessary to remove role memberships involving the role. `DROP ROLE` automatically revokes any memberships of the target role in other roles, and of other roles in the target role. The other roles are not dropped or affected. Drop a role. ```plpgsql yugabyte=# DROP ROLE John; ```
Project: Artifact Hub (App Definition and Development / Application Definition & Image Build)
File: gatekeeper_policies_repositories.md

Gatekeeper policies repositories are expected to be hosted in GitHub, GitLab or Bitbucket repos. When adding your repository to Artifact Hub, the url used must follow the following format: `https://github.com/user/repo[/path/to/packages]` `https://gitlab.com/user/repo[/path/to/packages]` `https://bitbucket.org/user/repo[/path/to/packages]` By default the `master` branch is used, but it's possible to specify a different one from the UI. Please NOTE that the repository URL used when adding the repository to Artifact Hub must NOT contain the git hosting platform specific parts, like tree/branch, just the path to your packages like it would show in the filesystem. The path/to/packages provided can contain metadata for one or more packages. Each package version must be on a separate folder, and it's up to you to decide if you want to publish one or multiple versions of your package. The structure of a repository with multiple policies packages and versions could look something like this: ```sh $ tree path/to/packages path/to/packages artifacthub-repo.yml package1 1.0.0 README.md artifacthub-pkg.yml 2.0.0 README.md artifacthub-pkg.yml package2 1.0.0 README.md artifacthub-pkg.yml ``` This structure is flexible, and in some cases it can be greatly simplified. In the case of a single package with a single version available at a time (the publisher doesn't want to make previous ones available, for example), the structure could look like this: ```sh $ tree path/to/packages path/to/packages artifacthub-repo.yml package1 README.md artifacthub-pkg.yml ``` In the previous case, even the `package1` directory could be omitted. The reason is that both packages names and versions are read from the `artifacthub-pkg.yml` metadata file, so directories names are not used at all. Each package version needs an `artifacthub-pkg.yml` metadata file. Please see the file for more details. The repository metadata file shown above can be used to setup features like or . This file must be located at `/path/to/packages`. Once you have added your repository, you are all set up. As you add new versions of your policies packages or even new packages to your git repository, they'll be automatically indexed and listed in Artifact Hub.