cwielenb/CNCF-Dataset huggingface dataset:
Project: Kyverno (Provisioning / Security & Compliance)
File: kyverno_oci.md

Pulls/pushes images that include policie(s) from/to OCI registries. Pulls/pushes images that include policie(s) from/to OCI registries. NOTE: This is an experimental command, use `KYVERNO_EXPERIMENTAL=true` to enable it. For more information visit https://kyverno.io/docs/kyverno-cli/#oci ``` kyverno oci [flags] ``` ``` kyverno oci push -p policy.yaml -i <imgref> kyverno oci pull -i <imgref> -d policies ``` ``` -h, --help help for oci ``` ``` --adddirheader If true, adds the file directory to the header of the log messages --alsologtostderr log to standard error as well as files (no effect when -logtostderr=true) --logbacktraceat traceLocation when logging hits line file:N, emit a stack trace (default :0) --log_dir string If non-empty, write log files in this directory (no effect when -logtostderr=true) --log_file string If non-empty, use this log file (no effect when -logtostderr=true) --logfilemax_size uint Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) --logtostderr log to standard error instead of files (default true) --one_output If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true) --skip_headers If true, avoid header prefixes in the log messages --skiplogheaders If true, avoid headers when opening log files (no effect when -logtostderr=true) --stderrthreshold severity logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2) -v, --v Level number for the log level verbosity --vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging ``` - Kubernetes Native Policy Management. - Pulls policie(s) that are included in an OCI image from OCI registry and saves them to a local directory. - Push policie(s) that are included in an OCI image to OCI registry.
Project: ShardingSphere (App Definition and Development / Database)
File: dev-env.en.md

+++ title = "How to Set Up Your DEV Environment" weight = 2 chapter = true +++ Use the latest version. You could download Git from . If you're running macOS or Linux, you could install Git from software repository. If you're running Windows, following settings should be done before cloning ShardingSphere code. Execute following command in PowerShell or cmd to prevent from `filename too long` error on cloning ShardingSphere code: ```shell git config --global core.longpaths true ``` Use JDK 11 or higher. You could download JDK from . You could search JDK installation guide for your platform on Google. Optional. You could use `mvn` command if Maven is ready, else use `mvnw` instead (download and install Maven automatically, use version defined in `.mvn/wrapper/maven-wrapper.properties`). Use 3.6+. You could download Maven from . Please refer to for more details. You could use any of them: Terminal : Preinstalled on macOS iTerm2 : Could be installed by yourself You could use any of them: PowerShell : Preinstalled on Windows Git Bash : Could be installed in official Git client Windows Subsystem for Linux (WSL) : Could be installed by yourself Different terminal on different distribution. Set up JAVAHOME, MAVENHOME and PATH system environment variables. You could find how to do it on Google. You could use any of them: IntelliJ IDEA Eclipse NetBeans These plugins might be useful for you: Lombok : Required. It's already preinstalled in the latest IntelliJ IDEA. CheckStyle : Optional. It provides both real-time and on-demand scanning of Java files. Notice: Not all could be checked. ANTLR v4 : Optional. It's recommended if you contribute to SQL extension. Add `Configuration File` : use `src/resources/checkstyle.xml` Select `Checkstyle version` : use `9.3`
Project: KICS (Provisioning / Security & Compliance)
File: ed35928e-195c-4405-a252-98ccb664ab7b.md

title: API Gateway With Invalid Compression hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ed35928e-195c-4405-a252-98ccb664ab7b Query name: API Gateway With Invalid Compression Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Encryption URL: API Gateway should have valid compression, which means attribute 'minimumcompressionsize' should be set and its value should be greater than -1 and smaller than 10485760.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 28 17" resource "awsapigatewayrestapi" "positive1" { name = "regional-example" endpoint_configuration { types = ["REGIONAL"] } } resource "awsapigatewayrestapi" "positive2" { name = "regional-example" endpoint_configuration { types = ["REGIONAL"] } minimumcompressionsize = -1 } resource "awsapigatewayrestapi" "positive3" { name = "regional-example" endpoint_configuration { types = ["REGIONAL"] } minimumcompressionsize = 10485760 } ``` ```tf title="Negative test num. 1 - tf file" resource "awsapigatewayrestapi" "negative1" { name = "regional-example" endpoint_configuration { types = ["REGIONAL"] } minimumcompressionsize = 0 } ```
Project: KICS (Provisioning / Security & Compliance)
File: a25cd877-375c-4121-a640-730929936fac.md

title: GuardDuty Detector Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a25cd877-375c-4121-a640-730929936fac Query name: GuardDuty Detector Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Make sure that Amazon GuardDuty is Enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Resources: mydetector3: Type: AWS::GuardDuty::Detector Properties: Enable: False FindingPublishingFrequency: FIFTEEN_MINUTES ``` ```json title="Positive test num. 2 - json file" hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "mydetector4": { "Properties": { "Enable": false, "FindingPublishingFrequency": "FIFTEEN_MINUTES" }, "Type": "AWS::GuardDuty::Detector" } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Resources: mydetector: Type: AWS::GuardDuty::Detector Properties: Enable: True FindingPublishingFrequency: FIFTEEN_MINUTES ``` ```json title="Negative test num. 2 - json file" { "document": [ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "mydetector2": { "Properties": { "Enable": true, "FindingPublishingFrequency": "FIFTEEN_MINUTES" }, "Type": "AWS::GuardDuty::Detector" } }, "id": "f63e21c6-c58e-45cf-b7b4-6b548d9f7674", "file": "C:\\Users\\foo\\Desktop\\Data\\yaml\\yaml.yaml" } ] } ```
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: welcome.md

title: Welcome to Kui layout: 1: left We love CLIs, and think they are critical for interacting in a flexible way with the cloud. We need the power to go off the rails. But ASCII is tedious. Kui takes your normal kubectl command line requests and responds with graphics. Instead of ASCII tables, you are presented with sortable ones. Instead of copying and pasting long auto-generated resource names to drill down, in Kui you just click. === "Mac" For MacOS, this is simplified by the use of : ```bash validate: brew info kui brew install kui kubectl kui get pods ``` === "Linux/Windows" | | Kui uses . Using Electron, Kui can be distributed as a double-clickable platform application, as a static single-page web application, or as a fully hosted client-server web app. If you want to help, please take a look at the [developer guide](https://github.com/IBM/kui/wiki) and our . ???+ tip "Kui as a `kubectl` plugin" To run Kui as `kubectl kui`, add the unpacked directory to your PATH. For users of Homebrew on macOS, this should happen automatically. To use Kui, type a normal `kubectl` command, and you should quickly see interactive graphics in response. You may use `k` as a shorthand for `kubectl`. First, let us try viewing our pods: ```bash k get deploy ``` Clicking on a table cell gives you a quick way to drill down the following details: ```bash k get deploy frontend -o yaml ``` Kui has enhanced views over Kubernetes events. ```bash k get events ``` Kui also has enhanced views over heterogeneous collections of resources. Both `apply` and `get` operations present a unified view of these resources, along with links to view the source yaml for each group of resources. ```bash k apply -f plugins/plugin-kubectl/tests/data/k8s/application/guestbook/ ```
Project: Salt Project (Provisioning / Automation & Configuration)
File: tech-debt.md

name: Tech Debt about: Issue is related to tech debt. This includes compatibility changes for newer versions of software and OSes that salt interacts with. title: "[TECH DEBT]" labels: tech-debt assignees: '' <!-- Note: Please direct questions to the salt-users google group, IRC or Community Slack. --> (Provided by running `salt --versions-report`. Please also mention any differences in master/minion versions.)
Project: Docker Compose (App Definition and Development / Application Definition & Image Build)
File: compose_alpha_viz.md

<!MARKERGENSTART--> EXPERIMENTAL - Generate a graphviz graph from your compose file | Name | Type | Default | Description | |:|:|:--|:| | `--dry-run` | | | Execute command in dry run mode | | `--image` | | | Include service's image name in output graph | | `--indentation-size` | `int` | `1` | Number of tabs or spaces to use for indentation | | `--networks` | | | Include service's attached networks in output graph | | `--ports` | | | Include service's exposed ports in output graph | | `--spaces` | | | If given, space character ' ' will be used to indent,<br>otherwise tab character '\t' will be used | <!MARKERGENEND-->
Project: external-secrets (Provisioning / Security & Compliance)
File: v1beta1.md

From version v0.5.0, `v1alpha1` version is deprecated, and `v1beta1` is in place. This guide will cover the main differences between the two versions, and a procedure on how to safely upgrade it. Versions v1alpha1 and v1beta1 are fully-compatible for SecretStores and ClusterSecretStores. For ExternalSecrets, there is a difference on the `dataFrom` method. While in v1alpha1, we could define a `dataFrom` with the following format: ``` spec: dataFrom: key: my-key key: my-other-key ``` In v1beta1 is possible to use two methods. One of them is `Extract` and has the exact same behavior as `dataFrom` in v1alpha1. The other is `Find`, which allows finding multiple external secrets and map them into a single Kubernetes secret. Here is an example of `Find`: ``` spec: dataFrom: find: name: #matches any secret name ending in foo-bar regexp: .*foo-bar$ find: tags: #matches any secrets with the following metadata. env: dev app: web ``` If you already have an installation of ESO using `v1alpha1`, we recommend you to upgrade to `v1beta1`. If you do not use `dataFrom` in your ExternalSecrets, or if you deploy the CRDs using the official Helm charts, the upgrade can be done with no risk of losing data. If you are installing CRDs manually, you will need to deploy the bundle CRD file available at `deploys/crds/bundle.yaml`. This bundle file contains `v1beta1` definition and a conversion webhook configuration. This configuration will ensure that new requests to handle any CRD object will only be valid after the upgrade is successfully complete - so there are no risks of losing data due to an incomplete upgrade. Once the new CRDs are applied, you can proceed to upgrade the controller version. Once the upgrade is finished, at each reconcile, any `ExternalSecret`, `SecretStore`, and `ClusterSecretStore` stored in `v1alpha1` will be automatically converted to `v1beta1`.
Project: ShardingSphere (App Definition and Development / Database)
File: CNCF.en.md

+++ title = "Apache ShardingSphere is included in CNCF Landscape" weight = 8 chapter = true +++ (Cloud Native Computing Foundation), is a cloud native computing open source software foundation founded by Google. It is committed to the popularization and sustainable development of Cloud Native technology. Cloud native technology helps enterprises and organizations to build and run agile and scalable applications in modern dynamic environments (such as public clouds, private clouds, and hybrid clouds) through a series of software, specifications, and standards. The representative cloud-native technologies including containers, micro-services, micro-service governance, and declarative APIs, etc. (https://github.com/cncf/landscape) is an important project from CNCF. It aims to provide a resource map for cloud native users, enterprises and developers quickly understand the overall picture of the cloud native system. The CNCF divides the cloud-native ecosystem horizontally into five layers, and vertically maps out two parts for them which are common to the five horizontal layers. The five horizontally divisions layer are: Application Definition and Development, Orchestration and Governance, Runtime, Supply Assurance, and Cloud Facilities. The two vertically divided parts are: observation and analysis and platform. The integrating of these functions result in a complete cloud platform service product offering with the following panorama the -- The above content is taken from the book "Future Architecture: From Service to Cloud Native" On June 28, 2019, UTC+8, Apache ShardingSphere entered CNCF Landscape. It has a place in the following panorama App Definition Development-Database field. Apache ShardingSphere will keep going to expand and improve in the open source and cloud native fields, and builds an organic open source ecosystem! We are hoping that more supporters of open source and cloud-native communities can join us to move forward together and promote the common growth of the Apache ShardingSphere community and its contributors! Since Apache ShardingSphere has been open sourced in 2016, it has been constantly improving and developing, and has been recognized by more and more companies and individuals: 8000+ stars have been harvested on Github, and successful cases of nearly 100 companies. In addition, more and more enterprises and individuals have joined the open source project of Apache ShardingSphere, which has contributed tremendously to its growth and development.
Project: KICS (Provisioning / Security & Compliance)
File: 970d224d-b42a-416b-81f9-8f4dfe70c4bc.md

title: Root Account Has Active Access Keys hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 970d224d-b42a-416b-81f9-8f4dfe70c4bc Query name: Root Account Has Active Access Keys Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: The AWS Root Account must not have active access keys associated, which means if there are access keys associated to the Root Account, they must be inactive.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="2" resource "awsiamaccess_key" "positive1" { user = "root" pgpkey = "keybase:somepersonthatexists" } resource "awsiamuser" "positive3" { name = "loadbalancer" path = "/system/" } resource "awsiamuser_policy" "positive4" { name = "test" user = awsiamuser.lb.name policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } output "secret" { value = awsiamaccesskey.lb.encryptedsecret } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="4" resource "awsiamaccess_key" "positive2" { user = "root" pgpkey = "keybase:somepersonthatexists" status = "Active" } resource "awsiamuser" "lb" { name = "loadbalancer" path = "/system/" } resource "awsiamuser_policy" "positive5" { name = "test" user = awsiamuser.lb.name policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } output "secret" { value = awsiamaccesskey.lb.encryptedsecret } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamaccess_key" "negative1" { user = awsiamuser.lb.name pgpkey = "keybase:somepersonthatexists" } resource "awsiamuser" "negative2" { name = "loadbalancer" path = "/system/" } resource "awsiamuser_policy" "negative3" { name = "test" user = awsiamuser.lb.name policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:Describe*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } output "secret" { value = awsiamaccesskey.lb.encryptedsecret } ```
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: permissions.md

id: permissions title: Permissions Service sidebar_label: Permissions description: Documentation for the Permissions service This service allows your plugins to ask for authorization of user actions. The following example shows how to get the permissions service in your `example` backend to check to see if the user is allowed to perform a certain action with a custom permission rule. ```ts import { coreServices, createBackendPlugin, } from '@backstage/backend-plugin-api'; import { Router } from 'express'; createBackendPlugin({ pluginId: 'example', register(env) { env.registerInit({ deps: { permissions: coreServices.permissions, http: coreServices.httpRouter, }, async init({ permissions, http }) { const router = Router(); router.get('/test-me', (request, response) => { // use the identity service to pull out the token from request headers const { token } = await identity.getIdentity({ request, }); // ask the permissions framework what the decision is for the permission const permissionResponse = await permissions.authorize( [ { permission: myCustomPermission, }, ], { token }, ); }); http.use(router); }, }); }, }); ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.7.4.md

RabbitMQ `3.7.4` is a patch release that primarily includes bug fixes. This release has no known incompatibilities with earlier 3.7.x versions. See upgrade and compatibility notes if upgrading from an earlier release. See the for general documentation on upgrades. See for release notes of other releases. Priority queues could terminate when the node was under memory pressure and needed to offload messages to disk. GitHub issue: queue leader locator strategy of `min-masters` was affected by queue binding count and could select the wrong node. GitHub issue: It was not possible to set range via new style config file. GitHub issue: Windows scripts used `USE_LONGNAME` from the env file incorrectly. GitHub issue: systemd notification implementation was prone to shell escaping issues. GitHub issue: It wasn't possible to configure `delegate_count` via new style config file. GitHub issue: It wasn't possible to configure `net_ticktime` via new style config file. GitHub issue: It is now possible to configure max number of Erlang processes and atoms using `RABBITMQMAXNUMBEROFPROCESSES` (`MAXNUMBEROFPROCESSES` in `rabbitmq-env.conf`) and `RABBITMQMAXNUMBEROF_ATOMS` (`MAXNUMBEROF_ATOMS`) environment variables, respectively. GitHub issue: `SCHEDULERBINDTYPE` and `DISTRIBUTIONBUFFERSIZE` now can be used in `rabbitmq-env.conf` without the `RABBITMQ_` prefix. GitHub issue: `rabbitmq-plugins set` failed when was used in offline mode (with `--offline`) GitHub issue: `rabbitmqctl list_` command streaming now can be restricted to a set of client TCP ports used to contact RabbitMQ nodes. GitHub issue: Valid definitions could be rejected as invalid during import via HTTP API. GitHub issue: It wasn't possible to configure `path_prefix` via new style config file. GitHub issue: Valid upstreams were rejected as invalid when imported from a definition file. GitHub issue: Valid upstream sets were rejected as invalid when added using CLI tools. GitHub issue: The plugin skipped registration and thus injection. GitHub issue: Warning: The source code archive provided by GitHub only contains the source of the broker, not the plugins or the client libraries. Please download the archive named `rabbitmq-3.7.4.tar.gz`.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_compute_target_tcp_proxy.md

+++ title = "googlecomputetargettcpproxy resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlecomputetargettcpproxy" identifier = "inspec/resources/gcp/googlecomputetargettcpproxy.md googlecomputetargettcpproxy resource" parent = "inspec/resources/gcp" +++ A `googlecomputetargettcpproxy` is used to test a Google TargetTcpProxy resource This resource has beta fields available. To retrieve these fields, include `beta: true` in the constructor for the resource ```ruby describe googlecomputetargettcpproxy(project: 'chef-gcp-inspec', name: 'inspec-gcp-target-tcp-proxy') do it { should exist } its('proxy_header') { should eq 'NONE' } its('service') { should match /\/gcp-inspec-tcp-backend-service$/ } end describe googlecomputetargettcpproxy(project: 'chef-gcp-inspec', name: 'nonexistent') do it { should_not exist } end ``` Properties that can be accessed from the `googlecomputetargettcpproxy` resource: `creation_timestamp` : Creation timestamp in RFC3339 text format. `description` : An optional description of this resource. `id` : The unique identifier for the resource. `name` : Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash. `proxy_header` : Specifies the type of proxy header to append before sending data to the backend. Possible values: NONE PROXY_V1 `service` : A reference to the BackendService resource. Ensure the is enabled for the current project.
Project: KICS (Provisioning / Security & Compliance)
File: 4950837c-0ce5-4e42-9bee-a25eae73740b.md

title: PSP Allows Containers To Share The Host Network Namespace hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4950837c-0ce5-4e42-9bee-a25eae73740b Query name: PSP Allows Containers To Share The Host Network Namespace Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Check if Pod Security Policies allow containers to share the host network namespace.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8" resource "kubernetespodsecurity_policy" "example" { metadata { name = "terraform-example" } spec { privileged = false allowprivilegeescalation = false host_network = true volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetespodsecurity_policy" "example" { metadata { name = "terraform-example" } spec { privileged = false allowprivilegeescalation = false host_network = false volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ```