cwielenb/CNCF-Dataset huggingface dataset:
Project: Tetragon (Provisioning / Security & Compliance)
File: demo.md

This is a dev demo of how to install the teragon OCI hook on a CRI-O runtime. Note: we should move this to the documentation once the PR is merged and `tetragon-oci-hook` and `tetragon-oci-hook-setup` are part of the tetragon development image. Start minikube: ```shell-session minikube start --driver=kvm2 --container-runtime=cri-o ``` Build images and load them to minikube: ```shell-session make image image-operator minikube image load cilium/tetragon:latest minikube image load cilium/tetragon-operator:latest minikube image list | grep tetragon localhost/cilium/tetragon:latest localhost/cilium/tetragon-operator:latest ``` Install the image enabling the init container: ``` helm install --namespace kube-system \ --set tetragonOperator.image.override=localhost/cilium/tetragon-operator:latest \ --set tetragon.image.override=localhost/cilium/tetragon:latest \ --set tetragon.grpc.address="unix:///var/run/cilium/tetragon/tetragon.sock" \ --set tetragon.ociHookSetup.enabled=true \ tetragon ./install/kubernetes/tetragon ... kubectl logs -n kube-system tetragon-289tf -c oci-hook-setup time="2023-12-05T09:28:50Z" level=info msg="written binary" hook-dst-path=/hostInstall/tetragon-oci-hook time="2023-12-05T09:28:50Z" level=info msg="written conf" conf-dst-path=/hostHooks/tetragon-oci-hook.json ``` Check the hook looks: ``` minikube ssh -- tail -f /opt/tetragon/tetragon-oci-hook.log ... time="2023-12-05T09:31:08Z" level=info msg="hook request to agent succeeded" hook=create-container ... ``` You can now uninstall tetragon: ``` helm uninstall -n kube-system tetragon ``` In many situations, you would want the hook to keep running even if tetragon is not. Doing so, will allow you to configure a class of pods that can only run if tetragon is availble. To uninstall the hook, you can install the following daemonset: ``` kubectl -n kube-system apply -f contrib/rthooks/tetragon-oci-hook/k8s/ds-uninstall.yaml kubectl -n kube-system logs tetragon-oci-hook-uninstall-8t4bl -c setup time="2023-12-05T09:37:37Z" level=info msg="conf removed" conf-dst-path=/hostHooks/tetragon-oci-hook.json error="<nil>" time="2023-12-05T09:37:37Z" level=info msg="binary removed" bin-dst-path=/hostInstall/tetragon-oci-hook error="<nil>" ``` (NB: above is not ideal, we should find a better way to do this)
Project: Monokle (App Definition and Development / Application Definition & Image Build)
File: features.md

Here is a short list of some of the features currently in Monokle Desktop. A big thanks to the excellent project on GitHub for providing plentiful manifests for us to run Monokle Desktop against. Monokle Desktop compiles a list of all the objects in your repo (from files you didn't want ignored), to give you a handy overview of all your resources - . Surf upstream or downstream through your resources! Monokle Desktop highlights other resources that your selection has direct relations to and even provides you with the links to go to them quickly - . To preview the resources created by Kustomize or Helm, open the corresponding pane at the bottom of the first column. Do a quick dry-run, enabling you to navigate and debug the resources created by Kustomize or Helm. Apply them to the cluster when you are satisfied - read more about and . When you select a resource, Monokle Desktop will show which file it was defined in. A yellow warning triangle indicates that a resource is pointing to a link that does not exist. To browse a cluster instead of a repo, simply click the "Preview" button next to a file to import all objects from the cluster into Monokle Desktop - . If you need to make any immediate hot-fixes, simply modify the resource in the source editor and click the "Apply" button. Easily switch in between projects to more efficiently work with multiple projects at the same time. The Editor contains a Compare Resources button in the left panel. Selecting Compare Resources will open the Comparing Resources window: Almost anything that you work on in Monokle Desktop can be compared. Select from the drop down on the left side and the right side to do a compare of a local resource, a Kustomize or Helm preview or a cluster: Return to the Monokle home screen by clicking on the Monokle icon at the top left: Then select "New project": Monokle Desktop allows the use of templates to start a new project via the Start from a template option: The Create a Project from a Template dialog appears: Name your project, select its location and click Next: Select a Template. Monokle Desktop includes a default set of templates which are installed automatically when starting Monokle Desktop for the first time and available in the Templates Explorer when working with your Monokle Desktop projects: Check out the repository to see the complete list of templates that are included along with their corresponding schemas and manifests.
Project: KICS (Provisioning / Security & Compliance)
File: 965e8830-2bec-4b9b-a7f0-24dbc200a68f.md

title: Google Compute SSL Policy Weak Cipher In Use hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 965e8830-2bec-4b9b-a7f0-24dbc200a68f Query name: Google Compute SSL Policy Weak Cipher In Use Platform: Pulumi Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: This query confirms if Google Compute SSL Policy Weak Chyper Suits is Enabled, to do so we need to check if TLS is TLS12, because other version have Weak Chypers<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="16 7" name: aws-eks runtime: yaml description: An EKS cluster resources: example: type: gcp:compute:SSLPolicy properties: name: aws-eks runtime: yaml description: An EKS cluster resources: example: type: gcp:compute:SSLPolicy properties: minTlsVersion: TLS11 ``` ```yaml title="Negative test num. 1 - yaml file" name: aws-eks runtime: yaml description: An EKS cluster resources: example: type: gcp:compute:SSLPolicy properties: minTlsVersion: TLS12 ```
Project: Harbor (Provisioning / Container Registry)
File: 10-06-Change-scan-configuration.md

Test 10-06 Change scan configuration ======= To verify scan configuration can be changed correctly. User guide This test requires that a Harbor instance is running and available. Harbor is installed with trivy enable. A linux host with Docker CLI installed. Login harbor as admin. Push a image to a project. Click configuration. Click vulnerability. Set scan all to none. Click scan now. Check scan now button. Check the image scan time. Step 4 if a new installed Harbor,vulnerability not ready hit should exist. Step 5 schedule time input should disappear. Step 7 after click scan now, scan now button should be disabled. Step 8 scan timestamp should be the time when click scan now. None
Project: Salt Project (Provisioning / Automation & Configuration)
File: 3006.2.md

(release-3006.2)= <! Do not edit this file. This is auto generated. Edit the templates in doc/topics/releases/templates/ for a given release. --> <!-- Add release specific details below --> <!-- Do not edit the changelog below. This is auto generated. --> In scenarios where PythonNet fails to load, Salt will now fall back to WMI for gathering grains information fix CVE-2023-20897 by catching exception instead of letting exception disrupt connection Fixed gitfs cachedir_basename to avoid hash collisions. Added MP Lock to gitfs. These changes should stop race conditions. Upgrade to `requests==2.31.0` Due to: https://github.com/advisories/GHSA-j8r2-6x86-q33q Upgrade to `cryptography==41.0.3`(and therefor `pyopenssl==23.2.0` due to https://github.com/advisories/GHSA-jm77-qphf-c4w8) This only really impacts pip installs of Salt and the windows onedir since the linux and macos onedir build every package dependency from source, not from pre-existing wheels. Also resolves the following cryptography advisories: Due to: https://github.com/advisories/GHSA-5cpq-8wj7-hf2v https://github.com/advisories/GHSA-x4qr-2fvf-3mr5 https://github.com/advisories/GHSA-w7pp-m8wf-vj6r There is no security upgrade available for Py3.5 Bump to `certifi==2023.07.22` due to https://github.com/advisories/GHSA-xqr8-7jwr-rhp7 Upgrade `relenv` to `0.13.2` and Python to `3.10.12` Addresses multiple CVEs in Python's dependencies: https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-12
Project: ClickHouse (App Definition and Development / Database)
File: v24.1.4.20-stable.md

sidebar_position: 1 sidebar_label: 2024 Backported in : In case when `mergemaxblocksizebytes` is small enough and tables contain wide rows (strings or tuples) background merges may stuck in an endless loop. This behaviour is fixed. Follow-up for https://github.com/ClickHouse/ClickHouse/pull/59340. (). Backported in : If you want to run initdb scripts every time when ClickHouse container is starting you shoud initialize environment varible CLICKHOUSEALWAYSRUNINITDBSCRIPTS. (). Fix digest calculation in Keeper (). Fix distributed table with a constant sharding key (). Fix query start time on non initial queries (). Fix parsing of partition expressions surrounded by parens (). Temporarily remove a feature that doesn't work (). Make ZooKeeper actually sequentialy consistent (). Fix special build reports in release branches ().
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-exp-model-list.md

layout: default title: mesheryctl-exp-model-list permalink: reference/mesheryctl/exp/model/list redirect_from: reference/mesheryctl/exp/model/list/ type: reference display-title: "false" language: en command: exp subcommand: model list registered models list name of all registered models <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl exp model list [flags] </div> </pre> View list of models <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl exp model list </div> </pre> View list of models with specified page number (25 models per page) <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl exp model list --page 2 </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -c, --count (optional) Get the number of models in total -h, --help help for list -p, --page int (optional) List next set of models with --page (default = 1) (default 1) </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -v, --verbose verbose output </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: KICS (Provisioning / Security & Compliance)
File: 0afbcfe9-d341-4b92-a64c-7e6de0543879.md

title: CloudWatch Log Group Without KMS hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0afbcfe9-d341-4b92-a64c-7e6de0543879 Query name: CloudWatch Log Group Without KMS Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: AWS CloudWatch Log groups should be encrypted using KMS<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awscloudwatchlog_group" "negative1" { name = "Yada" tags = { Environment = "production" Application = "serviceA" } retentionindays = 1 } ``` ```tf title="Negative test num. 1 - tf file" resource "awscloudwatchlog_group" "negative1" { name = "Yada" tags = { Environment = "production" Application = "serviceA" } retentionindays = 1 kmskeyid = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: identity-manager.md

layout: integration title: Identity Manager subtitle: Collaborative and visual infrastructure as code for Identity Manager image: /assets/img/integrations/identity-manager/icons/color/identity-manager-color.svg permalink: extensibility/integrations/identity-manager docURL: https://docs.meshery.io/extensibility/integrations/identity-manager description: integrations-category: Provisioning integrations-subcategory: Key Management registrant: Artifact Hub components: name: workload-identity colorIcon: assets/img/integrations/identity-manager/components/workload-identity/icons/color/workload-identity-color.svg whiteIcon: assets/img/integrations/identity-manager/components/workload-identity/icons/white/workload-identity-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: KICS (Provisioning / Security & Compliance)
File: f7e296b0-6660-4bc5-8f87-22ac4a815edf.md

title: SQL Server Auditing Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f7e296b0-6660-4bc5-8f87-22ac4a815edf Query name: SQL Server Auditing Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Make sure that for SQL Servers, 'Auditing' is set to 'On'<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "azurermsqlserver" "positive1" { name = "mssqlserver" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location version = "12.0" administrator_login = "mradministrator" administratorloginpassword = "thisIsDog11" } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermsqlserver" "negative1" { name = "mssqlserver" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location version = "12.0" administrator_login = "mradministrator" administratorloginpassword = "thisIsDog11" extendedauditingpolicy { storageendpoint = azurermstorageaccount.example.primaryblob_endpoint storageaccountaccesskey = azurermstorageaccount.example.primaryaccess_key storageaccountaccesskeyis_secondary = true retentionindays = 90 } } ```
Project: Dragonfly (Provisioning / Container Registry)
File: dfstore_copy.md

% DFCACHE(1) Version v2.1.0 | Frivolous "Dfstore" Documentation dfstore cp copies a local file or dragonfly object to another location locally or in dragonfly object storage Copies a local file or dragonfly object to another location locally or in dragonfly object storage. ```shell dfstore cp <source> <target> [flags] ``` ```shell --filter string filter is used to generate a unique task id by filtering unnecessary query params in the URL, it is separated by & character -h, --help help for cp --max-replicas int maxReplicas is the maximum number of replicas of an object cache in seed peers (default 3) -m, --mode int mode is the mode in which the backend is written, when the value is 0, it represents AsyncWriteBack, and when the value is 1, it represents WriteBack -e, --endpoint string endpoint of object storage service (default "http://127.0.0.1:65004") ``` - object storage client of dragonfly
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-system-connection-remove.1.md

% podman-system-connection-remove 1 podman\-system\-connection\-remove - Delete named destination podman system connection remove [options] name Delete named ssh destination. Remove all connections. Remove the specified system connection: ``` $ podman system connection remove production ``` , , July 2020, Originally compiled by Jhon Honce (jhonce at redhat dot com)
Project: KICS (Provisioning / Security & Compliance)
File: 8b042c30-e441-453f-b162-7696982ebc58.md

title: Geo Redundancy Is Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8b042c30-e441-453f-b162-7696982ebc58 Query name: Geo Redundancy Is Disabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Backup URL: Make sure that on PostgreSQL Geo Redundant Backups is enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="2 31" resource "azurermpostgresqlserver" "positive1" { name = "dbserver" location = "usgovvirginia" resourcegroupname = azurermresourcegroup.jira_rg.name skuname = "GPGen5_4" version = "9.6" storage_mb = 640000 backupretentiondays = var.jirapostgredata_retention autogrowenabled = true administratorlogin = var.mpdb_username administratorloginpassword = azurermkeyvaultsecret.dbpswd.value sslenforcementenabled = true tags = local.postgresqlserver_tags } resource "azurermpostgresqlserver" "positive2" { name = "dbserver" location = "usgovvirginia" resourcegroupname = azurermresourcegroup.jira_rg.name skuname = "GPGen5_4" version = "9.6" storage_mb = 640000 backupretentiondays = var.jirapostgredata_retention georedundantbackup_enabled = false autogrowenabled = true administratorlogin = var.mpdb_username administratorloginpassword = azurermkeyvaultsecret.dbpswd.value sslenforcementenabled = false tags = local.postgresqlserver_tags } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermpostgresqlserver" "negative1" { name = "dbserver" location = "usgovvirginia" resourcegroupname = azurermresourcegroup.jira_rg.name skuname = "GPGen5_4" version = "9.6" storage_mb = 640000 backupretentiondays = var.jirapostgredata_retention georedundantbackup_enabled = true autogrowenabled = true administratorlogin = var.mpdb_username administratorloginpassword = azurermkeyvaultsecret.dbpswd.value sslenforcementenabled = false tags = local.postgresqlserver_tags } ```
Project: KICS (Provisioning / Security & Compliance)
File: 539e4557-d2b5-4d57-a001-cb01140a4e2d.md

title: Check Databricks Cluster GCP Attribute Best Practices hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 539e4557-d2b5-4d57-a001-cb01140a4e2d Query name: Check Databricks Cluster GCP Attribute Best Practices Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: One or some Databricks Cluster GCP Attribute Best Practices are not respected<br> ```tf title="Positive test num. 1 - tf file" hl_lines="11" resource "databricks_cluster" "positive" { cluster_name = "data" sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id autotermination_minutes = 20 autoscale { min_workers = 1 max_workers = 50 } gcp_attributes { availability = "PREEMPTIBLE_GCP" zone_id = "AUTO" } } ``` ```tf title="Negative test num. 1 - tf file" resource "databricks_cluster" "negative" { cluster_name = "Shared Autoscaling" sparkversion = data.databricksspark_version.latest.id nodetypeid = data.databricksnodetype.smallest.id autotermination_minutes = 20 autoscale { min_workers = 1 max_workers = 50 } gcp_attributes { availability = "PREEMPTIBLEWITHFALLBACK_GCP" zone_id = "auto" firstondemand = 1 spotbidprice_percent = 100 } } ```
Project: ClickHouse (App Definition and Development / Database)
File: azureBlobStorageCluster.md

slug: /en/sql-reference/table-functions/azureBlobStorageCluster sidebar_position: 55 sidebar_label: azureBlobStorageCluster title: "azureBlobStorageCluster Table Function" Allows processing files from in parallel from many nodes in a specified cluster. On initiator it creates a connection to all nodes in the cluster, discloses asterisks in S3 file path, and dispatches each file dynamically. On the worker node it asks the initiator about the next task to process and processes it. This is repeated until all tasks are finished. This table function is similar to the . Syntax ``` sql azureBlobStorageCluster(clustername, connectionstring|storageaccounturl, containername, blobpath, [accountname, account_key, format, compression, structure]) ``` Arguments `cluster_name` Name of a cluster that is used to build a set of addresses and connection parameters to remote and local servers. `connectionstring|storageaccounturl` connectionstring includes account name & key () or you could also provide the storage account url here and account name & account key as separate parameters (see parameters accountname & accountkey) `container_name` - Container name `blobpath` - file path. Supports following wildcards in readonly mode: ``, `*`, `?`, `{abc,def}` and `{N..M}` where `N`, `M` numbers, `'abc'`, `'def'` strings. `accountname` - if storageaccount_url is used, then account name can be specified here `accountkey` - if storageaccount_url is used, then account key can be specified here `format` The of the file. `compression` Supported values: `none`, `gzip/gz`, `brotli/br`, `xz/LZMA`, `zstd/zst`. By default, it will autodetect compression by file extension. (same as setting to `auto`). `structure` Structure of the table. Format `'column1name column1type, column2name column2type, ...'`. Returned value A table with the specified structure for reading or writing data in the specified file. Examples Select the count for the file `testcluster*.csv`, using all the nodes in the `cluster_simple` cluster: ``` sql SELECT count(*) from azureBlobStorageCluster( 'clustersimple', 'http://azurite1:10000/devstoreaccount1', 'testcontainer', 'testclustercount.csv', 'devstoreaccount1', 'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==', 'CSV', 'auto', 'key UInt64') ``` See Also
Project: ClickHouse (App Definition and Development / Database)
File: v23.9.6.20-stable.md

sidebar_position: 1 sidebar_label: 2023 Backported in : There was a potential vulnerability in previous ClickHouse versions: if a user has connected and unsuccessfully tried to authenticate with the "interserver secret" method, the server didn't terminate the connection immediately but continued to receive and ignore the leftover packets from the client. While these packets are ignored, they are still parsed, and if they use a compression method with another known vulnerability, it will lead to exploitation of it without authentication. This issue was found with by https://twitter.com/malacupa. (). Backported in : There was an attempt to have the proper listing in , but the fix itself was in the wrong place, so it's still broken. See an . (). Fix ON CLUSTER queries without database on initial node (). Fix buffer overflow in Gorilla codec (). Close interserver connection on any exception before authentication (). Fix client suggestions for user without grants (). Fix pygithub (). Avoid dependencies with no fixed versions (). Tiny improvement security ().
Project: Apache CarbonData (App Definition and Development / Database)
File: language-manual.md

<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> CarbonData has its own parser, in addition to Spark's SQL Parser, to parse and process certain Commands related to CarbonData table handling. You can interact with the SQL interface using the or over . Data Definition Statements ,,,,,, - - - Data Manipulation Statements , , , ,