cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 6b896afb-ca07-467a-b256-1a0077a1c08e.md

title: RBAC Wildcard In Rule hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6b896afb-ca07-467a-b256-1a0077a1c08e Query name: RBAC Wildcard In Rule Platform: Kubernetes Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Roles and ClusterRoles with wildcard RBAC permissions provide excessive rights to the Kubernetes API and should be avoided. The principle of least privilege recommends to specify only the set of needed objects and actions<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7 9 18 19 20 29 31" kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: rbac1 name: configmap-modifier rules: apiGroups: ["*"] resources: ["configmaps"] verbs: ["*"] kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: rbac2 name: configmap-modifier1 rules: apiGroups: ["*"] resources: ["*"] verbs: ["*"] kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: rbac3 name: configmap-modifier2 rules: operations: ["CREATE", "UPDATE"] apiGroups: ["*"] apiVersions: ["*"] resources: ["*"] verbs: ["POST"] ``` ```yaml title="Negative test num. 1 - yaml file" kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: opa name: configmap-modifier rules: apiGroups: [""] resources: ["configmaps"] verbs: ["update", "patch"] kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: namespace: opa name: configmap-modifier rules: apiGroups: [""] resources: ["searchmaps"] verbs: ["create", "patch"] ```
Project: KICS (Provisioning / Security & Compliance)
File: 6ccb85d7-0420-4907-9380-50313f80946b.md

title: Private Cluster Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6ccb85d7-0420-4907-9380-50313f80946b Query name: Private Cluster Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Kubernetes Clusters must be created with Private Clusters enabled, meaning the 'privateclusterconfig' must be defined and the attributes 'enableprivatenodes' and 'enableprivateendpoint' must be true<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 73 44 16 88 58 30" resource "googlecontainercluster" "positive1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive2" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 privateclusterconfig { enableprivateendpoint = true } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive3" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 privateclusterconfig { enableprivatenodes = true } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive4" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 privateclusterconfig { } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive5" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 privateclusterconfig { enableprivateendpoint = false enableprivatenodes = true } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive6" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 privateclusterconfig { enableprivateendpoint = true enableprivatenodes = false } timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive7" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 privateclusterconfig { enableprivateendpoint = false enableprivatenodes = false } timeouts { create = "30m" update = "40m" } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecontainercluster" "negative1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 privateclusterconfig { enableprivateendpoint = true enableprivatenodes = true } timeouts { create = "30m" update = "40m" } } ```
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: code-sample.md

This page provides some sample code which may be used in your example component. This code uses TypeScript, and the Markdown code fence to wrap the code. ```typescript const serviceEntityPage = ( <EntityLayout> <EntityLayout.Route path="/" title="Overview"> <Grid container spacing={3} alignItems="stretch"> <Grid item md={6}> <EntityAboutCard variant="gridItem" /> </Grid> </Grid> </EntityLayout.Route> <EntityLayout.Route path="/docs" title="Docs"> <EntityTechdocsContent /> </EntityLayout.Route> </EntityLayout> ); ``` Here is an example of Python code: ```python def getUsersInGroup(targetGroup, secure=False): if debug: print('targetGroup=[' + targetGroup + ']') ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_compute_ssl_certificate.md

+++ title = "googlecomputessl_certificate resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlecomputessl_certificate" identifier = "inspec/resources/gcp/googlecomputesslcertificate.md googlecomputesslcertificate resource" parent = "inspec/resources/gcp" +++ A `googlecomputessl_certificate` is used to test a Google SslCertificate resource This resource has beta fields available. To retrieve these fields, include `beta: true` in the constructor for the resource ```ruby describe googlecomputessl_certificate(project: 'chef-gcp-inspec', name: 'inspec-gcp-ssl-certificate') do it { should exist } its('description') { should eq 'A fake ssl certificate (DO NOT USE)' } its('certificate') { should eq '--BEGIN CERTIFICATE-- MIICqjCCAk+gAwIBAgIJAIuJ+0352Kq4MAoGCCqGSM49BAMCMIGwMQswCQYDVQQG EwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjERMA8GA1UEBwwIS2lya2xhbmQxFTAT BgNVBAoMDEdvb2dsZSwgSW5jLjEeMBwGA1UECwwVR29vZ2xlIENsb3VkIFBsYXRm b3JtMR8wHQYDVQQDDBZ3d3cubXktc2VjdXJlLXNpdGUuY29tMSEwHwYJKoZIhvcN AQkBFhJuZWxzb25hQGdvb2dsZS5jb20wHhcNMTcwNjI4MDQ1NjI2WhcNMjcwNjI2 MDQ1NjI2WjCBsDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xETAP BgNVBAcMCEtpcmtsYW5kMRUwEwYDVQQKDAxHb29nbGUsIEluYy4xHjAcBgNVBAsM FUdvb2dsZSBDbG91ZCBQbGF0Zm9ybTEfMB0GA1UEAwwWd3d3Lm15LXNlY3VyZS1z aXRlLmNvbTEhMB8GCSqGSIb3DQEJARYSbmVsc29uYUBnb29nbGUuY29tMFkwEwYH KoZIzj0CAQYIKoZIzj0DAQcDQgAEHGzpcRJ4XzfBJCCPMQeXQpTXwlblimODQCuQ 4mzkzTv0dXyB750fOGN02HtkpBOZzzvUARTR10JQoSe2/5PIwaNQME4wHQYDVR0O BBYEFKIQC3A2SDpxcdfn0YLKineDNq/BMB8GA1UdIwQYMBaAFKIQC3A2SDpxcdfn 0YLKineDNq/BMAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDSQAwRgIhALs4vy+O M3jcqgA4fSW/oKw6UJxp+M6a+nGMX+UJR3YgAiEAvvl39QRVAiv84hdoCuyON0lJ zqGNhIPGq2ULqXKK8BY= --END CERTIFICATE-- ' } end describe googlecomputessl_certificate(project: 'chef-gcp-inspec', name: 'nonexistent') do it { should_not exist } end ``` Properties that can be accessed from the `googlecomputessl_certificate` resource: `certificate` : The certificate in PEM format. The certificate chain must be no greater than 5 certs long. The chain must include at least one intermediate cert. `creation_timestamp` : Creation timestamp in RFC3339 text format. `description` : An optional description of this resource. `id` : The unique identifier for the resource. `name` : Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash. `private_key` : The write-only private key in PEM format. Ensure the is enabled for the current project.
Project: Druid (App Definition and Development / Database)
File: opentsdb-emitter.md

id: opentsdb-emitter title: "OpenTSDB Emitter" <!-- ~ Licensed to the Apache Software Foundation (ASF) under one ~ or more contributor license agreements. See the NOTICE file ~ distributed with this work for additional information ~ regarding copyright ownership. The ASF licenses this file ~ to you under the Apache License, Version 2.0 (the ~ "License"); you may not use this file except in compliance ~ with the License. You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, ~ software distributed under the License is distributed on an ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ~ KIND, either express or implied. See the License for the ~ specific language governing permissions and limitations ~ under the License. --> To use this Apache Druid extension, `opentsdb-emitter` in the extensions load list. This extension emits druid metrics to over HTTP (Using `Jersey client`). And this emitter only emits service metric events to OpenTSDB (See for a list of metrics). All the configuration parameters for the OpenTSDB emitter are under `druid.emitter.opentsdb`. |property|description|required?|default| |--|--||-| |`druid.emitter.opentsdb.host`|The host of the OpenTSDB server.|yes|none| |`druid.emitter.opentsdb.port`|The port of the OpenTSDB server.|yes|none| |`druid.emitter.opentsdb.connectionTimeout`|`Jersey client` connection timeout(in milliseconds).|no|2000| |`druid.emitter.opentsdb.readTimeout`|`Jersey client` read timeout(in milliseconds).|no|2000| |`druid.emitter.opentsdb.flushThreshold`|Queue flushing threshold.(Events will be sent as one batch)|no|100| |`druid.emitter.opentsdb.maxQueueSize`|Maximum size of the queue used to buffer events.|no|1000| |`druid.emitter.opentsdb.consumeDelay`|Queue consuming delay(in milliseconds). Actually, we use `ScheduledExecutorService` to schedule consuming events, so this `consumeDelay` means the delay between the termination of one execution and the commencement of the next. If your druid processes produce metric events fast, then you should decrease this `consumeDelay` or increase the `maxQueueSize`.|no|10000| |`druid.emitter.opentsdb.metricMapPath`|JSON file defining the desired metrics and dimensions for every Druid metric|no|./src/main/resources/defaultMetrics.json| |`druid.emitter.opentsdb.namespacePrefix`|Optional (string) prefix for metric names, for example the default metric name `query.count` with a namespacePrefix set to `druid` would be emitted as `druid.query.count` |no|null| The OpenTSDB emitter will send only the desired metrics and dimensions which is defined in a JSON file. If the user does not specify their own JSON file, a default file is used. All metrics are expected to be configured in the JSON file. Metrics which are not configured will be logged. Desired metrics and dimensions is organized using the following schema:`<druid metric name> : [ <dimension list> ]`<br /> e.g. ```json "query/time": [ "dataSource", "type" ] ``` For most use-cases, the default configuration is sufficient.
Project: Falco (Provisioning / Security & Compliance)
File: release_template.md

](https://github.com/falcosecurity/libs/releases/tag/LIBSVER) ](https://github.com/falcosecurity/libs/releases/tag/DRIVERVER) | Packages | Download | | -- | | | rpm-x8664 | ](https://download.falco.org/packages/rpmFALCOBUCKET/falco-FALCOVER-x8664.rpm) | | deb-x8664 | ](https://download.falco.org/packages/debFALCOBUCKET/stable/falco-FALCOVER-x8664.deb) | | tgz-x8664 | ](https://download.falco.org/packages/binFALCOBUCKET/x8664/falco-FALCOVER-x86_64.tar.gz) | | rpm-aarch64 | ](https://download.falco.org/packages/rpmFALCOBUCKET/falco-FALCOVER-aarch64.rpm) | | deb-aarch64 | ](https://download.falco.org/packages/debFALCOBUCKET/stable/falco-FALCOVER-aarch64.deb) | | tgz-aarch64 | ](https://download.falco.org/packages/binFALCOBUCKET/aarch64/falco-FALCOVER-aarch64.tar.gz) | | Images | | | | `docker pull docker.io/falcosecurity/falco:FALCOVER` | | `docker pull public.ecr.aws/falcosecurity/falco:FALCOVER` | | `docker pull docker.io/falcosecurity/falco-driver-loader:FALCOVER` | | `docker pull docker.io/falcosecurity/falco-driver-loader-legacy:FALCOVER` | | `docker pull docker.io/falcosecurity/falco-no-driver:FALCOVER` | | `docker pull docker.io/falcosecurity/falco-distroless:FALCOVER` |
Project: YDB (App Definition and Development / Database)
File: darwin_amd64.md

| Version | Release date | Download | Changelog | : | : | : | : | v.2.8.0 | 12/01/2024 | | | | v.2.7.0 | 23/10/2023 | | | | v.2.6.0 | 07/09/2023 | | | | v.2.5.0 | 20/06/2023 | | | | v.2.4.0 | 24/05/2023 | | | | v.2.3.0 | 01/05/2023 | | | | v.2.2.0 | 03/03/2023 | | | | v.2.1.1 | 30/12/2022 | | | | v.2.1.0 | 18/11/2022 | | | | v.2.0.0 | 20/09/2022 | | | | v.1.9.2 | 30/06/2022 | | | v.1.9.1 | 25/06/2022 | | | | v.1.9.0 | 22/06/2022 | | | v.1.8.0 | 19/04/2022 | | | v.1.7.0 | 01/03/2022 | | | v.1.6.0 | 24/12/2021 | |
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: CONTRIBUTING.md

Welcome to Kubernetes. We are excited about the prospect of you joining our ! The Kubernetes community abides by the CNCF . Here is an excerpt: As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities. We have full documentation on how to get started contributing here: <! If your repo has certain guidelines for contribution, put them here ahead of the general k8s resources --> Kubernetes projects require that you sign a Contributor License Agreement (CLA) before we can accept your pull requests - Main contributor documentation, or you can just jump directly to the - Common resources for existing developers - We have a diverse set of mentorship programs available that are always looking for volunteers! <! Custom Information - if you're copying this template for the first time you can add custom content here, for example: - Replace `kubernetes-users` with your slack channel string, this will send users directly to your channel. -->
Project: KICS (Provisioning / Security & Compliance)
File: 2fc99041-ddad-49d5-853f-e35e70a48391.md

title: Restart Policy On Failure Not Set To 5 hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2fc99041-ddad-49d5-853f-e35e70a48391 Query name: Restart Policy On Failure Not Set To 5 Platform: DockerCompose Severity: <span style="color:#ff7213">Medium</span> Category: Build Process URL: Attribute 'restart:on-failure' should be set to 5. Restart policies in general should be used, and 5 retries is the recommended by CIS.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17 6" version: "3.9" services: customer: image: whoa/hello restart: on-failure:10 networks: netnet expose: 8080 ports: 8082:8080 deploy: restart_policy: condition: on-failure delay: 5s max_attempts: 10 window: 120s networks: netnet: ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="15" version: '3.6' networks: nameofnetwork: name: nameofnetwork driver: overlay services: nameofservice: image: notareal_one container_name: container1 build: ./ ports: '5002:80' restart: on-failure:3 networks: nameofnetwork ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="6" version: "3.9" services: customer: image: whoa/hello restart: on-failure:10 networks: netnet expose: 8080 ports: 8082:8080 deploy: restart_policy: condition: on-failure delay: 5s max_attempts: 5 window: 120s networks: netnet: ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="17" version: "3.9" services: customer: image: whoa/hello restart: on-failure:5 networks: netnet expose: 8080 ports: 8082:8080 deploy: restart_policy: condition: on-failure delay: 5s max_attempts: 10 window: 120s networks: netnet: ``` </details> ```yaml title="Negative test num. 1 - yaml file" version: "3.9" services: customer: image: whoa/hello restart: on-failure:5 networks: netnet expose: 8080 ports: 8082:8080 deploy: restart_policy: condition: on-failure delay: 5s max_attempts: 5 window: 120s networks: netnet: ```
Project: KICS (Provisioning / Security & Compliance)
File: e2de2b80-2fc2-4502-a764-40930dfcc70a.md

title: Nifcloud ELB Use HTTP Protocol hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e2de2b80-2fc2-4502-a764-40930dfcc70a Query name: Nifcloud ELB Use HTTP Protocol Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: The elb use http protocol<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "nifcloud_elb" "positive" { availability_zone = "east-11" instance_port = 80 protocol = "HTTP" lb_port = 80 network_interface { networkid = "net-COMMONGLOBAL" isvipnetwork = true } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "nifcloud_elb" "positive" { availability_zone = "east-11" instance_port = 80 protocol = "HTTP" lb_port = 80 network_interface { networkid = "net-COMMONGLOBAL" isvipnetwork = true } network_interface { networkid = "net-COMMONPRIVATE" } } ``` ```tf title="Negative test num. 1 - tf file" resource "nifcloud_elb" "negative" { availability_zone = "east-11" instance_port = 443 protocol = "HTTPS" lb_port = 443 network_interface { networkid = "net-COMMONGLOBAL" isvipnetwork = true } } ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: chrony_conf.md

+++ title = "chrony_conf resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "chrony_conf" identifier = "inspec/resources/os/chronyconf.md chronyconf resource" parent = "inspec/resources/os" +++ Use the `chrony_conf` Chef InSpec audit resource to test the synchronization settings defined in the `chrony.conf` file. This file is typically located at `/etc/chrony.conf`. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} <!-- TODO: needs version number --> <!-- ### Version This resource first became available in v of InSpec. --> An `chrony_conf` resource block declares the synchronization settings that should be tested: ```ruby describe chrony_conf('PATH') do its('setting_name') { should eq 'VALUE' } end ``` where: `'setting_name'` is a synchronization setting defined in the `chrony.conf` file. `('path')` is the non-default path to the `chrony.conf` file (default path is `/etc/chrony.conf`). `{ should eq 'value' }` is the value that is expected. The following examples show how to use this Chef InSpec audit resource. This resource matches any service listed in the `chrony.conf` file. ```ruby describe chrony_conf do its('driftfile') { should cmp '/var/lib/chrony/drift' } its('server') do should cmp [ '0.ubuntu.pool.ntp.org', '1.ubuntu.pool.ntp.org', '2.ubuntu.pool.ntp.org' ] end end ``` ```ruby describe chrony_conf do its('server') { should_not eq nil } its('allow') { should include '192.168.0.0/16'} end ``` {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Docker Compose (App Definition and Development / Application Definition & Image Build)
File: compose_version.md

<!MARKERGENSTART--> Show the Docker Compose version information | Name | Type | Default | Description | |:--|:|:--|:| | `--dry-run` | | | Execute command in dry run mode | | `-f`, `--format` | `string` | | Format the output. Values: [pretty \| json]. (Default: pretty) | | `--short` | | | Shows only Compose's version number | <!MARKERGENEND-->
Project: KICS (Provisioning / Security & Compliance)
File: d6e10477-2e19-4bcd-b8a8-19c65b89ccdf.md

title: Node Auto Upgrade Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d6e10477-2e19-4bcd-b8a8-19c65b89ccdf Query name: Node Auto Upgrade Disabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: Kubernetes nodes must have auto upgrades set to true, which means Node 'auto_upgrade' should be enabled for Kubernetes Clusters<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3 36 22" name: create a node pool google.cloud.gcpcontainernode_pool: name: my-pool initialnodecount: 4 cluster: "{{ cluster }}" location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a second node pool google.cloud.gcpcontainernode_pool: name: my-pool initialnodecount: 4 cluster: "{{ cluster }}" location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present management: auto_repair: yes name: create a third node pool google.cloud.gcpcontainernode_pool: name: my-pool initialnodecount: 4 cluster: "{{ cluster }}" location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present management: auto_repair: yes auto_upgrade: no ``` ```yaml title="Negative test num. 1 - yaml file" name: create a node pool google.cloud.gcpcontainernode_pool: name: my-pool initialnodecount: 4 cluster: '{{ cluster }}' location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present management: auto-repair: yes auto_upgrade: yes ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: _index.md

+++ title = "InSpec Resources Reference" draft = false gh_repo = "inspec" [menu] [menu.inspec] title = "InSpec Resources (Single Page)" identifier = "inspec/resources/_index.md Chef InSpec Resources (Single Page)" parent = "inspec/resources" weight = 10 +++ The following list of InSpec resources are available. {{< inspec/inspecresourcesfilter >}} {{< inspec/inspec_resources platform="os" >}} The following resources work on Linux operating systems. {{< inspec/inspec_resources platform="linux" >}} The following resources work on BSD operating systems. {{< inspec/inspec_resources platform="bsd" >}} The following resources work on Windows operating systems. {{< inspec/inspec_resources platform="windows" >}} {{< inspec/inspec_resources platform="alicloud" >}} {{< inspec/inspec_resources platform="aws" >}} {{< inspec/inspec_resources platform="azure" >}} {{< inspec/inspec_resources platform="gcp" >}} {{< inspec/inspec_resources platform="habitat" >}} {{< inspec/inspec_resources platform="k8s" >}}