cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 5c6dd5e7-1fe0-4cae-8f81-4c122717cef3.md

title: Kinesis SSE Not Configured hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5c6dd5e7-1fe0-4cae-8f81-4c122717cef3 Query name: Kinesis SSE Not Configured Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: AWS Kinesis Server data at rest should have Server Side Encryption (SSE) enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="34 12 42 23" resource "awskinesisfirehosedeliverystream" "positive1" { name = "${awss3bucket.logs.bucket}-firehose" destination = "extended_s3" kinesissourceconfiguration { kinesisstreamarn = awskinesisstream.cloudwatch-logs.arn rolearn = awsiamrole.firehoserole.arn } } resource "awskinesisfirehosedeliverystream" "positive2" { name = "${awss3bucket.logs.bucket}-firehose" destination = "extended_s3" } resource "awskinesisfirehosedeliverystream" "positive3" { name = "${awss3bucket.logs.bucket}-firehose" destination = "extended_s3" serversideencryption { enabled = false } } resource "awskinesisfirehosedeliverystream" "positive4" { name = "${awss3bucket.logs.bucket}-firehose" destination = "extended_s3" serversideencryption { enabled = true keytype = "AWSOWN" } } resource "awskinesisfirehosedeliverystream" "positive5" { name = "${awss3bucket.logs.bucket}-firehose" destination = "extended_s3" serversideencryption { enabled = true keytype = "CUSTOMERMANAGED_CMK" } } ``` ```tf title="Negative test num. 1 - tf file" resource "awskinesisfirehosedeliverystream" "negative1" { name = "${awss3bucket.logs.bucket}-firehose" destination = "extended_s3" serversideencryption { enabled = true keytype = "CUSTOMERMANAGED_CMK" key_arn = "qwewewre" } } resource "awskinesisfirehosedeliverystream" "negative2" { name = "${awss3bucket.logs.bucket}-firehose" destination = "extended_s3" serversideencryption { enabled = true keytype = "AWSOWNED_CMK" } } ```
Project: KICS (Provisioning / Security & Compliance)
File: ab759fde-e1e8-4b0e-ad73-ba856e490ed8.md

title: ECS Cluster with Container Insights Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ab759fde-e1e8-4b0e-ad73-ba856e490ed8 Query name: ECS Cluster with Container Insights Disabled Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: ECS Cluster should enable container insights<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4" Resources: ECSCluster: Type: 'AWS::ECS::Cluster' Properties: ClusterName: MyCluster Tags: Key: environment Value: production ``` ```json title="Positive test num. 2 - json file" hl_lines="7" { "Resources": { "ECSCluster": { "Type": "AWS::ECS::Cluster", "Properties": { "ClusterName": "MyCluster", "ClusterSettings": [], "Tags": [ { "Key": "environment", "Value": "production" } ] } } } } ``` ```json title="Positive test num. 3 - json file" hl_lines="7" { "Resources": { "ECSCluster": { "Type": "AWS::ECS::Cluster", "Properties": { "ClusterName": "MyCluster", "ClusterSettings": [ { "Name": "containerInsights", "Value": "disabled" } ], "Tags": [ { "Key": "environment", "Value": "production" } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: ECSCluster: Type: 'AWS::ECS::Cluster' Properties: ClusterName: MyCluster ClusterSettings: Name: containerInsights Value: enabled Tags: Key: environment Value: production ``` ```json title="Negative test num. 2 - json file" { "Resources": { "ECSCluster": { "Type": "AWS::ECS::Cluster", "Properties": { "ClusterName": "MyCluster", "ClusterSettings": [ { "Name": "containerInsights", "Value": "enabled" } ], "Tags": [ { "Key": "environment", "Value": "production" } ] } } } } ```
Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: ansible-base-images.md

title: Ansible Operator Base Images linkTitle: Base Images weight: 20 Ansible-based operators are built on top of base images built for use with the Operator-SDK. For Operator-SDK versions > `v1.30.0` the `quay.io/operator-framework/ansible-operator` base image has been updated to use Ansible 2.15. The Ansible 2.11 preview base image has been removed and will no longer be built/supported past Operator-SDK `v1.30`. For Operator-SDK versions <= `v1.30.0`, the below information applies: There have been some major changes in the Ansible ecosystem, primarily the addition of `collections` and the removal of these libraries from Ansible core. Ansible 2.9 is the last release of the "old way", with forward compatibility for collections. This is the version officially supported by the Operator-SDK. Ansible 2.10 was a transition release, and it is NOT recommended for use with operators. Ansible 2.11 is the future, and Operator-SDK will eventually provide only 2.11 images. Currently, 2.11 base images are in tech-preview. See: . For Operator-SDK versions > `v1.30.0` - Operators are scaffolded with the latest version of the base image (using Ansible 2.15). The base image name is the same as previous versions of the Operator-SDK. For Operator-SDK versions <= `v1.30.0`, the below information applies: Operators are scaffolded with the latest version of the base image (using Ansible 2.9) in the first line of the operator Dockerfile. `FROM quay.io/operator-framework/ansible-operator:v1.16` Operator authors who want to try out 2.11 can simply replace their FROM with: `FROM quay.io/operator-framework/ansible-operator-2.11-preview:v1.16`
Project: Puppet (Provisioning / Automation & Configuration)
File: http_facts.md

Facts ===== The `facts` endpoint allows setting the facts for the specified node name. Save Store facts for a node. The request body should contain JSON-formatted facts. PUT /puppet/v3/facts/:nodename?environment=:environment PUT `application/json` None Note: list of facts was shortened for readability. Note: JSON was formatted for readability. PUT /puppet/v3/facts/elmo.mydomain.com?environment=env Content-Type: application/json { "name": "elmo.mydomain.com", "values": { "architecture": "x86_64", "kernel": "Darwin", "domain": "local", "macaddress": "70:11:24:8c:33:a9", "osfamily": "Darwin", "operatingsystem": "Darwin", "facterversion": "1.7.2", "fqdn": "elmo.mydomain.com", }, "timestamp": "2013-09-09 15:49:27 -0700", "expiration": "2013-09-09 16:19:27 -0700" } HTTP/1.1 200 OK Content-Type: application/json Schema The representation of facts contained in a PUT body, should adhere to
Project: Pulsar (App Definition and Development / Streaming & Messaging)
File: pip_307.md

WebSocket currently only supports the consumption of a single topic, which cannot satisfy users' consumption scenarios of multiple topics. Supports consumption of multiple topics or pattern topics. Currently, the topic name is specified through path for consumption, like: ``` /ws/v2/consumer/persistent/my-property/my-ns/my-topic/my-subscription ``` If we want to support subscribing multi-topics, adding parameters will be confusing. Therefore, add a new v3 request path as follows: For consumption of pattern-topics: ``` /ws/v3/consumer/subscription?topicsPattern="a.*" ``` For consumption of multi-topics: ``` /ws/v3/consumer/subscription?topics="a,b,c" ``` Mailing List discussion thread: https://lists.apache.org/thread/co8396ywny161x91dffzvxlt993mo1ht Mailing List voting thread: https://lists.apache.org/thread/lk28o483y351s7m44p018320gq3g4507
Project: Kapitan (Provisioning / Automation & Configuration)
File: kap_2_helm_charts_input_type.md

This will allow kapitan, during compilation, to overwrite the values in user-specified helm charts using its inventory by calling the Go & Sprig template libraries. The helm charts can be specified via local path, and users may download the helm chart via (of http[s] type). Author: @yoshi-1224 This feature basically follows the `helm template` command available. This will run after the fetching of the external dependencies takes place, such that users can simultaneously specify the fetch as well as the import of a helm chart dependency. ```yaml kapitan: compile: input_type: helm inputpath: <pathtochartdir> outputpath: <outputpath> set-file: <optionalfilepath> ... valuesfile: <optionalvalues_file> namespace: <optional_namespace> ``` This mostly maps to the options available to `helm template` command (refer to ). C-binding between Helm (Go) and Kapitan (Python) will be created. Helm makes use of two template libraries, namely, text/template and Sprig. The code for `helm template` command will be converted into shared object (.so) using CGo, which exposes C interface that kapitan (i.e. CPython) could use. The source code for `helm template` command is found . This file will be modified to remove redundant options expose C-interface for Kapitan (possibly)
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: v0.3.2.md

sidebar_label: v0.3.2 OS X Process.Name function requires elevated permissions (, @sophon-zt) remove cached entry from SecretMap (, @shanshanying) pvc bound check wrong (, @lynnleelhl) check existence of address before retrieving IP (, @shanshanying) systemaccount controller doesn't set secret's owner when it refers a existing one (, @weicao) kbcli snapshot-controller.enabled supported in minikube (, @dengshaojiang) improve setup scripts to tolerate timeout error (, @lynnleelhl)
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-exp-connections-delete.md

layout: default title: mesheryctl-exp-connections-delete permalink: reference/mesheryctl/exp/connections/delete redirect_from: reference/mesheryctl/exp/connections/delete/ type: reference display-title: "false" language: en command: exp subcommand: connections Delete a connection Delete a connection <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl exp connections delete [flags] </div> </pre> Delete a connection <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl exp connections delete [connection_id] </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -h, --help help for delete -i, --id string ID of the connection to be deleted </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -v, --verbose verbose output </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: KICS (Provisioning / Security & Compliance)
File: 6f5f5444-1422-495f-81ef-24cefd61ed2c.md

title: Password Without Reuse Prevention hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6f5f5444-1422-495f-81ef-24cefd61ed2c Query name: Password Without Reuse Prevention Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: Password policy `passwordreuseprevention` doesn't exist or is equal to 0<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="26 3 23" name: Password policy for AWS account community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwmaxage: 60 pw_expire: false name: Password policy for AWS account2 community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwmaxage: 60 passwordreuseprevent: 0 pw_expire: false name: Password policy for AWS account3 community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwmaxage: 60 pw_expire: false ``` ```yaml title="Negative test num. 1 - yaml file" name: Password policy for AWS account community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwmaxage: 60 pwreuseprevent: 5 pw_expire: false name: Password policy for AWS account2 community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwmaxage: 60 passwordreuseprevent: 5 pw_expire: false name: Password policy for AWS account3 community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwmaxage: 60 prevent_reuse: 5 pw_expire: false ```
Project: KICS (Provisioning / Security & Compliance)
File: 6db03a91-f933-4f13-ab38-a8b87a7de54d.md

title: ElastiCache Nodes Not Created Across Multi AZ hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6db03a91-f933-4f13-ab38-a8b87a7de54d Query name: ElastiCache Nodes Not Created Across Multi AZ Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Availability URL: ElastiCache Nodes should be created across multi az, which means 'az_mode' should be set to 'cross-az' in multi nodes cluster<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 12" resource "awselasticachecluster" "positive1" { cluster_id = "cluster-example" engine = "memcached" numcachenodes = 3 } resource "awselasticachecluster" "positive2" { cluster_id = "cluster-example" engine = "memcached" numcachenodes = 3 az_mode = "single-az" } ``` ```tf title="Negative test num. 1 - tf file" resource "awselasticachecluster" "negative1" { cluster_id = "cluster-example" engine = "memcached" numcachenodes = 3 az_mode = "cross-az" } ```
Project: ArangoDB (App Definition and Development / Database)
File: tryx.md

+++ title = "`BOOSTOUTCOMETRYX(expr)`" description = "Evaluate an expression which results in an understood type, emitting the `T` if successful, immediately returning `tryoperationreturn_as(X)` from the calling function if unsuccessful." +++ Evaluate an expression which results in a type matching the following customisation points, emitting the `T` if successful, immediately returning {{% api "tryoperationreturn_as(X)" %}} from the calling function if unsuccessful: `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationhasvalue(X)" %}} `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationreturnas(X)" %}} `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationextractvalue(X)" %}} Default overloads for these customisation points are provided. See . Hints are given to the compiler that the expression will be successful. If you expect failure, you should use {{% api "BOOSTOUTCOMETRYXFAILURELIKELY(expr)" %}} instead. An internal temporary to hold the value of the expression is created, which generally invokes a copy/move. Availability: GCC and clang only. Use `#ifdef BOOSTOUTCOMETRYX` to determine if available. Overridable: Not overridable. Definition: See {{% api "BOOSTOUTCOMETRYV(expr)" %}} for most of the mechanics. This macro makes use of a proprietary extension in GCC and clang to emit the `T` from a successful expression. You can thus use `BOOSTOUTCOMETRYX(expr)` directly in expressions e.g. `auto x = y + BOOSTOUTCOMETRYX(foo(z));`. Be aware there are compiler quirks in preserving the rvalue/lvalue/etc-ness of emitted `T`'s, specifically copy or move constructors may be called unexpectedly and/or copy elision not work as expected. If these prove to be problematic, use {{% api "BOOSTOUTCOMETRY(var, expr)" %}} instead. Header: `<boost/outcome/try.hpp>`
Project: ThreatMapper (Provisioning / Security & Compliance)
File: docker.md

title: Docker On a Linux-based Docker host, the ThreatMapper agents are deployed as a lightweight container. Install a docker runtime on the Linux host. Refer to the for minimum supported platforms. For Windows Server hosts, experimental support exists, but it is not suitable for production use. Install and start the latest release of the deepfence sensor. Run the following command to start the sensor on the host, replacing the `CONSOLEURL` and `DEEPFENCEKEY` values: :::info Image tag `deepfenceio/deepfenceagentce:2.1.1-multiarch` is supported in amd64 and arm64/v8 architectures. ::: ```bash docker run -dit \ --cpus=".2" \ --name=deepfence-agent \ --restart on-failure \ --pid=host \ --net=host \ --log-driver json-file \ --log-opt max-size=50m \ --privileged=true \ -v /sys/kernel/debug:/sys/kernel/debug:rw \ -v /var/log/fenced \ -v /var/run/docker.sock:/var/run/docker.sock \ -v /:/fenced/mnt/host/:ro \ -e DFLOGLEVEL="info" \ -e USERDEFINEDTAGS="" \ -e MGMTCONSOLEURL="CONSOLE-IP" \ -e MGMTCONSOLEPORT="443" \ -e DEEPFENCE_KEY="DEEPFENCE-API-KEY" \ deepfenceio/deepfenceagentce:2.1.1 ``` Podman system service (API service) should be running before deploying the sensor (https://docs.podman.io/en/latest/markdown/podman-system-service.1.html) ```bash sudo podman run -dit \ --cpus=".2" \ --name=deepfence-agent \ --restart on-failure \ --pid=host \ --net=host \ --log-driver json-file \ --log-opt max-size=50m \ --privileged=true \ -v /sys/kernel/debug:/sys/kernel/debug:rw \ -v /var/log/fenced \ -v /run/podman/podman.sock:/run/podman/podman.sock \ -v /run/systemd/:/run/systemd/ \ -v /:/fenced/mnt/host/:ro \ -e DFLOGLEVEL="info" \ -e USERDEFINEDTAGS="" \ -e MGMTCONSOLEURL="CONSOLE-IP" \ -e MGMTCONSOLEPORT="443" \ -e DEEPFENCE_KEY="DEEPFENCE-API-KEY" \ docker.io/deepfenceio/deepfenceagentce:2.1.1 ``` :::tip Optionally the sensor container can be further tagged using ```USERDEFINEDTAGS=""``` in the above command. Tags should be comma separated, for example, ```"dev,front-end"```. ::: To upgrade a sensor install, stop the existing sensor and start the new version. If ThreatMapper management console is accessed through a proxy server, add the proxy server details to the docker configuration. Edit the file: `~/.docker/config.json`, and add the following content. Remember to change the proxy server ip address from 111.111.111.111 to your proxy server ip: ```json { "auths": { "https://index.docker.io/v1/": { "auth": "" } }, "HttpHeaders": { "User-Agent": "Docker-Client/19.03.1 (linux)" }, "proxies": { "default": { "httpProxy": "http://111.111.111.111:8006", "httpsProxy": "http://111.111.111.111:8006", "noProxy": "localhost,127.0.0.1" } } } ``` Restart the docker daemon: ```bash sudo systemctl restart docker ``` ThreatMapper agent VMs do not require any changes for proxy server.
Project: Harbor (Provisioning / Container Registry)
File: 2-06-DB-user-delete-projects.md

Test 2-06 - User Delete Projects (DB Mode) ======= To verify that a non-admin user can delete projects when users are managed locally by Harbor (DB mode). User guide This test requires that two(2) Harbor instances are running and available. Harbor is set to authenticate against a local database. ( auth_mode is set to db_auth* .) The user data is stored in a local database. A linux host with Docker CLI installed (Docker client). At least a non-admin user. NOTE: In below test, user A is non-admin user. User A and project X should be replaced by longer and meaningful names. Must use two kinds of browsers at the same time to ensure independent sessions. For example, use Chrome and Firefox, or Chrome and Safari. DO NOT use the same browser to log in two users at the same time in different windows(tabs). Log in to UI as user A (non-admin). Create a project X so that the user has the project admin role. On a Docker client, log in as User A and run `docker push` to push an image to project X, e.g. projectX/myimage:v1. Push an image with different name to project X, e.g. projectX/newimage:v1 . Run `docker pull` to verify images can be pulled successfully. In UI, delete project X directly. (should fail with errors) While keeping the current user A logged on, in a different browser, log in as admin user. Under "Admin Options", create a replication policy of project X to another Harbor instance. (Do not need to activate this policy.) Switch to the UI of User A, delete all images under project X. In user A's UI, delete project X directly. (should fail with errors) Switch to the UI of admin user, delete the replication policy of project X. In user A's UI, delete project X. In user A's UI, recreate project X, On a Docker client, log in as User A and run `docker push` to push an image to project X, e.g. projectX/anotherimage:v1. The image name should not be the same as those deleted in previous steps. Switch to the UI of admin user, view images under the re-created project X. As an admin user, view the log in dashboard and should see delete and create operations of project X. Step 6, deleting project X should fail because there are images under it. Step 10, deleting project X should fail because there is an image replication policy under it. Step 12, deleting project X should succeed. Step 13, re-creation of project X should succeed. Step 14, push should succeed. Step 15, project X should contain newly pushed image. The old images should not be displayed. Step 16, there should be logs for delete and create of project X, notice the project name of the deleted operation is displayed differently. None
Project: Druid (App Definition and Development / Database)
File: technology.md

title: Technology canonical: 'https://druid.apache.org/technology' <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at * http://www.apache.org/licenses/LICENSE-2.0 * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> Edit this page in the repo. To see your changes, navigate to them from the .
Project: Distribution (Provisioning / Container Registry)
File: azure.md

description: Explains how to use the Azure storage drivers keywords: registry, service, driver, images, storage, azure title: Microsoft Azure storage driver An implementation of the `storagedriver.StorageDriver` interface which uses for object storage. | Parameter | Required | Description | |:--|:|:--| | `accountname` | yes | Name of the Azure Storage Account. | | `accountkey` | yes | Primary or Secondary Key for the Storage Account. | | `container` | yes | Name of the Azure root storage container in which all registry data is stored. Must comply the storage container name . For example, if your url is `https://myaccount.blob.core.windows.net/myblob` use the container value of `myblob`.| | `realm` | no | Domain name suffix for the Storage Service API endpoint. For example realm for "Azure in China" would be `core.chinacloudapi.cn` and realm for "Azure Government" would be `core.usgovcloudapi.net`. By default, this is `core.windows.net`. | | `copystatuspollmaxretry` | no | Max retry number for polling of copy operation status. Retries use a simple backoff algorithm where each retry number is multiplied by `copystatuspoll_delay`, and this number is used as the delay. Set to -1 to disable retries and abort if the copy does not complete immediately. Defaults to 5. | | `copystatuspoll_delay` | no | Time to wait between retries for polling of copy operation status. This time is multiplied by N on each retry, where N is the retry number. Defaults to 100ms | To get information about , visit the Microsoft website. You can use Microsoft's to .