cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: b1ffa705-19a3-4b73-b9d0-0c97d0663842.md

title: IAM Role With Full Privileges hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b1ffa705-19a3-4b73-b9d0-0c97d0663842 Query name: IAM Role With Full Privileges Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: IAM role policy that allow full administrative privileges (for all resources)<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4 29" resource "awsiamrole" "positive1" { name = "test_role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": ["*"], "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Resource": "*", "Sid": "" } ] } EOF tags = { tag-key = "tag-value" } } resource "awsiamrole" "positive2" { name = "test_role2" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "*", "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Resource": "*", "Sid": "" } ] } EOF tags = { tag-key = "tag-value" } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamrole" "negative1" { name = "test_role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": ["some:action"], "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Resource": "*", "Sid": "" } ] } EOF tags = { tag-key = "tag-value" } } ```
Project: SuperEdge (Provisioning / Automation & Configuration)
File: template.md

<!-- toc --> - - <!-- /toc --> <!-- This section is for explicitly listing the motivation, goals and non-goals of this KEP. --> There is currently no standard way to deploy Nginx Ingress in SuperEdge. This KEP proposes a method to deploy Nginx Ingress in SuperEdge. It aims for minimal additional configuration, making SuperEdge Nginx Ingress as easy to use as Kubernetes. <!-- List the specific goals of the KEP. What is it trying to achieve? How will we know that this has succeeded? --> Goal-A. Goal-B. <!-- What is out of scope for this KEP? Listing non-goals helps to focus discussion and make progress. --> Non-Goal-A. Non-Goal-B. <!-- This section should contain enough information that the specifics of your change are understandable. This may include API specs (though not always required) or even code snippets. If there's any ambiguity about HOW your proposal will be implemented, this is the place to discuss them. -->
Project: Pachyderm (App Definition and Development / Streaming & Messaging)
File: demo-script.md

Setup -- Run `./setup-demo.sh` You'll want to do that, and run through this script before any demo (to cache the opencv image) Then do a `pachctl delete all` and re-create the images repo Demo Local setup minikube local VM running k8s kubectl get all running all on my machine from a VM pachctl list repo see images repo version control data all terms from git ```shell pachctl put file images@master -i examples/opencv/images.txt ``` show them the mount locally view the data can see repo images now there is an image in it because everything is snapshotted (commit 0) statue of liberty ```shell pachctl put file images@master -i examples/opencv/images2.txt ``` refresh new commit -- master/1 overlays data based on diffs / analgous to git diffs first one is there two more on top of it ```shell pachctl create pipeline -f edges.json pachctl list job ``` the pipeline uses openCV show powerpoint from dropbox: show them the pipeline code (or show in vim) take intput / output repo multiple inputs subscribe to new data coming in on data repo describe w json manifest dont know opencv just pull in a library as a processing step plug and play different approaches / steps of analysis NOTE!!! create pipeline will take 5 min now if you haven't cached the opencv image so do it once before, then do delete all see output of pipeline output commits correspond to input structure ```shell pachctl put file images@master -c -i examples/opencv/images3.txt ``` kicks off the pipeline see new commit in the edges repo Common questions provenance look at input commits for one of the outputs no reprocessing! only processed the new images per commit if you delete minikube has to pull container again you can just kill pachyderm, thats ok Gotchas VM network req broken putfile / do delete all to recover
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-kube-down.1.md

% podman-kube-down 1 podman-kube-down - Remove containers and pods based on Kubernetes YAML podman kube down [options] file.yml|-|https://website.io/file.yml podman kube down reads a specified Kubernetes YAML file, tearing down pods that were created by the `podman kube play` command via the same Kubernetes YAML file. Any volumes that were created by the previous `podman kube play` command remain intact unless the `--force` options is used. If the YAML file is specified as `-`, `podman kube down` reads the YAML from stdin. The input can also be a URL that points to a YAML file such as https://podman.io/demo.yml. `podman kube down` tears down the pods and containers created by `podman kube play` via the same Kubernetes YAML from the URL. However, `podman kube down` does not work with a URL if the YAML file the URL points to has been changed or altered since the creation of the pods and containers using `podman kube play`. Tear down the volumes linked to the PersistentVolumeClaims as part --down Example YAML file `demo.yml`: ``` apiVersion: v1 kind: Pod metadata: ... spec: containers: command: top name: container value: podman image: foobar ... ``` Remove the pod and containers as described in the `demo.yml` file ``` $ podman kube down demo.yml Pods stopped: 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 Pods removed: 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 ``` Remove the pod and containers as described in the `demo.yml` file YAML sent to stdin ``` $ cat demo.yml | podman kube play - Pods stopped: 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 Pods removed: 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 ``` Remove the pods and containers as described in the `demo.yml` file YAML read from a URL ``` $ podman kube down https://podman.io/demo.yml Pods stopped: 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 Pods removed: 52182811df2b1e73f36476003a66ec872101ea59034ac0d4d3a7b40903b955a6 ``` `podman kube down` does not work with a URL if the YAML file the URL points to has been changed or altered since it was used to create the pods and containers. , , , ,
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_dataprotection_delete-backup.md

title: kbcli dataprotection delete-backup Delete a backup. ``` kbcli dataprotection delete-backup [flags] ``` ``` kbcli dp delete-backup mybackup ``` ``` -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace. --auto-approve Skip interactive approval before deleting --cluster string The cluster name. --force If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation. --grace-period int Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion). (default -1) -h, --help help for delete-backup --now If true, resources are signaled for immediate shutdown (same as --grace-period=1). -l, --selector string Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2). Matching objects must satisfy all of the specified label constraints. ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Data protection command.
Project: YugabyteDB (App Definition and Development / Database)
File: batch-operations-ysql.md

title: Batch operations in YSQL headerTitle: Batch operations linkTitle: 6. Batch operations description: Learn how batch operations in YSQL send a set of operations as a single RPC call rather than one by one as individual RPC calls. menu: v2.18: identifier: batch-operations-2-ysql parent: learn weight: 568 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li > <a href="{{< relref "./batch-operations-ysql.md" >}}" class="nav-link active"> <i class="icon-postgres" aria-hidden="true"></i> YSQL </a> </li> <li > <a href="{{< relref "./batch-operations-ycql.md" >}}" class="nav-link"> <i class="icon-cassandra" aria-hidden="true"></i> YCQL </a> </li> </ul> Batch operations is the ability to send a set of operations as one operation (RPC call) to the database instead of sending the operations one by one as individual RPC calls. For use cases requiring high throughput, batch operations can be very efficient since it is possible to reduce the overhead of multiple RPC calls. The larger the batch size, the higher the latency for the entire batch. Although the latency for the entire batch of operations is higher than the latency of any single operation, the throughput of the batch of operations is much higher. YSQL content coming soon.
Project: zot (Provisioning / Container Registry)
File: guidelines.md

Logs from `zot` can be pushed to the popular ELK stack and therefore they become one of the service level indicators (SLI). It is therefore important to set guidelines about how we log in this project. Depending on whether a log message is useful in development or production, set the appropriate level. Development code should use DEBUG level. We use structured logs (currently via the `zerolog` library). Use lower-case strings by default The "message" field should not have any formatting strings For example, ``` log.Info().Msg(fmt.Sprintf("this is a %s message", "test")) ``` So that exact string matches are possible on the "message" field. All parameters should be specified separately as part of the log. For example, ``` log.Info().Str("stringParam", "stringValue").Msg("static message") ``` Instead of: ``` log.Info().Msg("module: message") ``` use: ``` log.Info().Str("module", "module").Msg("message") ``` OR if you want to a reusable logger then: ``` log.Info().With().Str("module", "module1").Logger().Msg("message") ``` Not all errors are really errors. For example, lookup a cache (fast path) and it throws a not-found error, and we expect to handle it and perform a slow path lookup. Instead of logging the lookup failure at ERROR level, it may be more appropriate to log at DEBUG level and then handle the error. Also, instead of `Msg("error at something")` standardize on `Msg("failed at something")`.
Project: StarRocks (App Definition and Development / Database)
File: avg.md

displayed_sidebar: "English" Returns the average value of selected fields. Optional field DISTINCT parameters can be used to return the weighted average. ```Haskell AVG([DISTINCT] expr) ``` ```plain text MySQL > SELECT datetime, AVG(cost_time) FROM log_statis group by datetime; ++--+ | datetime | avg(`cost_time`) | ++--+ | 2019-07-03 21:01:20 | 25.827794561933533 | ++--+ MySQL > SELECT datetime, AVG(distinct cost_time) FROM log_statis group by datetime; +++ | datetime | avg(DISTINCT `cost_time`) | +++ | 2019-07-04 02:23:24 | 20.666666666666668 | +++ ``` AVG
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.8.20.md

RabbitMQ `3.8.20` is a maintenance release. RabbitMQ releases are distributed via , , and . This release and . explains what package repositories and tools can be used to provision modern Erlang versions. See the for general documentation on upgrades and for release notes of other releases. If upgrading from a`3.7.x` release, see upgrade and compatibility notes first. If upgrading from a `3.6.x` or older , first upgrade to and then to this version. Any questions about this release, upgrades or RabbitMQ in general are welcome on the and . Release notes are kept under . Contributors are encouraged to update them together with their changes. This helps with release automation and more consistent release schedule. Nodes failed to start when hostname contained non-ASCII (broader Unicode) characters. GitHub issue: TLS information delivered in header is now attached to connection metrics as if it was provided by a non-proxying client. GitHub issue: contributed by @prefiks `rabbitmq-upgrade drain` and `rabbitmq-upgrade revive` now log and `warning` and `info` level instead of `alert` (that can show up as `error`). GitHub issue: HTTP API now includes `WWW-Authentiate` header into 401 responses to requests that contain invalid credentials GitHub issue: Queue name is now validated for length according to the AMQP 0-9-1 spec. GitHub issue: Multiple Shovels could be started in some cases involving node restarts of failures. GitHub issue: Multiple Federation links could be started in some cases involving node restarts of failures. GitHub issue: New releases of the client are again published to Hex.pm. GitHub issue: `connection_timeout` was adjusted to avoid a confusing warning. GitHub issue: contributed by @britto Corrected a typo in direct connection net tick time adjustment. GitHub issue: contributed by @britto No dependency changes in this release. To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.8.20.tar.xz` instead of the source tarball produced by GitHub.
Project: kube-hunter (Provisioning / Security & Compliance)
File: KHV005.md

vid: KHV005 title: Access to Kubernetes API categories: [Information Disclosure, Unauthenticated Access] severity: high Kubernetes API was accessed with Pod Service Account or without Authentication (see report message for details). Secure access to your Kubernetes API. It is recommended to explicitly specify a Service Account for all of your workloads (`serviceAccountName` in `Pod.Spec`), and manage their permissions according to the least privilege principal. Consider opting out automatic mounting of SA token using `automountServiceAccountToken: false` on `ServiceAccount` resource or `Pod.spec`.
Project: BigchainDB (App Definition and Development / Database)
File: extend-post-txn.md

<! Copyright 2020 Interplanetary Database Association e.V., BigchainDB and IPDB software contributors. SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0) Code is Apache-2.0 and docs are CC-BY-4.0 > Add new query parameter `mode` to the such that client can, asynchronously post the transaction post the transaction and return after it has been validated post the transaction and return after it has been committed When posting a transaction it is broadcast asynchronously to Tendermint which enables the client to return immediately. Furthermore, the transaction status API would allow the client to get the current status for a given transaction. The above workflow seems efficient when the client doesn't need to wait until a transaction gets committed. In case a client wishes to wait until a transaction gets committed it would need to poll the transaction status api. The Tendermint api allows to post a transaction in , `/broadcasttxasync` post transaction and return `/broadcasttxsync` post transaction and return after `checkTx` is executed `/broadcasttxcommit` post transaction and return after the transaction has been committed allow clients to post a transaction synchronously i.e. the `POST` transaction request returns after the transaction has passed `checkTx`. allow client to post a transaction and return after a transaction has been committed. Add query parameter `mode` to the N/A N/A The query parameter `mode` will be introduced to and will have the following possible values `async` `sync` `commit` To preserve compability with the existing behavour of the API, the query parameter `mode` is optional. In this case the default value would be `async`. example URI: `/api/v1/transaction?mode=async` N/A N/A The feature itself will not impact the client drivers but it may lead to being deprecated in the future. N/A The documentation for would need to describe the use of query parameter `mode`. Following new test cases should be included `POST` a transaction with no `mode` i.e. `POST /api/v1/transaction` `POST` a transaction with `mode=sync`, `mode=async`, `mode=commit` `POST` a transaction with invalid `mode` Primary assignee(s): @kansi BigchainDB 2.0 N/A
Project: Stolon (App Definition and Development / Database)
File: stolon-sentinel.md

``` stolon-sentinel [flags] ``` ``` --cluster-name string cluster name -h, --help help for stolon-sentinel --initial-cluster-spec string a file providing the initial cluster specification, used only at cluster initialization, ignored if cluster is already initialized --kube-resource-kind string the k8s resource kind to be used to store stolon clusterdata and do sentinel leader election (only "configmap" is currently supported) --log-color enable color in log output (default if attached to a terminal) --log-level string debug, info (default), warn or error (default "info") --metrics-listen-address string metrics listen address i.e "0.0.0.0:8080" (disabled by default) --store-backend string store backend type (etcdv2/etcd, etcdv3, consul or kubernetes) --store-ca-file string verify certificates of HTTPS-enabled store servers using this CA bundle --store-cert-file string certificate file for client identification to the store --store-endpoints string a comma-delimited list of store endpoints (use https scheme for tls communication) (defaults: http://127.0.0.1:2379 for etcd, http://127.0.0.1:8500 for consul) --store-key string private key file for client identification to the store --store-prefix string the store base prefix (default "stolon/cluster") --store-skip-tls-verify skip store certificate verification (insecure!!!) --store-timeout duration store request timeout (default 5s) ```
Project: KICS (Provisioning / Security & Compliance)
File: 9c3ea128-7e9a-4b4c-8a32-75ad17a2d3ae.md

title: Components Response Definition Is Unused hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9c3ea128-7e9a-4b4c-8a32-75ad17a2d3ae Query name: Components Response Definition Is Unused Platform: OpenAPI Severity: <span style="color:#5bc0de">Info</span> Category: Best Practices URL: Components responses definitions should be referenced or removed from Open API definition<br> ```json title="Positive test num. 1 - json file" hl_lines="50" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "$ref": "#/components/schemas/MyObject" } } } } }, "components": { "schemas": { "Error": { "type": "object", "properties": { "code": { "type": "string" }, "message": { "type": "string" }, "required": [ "code", "message" ] } }, "MyObject": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } } }, "responses": { "NotFound": { "description": "Resource not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } } ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="33" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': "$ref": "#/components/schemas/MyObject" components: schemas: Error: type: object properties: code: type: string message: type: string required: code message MyObject: type: object properties: id: type: string name: type: string responses: NotFound: description: Resource not found content: application/json: schema: "$ref": "#/components/schemas/Error" ``` ```json title="Negative test num. 1 - json file" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "404": { "$ref": "#/components/responses/NotFound" } } } } }, "components": { "schemas": { "Error": { "type": "object", "properties": { "code": { "type": "string" }, "message": { "type": "string" }, "required": [ "code", "message" ] } } }, "responses": { "NotFound": { "description": "Resource not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } } ``` ```yaml title="Negative test num. 2 - yaml file" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '404': "$ref": "#/components/responses/NotFound" components: schemas: Error: type: object properties: code: type: string message: type: string required: code message responses: NotFound: description: Resource not found content: application/json: schema: "$ref": "#/components/schemas/Error" ```
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: open-policy-registry.md

title: Open Policy Registry subtitle: A Docker-inspired workflow for OPA policies labels: category: containers layer: application inventors: aserto software: open-policy-registry code: https://github.com/opcr-io/policy tutorials: https://www.openpolicyregistry.io/docs/tutorial blogs: https://www.openpolicyregistry.io/blog/docker-workflow-for-opa docs_features: go-integration: note: | Makes use of the to interact with an OPA instance. opa-bundles: note: | OPCR policy images can be loaded in over the Bundle API. The feature it documented in the . opa-bundles-discovery: note: | OPCR images can be loaded in over the Bundle API and contain discovery bundles. The feature it documented in the . external-data: note: | OPCR policy images can contain data as well as policy. If you need to distribute data to OPA from an OCI registry, OPCR can build and push such images. See the docs for . The Open Policy Registry project provides a docker-style workflow for OPA policies. The policy CLI can be used to build, tag, sign, push, and pull OPA policies as OCIv2 container images, in conjunction with any container registry. The Open Policy Registry (OPCR) is a reference implementation of a policy registry, built and hosted on GCP.