cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 3199c26c-7871-4cb3-99c2-10a59244ce7f.md

title: RDS Storage Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3199c26c-7871-4cb3-99c2-10a59244ce7f Query name: RDS Storage Not Encrypted Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: RDS Storage should be encrypted, which means the attribute 'storage_encrypted' should be set to 'true'<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsrdscluster" "positive1" { cluster_identifier = "aurora-cluster-demo" engine = "aurora-mysql" engineversion = "5.7.mysqlaurora.2.03.2" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backupretentionperiod = 5 preferredbackupwindow = "07:00-09:00" } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="10" resource "awsrdscluster" "positive3" { cluster_identifier = "cloudrail-test-non-encrypted" engine = "aurora-mysql" engineversion = "5.7.mysqlaurora.2.03.2" availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] database_name = "cloudrail" master_username = "administrator" master_password = "cloudrail-TEST-password" skipfinalsnapshot = true storage_encrypted = false } ``` ```tf title="Negative test num. 1 - tf file" resource "awsrdscluster" "negative1" { cluster_identifier = "cloudrail-test-non-encrypted" engine = "aurora-mysql" engineversion = "5.7.mysqlaurora.2.03.2" availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] database_name = "cloudrail" master_username = "administrator" master_password = "cloudrail-TEST-password" skipfinalsnapshot = true storage_encrypted = true } ``` ```tf title="Negative test num. 2 - tf file" resource "awsrdscluster" "negative2" { cluster_identifier = "cloudrail-test-non-encrypted" engine = "aurora-mysql" engineversion = "5.7.mysqlaurora.2.03.2" engine_mode = "serverless" availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] database_name = "cloudrail" master_username = "administrator" master_password = "cloudrail-TEST-password" skipfinalsnapshot = true } ```
Project: YugabyteDB (App Definition and Development / Database)
File: analyze,table_and_columns.diagram.md

<svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="459" height="80" viewbox="0 0 459 80"><path class="connector" d="M0 52h15m75 0h30m77 0h20m-112 0q5 0 5 5v8q0 5 5 5h87q5 0 5-5v-8q0-5 5-5m5 0h50m-5 0q-5 0-5-5v-20q0-5 5-5h61m24 0h62q5 0 5 5v20q0 5-5 5m-5 0h40m-212 0q5 0 5 5v8q0 5 5 5h187q5 0 5-5v-8q0-5 5-5m5 0h15"/><polygon points="0,59 5,52 0,45" style="fill:black;stroke-width:0"/><rect class="literal" x="15" y="35" width="75" height="25" rx="7"/><text class="text" x="25" y="52">ANALYZE</text><rect class="literal" x="120" y="35" width="77" height="25" rx="7"/><text class="text" x="130" y="52">VERBOSE</text><rect class="literal" x="323" y="5" width="24" height="25" rx="7"/><text class="text" x="333" y="22">,</text><a xlink:href="#table-and-columns"><rect class="rule" x="267" y="35" width="137" height="25"/><text class="text" x="277" y="52">tableandcolumns</text></a><polygon points="455,59 459,59 459,45 455,45" style="fill:black;stroke-width:0"/></svg> <svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="387" height="80" viewbox="0 0 387 80"><path class="connector" d="M0 52h15m91 0h30m25 0h30m-5 0q-5 0-5-5v-20q0-5 5-5h46m24 0h46q5 0 5 5v20q0 5-5 5m-5 0h30m25 0h20m-251 0q5 0 5 5v8q0 5 5 5h226q5 0 5-5v-8q0-5 5-5m5 0h15"/><polygon points="0,59 5,52 0,45" style="fill:black;stroke-width:0"/><a xlink:href="../../../syntaxresources/grammardiagrams#table-name"><rect class="rule" x="15" y="35" width="91" height="25"/><text class="text" x="25" y="52">tablename</text></a><rect class="literal" x="136" y="35" width="25" height="25" rx="7"/><text class="text" x="146" y="52">(</text><rect class="literal" x="232" y="5" width="24" height="25" rx="7"/><text class="text" x="242" y="22">,</text><a xlink:href="../../../syntaxresources/grammardiagrams#column-name"><rect class="rule" x="191" y="35" width="106" height="25"/><text class="text" x="201" y="52">columnname</text></a><rect class="literal" x="327" y="35" width="25" height="25" rx="7"/><text class="text" x="337" y="52">)</text><polygon points="383,59 387,59 387,45 383,45" style="fill:black;stroke-width:0"/></svg>
Project: KICS (Provisioning / Security & Compliance)
File: 015eac96-6313-43c0-84e5-81b1374fa637.md

title: Schema JSON Reference Does Not Exists (v3) hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 015eac96-6313-43c0-84e5-81b1374fa637 Query name: Schema JSON Reference Does Not Exists (v3) Platform: OpenAPI Severity: <span style="color:#5bc0de">Info</span> Category: Structure and Semantics URL: Schema reference should exists on components field<br> ```json title="Positive test num. 1 - json file" hl_lines="14" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "$ref": "#/components/schemas/MyWrongObject" } } } } }, "components": { "schemas": { "MyObject": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } } } } } ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="13" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': "$ref": "#/components/schemas/MyWrongObject" components: schemas: MyObject: type: object properties: id: type: string name: type: string ``` ```json title="Negative test num. 1 - json file" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "$ref": "#/components/schemas/MyObject" } } } } }, "components": { "schemas": { "MyObject": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } } } } } ``` ```yaml title="Negative test num. 2 - yaml file" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': "$ref": "#/components/schemas/MyObject" components: schemas: MyObject: type: object properties: id: type: string name: type: string ```
Project: ClickHouse (App Definition and Development / Database)
File: v22.8.7.34-lts.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Replace back `clickhouse su` command with `sudo -u` in start in order to respect limits in `/etc/security/limits.conf`. (). Backported in : - Choose correct aggregation method for LowCardinality with BigInt. (). Backported in : Update cctz to the latest master, update tzdb to 2020e. (). Backported in : Update tzdata to 2022e to support the new timezone changes. Palestine transitions are now Saturdays at 02:00. Simplify three Ukraine zones into one. Jordan and Syria switch from +02/+03 with DST to year-round +03. (https://data.iana.org/time-zones/tzdb/NEWS). This closes . (). Backported in : Removed skipping of mutations in unaffected partitions of `MergeTree` tables, because this feature never worked correctly and might cause resurrection of finished mutations. (). Backported in : Fixed "Part ... intersects part ..." error that might happen in extremely rare cases if replica was restarted just after detaching some part as broken. (). Prevent crash when passing wrong aggregation states to groupBitmap. (). - Fix read bytes/rows in X-ClickHouse-Summary with materialized views. (). Backported in : Fix reusing of files > 4GB from base backup. (). Backported in : Fix a bug with projections and the `aggregatefunctionsnullforempty` setting. This bug is very rare and appears only if you enable the `aggregatefunctionsnullforempty` setting in the server's config. This closes . (). Backported in : `ALTER UPDATE` of attached part (with columns different from table schema) could create an invalid `columns.txt` metadata on disk. Reading from such part could fail with errors or return invalid data. Fixes . (). Backported in : Setting `additionaltablefilters` were not applied to `Distributed` storage. Fixes . (). Backported in : Fix buffer overflow in the processing of Decimal data types. This closes . (). Backported in : This closes . (). Add a warning message to release.py script, require release type (). Revert ().
Project: GraphScope (App Definition and Development / Database)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: '' assignees: '' Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] Describe the solution you'd like A clear and concise description of what you want to happen. Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered. Additional context Add any other context or screenshots about the feature request here.
Project: Pachyderm (App Definition and Development / Streaming & Messaging)
File: doc-issue.md

name: Documentation issue about: Create a report to help us improve title: '' labels: docs assignees: '' <!-- This form is for documentation issues! If you're looking for help, please check: Docs: http://docs.pachyderm.com Slack: http://slack.pachyderm.io/ --> Provide a link to the page with an issue: Describe what is wrong: Describe the suggested changes: Anything else we need to know? Environment: Kubernetes version (use `kubectl version`): Pachyderm CLI and pachd server version (use `pachctl version`): Cloud provider (e.g. aws, azure, gke) or local deployment (e.g. minikube vs dockerized k8s): OS: Other:
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_clusterversion.md

title: kbcli clusterversion ClusterVersion command. ``` -h, --help help for clusterversion ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - List ClusterVersions. - Set the clusterversion to the default clusterversion for its clusterdefinition. - Unset the clusterversion if it's default.
Project: KICS (Provisioning / Security & Compliance)
File: 5ba316a9-c466-4ec1-8d5b-bc6107dc9a92.md

title: CloudTrail SNS Topic Name Undefined hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5ba316a9-c466-4ec1-8d5b-bc6107dc9a92 Query name: CloudTrail SNS Topic Name Undefined Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: Check if SNS topic name is set for CloudTrail<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2 15" name: no sns topic name community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket s3keyprefix: cloudtrail region: us-east-1 name: sns topic name defined community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket s3keyprefix: cloudtrail region: us-east-1 snstopicname: ``` ```yaml title="Negative test num. 1 - yaml file" name: sns topic name defined community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket s3keyprefix: cloudtrail region: us-east-1 snstopicname: sometopicname ```
Project: LinuxKit (Provisioning / Automation & Configuration)
File: virtual-os-tools.md

A number of provide tools or agents that can be installed inside of a virtualised operating system. These tools can consist of system daemons, kernel modules and general utilities that will provide a better experience (either through improvments of performance, management or user interaction) for the virtualised operating system. As every tool offers different feature sets, this summary details the more important features for OS tools. Capability to issue virtual machine power operations from within the Operating System, allowing application shutdown scripts to be ran. Synchronisation of clocks between the hypervisor and the virtualised Operating System. Capturing OS specific details such as a dynamically allocated IP address and exposing that to the virtualised management system or API. Freezing of virtualised Operating System for the hypervisor to take VM snapshots. Heart beat functionality from OS to the hypervisor, enabling the hypervisor to determine if the OS within the virtual machine has crashed. Execution of commands or scripts within the Operating System. As with all agents and additional tooling installed within an Operating System there is the concern of new attack vectors. With this category of tooling the majority of security issues are mitigated by the design that only the hypervisor can call upon these features. This essentially means that in order to exploit any of this exposed functionality one must first have access to or exploit the hypervisor, at which point the concerns around the tooling are moot. Also the use of these OS tools is optional, meaning that they can be enabled on a case-by-case basis. Website(s): / Usage: ``` services: name: open-vm-tools image: linuxkit/open-vm-tools:<HASH> ``` Website: Usage: ``` services: [TBD] ``` Website : Usage: ``` services: [TBD]
Project: KICS (Provisioning / Security & Compliance)
File: f2daed12-c802-49cd-afed-fe41d0b82fed.md

title: Same Alias In Different Froms hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f2daed12-c802-49cd-afed-fe41d0b82fed Query name: Same Alias In Different Froms Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Build Process URL: Different FROMS cant have the same alias defined<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="4" FROM baseImage RUN Test FROM debian:jesse2 as build RUN stuff FROM debian:jesse1 as build RUN more_stuff ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM debian:jesse1 as build RUN stuff FROM debian:jesse1 as another-alias RUN more_stuff ```
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-system-stop.md

layout: default title: mesheryctl-system-stop permalink: reference/mesheryctl/system/stop redirect_from: reference/mesheryctl/system/stop/ type: reference display-title: "false" language: en command: system subcommand: stop Stop Meshery Stop all Meshery containers / remove all Meshery resources. <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system stop [flags] </div> </pre> Stop Meshery <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system stop </div> </pre> Reset Meshery's configuration file to default settings. <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system stop --reset </div> </pre> (optional) keep the Meshery namespace during uninstallation <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system stop --keep-namespace </div> </pre> Stop Meshery forcefully (use it when system stop doesn't work) <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system stop --force </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --force (optional) uninstall Meshery resources forcefully -h, --help help for stop --keep-namespace (optional) keep the Meshery namespace during uninstallation --reset (optional) reset Meshery's configuration file to default settings. </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -c, --context string (optional) temporarily change the current context. -v, --verbose verbose output -y, --yes (optional) assume yes for user interactive prompts. </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: Carvel (App Definition and Development / Application Definition & Image Build)
File: README_Config.md

The following is a sample Lambda function that receives Amazon Config event record data as an input and writes some of the record data to CloudWatch Logs. (Note that anything written to stdout or stderr will be logged as CloudWatch Logs events.) ```go import ( "strings" "github.com/aws/aws-lambda-go/events" ) func handleRequest(ctx context.Context, configEvent events.ConfigEvent) { fmt.Printf("AWS Config rule: %s\n", configEvent.ConfigRuleName) fmt.Printf("Invoking event JSON: %s\n", configEvent.InvokingEvent) fmt.Printf("Event version: %s\n", configEvent.Version) } ```
Project: ClickHouse (App Definition and Development / Database)
File: setting.md

slug: /en/sql-reference/statements/alter/setting sidebar_position: 38 sidebar_label: SETTING There is a set of queries to change table settings. You can modify settings or reset them to default values. A single query can change several settings at once. If a setting with the specified name does not exist, then the query raises an exception. Syntax ``` sql ALTER TABLE [db].name [ON CLUSTER cluster] MODIFY|RESET SETTING ... ``` :::note These queries can be applied to tables only. ::: Changes table settings. Syntax ```sql MODIFY SETTING setting_name=value [, ...] ``` Example ```sql CREATE TABLE example_table (id UInt32, data String) ENGINE=MergeTree() ORDER BY id; ALTER TABLE exampletable MODIFY SETTING maxpartloadingthreads=8, maxpartsin_total=50000; ``` Resets table settings to their default values. If a setting is in a default state, then no action is taken. Syntax ```sql RESET SETTING setting_name [, ...] ``` Example ```sql CREATE TABLE example_table (id UInt32, data String) ENGINE=MergeTree() ORDER BY id SETTINGS maxpartloading_threads=8; ALTER TABLE exampletable RESET SETTING maxpartloadingthreads; ``` See Also
Project: Trivy (Provisioning / Security & Compliance)
File: cloudformation.md

Trivy supports the scanners listed in the table below. | Scanner | Supported | |::|::| | [Misconfiguration] | | | [Secret] | | It supports the following formats. | Format | Supported | |::|::| | JSON | | | YAML | | Trivy recursively searches directories and scans all found CloudFormation files. It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations. You can provide `cf-params` with path to [CloudFormation Parameters] file to Trivy to scan your CloudFormation code with parameters. ```bash trivy conf --cf-params params.json ./infrastructure/cf ``` You can check a [CloudFormation Parameters Example] The secret scan is performed on plain text files, with no special treatment for CloudFormation.
Project: YugabyteDB (App Definition and Development / Database)
File: mysql.md

<!-- +++ private=true +++ --> Create a database user and provide the user with READ access to all the resources which need to be migrated. Replace `<client_IP>` from the following commands with an appropriate hostname in your setup. Create a new user `ybvoyager`. ```sql CREATE USER 'ybvoyager'@'<clientIP>' IDENTIFIED WITH mysqlnative_password BY 'Password#123'; ``` Grant the global `PROCESS` permission. ```sql GRANT PROCESS ON . TO 'ybvoyager'@'<client_IP>'; ``` Grant the `SELECT`, `SHOW VIEW`, and `TRIGGER` permissions on the source database: ```sql GRANT SELECT ON sourcedbname.* TO 'ybvoyager'@'<client_IP>'; GRANT SHOW VIEW ON sourcedbname.* TO 'ybvoyager'@'<client_IP>'; GRANT TRIGGER ON sourcedbname.* TO 'ybvoyager'@'<client_IP>'; ``` Note that if you want to , include the following grants additionally as follows: For MYSQL ```sql GRANT FLUSHTABLES ON *.* TO 'ybvoyager'@'<clientIP>'; GRANT REPLICATION CLIENT ON . TO 'ybvoyager'@'<client_IP>'; ``` For MYSQL RDS ```sql GRANT FLUSHTABLES ON *.* TO 'ybvoyager'@'<clientIP>'; GRANT REPLICATION CLIENT ON . TO 'ybvoyager'@'<client_IP>'; GRANT LOCK TABLES ON <sourcedbname>.* TO 'ybvoyager'@'<client_IP>'; ``` If you are running MySQL version 8.0.20 or later, grant the global `SHOW_ROUTINE` permission. For older versions, grant the global `SELECT` permission. These permissions are necessary to dump stored procedure/function definitions. ```sql --For MySQL >= 8.0.20 GRANT SHOWROUTINE ON *.* TO 'ybvoyager'@'<clientIP>'; ``` ```sql --For older versions GRANT SELECT ON . TO 'ybvoyager'@'<client_IP>'; ``` The `ybvoyager` user can now be used for migration. If you want yb-voyager to connect to the source database over SSL, refer to .