cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 6cf4c3a7-ceb0-4475-8892-3745b84be24a.md

title: DNSSEC Using RSASHA1 hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6cf4c3a7-ceb0-4475-8892-3745b84be24a Query name: DNSSEC Using RSASHA1 Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: DNSSEC should not use the RSASHA1 algorithm<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="13" name: create a managed zone google.cloud.gcpdnsmanaged_zone: name: test_object dns_name: test.somewild2.example.com. description: test zone project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present dnssec_config: defaultKeySpecs: algorithm: RSASHA1 state: off ``` ```yaml title="Negative test num. 1 - yaml file" name: create a managed zone google.cloud.gcpdnsmanaged_zone: name: test_object dns_name: test.somewild2.example.com. description: test zone project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present dnssec_config: defaultKeySpecs: algorithm: RSASHA256 state: off ```
Project: KubeMQ (App Definition and Development / Streaming & Messaging)
File: kubemq_commands_send.md

Command send messages to 'commands' channel command Command send command allow to send messages to 'commands' channel with an option to set command time-out ``` kubemq commands send [flags] ``` ``` kubemq commands send some-channel some-command kubemq commands send some-channel some-body -m some-metadata kubemq commands send some-channel some-body -o 120 ``` ``` -h, --help help for send -m, --metadata string Set metadata body -o, --timeout int Set command timeout (default 30) ``` - Execute Kubemq 'commands'
Project: Meshery (Provisioning / Automation & Configuration)
File: openmetrics.md

layout: integration title: OpenMetrics subtitle: Collaborative and visual infrastructure as code for OpenMetrics image: /assets/img/integrations/openmetrics/icons/color/openmetrics-color.svg permalink: extensibility/integrations/openmetrics docURL: https://docs.meshery.io/extensibility/integrations/openmetrics description: integrations-category: Observability and Analysis integrations-subcategory: Monitoring registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: ContainerSSH (Provisioning / Security & Compliance)
File: README.md

](https://containerssh.io/) <!--suppress HtmlDeprecatedAttribute --> <h1 align="center">An SSH Server that Launches Containers in Kubernetes and Docker</h1> ](https://containerssh.io/) ](https://github.com/containerssh/containerssh/actions) ](https://github.com/containerssh/containerssh/releases) ](http://hub.docker.com/r/containerssh/containerssh) ](https://goreportcard.com/report/github.com/containerssh/containerssh) ](LICENSE.md) ](https://app.fossa.com/projects/git%2Bgithub.com%2FContainerSSH%2FContainerSSH?ref=badge_shield&issueType=license) In a hurry? This one-minute video explains everything you need to know about ContainerSSH. ](https://youtu.be/Cs9OrnPi2IM) Building a lab environment can be time-consuming. ContainerSSH solves this by providing dynamic SSH access with APIs, automatic cleanup on logout using ephemeral containers, and persistent volumes for storing data. Perfect for vendor and student labs. Provide production access to your developers, give them their usual tools while logging all changes. Authorize their access and create short-lived credentials for the database using simple webhooks. Clean up the environment on disconnect. Study SSH attack patterns up close. Drop attackers safely into network-isolated containers or even virtual machines, and capture their every move using the audit logging ContainerSSH provides. The built-in S3 upload ensures you don't lose your data. The user opens an SSH connection to ContainerSSH. ContainerSSH calls the authentication server with the users username and password/pubkey to check if its valid. ContainerSSH calls the config server to obtain backend location and configuration (if configured) ContainerSSH calls the container backend to launch the container with the specified configuration. All input from the user is sent directly to the backend, output from the container is sent to the user. | Each of the releases come with a SLSA provenance data file `multiple.intoto.jsonl`. This file can be used to verify the source and provenance of the produced artifacts with . This aims to ensure the users that the artifacts are coming from containerssh. An example of verification : ```sh slsa-verifier verify-artifact <artifact-to-verify> \ --provenance-path <path-to-your-provenance> \ --source-uri github.com/containerssh/containerssh ``` If the verification is successful, the process should produce the following output : ``` Verifying artifact <artifact-to-verify>: PASSED PASSED: Verified SLSA provenance ``` If you would like to contribute, please check out our as well as our .
Project: YugabyteDB (App Definition and Development / Database)
File: 12-having.md

title: "HAVING" In this exercise we will query the products table, group the results and return only those that have a category\id_ of "5". ``` SELECT product_id, product_name, unit_price, category_id FROM products GROUP BY product_id, product_name, unit_price, category_id HAVING category_id=5; ``` This query should return 7 rows In this exercise we will query the products table, group the results and return only those unit\price when multiplied by units\in\stock_ is greater than $2800. ``` SELECT product_name, sum(unitprice * unitsin_stock), unitsinstock FROM products GROUP BY product_name, unit_price, unitsinstock HAVING unitprice * unitsin_stock > 2800; ``` This query should return 7 rows In this exercise we will query the products table, group the results and return only those unit\price_ greater than 28. ``` SELECT product_name, sum(unitprice) unitsin_stock FROM products GROUP BY product_name, unit_price, unitsinstock HAVING unit_price > 28 ``` This query should return 26 rows In this exercise we will query the products table, group the results and return only those whose category\id_ is less than 4. ``` SELECT product_id, product_name, unit_price, category_id FROM products GROUP BY product_id, product_name, unit_price, category_id HAVING category_id < 4; ``` This query should return 37 rows
Project: Trivy (Provisioning / Security & Compliance)
File: cbl-mariner.md

Trivy supports the following scanners for OS packages. | Version | SBOM | Vulnerability | License | | - | :: | :--: | :--: | | 1.0 | | | | | 1.0 (Distroless) | | | | | 2.0 | | | | | 2.0 (Distroless) | | | | The following table provides an outline of the targets Trivy supports. | Version | Container image | Virtual machine | Arch | | - | :-: | :-: | :-: | | 1.0 | | | amd64, arm64 | | 2.0 | | | amd64, arm64 | The table below outlines the features offered by Trivy. | Feature | Supported | |::|::| | Detect unfixed vulnerabilities | | | | | Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities. See . Trivy takes fixed versions from . Trivy calculates the severity of an issue based on the severity provided in . Trivy supports the following [vulnerability statuses] for CBL-Mariner. | Status | Supported | | :--: | :-: | | Fixed | | | Affected | | | Under Investigation | | | Will Not Fix | | | Fix Deferred | | | End of Life | | Trivy identifies licenses by examining the metadata of RPM packages. !!! note License detection is not supported for CBL-Mariner Distroless.
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.5.7.md

RabbitMQ `3.5.7` is primarily a bug fix release. Fix a race condition that could prevent nodes from stopping. GitHub issue: `filehandlecache:clearreadcache/0` no longer silently fails. The function is mean to be used with `rabbitmqctl eval` in environments where in-process buffering of file data is enabled. GitHub issue: Default `RABBITMQPLUGINSDIR` value on Windows should be calculated as relative to RabbitMQ server installation directory, not `RABBITMQ_BASE`. If you override `RABBITMQBASE`, you may need to copy plugins from `%RABBITMQBASE%\plugins` to the `plugins` directory under RabbitMQ installation. GitHub issue: When rabbitmq-server failed to start due to an unreadable config file, exit code was 0 GitHub issue: Overriding `RABBITMQLOGS` and `RABBITMQSASL_LOGS` on Windows prevented node from starting. GitHub issue: Some startup code bits assumed IPv4 is enabled in the environment GitHub issue: More robust disk monitor, fewer errors logged. GitHub issue: `rabbitmqctl forgetclusternode` no longer attempts to impersonate live (reachable) nodes. GitHub issue: `rabbitmq-plugins` was using an incorrect env variable. GitHub issue: RAM watermark can be configured as an absolute value in bytes (just like with disk space monitoring): ``` [{rabbit, [{vmmemoryhigh_watermark, {absolute, 1073741824}}]}]. ``` GitHub issue: `rabbitmqctl authenticate_user` is a new command that can be used to test user authentication. GitHub issue: `rabbitmqctl` now supports `exclusive` as a queue info item. Contributed by Alexey Lebedeff (@binarin). GitHub issue: Heartbeats are now enabled by default. GitHub issue: . `AutorecoveringChannel#basicCancel` could throw a `NullPointerException`. GitHub issue: Heartbeats are now enabled by default. GitHub issue: . `IConnection.Dispose` could throw an exception. GitHub issue: Auto-deletion of queues that back QoS 1 subscriptions is again controlled by the clean session flag. GitHub issues: (original report which introduced the issue), (clarification and fix) Queue names now can be set explicitly using the `x-queue-name` header, for all destination types. GitHub issue: Management plugin could prevent a node from starting when it recovers after a network split. GitHub issue: Sorting arrow direction in the UI is now more conventional. Contributed by Philippe Serhal. GitHub issue: . 401 responses correctly set content type to `application/json` GitHub issue: Consumer utilisation is correctly reported as a number instead of `""` when it equals 0. GitHub issue: `rabbitmqadmin` misinterpreted boolean settings in config as strings GitHub issue: Fixed an edge case in serialisation of collections. GitHub issue: Heartbeats are now enabled by default. GitHub issue: .
Project: external-secrets (Provisioning / Security & Compliance)
File: generator.md

Generators allow you to generate values. They are used through a ExternalSecret `spec.DataFrom`. They are referenced from a custom resource using `sourceRef.generatorRef`. If the External Secret should be refreshed via `spec.refreshInterval` the generator produces a map of values with the `generator.spec` as input. The generator does not keep track of the produced values. Every invocation produces a new set of values. These values can be used with the other features like `rewrite` or `template`. I.e. you can modify, encode, decode, pack the values as needed. Generators can be defined as a custom resource and re-used across different ExternalSecrets. Every invocation creates a new set of values. I.e. you can not share the same value produced by a generator across different `ExternalSecrets` or `spec.dataFrom[]` entries. ```yaml apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: "ecr-token" spec: refreshInterval: "30m" target: name: ecr-token dataFrom: sourceRef: generatorRef: apiVersion: generators.external-secrets.io/v1alpha1 kind: ECRAuthorizationToken name: "my-ecr" ```
Project: Hazelcast IMDG (App Definition and Development / Database)
File: 02-offloaded-entry-processor-executor-stats.md

| Since: 4.1| |-| Offloaded entry processors are not executed by regular operation threads. As its name suggests, they offloaded to a different pool of threads and executed by them. But the executor of these offloaded entry processors has no statistics available. In this design, we collect statistics for offloaded entry processor executors. We use same `LocalExecutorStats` with other executors in Hazelcast. ``` public interface LocalExecutorStats extends LocalInstanceStats { / Returns the number of pending operations on the executor service. * @return the number of pending operations on the executor service */ long getPendingTaskCount(); / Returns the number of started operations on the executor service. * @return the number of started operations on the executor service */ long getStartedTaskCount(); / Returns the number of completed operations on the executor service. * @return the number of completed operations on the executor service */ long getCompletedTaskCount(); / Returns the number of cancelled operations on the executor service. * @return the number of cancelled operations on the executor service */ long getCancelledTaskCount(); / Returns the total start latency of operations started. * @return the total start latency of operations started */ long getTotalStartLatency(); / Returns the total execution time of operations finished. * @return the total execution time of operations finished */ long getTotalExecutionLatency(); } ``` On submit of each offloadable entry processor, we start to collect the statistics and with metrics subsystem, we made these available to management center. In `MapService` we have `DynamicMetricsProvider` interface implementation and offloaded executor stats are added there too. Statistics are available by default, they can be disabled via `MapConfig`. `map.entry.processor.offloadable.executor` prefix is used for offloaded executor. ``` [name=STATSOFFLOADEDEXECUTOR,unit=ms,metric=map.entry.processor.offloadable.executor.creationTime]=1598017099308 [name=STATSOFFLOADEDEXECUTOR,unit=count,metric=map.entry.processor.offloadable.executor.pending]=0 [name=STATSOFFLOADEDEXECUTOR,unit=count,metric=map.entry.processor.offloadable.executor.started]=1 [name=STATSOFFLOADEDEXECUTOR,unit=count,metric=map.entry.processor.offloadable.executor.completed]=0 [name=STATSOFFLOADEDEXECUTOR,unit=count,metric=map.entry.processor.offloadable.executor.cancelled]=0 [name=STATSOFFLOADEDEXECUTOR,unit=ms,metric=map.entry.processor.offloadable.executor.totalStartLatency]=1 [name=STATSOFFLOADEDEXECUTOR,unit=ms,metric=map.entry.processor.offloadable.executor.totalExecutionTime]=0 ```
Project: KICS (Provisioning / Security & Compliance)
File: e08ed7eb-f3ef-494d-9d22-2e3db756a347.md

title: Lambda Permission Principal Is Wildcard hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e08ed7eb-f3ef-494d-9d22-2e3db756a347 Query name: Lambda Permission Principal Is Wildcard Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Lambda Permission Principal should not contain a wildcard.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="5" resource "awslambdapermission" "positive1" { statement_id = "AllowExecutionFromCloudWatch" action = "lambda:InvokeFunction" functionname = awslambdafunction.testlambda.function_name principal = "*" source_arn = "arn:aws:events:eu-west-1:111122223333:rule/RunDaily" qualifier = awslambdaalias.test_alias.name } ``` ```tf title="Negative test num. 1 - tf file" resource "awslambdapermission" "negative1" { statement_id = "AllowExecutionFromCloudWatch" action = "lambda:InvokeFunction" functionname = awslambdafunction.testlambda.function_name principal = "events.amazonaws.com" source_arn = "arn:aws:events:eu-west-1:111122223333:rule/RunDaily" qualifier = awslambdaalias.test_alias.name } ```
Project: Eclipse Che (App Definition and Development / Application Definition & Image Build)
File: NUMBERING.md

``` a.b.c-d a = major b = feature c = bug fix d = development, numbered as `<rc>d` ``` ``` a.b.0 - initial a.b.c - bug fixing ``` ``` 4.0.0-rc1-SNAPSHOT - This is a build 4.0.0-rc1 - This is a release 4.0.0-rc2-SNAPSHOT - This is a build 4.0.0-rc2 - This is a release ``` ``` 4.0.0 ``` ``` 4.0.x ``` ``` 4.0.1 4.0.2 ```
Project: Kapeta (App Definition and Development / Application Definition & Image Build)
File: README.md

Here, you'll find an overview of the various repositories we have, their purpose, and their licensing. To learn more about how to use Kapeta, please visit our knowledge base: We're always here to help - write us at support@kapeta.com We want to engage as much as possible with the open-source community, and for that reason, we've open-sourced most of what we're doing. Some of the more advanced and core parts of Kapeta are, however, licensed under the BUSL license - also known as source available. This is to protect our interests as a business and ensure that Kapeta will exist forever :) All software installed on your machine or in your cloud will have its source available - with either an MIT or BUSL license. License: BUSL-1.1 The desktop application is the main app you use to interact with Kapeta. It's fully source-available and licensed under the BUSL. The repositories that contain the various components of the desktop app are: https://github.com/kapetacom/app-desktop-builder - Main electron app https://github.com/kapetacom/local-cluster-service - Background worker that does all the file reads and writes https://github.com/kapetacom/ui-web-plan-editor - The main Kapeta editor UI We have SDKs for each programming language we support - all MIT-licensed. You can find them here: At the core of Kapeta, we have a series of what we call "providers" that provide support for block types, language targets, resource types, deployment targets, and more. You can view them . To learn more about these concepts, have a look at our knowledge base page here: https://docs.kapeta.com/docs/providers Providers are MIT licensed except Deployment Targets, which are BUSL licensed. We publish samples for different systems in Kapeta - you can find the source by clicking . Samples are MIT-licensed. Insights is a collection of software components we add to your system to provide you with insights like logs and metrics - you can find the source by clicking . Insights are MIT-licensed Because we want to encourage the forking and implementation of plugins/providers for Kapeta, we're also providing the UI library we use for building the existing providers. This makes it easy to copy and adjust things to your needs. You can find them - the main one being The UI library is MIT licensed - except for ui-web-plan-editor, which is BUSL licensed. As part of the Kapeta system, we also have several cloud services and web frontends. These will remain closed-sourced for now - but we aim to publish several, if not all, of them in the future.
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_completion.md

title: Kubectl-Dba Completion menu: docs_{{ .version }}: identifier: kubectl-dba-completion name: Kubectl-Dba Completion parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Generate completion script To load completions: Bash: $ source <(kubectl-dba completion bash) Linux: $ kubectl-dba completion bash > /etc/bash_completion.d/kubectl-dba MacOS: $ kubectl-dba completion bash > /usr/local/etc/bash_completion.d/kubectl-dba Zsh: $ echo "autoload -U compinit; compinit" >> ~/.zshrc $ kubectl-dba completion zsh > "${fpath[1]}/_kubectl-dba" Fish: $ kubectl-dba completion fish | source $ kubectl-dba completion fish > ~/.config/fish/completions/kubectl-dba.fish ``` kubectl-dba completion [bash|zsh|fish|powershell] ``` ``` -h, --help help for completion ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - kubectl plugin for KubeDB
Project: KICS (Provisioning / Security & Compliance)
File: grpc-queries.md

This page contains all queries from GRPC. | Query |Severity|Category|More info| ||--|--|--| |Enum Name Not CamelCase<br/><sup><sub>daaace5f-c0dc-4835-b526-7a116b7f4b4e</sub></sup>|<span style="color:#5bc0de">Info</span>|Best Practices|<a href="../grpc-queries/daaace5f-c0dc-4835-b526-7a116b7f4b4e" target="blank">Query details</a><br><a href="https://developers.google.com/protocol-buffers/docs/reference/proto3-spec#enumdefinition">Documentation</a><br/>|