cwielenb/CNCF-Dataset huggingface dataset:
Project: Chef InSpec (Provisioning / Security & Compliance)
File: wmi.md

+++ title = "wmi resource" draft = false gh_repo = "inspec" platform = "windows" [menu] [menu.inspec] title = "wmi" identifier = "inspec/resources/os/wmi.md wmi resource" parent = "inspec/resources/os" +++ Use the `wmi` Chef InSpec audit resource to test WMI settings on the Windows platform. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `wmi` resource block tests WMI settings on the Windows platform: describe wmi({ class: 'class_name', namespace: 'path\\to\\setting', filter: 'filter', query: 'query' }) do its('setting_name') { should eq '' } end where `class`, `namespace`, `filter`, and `query` comprise a Ruby Hash of the WMI object `('class')` is the WMI class to which the setting belongs, such as `win32_service` `('namespace')` is path to that object, such as `root\\cimv2` Use `('filter')` fine-tune the information defined by the WMI class, such as to find a specific service (`filter: "name like '%winrm%'")`, to find a specific setting (`filter: 'KeyName = \'MinimumPasswordAge\' And precedence=1'`), and so on Use `('query')` to run a query that returns data to be tested, such as `"SELECT Setting FROM RSOP_SecuritySettingBoolean WHERE KeyName='LSAAnonymousNameLookup' AND Precedence=1"` `('setting_name')` is a setting in the WMI object to be tested, and then `should eq ''` is the expected value for that setting For example, both of the following tests will verify if WinRM is present on the target node. The first tests if WinRM belongs to the list of services running under the `win32_service` class: describe wmi({class: 'win32_service'}) do its('DisplayName') { should include 'Windows Remote Management (WS-Management)'} end and the second uses a filter in the Ruby Hash to first identify WinRM, and then perform additional tests: describe wmi({ class: 'win32_service', filter: "name like '%winrm%'" }) do its('Status') { should cmp 'ok' } its('State') { should cmp 'Running' } its('ExitCode') { should cmp 0 } its('DisplayName') { should eq 'Windows Remote Management (WS-Management)'} end The following examples show how to use this Chef InSpec audit resource. describe wmi({ class: 'RSOP_SecuritySettingNumeric', namespace: 'root\\rsop\\computer', filter: 'KeyName = \'MinimumPasswordAge\' And precedence=1' }) do its('Setting') { should eq 1 } end describe wmi({ namespace: 'root\\rsop\\computer', query: "SELECT Setting FROM RSOP_SecuritySettingBoolean WHERE KeyName='LSAAnonymousNameLookup' AND Precedence=1" }) do its('Setting') { should eq false } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Confidential Containers (Provisioning / Security & Compliance)
File: ephemeral_storage.md

With CoCo, container images are pulled inside the guest VM. By default container images are saved in guest memory which is protected by CC hardware. Since memory is an expensive resource, CoCo implemented for container image and RW layer. This solution is verified with Kubernetes CSI driver . Please follow this to install open-local. We can use following example `trustedstorecc.yaml` to have a try: ```yaml apiVersion: v1 kind: Pod metadata: name: trusted-lvm-block annotations: io.containerd.cri.runtime-handler: kata-qemu-tdx spec: runtimeClassName: kata-qemu-tdx containers: name: sidecar-trusted-store image: pause volumeDevices: devicePath: "/dev/trusted_store" name: trusted-store name: application image: busybox command: sh "-c" | sleep 10000 volumes: name: trusted-store persistentVolumeClaim: claimName: trusted-store-block-pvc apiVersion: v1 kind: PersistentVolumeClaim metadata: name: trusted-store-block-pvc spec: volumeMode: Block accessModes: ReadWriteOnce resources: requests: storage: 1Gi storageClassName: open-local-lvm ``` Before deploy the workload, we can follow this and use to enable CoCo console debug(optional, check whether working as expected). Create the workload: ```sh kubectl apply -f trustedstorecc.yaml ``` Ensure the pod was created successfully (in running state): ```sh kubectl get pods ``` Output: ``` NAME READY STATUS RESTARTS AGE trusted-lvm-block 2/2 Running 0 31s ``` After we enable the debug option, we can login into the VM with `ccv0.sh` script: ```sh ./ccv0.sh -d openkatashell ``` Check container image is saved in encrypted storage with following commands: ```sh root@localhost:/# lsblk --fs NAME FSTYPE LABEL UUID FSAVAIL FSUSE% MOUNTPOINT sda ephemeralimageencrypted_disk 906M 0% /run/image root@localhost:/# cryptsetup status ephemeralimageencrypted_disk /dev/mapper/ephemeralimageencrypted_disk is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: dm-crypt device: /dev/sda sector size: 4096 offset: 32768 sectors size: 2064384 sectors mode: read/write root@localhost:/# mount|grep image /dev/mapper/ephemeralimageencrypted_disk on /run/image type ext4 (rw,relatime) root@localhost:/# ls /run/image/ layers lost+found overlay ```
Project: kiosk (Provisioning / Automation & Configuration)
File: README.md

](https://goreportcard.com/report/sigs.k8s.io/controller-runtime) The Kubernetes controller-runtime Project is a set of go libraries for building Controllers. It is leveraged by and . Both are a great place to start for new projects. See to see how it can be used. Documentation: The full documentation can be found at , but TL;DR: Users: We follow Use releases with your dependency management to ensure that you get compatible code The master branch contains all the latest code, some of which may break compatibility (so "normal" `go get` is not recommended) Contributors: All code PR must be labeled with :bug: (patch fixes), :sparkles: (backwards-compatible features), or :warning: (breaking changes) Breaking changes will find their way into the next major release, other changes will go into an semi-immediate patch or minor release For a quick PR template suggesting the right information, use one of these PR templates: * * See Learn how to engage with the Kubernetes community on the . controller-runtime is a subproject of the project in sig apimachinery. You can reach the maintainers of this project at: Slack channel: Google Group: Contributions are greatly appreciated. The maintainers actively manage the issues list, and try to highlight issues suitable for newcomers. The project follows the typical GitHub pull request model. See for more details. Before starting any work, please either comment on an existing issue, or file a new one. Participation in the Kubernetes community is governed by the .
Project: Chef InSpec (Provisioning / Security & Compliance)
File: windows_firewall_rule.md

+++ title = "windowsfirewallrule resource" draft = false gh_repo = "inspec" platform = "windows" [menu] [menu.inspec] title = "windowsfirewallrule" identifier = "inspec/resources/os/windowsfirewallrule.md windowsfirewallrule resource" parent = "inspec/resources/os" +++ Use the `windowsfirewallrule` Chef InSpec audit resource to test if a firewall rule is correctly configured on a Windows system. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} A `windowsfirewallrule` resource block specifies which rule to validate: describe windowsfirewallrule('name') do it { should be_enabled } end where `('name')` must specify the name of a firewall rule, which is not the firewall rule's display name `be_enabled` is a valid matcher for this resource The following example shows how to use this Chef InSpec audit resource. describe windowsfirewallrule('HTTPS Out') do it { should be_enabled } it { should be_allowed } it { should be_outbound } it { should be_tcp } its('remote_port') { should eq 443 } end The resource compiles the following list of firewall rule properties: `description` `displayname` `group` `local_address` `local_port` `remote_address` `remote_port` `direction` `protocol` `icmp_type` `action` `profile` `program` `service` `interface_type` Each of these properties can be used in two distinct ways: its('remote_address') { should cmp '192.0.2.42' } or via matcher: it { should haveremoteaddress '192.0.2.42' } {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `be_enabled` matcher tests if the rule does exist: it { should exist } The `be_enabled` matcher tests if the rule is enabled: it { should be_enabled } The `be_allowed` matcher tests if the rule is allowing traffic: it { should be_allowed } The `be_inbound` matcher tests if the rule is an inbound rule: it { should be_inbound } The `be_outbound` matcher tests if the rule is an outbound rule: it { should be_outbound } The `be_tcp` matcher tests if the rule is for the TCP protocol: it { should be_tcp } The `be_ucp` matcher tests if the rule is for the DCP protocol: it { should be_dcp } The `be_icmp` matcher tests if the rule is for any ICMP protocol: it { should be_icmp } The `be_icmpv4` matcher tests if the rule is for the ICMPv4 protocol: it { should be_icmpv4 } The `be_icmpv6` matcher tests if the rule is for any ICMPv6 protocol: it { should be_icmpv6 }
Project: YugabyteDB (App Definition and Development / Database)
File: zscore.md

title: ZSCORE linkTitle: ZSCORE description: ZSCORE menu: preview: parent: api-yedis weight: 2545 aliases: /preview/api/redis/zscore /preview/api/yedis/zscore type: docs `ZSCORE key member` Returns the score of the member in the sorted set at key. If member does not exist in the sorted set, or key does not exist, null is returned. If `key` is associated with non sorted set data, an error is returned. The score of member (a double precision floating point number), represented as string. ```sh $ ZADD z_key 1.0 v1 ``` ``` (integer) 1 ``` ```sh $ ZSCORE z_key v1 ``` ``` "1.0" ``` ```sh $ ZSCORE z_key v2 ``` ``` (null) ``` , , , , ,
Project: kpt (Provisioning / Automation & Configuration)
File: README.md

Simple dependency scanner tool Keeps license detection easy - relies on a static set of files. To generate in a nice format: ``` go run . scan --binary ~/bin/kpt | \ jq -r '.[] | [.name, (.licenseInfo.licenseURLs | join(" ")), .licenseInfo.license, "kpt", "YES", if .licenseInfo.mustShipCode then "YES" else "NO" end ] | @csv' ``` Saving a copy in the repo is helpful to track changes over time: ``` go run . scan --binary ~/bin/kpt | jq . > results.txt ``` To generate a LICENSES text file (useful for embedding): ``` go run . scan --print --binary ~/bin/kpt | jq -r '.[] | ("================================================================================\n= " + .name + " =\n\n" + .licenseFiles[].contents + "\n\n")' > ../../licenses/kpt.txt ```iles. All files in this directory will be under their original licenses. Licenses notices will be reserved. The modifications made in the 3rd-party files may be contributed to upstream. The contribution is determined case by case. or`. The OpenAPI .
Project: ArangoDB (App Definition and Development / Database)
File: destructor.md

+++ title = "`~basic_result()`" description = "Destructor. Constexpr, triviality and noexcept propagating." categories = ["destructors"] weight = 150 +++ Destructor. Requires: Always available. Complexity: Same as for `valuetype`'s and `errortype`'s destructors. Constexpr, triviality and noexcept of underlying operations is propagated.
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_addon_describe.md

title: kbcli addon describe Describe an addon specification. ``` kbcli addon describe ADDON_NAME [flags] ``` ``` -h, --help help for describe ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Addon command.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_organizations.md

+++ title = "google_organizations resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "google_organizations" identifier = "inspec/resources/gcp/googleorganizations.md googleorganizations resource" parent = "inspec/resources/gcp" +++ A `google_organizations` is used to test a Google Organization resource ```ruby describe google_organizations do its('names') { should include "organizations/123456" } end ``` describe google_organizations do its('count') { should be <= 100} end describe google_organizations do its('names') { should include "organization/1234" } end describe google_organizations do its('display_names') { should include "google.com" } end describe google_organizations do its('lifecycle_state'){ should eq 'ACTIVE' } end googleorganizations.where(displayname: /^goog/, lifecycle_state: 'ACTIVE').names.each do |name| describe google_organization(name: name) do it { should exist } end end Properties that can be accessed from the `google_organizations` resource: See the resource for more information. `names` : an array of `google_organization` name `display_names` : an array of `googleorganization` displayname `lifecycle_states` : an array of `googleorganization` lifecyclestate `creation_times` : an array of `googleorganization` creationtime `owners` : an array of `google_organization` owner This resource supports all of the above properties as filter criteria, which can be used with `where` as a block or a method. Ensure the is enabled for the current project.
Project: Meshery (Provisioning / Automation & Configuration)
File: dex.md

layout: integration title: Dex subtitle: Collaborative and visual infrastructure as code for Dex image: /assets/img/integrations/dex/icons/color/dex-color.svg permalink: extensibility/integrations/dex docURL: https://docs.meshery.io/extensibility/integrations/dex description: integrations-category: Provisioning integrations-subcategory: Security & Compliance registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: KubeVirt (App Definition and Development / Application Definition & Image Build)
File: TROUBLESHOOTING.md

If logging and output artifacts are not enough, there is a way to connect to a running CI pod and troubleshoot directly from there. A working (enabled) account on the , specifically enabled to the `kubevirt-prow-jobs` project. The installed Through the `mkpj` tool, it's possible to craft a custom Prow Job that can be executed on the CI cluster. Just `go get` it by running `go get k8s.io/test-infra/prow/cmd/mkpj` Then run the following command from a checkout of the : ```bash mkpj --pull-number $KUBEVIRTPRNUMBER -job pull-kubevirt-e2e-kind-k8s-sriov-1.17.0 -job-config-path github/ci/prow/files/jobs/kubevirt/kubevirt-presubmits.yaml --config-path github/ci/prow/files/config.yaml > debugkind.yaml ``` You will end up having a ProwJob manifest in the `debugkind.yaml` file. It's strongly recommended to replace the job's name, as it will be easier to find and debug the relative pod, by replacing `metadata.name` with something more recognizeable. The $KUBEVIRTPRNUMBER can be an actual PR on the . In case we just want to debug the cluster provided by the CI, it's recommended to override the entry point, either in the test PR we are instrumenting (a good sample can be found ), or by overriding the entry point directly in the prow job's manifest. Remember that we want the cluster long living, so a long sleep must be provided as part of the entry point. Make sure you switch to the `kubevirt-prow-jobs` project, and apply the manifest: ```bash kubectl apply -f debugkind.yaml ``` You will end up with a ProwJob object, and a pod with the same name you gave to the ProwJob. Once the pod is up & running, connect to it via bash: ```bash kubectl exec -it debugprowjobpod bash ``` Once you are in the pod, you'll be able to troubleshoot what's happening in the environment CI is running its tests. Run the follow to bring up a cluster with a single node setup and the SR-IOV operator already setup to go (if it wasn't already done by the job itself). ```bash KUBEVIRT_PROVIDER=kind-k8s-sriov-1.17.0 make cluster-up ``` The kubeconfig file will be available under `/root/.kube/kind-config-sriov`. The `kubectl` binary is already on board and in `$PATH`. The container acting as node is the one named `sriov-control-plane`. You can even see what's in there by running `docker exec -it sriov-control-plane bash`.
Project: YugabyteDB (App Definition and Development / Database)
File: csharp.md

title: Build a YugabyteDB YEDIS application using C# headerTitle: Build an application using C# linkTitle: C# description: Use C# to build a YugabyteDB application that interacts with YEDIS aliases: /preview/yedis/develop/client-drivers/csharp menu: preview: identifier: client-drivers-yedis-csharp parent: develop-yedis type: docs This tutorial assumes that you have: installed YugabyteDB, created a universe, and are able to interact with it using the Redis shell. If not, follow the steps in . installed Visual Studio. In your Visual Studio create a new Project and choose Console Application as template. Follow the instructions to save the project. To install the driver in your Visual Studio project: <ol> <li>Open your Project Solution View.</li> <li>Right-click on Packages and click Add Packages.</li> <li>Search for StackExchange.Redis and click Add Package.</li> </ol> ```cs using System; using System.Collections.Generic; using StackExchange.Redis; namespace YugabyteCSharpDemo { class Program { static private void printHash(HashEntry[] hashes) { foreach (var hashEntry in hashes) { Console.WriteLine(string.Format("{0}: {1}", hashEntry.Name, hashEntry.Value)); } } static void Main(string[] args) { try { ConfigurationOptions config = new ConfigurationOptions { EndPoints = { { "127.0.0.1", 6379 }, }, CommandMap = CommandMap.Create(new HashSet<string> { // EXCLUDE commands that are not fully supported on YugabyteDB side. "SUBSCRIBE", "CLUSTER", "TIME", "PING" }, available: false) }; ConnectionMultiplexer connection = ConnectionMultiplexer.Connect(config); IDatabase redisDB = connection.GetDatabase(); var hashKey = "1"; HashEntry[] setHash = { new HashEntry("name", "John"), new HashEntry("age", 35), new HashEntry("language", "C#"), new HashEntry("client", "Redis") }; Console.WriteLine("Successfully executed HMSET:"); printHash(setHash); redisDB.HashSet(hashKey, setHash); var getHash = redisDB.HashGetAll(hashKey); Console.WriteLine("Successfully executed HMGET:"); printHash(getHash); } catch (RedisConnectionException e) { Console.WriteLine("Unable to make a connection to local YugabyteDB. " + "Error:", e.Message); } } } } ``` Run the C# application from menu select `Run -> Start Without Debugging` You should see the following as the output. ``` Successfully executed HMSET: name: John age: 35 language: C# client: Redis Successfully executed HMGET: age: 35 client: Redis language: C# name: John ```
Project: KICS (Provisioning / Security & Compliance)
File: d53f4123-f8d8-4224-8cb3-f920b151cc98.md

title: RDS Instance Log Disconnections Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d53f4123-f8d8-4224-8cb3-f920b151cc98 Query name: RDS Instance Log Disconnections Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: log_disconnections parameter should be set to ON for RDS instances<br> ```tf title="Positive test num. 1 - tf file" hl_lines="14" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" },{ name = "log_disconnections" value = "OFF" }] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="6" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" }] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" } ``` ```tf title="Negative test num. 1 - tf file" resource "aliclouddbinstance" "default" { engine = "MySQL" engine_version = "5.6" dbinstanceclass = "rds.mysql.t1.small" dbinstancestorage = "10" parameters = [{ name = "innodblargeprefix" value = "ON" },{ name = "connect_timeout" value = "50" },{ name = "log_disconnections" value = "ON" }] } ```
Project: KICS (Provisioning / Security & Compliance)
File: 0461b4fd-21ef-4687-929e-484ee4796785.md

title: Log Retention Is Not Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0461b4fd-21ef-4687-929e-484ee4796785 Query name: Log Retention Is Not Set Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Make sure that for PostgreSQL Database, server parameter 'log_retention' is set to 'ON'<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" name: Update PostgreSQL Server setting azurermpostgresqlconfiguration: resource_group: myResourceGroup server_name: myServer name: log_retention value: off ``` ```yaml title="Negative test num. 1 - yaml file" name: Update PostgreSQL Server setting azurermpostgresqlconfiguration: resource_group: myResourceGroup server_name: myServer name: log_retention value: on ```