cwielenb/CNCF-Dataset huggingface dataset:
Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_key_vault_secrets.md

+++ title = "azurermkeyvault_secrets resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurermkeyvault_secrets" identifier = "inspec/resources/azure/azurermkeyvaultsecrets.md azurermkeyvaultsecrets resource" parent = "inspec/resources/azure" +++ {{< inspec/azurermdeprecated resource="azurekeyvaultsecrets" >}} Use the `azurermkeyvault_secrets` InSpec audit resource to test properties and configuration of Azure Secrets within Vaults. This resource interacts with version `2016-10-01` of the Azure Management API. For more information see the . At the moment, there doesn't appear to be a way to select the version of the Azure API docs. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: -name: inspec-azure git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . This resource first became available in 1.3.0 of the inspec-azure resource pack. An `azurermkeyvault_secrets` resource block returns all Secrets within a Vault. describe azurermkeyvault_secrets('my-vault') do ... end The following examples show how to use this InSpec audit resource. azurermkeyvault_secrets('my-vault').entries.each do |secret| describe secret do its('id') { should_not be nil } its('attributes.exp') { shouldnot benil } end end All fields described in can be used to filter. Below is an example using `managed`. Filters the results to include only those Secrets which are not managed by the Vault. This is a boolean value. describe azurermkeyvault_secrets('my-vault').where{ managed.eql?(false) } do it { should_not exist } end `id` `attributes` `contentType` `managed` `tags` Secret identifier. The secret management attributes. Type of the secret value such as a password. True if the secret's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true. Resource tags applied to the Key. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The control will pass if the filter returns at least one result. Use `should_not` if you expect zero matches. describe azurermkeyvault_secrets('my-vault') do it { should exist } end Your [Service Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal) must be setup with a `contributor` role on the subscription you wish to test. Your Azure Key Vault should also have this Service Principal listed in it's Access Policy with `secrets/list` permissions.
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-filter-list.md

layout: default title: mesheryctl-filter-list permalink: reference/mesheryctl/filter/list redirect_from: reference/mesheryctl/filter/list/ type: reference display-title: "false" language: en command: filter subcommand: list List filters Display list of all available filter files. <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl filter list [flags] </div> </pre> List all WASM filter files present <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl filter list (maximum 25 filters) </div> </pre> Search for filter <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl filter list Test (maximum 25 filters) </div> </pre> Search for filter with space <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl filter list 'Test Filter' (maximum 25 filters) </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -h, --help help for list -p, --page int (optional) List next set of filters with --page (default = 1) (default 1) -v, --verbose Display full length user and filter file identifiers </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -t, --token string Path to token file default from current context </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: KICS (Provisioning / Security & Compliance)
File: 60a05ede-0a68-4d0d-a58f-f538cf55ff79.md

title: Serverless API Cache Cluster Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 60a05ede-0a68-4d0d-a58f-f538cf55ff79 Query name: Serverless API Cache Cluster Disabled Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: AWS Serverless API should have cache clustering enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: ApiGatewayApi: Type: AWS::Serverless::Api Properties: StageName: prod TracingEnabled: true ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="10" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: ApiGatewayApi2: Type: AWS::Serverless::Api Properties: StageName: prod TracingEnabled: true CacheClusterEnabled: false ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: ApiGatewayApi3: Type: AWS::Serverless::Api Properties: StageName: prod TracingEnabled: true CacheClusterEnabled: true ```
Project: BigchainDB (App Definition and Development / Database)
File: deploy-a-machine.md

<! Copyright 2020 Interplanetary Database Association e.V., BigchainDB and IPDB software contributors. SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0) Code is Apache-2.0 and docs are CC-BY-4.0 > The first step is to deploy a machine for your BigchainDB node. It might be a virtual machine (VM) or a real machine, for example, an EC2 on AWS or a droplet on Digital Ocean. If you follow this simple deployment template, all your node's software will run on that one machine. We don't make any assumptions about where you run the machine. It might be in Azure, AWS, your data center or a Raspberry Pi. The following instructions assume all the nodes in the network (including yours) have public IP addresses. (A BigchainDB network can be run inside a private network, using private IP addresses, but we don't cover that here.) Use Ubuntu 18.04 or Ubuntu Server 18.04 as the operating system. Similar instructions will work on other versions of Ubuntu, and other recent Debian-like Linux distros, but you may have to change the names of the packages, or install more packages. If your machine is in AWS or Azure, for example, and you want users to connect to BigchainDB via HTTPS, then you should configure its network security group to allow all incoming and outgoing traffic for: TCP on port 22 (SSH) TCP on port 80 (HTTP) TCP on port 443 (HTTPS) Any protocol on port 26656 (Tendermint P2P) If you don't care about HTTPS, then forget about port 443, and replace port 80 with port 9984 (the default BigchainDB HTTP port). SSH into your machine and update all its OS-level packages: ``` sudo apt update sudo apt full-upgrade ``` Register a domain name for your BigchainDB node, such as `example.com` Pick a subdomain of that domain for your BigchainDB node, such as `bnode.example.com` Create a DNS "A Record" pointing your chosen subdomain (such as `bnode.example.com`) at your machine's IP address.
Project: Carvel (App Definition and Development / Application Definition & Image Build)
File: README_Cognito_UserPools_PreTokenGen.md

The following is a sample Lambda function that receives Amazon Cognito User Pools pre-token-gen event as an input and writes some of the record data to CloudWatch Logs. (Note that anything written to stdout or stderr will be logged as CloudWatch Logs events.) Please see instructions for setting up the Cognito triggers at https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html . ```go package main import ( "fmt" "github.com/aws/aws-lambda-go/lambda" "github.com/aws/aws-lambda-go/events" ) func handler(event events.CognitoEventUserPoolsPreTokenGen) (events.CognitoEventUserPoolsPreTokenGen, error) { fmt.Printf("PreTokenGen of user: %s\n", event.UserName) event.Response.ClaimsOverrideDetails.ClaimsToSuppress = []string{"family_name"} return event, nil } func main() { lambda.Start(handler) } ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.8.19.md

RabbitMQ `3.8.19` is a maintenance release. RabbitMQ releases are distributed via , , and . This release and . explains what package repositories and tools can be used to provision modern Erlang versions. See the for general documentation on upgrades and for release notes of other releases. If upgrading from a`3.7.x` release, see upgrade and compatibility notes first. If upgrading from a `3.6.x` or older , first upgrade to and then to this version. Any questions about this release, upgrades or RabbitMQ in general are welcome on the and . Binding recovery on node startup is now more efficient. This means in clusters with a lot of queues and/or bindings, nodes start quicker. GitHub issue: Plugin directory paths are now deduplicated, so if a single directory is specified more than ones, the node won't complain about duplicate plugins. GitHub issue: Startup banner and log entries now use path separators more consistently on Windows. Thanks to Linda @LindaLawton Lawton for pointing out the inconsistency. GitHub issue: When dynamic Shovels are started the plugin now acquires a distributed lock. This is generally not necessary but helps avoid duplicate Shovels being started via import of a definition file on every cluster node during cluster formation. GitHub issue: No dependency changes in this release. To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.8.19.tar.xz` instead of the source tarball produced by GitHub.
Project: Redpanda (App Definition and Development / Streaming & Messaging)
File: README.md

This low level tool is for offline use by Redpanda Engineering when diagnosing faults. This tool is not for everyday use on live clusters. curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh cargo run --release -- --backend=<aws|gcp|azure> scan --source=<bucket name> To run the tool outside a built tree, you may simply copy the statically linked binary. cargo build --release cp target/release/rp-storage-tool /usr/local/bin The following examples assume you are running on an AWS instance with IAM roles configured for access to your bucket. If you need to specify static keys, see the "Working with local object stores" section below. $ rp-storage-tool --backend aws scan-metadata --source=my-bucket --meta-file my-bucket.json $ rp-storage-tool --filter kafka/my-topic/_ --backend aws scan-data --source=my-bucket --meta-file my-bucket.json $ mkdir my-data-dump $ rp-storage-tool --filter kafka/my-topic/13_63 --backend aws extract --source=my-bucket --meta-file my-bucket.json --sink ./my-data-dump/ The `--backend` argument selects the cloud storage backend. This has a default (AWS) for convenience when working with commands that don't use cloud storage, but ordinarily you should be specifying it. The `--filter` argument controls which topics & partitions will be examined. When scanning metadata we always scan all objects, but will only store+analyze metadata for partitions matching the filter. If you are running on a node with authentication already set up (e.g. IAM Roles on AWS), this will Just Work. Otherwise you may need to set the appropriate access key/secret environment variables for the cloud platform you are connecting to. This walks the objects in a bucket used by Redpanda Tiered Storage and reports on any inconsistencies. Not all issues this tool reports are harmful, for example `segmentsoutsidemanifest` may contain objects harmlessly left behind when Redpanda was restarted during an upload. This walks the data within segments (you probably want to use `--filter` to only scan segments for certain NTPS) to check that it is readable, and that the metadata in the partition manifest is consistent with the data. For NTPs matching the filter, copy all metadata and data objects into a local folder. This tool uses environment variables for any special configuration of storage backends required for working outside of real cloud environments. For example, to use the tool with a bucket called `data` in a minio cluster at `aplite:9000`: AWSALLOWHTTP=1 AWSACCESSKEYID=minioadmin AWSSECRETACCESSKEY=minioadmin AWS_REGION=us-east-1 \ AWS_ENDPOINT=http://aplite:9000 cargo run --release -- --backend aws scan --source data If you are building on a workstation and copying the binary to a remote machine, and your workstation doesn't happen to run the same linux distro as the remote machine, it is useful to build a statically linked binary that will work on any distro. sudo dnf install -y musl-gcc rustup target add x86_64-unknown-linux-musl cargo build --release --target=x86_64-unknown-linux-musl
Project: Cyclops (App Definition and Development / Application Definition & Image Build)
File: usage_metrics.md

Cyclops tracks usage metrics so that the maintainers can gain better insights into Cyclops usage. No sensitive or user data is sent; only triggered events, like a Cyclops instance start, are sent. These events include: `cyclops-instance-start` - triggered once at the start of cyclops-ctrl pod `module-creation` - called by the UI each time you create a new module `module-reconciliation` - each time a Module CRD in the cluster is changed The metric collection is implemented using . Each time one of the events above is triggered, Cyclops sends an HTTP request to the posthog API with the following information: ```json { "type": "capture", "timestamp": "2024-03-23T19:05:38.808279+01:00", "distinct_id": "f46d57f0-e93f-11ee-924c-8281c5d92ae4", "event": "cyclops-instance-start" } ``` `distinct_id` - generated for each Cyclops instance using from google/uuid package `event` - which event was triggered; see events above If you wish to turn off tracking metrics, add an environment variable to cyclops-ctrl: `DISABLE_TELEMETRY: true` You can turn it off by adding the env variable to your `cyclops-ctrl` Deployment definition. Navigate to the `env` part of the deployment definition and add the following: ``` env: name: PORT value: "8080" - name: DISABLE_TELEMETRY value: "true" ``` The metric collection is enabled by default but is . If you have any additional questions about Cyclops and tracking usage metrics, reach out to us at
Project: secureCodeBox (Provisioning / Security & Compliance)
File: operator.md

title: "Modifying the Operator" sidebar_position: 4 The operator is written in Golang. To build the operator you will need to install . For local development we recommend to use or . If you are using MacOS or Windows you can also use the kubernetes cluster included within Docker for Mac/Windows. All of these tools will enable you to run a local kubernetes cluster on your development machine. To operate your (local) Kubernetes cluster you will need to install and For macOs simply use to install all the tools: ```bash brew cask install docker brew install go helm ``` After that start the `Docker.app` and go to it's settings and start Kubernetes. For your local development you will need a S3 compatible storage. We would recommend to use inside a docker container. ```bash docker container run \ --name minio \ -p 9000:9000 \ -p 9001:9001 \ -d \ --rm \ minio/minio \ server /data \ --console-address ":9001" ``` In the Minio management GUI you will need to add a new bucket for the operator. The default credentials for your minio instance are `minioadmin:minioadmin`. You might change those. Go to the management UI at and add a new bucket. After creating your bucket you will need to specify some environment variables to enable the operator to use the bucket. For that export these variables: ```bash export MINIOACCESSKEY="your-minio-access-key" export MINIOSECRETKEY="your-minio-secret-key" export S3_BUCKET="name-of-your-bucket" export S3USESSL="false" # This ensures that the operator will connect even without HTTPS export S3_ENDPOINT="127.0.0.1:9000" ``` You can save time by using to export these variables in your project. If you use direnv just add a file `.s3_credentials` with your Minio credentials. To build and run the operator you can simply execute `make` in the `operator` directory of this repository: ```bash cd operator make ``` This will produce the operator as `bin/manager`. If you wonder why the operator is named manager (the resulting binary). The reason for that is in Kubernetes a combination of more than one controller is called controller-manager or short manager. In contrast, operator is created by the community to name a controller-manager which controls custom resources and hence we use custom resources. (see for further information) To run the operator locally you can simply execute `make run` in the `operator` directory of this repository: NOTICE: You will need to uninstall the operator with `helm -n securecodebox-system uninstall securecodebox-operator` from your local cluster, if you've installed it via helm. Unless both operators try to work on the same cluster which may cause unexpected behavior. ```bash cd operator make run ``` To run multiple operator instances locally (e.g. SCB operator and SCB Autodiscovery operator) the `metrics-bind-address` and `health-probe-bind-address` port needs to be changed via commandline arguements for one of the operators.<br/> ``` go run ./main.go -metrics-bind-address :9090 -health-probe-bind-address :9595 ```
Project: KICS (Provisioning / Security & Compliance)
File: a2f548f2-188c-4fff-b172-e9a6acb216bd.md

title: Secretsmanager Secret Without KMS hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a2f548f2-188c-4fff-b172-e9a6acb216bd Query name: Secretsmanager Secret Without KMS Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: AWS Secretmanager should use AWS KMS customer master key (CMK) to encrypt the secret values in the versions stored in the secret<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awssecretsmanagersecret" "example" { name = "example" } ``` ```tf title="Negative test num. 1 - tf file" resource "awssecretsmanagersecret" "example" { name = "example" kmskeyid = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: mssql_session.md

+++ title = "mssql_session resource" draft = false gh_repo = "inspec" platform = "windows" [menu] [menu.inspec] title = "mssql_session" identifier = "inspec/resources/os/mssqlsession.md mssqlsession resource" parent = "inspec/resources/os" +++ Use the `mssql_session` Chef InSpec audit resource to test SQL commands run against a Microsoft SQL database. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.24.0 of InSpec. A `mssql_session` resource block declares the username and password to use for the session, and then the command to be run: describe mssql_session(user: 'username', password: 'password').query('QUERY').row(0).column('result') do its('value') { should eq('') } end where `mssql_session` declares a username and password with permission to run the query. Omitting the username or password parameters results in the use of Windows authentication as the user Chef InSpec is executing as. You may also optionally pass a host and instance name. If omitted, they will default to host: localhost and the default instance. `query('QUERY')` contains the query to be run `its('value') { should eq('') }` compares the results of the query against the expected result in the test The following examples show how to use this Chef InSpec audit resource. sql = mssqlsession(user: 'myuser', password: 'password') describe sql.query("SELECT SERVERPROPERTY('ProductVersion') as result").row(0).column('result') do its("value") { should cmp > '12.00.4457' } end sql = mssql_session describe sql.query("SELECT SERVERPROPERTY('ProductVersion') as result").row(0).column('result') do its("value") { should cmp > '12.00.4457' } end sql = mssqlsession(user: 'myuser', password: 'password', host: 'ms-sql-server', instance: 'foo') describe sql.query("SELECT SERVERPROPERTY('ProductVersion') as result").row(0).column('result') do its("value") { should cmp > '12.00.4457' } end sql = mssqlsession(user: 'myuser', password: 'password', db_name: 'test') describe sql.query("SELECT Name AS result FROM Product WHERE ProductID == 1").row(0).column('result') do its("value") { should eq 'foo' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-ecr-controller.md

layout: integration title: AWS Elastic Container Registry subtitle: Collaborative and visual infrastructure as code for AWS Elastic Container Registry image: /assets/img/integrations/aws-ecr-controller/icons/color/aws-ecr-controller-color.svg permalink: extensibility/integrations/aws-ecr-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-ecr-controller description: integrations-category: Provisioning integrations-subcategory: Containers registrant: GitHub components: name: field-export colorIcon: assets/img/integrations/aws-ecr-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-ecr-controller/components/field-export/icons/white/field-export-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-ecr-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-ecr-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: pull-through-cache-rule colorIcon: assets/img/integrations/aws-ecr-controller/components/pull-through-cache-rule/icons/color/pull-through-cache-rule-color.svg whiteIcon: assets/img/integrations/aws-ecr-controller/components/pull-through-cache-rule/icons/white/pull-through-cache-rule-white.svg description: name: repository colorIcon: assets/img/integrations/aws-ecr-controller/components/repository/icons/color/repository-color.svg whiteIcon: assets/img/integrations/aws-ecr-controller/components/repository/icons/white/repository-white.svg description: featureList: [ "OCI and Docker support", "Public container image and artifact gallery ", "Amazon ECR supports the ability to define and organize repositories in your registry using namespaces." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: ArangoDB (App Definition and Development / Database)
File: value_rvalue_const.md

+++ title = "`const value_type &&value() const &&`" description = "Wide contract const rvalue reference observer of any value present. Constexpr propagating." categories = ["observers"] weight = 670 +++ Wide contract const rvalue reference observer of any value present. `NoValuePolicy::widevaluecheck()` is first invoked, then the reference to the value is returned. Note that if `value_type` is `void`, only a `const` overload returning `void` is present. Requires: Always available. Complexity: Depends on `NoValuePolicy::widevaluecheck()`. Guarantees: None.