cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 568cc372-ca64-420d-9015-ee347d00d288.md

title: User Data Contains Encoded Private Key hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 568cc372-ca64-420d-9015-ee347d00d288 Query name: User Data Contains Encoded Private Key Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: User Data should not contain a base64 encoded private key. If so, anyone can decode the private key easily<br> ```json title="Positive test num. 1 - json file" hl_lines="12" { "Resources":{ "myLaunchConfig3":{ "Type":"AWS::AutoScaling::LaunchConfiguration", "Properties":{ "ImageId":"ami-02354e95b39ca8dec", "SecurityGroups":[ { "Ref":"myEC2SecurityGroup" }, "myExistingEC2SecurityGroup" ], "InstanceType":"m1.large", "KeyName":{ "Ref":"KeyName" }, "UserData": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpzb21lS2V5" } } } } ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="13" Resources: myLaunchConfig4: Type: AWS::AutoScaling::LaunchConfiguration Properties: ImageId: "ami-02354e95b39ca8dec" SecurityGroups: Ref: "myEC2SecurityGroup" myExistingEC2SecurityGroup InstanceType: "m1.large" KeyName: Ref: "KeyName" UserData: "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpzb21lS2V5" ``` ```json title="Negative test num. 1 - json file" { "Resources":{ "myLaunchConfig":{ "Type":"AWS::AutoScaling::LaunchConfiguration", "Properties":{ "ImageId":"ami-02354e95b39ca8dec", "SecurityGroups":[ { "Ref":"myEC2SecurityGroup" }, "myExistingEC2SecurityGroup" ], "InstanceType":"m1.large", "KeyName":{ "Ref":"KeyName" }, "UserData": "some-gibberish" } } } } ``` ```yaml title="Negative test num. 2 - yaml file" Resources: myLaunchConfig2: Type: AWS::AutoScaling::LaunchConfiguration Properties: ImageId: "ami-02354e95b39ca8dec" SecurityGroups: Ref: "myEC2SecurityGroup" myExistingEC2SecurityGroup InstanceType: "m1.large" KeyName: Ref: "KeyName" UserData: "some-gibberish" ```
Project: ClickHouse (App Definition and Development / Database)
File: v22.6.8.35-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Add setting to disable limit on kafkanumconsumers. Closes . (). Backported in : Fix memory safety issues with functions `encrypt` and `contingency` if Array of Nullable is used as an argument. This fixes . (). Backported in : Fix unused unknown columns introduced by WITH statement. This fixes . (). Backported in : Fix potential deadlock in WriteBufferFromS3 during task scheduling failure. (). Backported in : - Fix crash while parsing values of type `Object` that contains arrays of variadic dimension. (). Backported in : During insertion of a new query to the `ProcessList` allocations happen. If we reach the memory limit during these allocations we can not use `OvercommitTracker`, because `ProcessList::mutex` is already acquired. Fixes . (). Backported in : Fix memory leak while pushing to MVs w/o query context (from Kafka/...). (). Backported in : Fix access rights for `DESCRIBE TABLE url()` and some other `DESCRIBE TABLE <table_function>()`. (). Backported in : Fix incorrect logical error `Expected relative path` in disk object storage. Related to . (). Backported in : Add column type check before UUID insertion in MsgPack format. (). use ROBOTCLICKHOUSECOMMIT_TOKEN for create-pull-request (). use input token instead of env var (). Migrate artifactory (). Docker server version (). Increase open files limit ().
Project: KICS (Provisioning / Security & Compliance)
File: 6cf42c97-facd-4fda-b8af-ea4529123355.md

title: Kubelet Protect Kernel Defaults Set To False hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6cf42c97-facd-4fda-b8af-ea4529123355 Query name: Kubelet Protect Kernel Defaults Set To False Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: --protect-kernel-defaults should be set to true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--protect-kernel-defaults=false"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet","--protect-kernel-defaults=false"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="5" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 protectKernelDefaults: false serializeImagePulls: false tlsCertFile: "someFile.txt" tlsPrivateKeyFile: "someFile.txt" evictionHard: memory.available: "200Mi" ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="2" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false tlsCertFile: "someFile.txt" tlsPrivateKeyFile: "someFile.txt" evictionHard: memory.available: "200Mi" ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--protect-kernel-defaults=true"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: [] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false protectKernelDefaults: true tlsCertFile: "someFile.txt" tlsPrivateKeyFile: "someFile.txt" evictionHard: memory.available: "200Mi" ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "port": 10250, "readOnlyPort": 10255, "cgroupDriver": "cgroupfs", "protectKernelDefaults": true, "hairpinMode": "promiscuous-bridge", "serializeImagePulls": false, "featureGates": { "RotateKubeletClientCertificate": true, "RotateKubeletServerCertificate": true } } ``` </details>
Project: YugabyteDB (App Definition and Development / Database)
File: ddl_drop_extension.md

title: DROP EXTENSION statement [YSQL] headerTitle: DROP EXTENSION linkTitle: DROP EXTENSION summary: Remove an extension description: Use the DROP EXTENSION statement to remove an extension from the database menu: v2.18: identifier: ddldropextension parent: statements type: docs Use the `DROP EXTENSION` statement to remove an extension from the database. {{%ebnf%}} drop_extension {{%/ebnf%}} An error is thrown if the extension does not exist unless `IF EXISTS` is used. Then, a notice is issued instead. `RESTRICT` is the default, and it will not drop the extension if any objects depend on it. `CASCADE` drops any objects that transitively depend on the extension. ```plpgsql DROP EXTENSION IF EXISTS cube; ``` ```output NOTICE: extension "cube" does not exist, skipping ``` ```plpgsql CREATE EXTENSION cube; CREATE EXTENSION earthdistance; DROP EXTENSION IF EXISTS cube RESTRICT; ``` ```output ERROR: cannot drop extension cube because other objects depend on it DETAIL: extension earthdistance depends on function cube_out(cube) HINT: Use DROP ... CASCADE to drop the dependent objects too. ``` ```plpgsql DROP EXTENSION IF EXISTS cube CASCADE; ``` ```output NOTICE: drop cascades to extension earthdistance DROP EXTENSION ```
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-pattern-onboard.md

layout: default title: mesheryctl-pattern-onboard permalink: reference/mesheryctl/pattern/onboard redirect_from: reference/mesheryctl/pattern/onboard/ type: reference display-title: "false" language: en command: pattern subcommand: onboard Onboard pattern Command will trigger deploy of pattern <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl pattern onboard [flags] </div> </pre> Onboard pattern by providing file path <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl pattern onboard -f [filepath] -s [source type] </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl pattern onboard -f ./pattern.yml -s "Kubernetes Manifest" </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -f, --file string Path to pattern file -h, --help help for onboard --skip-save Skip saving a pattern -s, --source-type string Type of source file (ex. manifest / compose / helm) </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -t, --token string Path to token file default from current context -v, --verbose verbose output </div> </pre> Usage of mesheryctl pattern onboard Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: KICS (Provisioning / Security & Compliance)
File: b25398a2-0625-4e61-8e4d-a1bb23905bf6.md

title: CDN Configuration Is Missing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b25398a2-0625-4e61-8e4d-a1bb23905bf6 Query name: CDN Configuration Is Missing Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: Content Delivery Network (CDN) service is used within an AWS account to secure and accelerate the delivery of websites. The use of a CDN can provide a layer of security between your origin content and the destination.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2 23" name: create a distribution without an origin and with enabled=false community.aws.cloudfront_distribution: state: present caller_reference: unique test distribution ID defaultcachebehavior: targetoriginid: 'my test origin-000111' forwarded_values: query_string: true cookies: forward: all headers: '*' viewerprotocolpolicy: allow-all smooth_streaming: true compress: true allowed_methods: items: GET HEAD cached_methods: GET HEAD enabled: false logging: enabled: true include_cookies: false bucket: mylogbucket.s3.amazonaws.com prefix: myprefix/ ``` ```yaml title="Negative test num. 1 - yaml file" name: create a distribution with an origin, logging and default cache behavior community.aws.cloudfront_distribution: state: present caller_reference: unique test distribution ID origins: id: 'my test origin-000111' domain_name: www.example.com origin_path: /production custom_headers: header_name: MyCustomHeaderName header_value: MyCustomHeaderValue defaultcachebehavior: targetoriginid: 'my test origin-000111' forwarded_values: query_string: true cookies: forward: all headers: '*' viewerprotocolpolicy: allow-all smooth_streaming: true compress: true allowed_methods: items: GET HEAD cached_methods: GET HEAD logging: enabled: true include_cookies: false bucket: mylogbucket.s3.amazonaws.com prefix: myprefix/ enabled: true comment: this is a CloudFront distribution with logging ```
Project: Stolon (App Definition and Development / Database)
File: manual_switchover.md

If for any reason (eg. maintenance) you want to switch the current master to another one without losing any transaction you can do this in these ways: If you've synchronous replication enabled you can just stop/ the current master keeper, one of the synchronous standbys will be elected as the new master. If you aren't using synchronous replication you can just temporarily enable it (see ), wait that the cluster reconfigures some synchronous standbys (you can monitor `pgstatreplication` for a standby with `sync_state` = `sync`) and then stop/ the master keeper, wait for a new synchronous standby to be elected and disable synchronous replication.
Project: Meshery (Provisioning / Automation & Configuration)
File: cri-o.md

layout: integration title: CRI-O subtitle: Collaborative and visual infrastructure as code for CRI-O image: /assets/img/integrations/cri-o/icons/color/cri-o-color.svg permalink: extensibility/integrations/cri-o docURL: https://docs.meshery.io/extensibility/integrations/cri-o description: integrations-category: Runtime integrations-subcategory: Container Runtime registrant: Artifact Hub components: featureList: [ "Supports multiple image formats including the existing Docker image format.", "Container image management (managing image layers, overlay filesystems, etc).", "Container process lifecycle management" ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: ClickHouse (App Definition and Development / Database)
File: union.md

slug: /en/sql-reference/statements/select/union sidebar_label: UNION You can use `UNION` with explicitly specifying `UNION ALL` or `UNION DISTINCT`. If you don't specify `ALL` or `DISTINCT`, it will depend on the `uniondefaultmode` setting. The difference between `UNION ALL` and `UNION DISTINCT` is that `UNION DISTINCT` will do a distinct transform for union result, it is equivalent to `SELECT DISTINCT` from a subquery containing `UNION ALL`. You can use `UNION` to combine any number of `SELECT` queries by extending their results. Example: ``` sql SELECT CounterID, 1 AS table, toInt64(count()) AS c FROM test.hits GROUP BY CounterID UNION ALL SELECT CounterID, 2 AS table, sum(Sign) AS c FROM test.visits GROUP BY CounterID HAVING c > 0 ``` Result columns are matched by their index (order inside `SELECT`). If column names do not match, names for the final result are taken from the first query. Type casting is performed for unions. For example, if two queries being combined have the same field with non-`Nullable` and `Nullable` types from a compatible type, the resulting `UNION` has a `Nullable` type field. Queries that are parts of `UNION` can be enclosed in round brackets. and are applied to separate queries, not to the final result. If you need to apply a conversion to the final result, you can put all the queries with `UNION` in a subquery in the clause. If you use `UNION` without explicitly specifying `UNION ALL` or `UNION DISTINCT`, you can specify the union mode using the setting. The setting values can be `ALL`, `DISTINCT` or an empty string. However, if you use `UNION` with `uniondefaultmode` setting to empty string, it will throw an exception. The following examples demonstrate the results of queries with different values setting. Query: ```sql SET uniondefaultmode = 'DISTINCT'; SELECT 1 UNION SELECT 2 UNION SELECT 3 UNION SELECT 2; ``` Result: ```text 1 1 1 2 1 3 ``` Query: ```sql SET uniondefaultmode = 'ALL'; SELECT 1 UNION SELECT 2 UNION SELECT 3 UNION SELECT 2; ``` Result: ```text 1 1 1 2 1 2 1 3 ``` Queries that are parts of `UNION/UNION ALL/UNION DISTINCT` can be run simultaneously, and their results can be mixed together. See Also setting. setting.
Project: StarRocks (App Definition and Development / Database)
File: Superset.md

displayed_sidebar: "English" Apache Superset supports querying and visualizing both internal data and external data in StarRocks. Make sure that you have finished the following installations: Install the Python client for StarRocks on your Apache Superset server. ```SQL pip install starrocks ``` Install the latest version of Apache Superset. For more information, see . Create a database in Apache Superset: Take note of the following points: For SUPPORTED DATABASES, select StarRocks, which will be used as the data source. For SQLALCHEMY URI, enter a URI in the StarRocks SQLAlchemy URI format as below: ```SQL starrocks://<User>:<Password>@<Host>:<Port>/<Catalog>.<Database> ``` The parameters in the URI are described as follows: `User`: the username that is used to log in to your StarRocks cluster, for example, `admin`. `Password`: the password that is used to log in to your StarRocks cluster. `Host`: the FE host IP address of your StarRocks cluster. `Port`: the FE query port of your StarRocks cluster, for example, `9030`. `Catalog`: the target catalog in your StarRocks cluster. Both internal and external catalogs are supported. `Database`: the target database in your StarRocks cluster. Both internal and external databases are supported.
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: v1.8.3.md

Dapr 1.8.0 introduced an error that causes a panic in the runtime when attempting to invoke a service that does not exist (and with dealing with a few other error cases) and the `Resiliency` preview feature is enabledeven if no resiliency policies are configured. This issue impacts all users that have enabled the `Resiliency` preview feature in Dapr 1.8.01.8.2, even when no resiliency policies are configured. Due to incorrect handling of errors in the direct messaging package, certain types of errors were discarded and the affected method returned a non-error response, eventually causing receivers to panic. We have fixed the handling of the errors in the direct messaging package when `Resiliency` is enabled, resolving the issue that could have caused a panic in case of errors.
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: README.md

This directory contains the source of release notes starting with RabbitMQ `3.5.7` as well as archived notes for earlier releases. The notes are published together with releases and most commonly discovered via the . This may include WIP notes for unreleased versions or preview releases. This directory contains release notes for releases from `1.1.x` through `3.5.0`, which pre-date the migration to GitHub. They are preserved both for historical purposes and to keep the links functional, so their names were not modified to match the `X.Y.Z.md` pattern.
Project: KICS (Provisioning / Security & Compliance)
File: a21b8df3-c840-4b3d-a41a-10fb2afda171.md

title: Not Proper Email Account In Use hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a21b8df3-c840-4b3d-a41a-10fb2afda171 Query name: Not Proper Email Account In Use Platform: GoogleDeploymentManager Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Gmail accounts are being used instead of corporate credentials<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9" resources: name: a-new-pubsub-topic type: pubsub.v1.topic accessControl: gcpIamPolicy: bindings: role: roles/pubsub.publisher members: "user:jane@gmail.com" "serviceAccount:my-other-app@appspot.gserviceaccount.com" ``` ```yaml title="Negative test num. 1 - yaml file" resources: name: a-new-pubsub-topic type: pubsub.v1.topic accessControl: gcpIamPolicy: bindings: role: roles/pubsub.publisher members: "user:jane@example.com" "serviceAccount:my-other-app@appspot.gserviceaccount.com" ```
Project: Kubescape (Provisioning / Security & Compliance)
File: GOVERNANCE.md

The Kubescape project is an open-source initiative dedicated to improve security and best practices in Kubernetes environments. This document outlines the governance structure of the Kubescape project and provides guidance for its community contributors. Maintainers are responsible for the smooth operation of the project. They review and merge pull requests, manage releases, and ensure the quality and stability of the codebase. Maintainers are chosen based on their ongoing contributions and their demonstrated commitment to the project. Everyone who had at least 5 code contribution in the last 12 month can submit her/himself for joining the maintainer team Maintainers who are not taken part in the project work (code, reviews, discussions) for 12 month are automaticaly removed from the maintainer team Committers are contributors who have made significant and consistent contributions to the project. They have the ability to merge minor pull requests if assigned by maintainers. A contributor can be proposed as a committer by any existing maintainer. The proposal will be reviewed and voted on by the existing maintainers. Anyone can become a community member by contributing to the project. This can be in the form of code contributions, documentation, or any other form of project support. Open an issue on the project repository to discuss the proposed change. Once there is consensus around the proposed change, create a pull request. Pull requests will be reviewed by committers and/or maintainers. Once the pull request has received approval, it can be merged into the main codebase. In case of any conflicts, it is primarily the responsibility of the parties involved to resolve it. If the conflict cannot be resolved, it will be escalated to the maintainers for resolution. Maintainers' decision will be final in case of unresolved conflicts. Ensure the quality and stability of the project. Resolve conflicts. Provide direction and set priorities for the project. Review and merge minor pull requests. Assist maintainers in project tasks. Promote best practices within the community. Contribute to the project in any form. Participate in discussions and provide feedback. Respect the code of conduct and governance of the project. Proposed changes to this governance document should follow the same process as any other code change to the Kubescape project (see "Proposing Changes").
Project: Meshery (Provisioning / Automation & Configuration)
File: app-mesh.md

layout: default title: Meshery Adapter for App Mesh name: Meshery Adapter for App Mesh component: App Mesh earliest_version: v1.4.1 port: 10005/gRPC project_status: beta github_link: https://github.com/meshery/meshery-app-mesh image: /assets/img/service-meshes/app-mesh.svg white_image: /assets/img/service-meshes/app-mesh-white.svg permalink: extensibility/adapters/app-mesh redirect_from: service-meshes/adapters/app-mesh language: en {% assign sortedtestsgroup = site.compatibility | group_by: "meshery-component" %} {% for group in sortedtestsgroup %} {% if group.name == "meshery-app-mesh" %} {% assign items = group.items | sort: "meshery-component-version" | reverse %} {% for item in items %} {% if item.meshery-component-version != "edge" %} {% if item.overall-status == "passing" %} {% assign adapterversiondynamic = item.meshery-component-version %} {% break %} {% elsif item.overall-status == "failing" %} {% continue %} {% endif %} {% endif %} {% endfor %} {% endif %} {% endfor %} {% include compatibility/adapter-status.html %} The {{page.name}} can install {{page.earliest_version}} of {{page.component}}. A number of sample applications can be installed using the {{page.name}}. Lifecycle management of {{page.component}} Lifecycle management of sample applications Performance testing The {{ page.name }} includes a handful of sample applications. Use Meshery to deploy any of these sample applications. - A microservice application that allows users to vote for their favorite emoji, and tracks votes received on a leaderboard. - Follow this to set up and deploy the BookInfo sample app on Istio using Meshery. - Httpbin is a simple HTTP request and response service. Identify overhead involved in running {{page.component}}, various {{page.component}} configurations while running different workloads and on different infrastructure. The adapter facilitates data plane and control plane performance testing. Prometheus integration Grafana integration The will connect to {{page.component}}'s Prometheus and Grafana instances running in the control plane.