cwielenb/CNCF-Dataset huggingface dataset:
Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_ad_users.md

+++ title = "azurermadusers resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurermadusers" identifier = "inspec/resources/azure/azurermadusers.md azurermadusers resource" parent = "inspec/resources/azure" +++ {{< warning >}} This resource will be deprecated when version 2 of the inspec-azure resource pack is released. {{< /warning >}} Use the `azurermadusers` InSpec audit resource to test properties of some or all Azure Active Directory users within a Tenant. This resource interacts with version `1.6` of the Azure Graph API. For more information see the . I don't see a way to select the version of the API in the Azure documents. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: name: inspec-azure git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . This resource first became available in 1.1.0 of the inspec-azure resource pack. An `azurermadusers` resource block returns all Azure Active Directory user accounts for the contained within the configured Tenant and then tests that group group of users. describe azurermadusers do ... end The following examples show how to use this InSpec audit resource. describe azurermadusers do it { should exist } end describe azurermadusers.guest_accounts it { should_not exist } end `names` Filters the results to include only those Users that match the given name. This is a string value. describe azurermadusers.where{ displayName.eql?('Haris Shefu') } do it { should exist } end `object_ids` `display_names` `mails` `user_types` The azureIds property provides a list of all User's Azure IDs. its('azure_ids') { should include '44211066-f292-4546-8ced-2ab0e0911f44' } The displayNames property provides a list of all the User display names. its('display_names') { should include 'Azure Admin Account' } The mails property provides a list of all the User email addresses, where present. its('mails') { should include 'admin@example.com' } The userTypes property provides a list of all User Types for all users. its('user_types') { should include 'Member' } {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The control will pass if the filter returns at least one result. Use `should_not` if you expect zero matches. describe azurermadusers do it { should exist } end The Client/Active Directory Application you have configured InSpec Azure to use (`AZURECLIENTID`) must have permissions to read User data from the Azure Graph RBAC API. Please refer to the for information on how to grant these permissions to your application. Note: An Azure Admin must grant your application these permissions.
Project: SPIRE (Provisioning / Key Management)
File: plugin_server_nodeattestor_sshpop.md

Must be used in conjunction with the agent-side sshpop plugin The `sshpop` plugin attests nodes that have been provisioned with an ssh identity through an out-of-band mechanism. It verifies that the certificate is rooted to a trusted set of CAs and issues a signature based proof-of-possession challenge to the agent plugin to verify that the node is in possession of the private key. The SPIFFE ID produced by the plugin is based on the certificate fingerprint, which is an unpadded url-safe base64 encoded sha256 hash of the certificate in openssh format. ```xml spiffe://<trust_domain>/spire/agent/sshpop/<fingerprint> ``` | Configuration | Description | Default | |-|--|--| | `certauthorities` | A list of trusted CAs in ssh `authorizedkeys` format. | | | `certauthoritiespath` | A file that contains a list of trusted CAs in ssh `authorized_keys` format. | | | `canonicaldomain` | A domain suffix for validating the hostname against the certificate's valid principals. See CanonicalDomains in sshconfig(5). | | `agentpathtemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `"{{ .PluginName}}/{{ .Fingerprint }}"` | If both `certauthorities` and `certauthorities_path` are configured, the resulting set of authorized keys is the union of both sets. ```hcl NodeAttestor "sshpop" { plugin_data { hostcertpath = "./conf/agent/dummyagentssh_key-cert.pub" hostkeypath = "./conf/agent/dummyagentssh_key" } } ``` ```hcl NodeAttestor "sshpop" { plugin_data { cert_authorities = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEAWPAsKJ/qMYUIBeH7BLMRCE/bkUvMHX+7OZhANk45S"] certauthoritiespath = "./conf/server/dummysshcert_authority.pub" } } ```
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: LICENSING.md

License names used in this document are as per . The default license for this project is . The following directories and their subdirectories are licensed under Apache-2.0: ``` apis/ deploy/ docker/ externalapis/ hack/ pkg/client/ test/ tools/ ``` The following directories and their subdirectories are licensed under their original upstream licenses: ``` cmd/probe/pkg/component/ pkg/cli/cmd/plugin/download/ vendor/ ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_subscription.md

+++ title = "azurerm_subscription resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurerm_subscription" identifier = "inspec/resources/azure/azurermsubscription.md azurermsubscription resource" parent = "inspec/resources/azure" +++ {{< inspec/azurermdeprecated resource="azuresubscription" >}} Use the `azurerm_subscription` InSpec audit resource to test properties related to the current subscription subscription. This resource interacts with version `2019-10-01` of the Azure Management API. For more information see the . At the moment, there doesn't appear to be a way to select the version of the Azure API docs. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: name: inspec-azure git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . This resource first became available in 1.7.0 of the inspec-azure resource pack. The resource will retrieve the current subscription which InSpec is using, which is specified in your environment/service principal. describe azurerm_subscription do ... end describe azurerm_subscription do its('name') { should eq 'subscription name' } its('locations') { should include 'eastus' } end No parameters required. `id` `name` `locations` The subscription's unique id. e.g. '1ea4649e-0132-4f1c-8b68-9f9b2147281c' The subscriptions's display name. its('name') { should eq('subscription name') } An array of locations available in this subscription. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. describe azurerm_subscription do it { should exist } end Your [Service Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal) must be setup with a `contributor` role on the subscription you wish to test.
Project: ContainerSSH (Provisioning / Security & Compliance)
File: CODES.md

| Code | Explanation | ||-| | `CORECONFIGCANNOTWRITEFILE` | ContainerSSH cannot update the configuration file with the new host keys and will only use the host key for the current run. | | `CORECONFIGERROR` | ContainerSSH encountered an error in the configuration. | | `CORECONFIGFILE` | ContainerSSH is reading the configuration file. | | `COREHEALTHCHECK_FAILED` | A ContainerSSH health check failed. | | `COREHEALTHCHECK_SUCCESSFUL` | The health check was successful. | | `COREHOSTKEYGENERATIONFAILED` | ContainerSSH could not generate host keys and is aborting the run. | | `CORENOHOST_KEYS` | The configuration does not contain host keys. ContainerSSH will attempt to generate host keys and update the configuration file. |
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: gradle-plugin.md

title: Gradle Build Plugin labels: layer: cicd category: cicdplugin type: poweredbyopa software: gradle java groovy kotlin code: https://github.com/Bisnode/opa-gradle-plugin https://plugins.gradle.org/plugin/com.bisnode.opa inventors: bisnode Build plugin adding various tasks to support using OPA as part of Gradle builds
Project: YugabyteDB (App Definition and Development / Database)
File: cloud-security-features.md

title: Security architecture drilldown linkTitle: Security architecture drilldown description: Explore the security architecture of YugabyteDB Managed data, our fully managed YugabyteDB-as-a-Service. menu: preview_yugabyte-cloud: parent: cloud-security identifier: cloud-security-features weight: 10 type: docs YugabyteDB Managed is a fully managed YugabyteDB-as-a-Service that allows you to run YugabyteDB clusters on public cloud providers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). YugabyteDB Managed runs on top of . It is responsible for creating and managing customer YugabyteDB clusters deployed on cloud provider infrastructure. All customer clusters are firewalled from each other. Outside connections are also firewalled according to the rules that you assign to your clusters. You can also connect Dedicated (that is, not Sandbox) clusters to virtual private clouds (VPCs) on the public cloud provider of your choice (subject to the IP allow list rules). YugabyteDB Managed uses both encryption in transit and encryption at rest to protect clusters and cloud infrastructure. All communication between YugabyteDB Managed architecture domains is encrypted in transit using TLS. Likewise, all communication between clients or applications and clusters is encrypted in transit. Every cluster has its own certificates, generated when the cluster is created and signed by the Yugabyte internal PKI. Root and intermediate certificates are not extractable from the hardware security appliances. Data at rest, including clusters and backups, is AES-256 encrypted using native cloud provider technologies - S3 and EBS volume encryption for AWS, Azure disk encryption, and server-side and persistent disk encryption for GCP. Encryption keys are managed by the cloud provider and anchored by hardware security appliances. Customers can enable YugabyteDB and as additional security controls. YugabyteDB Managed provides DDoS and application layer protection, and automatically blocks network protocol and volumetric DDoS attacks. Yugabyte secures YugabyteDB Managed databases using the same default to secure their own YugabyteDB installations, including: authentication role-based access control dedicated users limited network exposure encryption in transit encryption at rest For information on data privacy and compliance, refer to the . Yugabyte supports audit logging at the account and database level. For information on database audit logging, refer to .
Project: KubeEdge (Provisioning / Automation & Configuration)
File: question.md

name: Question about: Question relating to KubeEdge. labels: kind/question <!-- Please use this template while providing as much info as possible. Thanks!--> What happened and what you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use `kubectl version`): KubeEdge version(e.g. `cloudcore --version` and `edgecore --version`):
Project: KICS (Provisioning / Security & Compliance)
File: 9d13b150-a2ab-42a1-b6f4-142e41f81e52.md

title: SNS Topic Without KmsMasterKeyId hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9d13b150-a2ab-42a1-b6f4-142e41f81e52 Query name: SNS Topic Without KmsMasterKeyId Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Secret Management URL: KmsMasterKeyId attribute should not be undefined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" AWSTemplateFormatVersion: 2010-09-09 Resources: MySNSTopic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Fn::GetAtt: "MyQueue1" "Arn" Protocol: "sqs" Endpoint: Fn::GetAtt: "MyQueue2" "Arn" Protocol: "sqs" TopicName: "SampleTopic" ``` ```json title="Positive test num. 2 - json file" hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MySNSTopic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Fn::GetAtt": [ "MyQueue1", "Arn" ] }, "Protocol": "sqs" }, { "Endpoint": { "Fn::GetAtt": [ "MyQueue2", "Arn" ] }, "Protocol": "sqs" } ], "TopicName": "SampleTopic" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: MySNSTopic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Fn::GetAtt: "MyQueue1" "Arn" Protocol: "sqs" Endpoint: Fn::GetAtt: "MyQueue2" "Arn" Protocol: "sqs" TopicName: "SampleTopic" KmsMasterKeyId: "kmsMasterKeyId" ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MySNSTopic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Fn::GetAtt": [ "MyQueue1", "Arn" ] }, "Protocol": "sqs" }, { "Endpoint": { "Fn::GetAtt": [ "MyQueue2", "Arn" ] }, "Protocol": "sqs" } ], "TopicName": "SampleTopic", "KmsMasterKeyId": "kmsMasterKeyId" } } } } ```
Project: OpenMessaging (App Definition and Development / Streaming & Messaging)
File: README.md

](https://travis-ci.org/openmessaging/openmessaging-java) ](http://search.maven.org/#search%7Cga%7C1%7Copenmessaging) ](https://openmessaging.herokuapp.com/) ](https://www.apache.org/licenses/LICENSE-2.0.html) OpenMessaging, which includes the establishment of industry guidelines and messaging, streaming specifications to provide a common framework for finance, e-commerce, IoT and big-data area. The design principles are the cloud-oriented, simplicity, flexibility, and language independent in distributed heterogeneous environments. Conformance to these specifications will make it possible to develop a heterogeneous messaging applications across all major platforms and operating systems. .
Project: Beam (App Definition and Development / Streaming & Messaging)
File: windowinto.md

title: "WindowInto" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <table align="left"> <a target="_blank" class="button" href="https://beam.apache.org/releases/pydoc/current/apachebeam.transforms.window.html?highlight=window#module-apachebeam.transforms.window"> <img src="/images/logos/sdks/python.png" width="20px" height="20px" alt="Pydoc"> Pydoc </a> </table> <br><br> Logically divides up or groups the elements of a collection into finite windows according to a function. {{< playground height="700px" >}} {{< playgroundsnippet language="py" path="SDKPYTHON_Window" show="window" >}} {{< /playground >}} produces a collection where each element consists of a key and all values associated with that key. applies a function to determine a timestamp to each element in the output collection.
Project: KICS (Provisioning / Security & Compliance)
File: 0d7ef70f-e176-44e6-bdba-add3e429788d.md

title: Serverless Function Without X-Ray Tracing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0d7ef70f-e176-44e6-bdba-add3e429788d Query name: Serverless Function Without X-Ray Tracing Platform: ServerlessFW Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: Serverless Function should have Tracing enabled. For this, property 'tracing' should have the value 'Active'<br> ```yml title="Positive test num. 1 - yml file" hl_lines="14" service: service frameworkVersion: '2' provider: name: aws runtime: nodejs12.x functions: hello: handler: handler.hello onError: arn:aws:sns:us-east-1:XXXXXX:test tags: foo: bar role: arn:aws:iam::XXXXXX:role/role tracing: PassThrough ``` ```yml title="Positive test num. 2 - yml file" hl_lines="8" service: service frameworkVersion: '2' provider: name: aws runtime: nodejs12.x functions: hello: handler: handler.hello onError: arn:aws:sns:us-east-1:XXXXXX:test tags: foo: bar role: arn:aws:iam::XXXXXX:role/role ``` ```yml title="Negative test num. 1 - yml file" service: service frameworkVersion: '2' provider: name: aws runtime: nodejs12.x functions: hello: handler: handler.hello onError: arn:aws:sns:us-east-1:XXXXXX:test tags: foo: bar role: arn:aws:iam::XXXXXX:role/role tracing: Active ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: php_config.md

+++ title = "php_config resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "php_config" identifier = "inspec/resources/os/phpconfig.md phpconfig resource" parent = "inspec/resources/os" +++ Use the `php_config` Chef InSpec audit resource to test the PHP configuration parameters from the default `php.ini` file or a custom php file. The Chef InSpec distributes This resource. A `php_config` Chef InSpec audit resource allows to test PHP configuration parameters from the default `php.ini` or a custom php file. The custom configuration file path is provided in a hash format with `ini` as the key and path as the value. ```ruby describe phpconfig("configparam") do its("value") { should eq "VALUE" } end describe phpconfig("configparam", { "ini" => "pathtoini_file" }) do its("value") { should eq "VALUE" } end ``` where `config_param` is a valid parameter of php configuration. `value` is a property of this resource. `somevalue` is the value of the specified `configparam`. `pathtoini_file` is the path for custom php configuration file. The property of this resource is `value`. The value property fetches the provided configuration parameter value from the default `php.ini` file or a custom `php` file. ```ruby its("value") { should eq "VALUE" } ``` The following examples show how to use this Chef InSpec audit resource. ```ruby describe phpconfig("defaultmimetype") do its("value") { should eq "text/html" } end ``` ```ruby describe phpconfig("defaultmimetype", { "ini" => "/etc/php/7.4/cli/php.ini" }) do its("value") { should eq "text/html" } end ```
Project: KICS (Provisioning / Security & Compliance)
File: 482b7d26-0bdb-4b5f-bf6f-545826c0a3dd.md

title: CloudTrail SNS Topic Name Undefined hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 482b7d26-0bdb-4b5f-bf6f-545826c0a3dd Query name: CloudTrail SNS Topic Name Undefined Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: Check if SNS topic name is set for CloudTrail<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 5" resource "aws_cloudtrail" "positive1" { } resource "aws_cloudtrail" "positive2" { snstopicname = null } ``` ```tf title="Negative test num. 1 - tf file" resource "aws_cloudtrail" "negative1" { snstopicname = "some-topic" } ```
Project: StarRocks (App Definition and Development / Database)
File: column_privileges.md

displayed_sidebar: "English" `column_privileges` identifies all privileges granted on columns to a currently enabled role or by a currently enabled role. The following fields are provided in `column_privileges`: | Field | Description | | -- | | | GRANTEE | The name of the user to which the privilege is granted. | | TABLE_CATALOG | The name of the catalog to which the table containing the column belongs. This value is always `def`. | | TABLE_SCHEMA | The name of the database to which the table containing the column belongs. | | TABLE_NAME | The name of the table containing the column. | | COLUMN_NAME | The name of the column. | | PRIVILEGE_TYPE | The privilege granted. The value can be any privilege that can be granted at the column level. Each row lists a single privilege, so there is one row per column privilege held by the grantee. | | ISGRANTABLE | `YES` if the user has the `GRANT OPTION` privilege, `NO` otherwise. The output does not list `GRANT OPTION` as a separate row with `PRIVILEGETYPE='GRANT OPTION'`. |
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.TabCompletionSpec.md

/ / TabCompletionSpec .TabCompletionSpec A registrar for enumerators toBeCompleted: `string` The prefix of the to-be-completed parameter that has been typed so far. toBeCompletedIdx: `number` An index into CommandLine.argv, or -1 if it is the trailing argument that is to be completed.
Project: Vald (App Definition and Development / Database)
File: client-side.md

This page introduces the popular troubleshooting for client side. The helps you find the root reason for your problem. Additionally, if you encounter some errors when using API, the helps you, too. Please check your container limit of memory at first. Vald Agent requires memory for keeping indexing on memory. ```bash kubectl describe statefulset vald-agent-ngt ``` If the limit of memory exists, please remove it or update the value to more enormous. There are two possible reasons. Indexing has not finished in Vald Agent Vald will search the nearest vectors of query from the indexing in Vald Agent. If the indexing process is running, Vald Agent returns no search result. It will resolve when completed indexing instructions, like `CreateIndex`. Too short timeout for searching When the search timeout configuration is too short, Vald LB Gateway stops the searching process before getting the search result from Vald Agent. In the sense of search operation, you can modify search timeout by . <div class="notice"> It is easy to find out which problem occurs by inspections of the log of each Pod, like <a href="https://github.com/stern/stern">stern</a>. </div> Vald Agent NGT requires an AVX2 processor for running. Please check your CPU information.
Project: FOSSA (Provisioning / Security & Compliance)
File: commit.md

This subcommand commits the analysis performed in the `analyze` subcommand into a `fossa-deps` file. For more information on possible options, run `millhone commit --help`. The primary thing this subcommand requires is the path to the directory in which the output of `analyze` was written. Users can also alter which kinds of matches to commit, and customize the output format of the created `fossa-deps` file. The result of this subcommand is a `fossa-deps` file written to the root of the project directory. [!NOTE] This subcommand will not overwrite an existing `fossa-deps` file by default, and currently does not merge its output into an existing `fossa-deps` file. However, users can customize the output format (via `--format`) and then perform scripted merges themselves. After running `millhone commit`, the next step is to run `fossa analyze` on the project. FOSSA CLI will then pick up the dependencies reported in that `fossa-deps` file and report them as dependencies of the project.