cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 3a81fc06-566f-492a-91dd-7448e409e2cd.md

title: Generic Git Module Without Revision hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3a81fc06-566f-492a-91dd-7448e409e2cd Query name: Generic Git Module Without Revision Platform: Terraform Severity: <span style="color:#5bc0de">Info</span> Category: Best Practices URL: All generic git repositories should reference a revision.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8" variable "cluster_name" { default = "example" description = "cluster name" type = string } module "acm" { source = "git::https://example.com/vpc.git" version = "~> v2.0" domainname = var.sitedomain zoneid = data.awsroute53zone.this.zoneid tags = var.tags providers = { aws = aws.useast1 # cloudfront needs acm certificate to be from "us-east-1" region } } resource "awsekscluster" "negative1" { dependson = [awscloudwatchloggroup.example] enabledclusterlog_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"] name = var.cluster_name } ``` ```tf title="Negative test num. 1 - tf file" variable "cluster_name" { default = "example" description = "cluster name" type = string } module "acm" { source = "terraform-aws-modules/acm/aws" version = "~> v2.0" domainname = var.sitedomain zoneid = data.awsroute53zone.this.zoneid tags = var.tags providers = { aws = aws.useast1 # cloudfront needs acm certificate to be from "us-east-1" region } } resource "awsekscluster" "negative1" { dependson = [awscloudwatchloggroup.example] enabledclusterlog_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"] name = var.cluster_name } ```
Project: Beam (App Definition and Development / Streaming & Messaging)
File: graduation-media-recap.md

title: "Media recap of the Apache Beam graduation" date: 2017-02-01 00:00:01 -0800 categories: blog aliases: /blog/2017/02/01/graduation-media-recap.html authors: davor <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> One year ago today Apache Beam was accepted into incubation at the Apache Software Foundation. The community's work over the past year culminated, just over three weeks ago, with an that Apache Beam has successfully graduated as a new Top-Level Project at the foundation. Graduation sparked an additional interest in the project, from corporate endorsements, news articles, interviews, to the volume of traffic to our website and mailing lists. <!--more--> Corporate endorsements include Google, PayPal, Talend, data Artisans, and others. You can read more in the following blog posts: Google: "" by Tyler Akidau. Talend: "" by Jean-Baptiste Onofr. Talend: "" by Shane Kent. Google: "" by Frances Perry. News coverage started with the Apache Software Foundations press release in , and followed by coverage in many independent outlets. Some of those in English include: ZDNet: "" by Tony Baer. Datanami: "" by Alex Woodie. InfoWorld / JavaWorld: "" by Serdar Yegulalp, and republished in . JAXenter: "" by Kypriani Sinaris. OStatic: "Apache Beam Unifies Batch and Streaming Data Processing" by Sam Dean. <!-- https://ostatic.com/blog/apache-beam-unifies-batch-and-streaming-data-processing --> Enterprise Apps Today: "" by Sean Michael Kerner. The Register: "" by Alexander J. Martin. SiliconANGLE: "" by Mike Wheatley. SD Times: "" by Alex Handy. Graduation and media coverage helped push Beam website traffic to record levels. The website traffic, measured in unique sessions per hour, peaked at more than 15 times above the previous weeks numbers. In a steady state, the traffic is several times larger than before graduation. Hopefully these perspectives entice you to join us on this exciting ride, either as a user or a contributor, as we work towards our first release with API stability. If youd like to try out Apache Beam today, check out the latest . We welcome contribution and participation from anyone through our mailing lists, issue tracker, pull requests, and events.
Project: KICS (Provisioning / Security & Compliance)
File: c3e073c1-f65e-4d18-bd67-4a8f20ad1ab9.md

title: S3 Bucket With Public Access hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c3e073c1-f65e-4d18-bd67-4a8f20ad1ab9 Query name: S3 Bucket With Public Access Platform: Ansible Severity: <span style="color:#ff0000">Critical</span> Category: Access Control URL: S3 Bucket allows public access<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11 6" name: Create an empty bucket amazon.aws.aws_s3: bucket: mybucket mode: create permission: public-read name: Create an empty bucket 01 amazon.aws.aws_s3: bucket: mybucket 01 mode: create permission: public-read-write ``` ```yaml title="Negative test num. 1 - yaml file" name: Create an empty bucket amazon.aws.aws_s3: bucket: mybucket mode: create permission: private name: Create an empty bucket 02 amazon.aws.aws_s3: bucket: mybucket mode: create ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.7.21.md

RabbitMQ `3.7.21` is a maintenance release that includes a patch for . RabbitMQ `3.7.x` series is supported . Per the new Erlang version support policy in effect starting with January 2019, this release . Make sure a is used before upgrading. explains what package repositories and tools can be used to provision latest patch versions of Erlang `21.3.x` and `22.x`. When upgrading to this release and upgrading Erlang to 21.x or later at the same time, extra care has to be taken. Since CLI tools from RabbitMQ releases older than 3.7.7 will fail on Erlang 21 or later, RabbitMQ must be upgraded before Erlang. See upgrade and compatibility notes first if upgrading from an earlier release. See the for general documentation on upgrades and for release notes of other releases. Any questions about this release, upgrades or RabbitMQ in general are welcome on the . Avoid pattern expansion when logging connection closure reason. This addresses . GitHub issue: Errors were not propagated back to the client correctly in case of an LDAP server authentication failure. GitHub issue: `stomp.hide_server` is now available in the new style configuration format. GitHub issue: The plugin emitted a warning on start. GitHub issue: The plugin emitted a warning on start. GitHub issue: `event_exchange.vhost` is now available in the new style configuration format. GitHub issue: Warning: The source code archive provided by GitHub only contains the source of the broker, not the plugins or the client libraries. Please download the archive named `rabbitmq-server-3.7.21.tar.xz`.
Project: YugabyteDB (App Definition and Development / Database)
File: func_lastval.md

title: lastval() function [YSQL] headerTitle: lastval() linkTitle: lastval() description: Returns the value returned from the last call to nextval(), for any sequence, in the current session. menu: v2.18: identifier: api-ysql-exprs-lastval parent: api-ysql-exprs type: docs Use the `lastval()` function to return the value returned from the last call to `nextval()`, for any sequence, in the current session. An error is raised if `nextval()` has not been called in the current session. Create two sequences and call `nextval()` for each of them. ```plpgsql yugabyte=# CREATE SEQUENCE s1; ``` ``` CREATE SEQUENCE ``` ```plpgsql yugabyte=# CREATE SEQUENCE s2 START -100 MINVALUE -100; ``` ``` CREATE SEQUENCE ``` ```plpgsql yugabyte=# SELECT nextval('s1'); ``` ``` nextval 1 (1 row) ``` ```plpgsql yugabyte=# SELECT nextval('s2'); ``` ``` nextval -100 (1 row) ``` Call `lastval()`. ```plpgsql yugabyte=# SELECT lastval() ``` ``` lastval -100 (1 row) ```
Project: LinuxKit (Provisioning / Automation & Configuration)
File: reproducible-builds.md

We aim to make the outputs of `linuxkit build` reproducible, i.e. the build artefacts should be bit-by-bit identical copies if invoked with the same inputs and run with the same version of the `linuxkit` command. See [this document](https://reproducible-builds.org/docs/buy-in/) on why this matters. _Note, we do not (yet) aim to make `linuxkit pkg build` builds reproducible._ Currently, the following output formats provide reproducible builds: `tar` (Tested as part of the CI) `tar-kernel-initrd` `docker` `kernel+initrd` (Tested as part of the CI) In general, `linuxkit build` lends itself for reproducible builds. LinuxKit packages, used during `linuxkit build`, are (signed) docker images. Packages are tagged with the content hash of the source code (and optionally release version) and are typically only updated if the source of the package changed (in which case the tag changes). For all intents and purposes, when pulled by tag, the contents of a packages should be bit-by-bit identical. Alternatively, the digest of the package, in which case, the pulled image will always be the same. The first phase of the `linuxkit build` mostly untars and retars the images of the packages to produce an tar file of the root filesystem. This then serves as input for other output formats. During this first phase, there are a number of things to watch out for to generate reproducible builds: Timestamps of generated files. The `docker export` command, as well as `linuxkit build` itself, creates a small number of files. The `ModTime` for these files needs to be clamped to a fixed date (otherwise the current time is used). Use the `defaultModTime` variable to set the `ModTime` of created files to a specific time. Generated JSON files. `linuxkit build` generates a number of JSON files by marshalling Go `struct` variables. Examples are the OCI specification `config.json` and `runtime.json` files for containers. The default Go `json.Marshal()` function seems to do a reasonable good job in generating reproducible output from internal structures, including for JSON objects. However, during `linuxkit build` some of the OCI runtime spec fields are generated/modified and care must be taken to ensure consistent ordering. For JSON arrays (Go slices) it is best to sort them before Marshalling them. Reproducible builds for the first phase of `linuxkit build` can be tested using `-output tar` and comparing the output of subsequent builds with tools like `diff` or the excellent . The second phase of `linuxkit build` converts the intermediary `tar` format into the desired output format. Making this phase reproducible depends on the tools used to generate the output. Builds, which produce ISO formats should probably be converted to use before attempting to make them reproducible. For ideas on how to make the builds for other output formats reproducible, see [this page](https://reproducible-builds.org/docs/system-images/).
Project: KICS (Provisioning / Security & Compliance)
File: dd5230f8-a577-4bbb-b7ac-f2c2fe7d5299.md

title: Storage Container Is Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: dd5230f8-a577-4bbb-b7ac-f2c2fe7d5299 Query name: Storage Container Is Publicly Accessible Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Anonymous, public read access to a container and its blobs are enabled in Azure Blob Storage<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4" resource "azurermstoragecontainer" "positive1" { name = "vhds" storageaccountname = azurermstorageaccount.example.name containeraccesstype = "blob" } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermstoragecontainer" "negative1" { name = "vhds" storageaccountname = azurermstorageaccount.example.name containeraccesstype = "private" } resource "azurermstoragecontainer" "negative2" { name = "vhds2" storageaccountname = azurermstorageaccount.example.name // default is "private" } ```
Project: Crate.io (App Definition and Development / Database)
File: SECURITY.md

The CrateDB team and community take security bugs seriously. We appreciate your efforts to [responsibly disclose] your findings, and will make every effort to acknowledge your contributions. To report a security issue, please use the GitHub security reporting system on the corresponding project where you discovered the flaw. It is on the "Security" tab at Security Advisories New draft security advisory. For CrateDB, just navigate to [Report a vulnerability for CrateDB]. The CrateDB team will send a response indicating the next steps in handling your report. After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance. If you can't use the GitHub security reporting system, an alternative way of reporting security issues will be to write an email to security@crate.io.
Project: KubeArmor (Provisioning / Security & Compliance)
File: pkg-tools.md

```sh kubectl exec -it mysql-74775b4bf4-65nqf -n wordpress-mysql -- bash root@mysql-74775b4bf4-65nqf:/# apt bash: /usr/bin/apt: Permission denied root@mysql-74775b4bf4-65nqf:/# apt-get bash: /usr/bin/apt-get: Permission denied ``` ``` { "ATags": [ "NIST", "NIST800-53CM-7(4)", "SI-4", "process", "NIST800-53SI-4" ], "Action": "Block", "ClusterName": "aditya", "ContainerID": "b75628d4225b8071d5795da342cf2a5c03b1d67b22b40016697fcd17a0db20e4", "ContainerImage": "docker.io/library/mysql:5.6@sha256:20575ecebe6216036d25dab5903808211f1e9ba63dc7825ac20cb975e34cfcae", "ContainerName": "mysql", "Data": "syscall=SYS_EXECVE", "Enforcer": "AppArmor", "HashID": "dd573c234f68b8df005e8cd314809c8b2a23852230d397743e348bf4a03ada3f", "HostName": "aditya", "HostPID": 21894, "HostPPID": 16435, "Labels": "app=mysql", "Message": "Alert! Execution of package management process inside container is denied", "NamespaceName": "wordpress-mysql", "Operation": "Process", "Owner": { "Name": "mysql", "Namespace": "wordpress-mysql", "Ref": "Deployment" }, "PID": 168, "PPID": 160, "PodName": "mysql-74775b4bf4-65nqf", "PolicyName": "harden-mysql-pkg-mngr-exec", "ProcessName": "/usr/bin/apt", "Resource": "/usr/bin/apt", "Result": "Permission denied", "Severity": "5", "Source": "/bin/bash", "Tags": "NIST,NIST800-53CM-7(4),SI-4,process,NIST800-53SI-4", "Timestamp": 1696318864, "Type": "MatchedPolicy", "UID": 0, "UpdatedTime": "2023-10-03T07:41:04.096412Z", "cluster_id": "3896", "component_name": "kubearmor", "instanceGroup": "0", "instanceID": "0", "workload": "1" } ```
Project: mirrord (App Definition and Development / Application Definition & Image Build)
File: TELEMETRY.md

mirrord sends anonymous usage statistics to our systems. We don't store IP addresses, and in the open-source version of mirrord, we don't create any unique identifier for the user. In mirrord for Teams, a random key is used as an identifier for each user, along with the key of the operator used. Data collected is session duration and what features were used (steal/mirror/fs mode, etc). This helps us to improve the product and by better understanding our users. Types of data sent: Feature on/off Feature enum value (steal/mirror, read/write) Feature count (how many ports in listen_ports) When there's an error, we send the name of the error (out of a hard-coded list, so there's no risk of any sensitive data being sent). Telemetry can be disabled by specifying the following in the mirrord config file: ```json {"telemetry": false} ```
Project: StarRocks (App Definition and Development / Database)
File: SHOW_USAGE_RESOURCE_GROUPS.md

displayed_sidebar: "English" Shows the usage information of resource groups. This feature is supported from v3.1.4 onwards. :::tip This operation does not require privileges. ::: ```SQL SHOW USAGE RESOURCE GROUPS ``` `Name`: The name of the resource group. `Id`: The ID of the resource group. `Backend`: The BE's IP or FQDN. `BEInUseCpuCores`: The number of CPU cores currently in use by this resource group on this BE. This value is an approximate estimate. `BEInUseMemBytes`: The number of memory bytes currently in use by this resource group on this BE. `BERunningQueries`: The number of queries from this resource group that are still running on this BE. BEs periodically report this resource usage information to the Leader FE at the interval specified in `reportresourceusageintervalms`, which is by default set to 1 second. The results will only show rows where at least one of `BEInUseCpuCores`/`BEInUseMemBytes`/`BERunningQueries` is a positive number. In other words, the information is displayed only when a resource group is actively using some resources on a BE. ```Plain MySQL [(none)]> SHOW USAGE RESOURCE GROUPS; ++-+--+--+--++ | Name | Id | Backend | BEInUseCpuCores | BEInUseMemBytes | BERunningQueries | ++-+--+--+--++ | default_wg | 0 | 127.0.0.1 | 0.100 | 1 | 5 | ++-+--+--+--++ | default_wg | 0 | 127.0.0.2 | 0.200 | 2 | 6 | ++-+--+--+--++ | wg1 | 0 | 127.0.0.1 | 0.300 | 3 | 7 | ++-+--+--+--++ | wg2 | 0 | 127.0.0.1 | 0.400 | 4 | 8 | ++-+--+--+--++ ```
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: feature_request.md

name: Feature request about: Suggest a user related feature for this project title: "[Features]" labels: area/user-interaction, documentation, kind/feature assignees: nayutah What is the user interaction of your feature A concise description of user interactions or user stories of your feature request Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] If this is a new feature, please describe the motivation and goals. A clear and concise description of why you want to happen, link the design doc if possible Describe the solution you'd like A clear and concise description of what you want to happen. Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered. Additional context Add any other context or screenshots about the feature request here.
Project: ArangoDB (App Definition and Development / Database)
File: conclusion.md

+++ title = "Conclusion" weight = 55 +++ This worked example was in fact excessively complex: a quicker route to achieving the same thing would be to add explicit converting constructors to `app::error_code` for each of the third party library `E` types. One then could have saved oneself with having to bother injecting custom converters into the `BOOSTOUTCOMEV2_NAMESPACE::convert` namespace. If you control your application's `E` type, then that is probably a better, and certainly simpler, approach. However there are occasions when you don't have control over the implementation of the destination `E` type e.g. in callbacks. Outcome's `valueorerror` infrastructure lets you inject custom interop code for any pair of incommensurate third party `E` types, without needing to modify either's source code. This is without doubt a "power users" feature, but one which will prove useful as `T|E` based C++ code proliferates.
Project: YugabyteDB (App Definition and Development / Database)
File: edit-helm-overrides.md

title: Edit Kubernetes overrides headerTitle: Edit Kubernetes overrides linkTitle: Edit Kubernetes overrides description: Edit Kubernetes overrides for a universe. menu: v2.18_yugabyte-platform: identifier: edit-helm-overrides parent: manage-deployments weight: 60 type: docs If your universe was created using Kubernetes, you have an option of modifying the Helm chart overrides. To do this, navigate to your universe's Overview, click Actions > Edit Kubernetes Overrides to open the Kubernetes Overrides dialog shown in the following illustration: Complete the dialog by following instructions provided in .
Project: Beam (App Definition and Development / Streaming & Messaging)
File: unbounded-splittable-dofn-support-status.md

type: runners title: "Unbounded Splittable DoFn Support Status" layout: "capability-template" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <!-- Summary table --> {{< documentation/capability-matrix-big cap-data="capability-matrix" cap-view="full" cap-index=2 >}}
Project: KICS (Provisioning / Security & Compliance)
File: 61c3cb8b-0715-47e4-b788-86dde40dd2db.md

title: Dashboard Is Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 61c3cb8b-0715-47e4-b788-86dde40dd2db Query name: Dashboard Is Enabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Check if the Kubernetes Dashboard is enabled.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="23" resource "azurermkubernetescluster" "positive1" { name = "example-aks1" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name dns_prefix = "exampleaks1" defaultnodepool { name = "default" node_count = 1 vmsize = "StandardD2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } addon_profile { kube_dashboard { enabled = true } } } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermkubernetescluster" "negative1" { name = "example-aks1" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name dns_prefix = "exampleaks1" defaultnodepool { name = "default" node_count = 1 vmsize = "StandardD2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } resource "azurermkubernetescluster" "negative2" { name = "example-aks1" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name dns_prefix = "exampleaks1" defaultnodepool { name = "default" node_count = 1 vmsize = "StandardD2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } addon_profile { kube_dashboard { enabled = false } } } ```
Project: Apache Ignite (App Definition and Development / Database)
File: PULL_REQUEST_TEMPLATE.md

Thank you for submitting the pull request to the Apache Ignite. In order to streamline the review of the contribution we ask you to ensure the following steps have been taken: [ ] There is a single JIRA ticket related to the pull request. [ ] The web-link to the pull request is attached to the JIRA ticket. [ ] The JIRA ticket has the Patch Available state. [ ] The pull request body describes changes that have been made. The description explains WHAT and WHY was made instead of HOW. [ ] The pull request title is treated as the final commit message. The following pattern must be used: `IGNITE-XXXX Change summary` where `XXXX` - number of JIRA issue. [ ] A reviewer has been mentioned through the JIRA comments (see ) [ ] The pull request has been checked by the Teamcity Bot and the `green visa` attached to the JIRA ticket (see ) If you need any help, please email dev@ignite.apache.org or ask an advice on http://asf.slack.com #ignite channel.
Project: KubeArmor (Provisioning / Security & Compliance)
File: MAINTAINERS.md

This is the official maintainers list for KubeArmor. The list is sorted in ascending order. (AccuKnox) (CERN) (Independent) (AccuKnox) (Dankook Univ) (AccuKnox) (AccuKnox) (AccuKnox)