cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: eda48c88-2b7d-4e34-b6ca-04c0194aee17.md

title: Role With Privilege Escalation By Actions 'glue:UpdateDevEndpoint' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: eda48c88-2b7d-4e34-b6ca-04c0194aee17 Query name: Role With Privilege Escalation By Actions 'glue:UpdateDevEndpoint' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Role with privilege escalation by actions 'glue:UpdateDevEndpoint' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamrole" "cosmic" { name = "cosmic" } resource "awsiamrolepolicy" "testinline_policy" { name = "testinlinepolicy" role = awsiamrole.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "glue:UpdateDevEndpoint", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: KICS (Provisioning / Security & Compliance)
File: 1aa4a1ae-5dbb-48a1-9aa2-630ea4be208e.md

title: Authorization Mode RBAC Not Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1aa4a1ae-5dbb-48a1-9aa2-630ea4be208e Query name: Authorization Mode RBAC Not Set Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: When using kube-apiserver command, the 'authorization-mode' flag should have 'RBAC' mode<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--authorization-mode=AlwaysAllow"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--authorization-mode=Node"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--authorization-mode=RBAC,Node"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver","--authorization-mode=RBAC,Node"] args: [] restartPolicy: OnFailure ```
Project: ShardingSphere (App Definition and Development / Database)
File: agent.en.md

+++ pre = "<b>5.9. </b>" title = "Observability" weight = 9 chapter = true +++ Plug lifecycle management interface | Configuration Type | Description | Fully-qualified class name | |-||| | File | Logging plug lifecycle management class | | | Prometheus | Prometheus plug lifecycle management class | | | OpenTelemetry | OpenTelemetryTracing plug lifecycle management class | |
Project: ClickHouse (App Definition and Development / Database)
File: set-role.md

slug: /en/sql-reference/statements/set-role sidebar_position: 51 sidebar_label: SET ROLE title: "SET ROLE Statement" Activates roles for the current user. ``` sql SET ROLE {DEFAULT | NONE | role [,...] | ALL | ALL EXCEPT role [,...]} ``` Sets default roles to a user. Default roles are automatically activated at user login. You can set as default only the previously granted roles. If the role isnt granted to a user, ClickHouse throws an exception. ``` sql SET DEFAULT ROLE {NONE | role [,...] | ALL | ALL EXCEPT role [,...]} TO {user|CURRENT_USER} [,...] ``` Set multiple default roles to a user: ``` sql SET DEFAULT ROLE role1, role2, ... TO user ``` Set all the granted roles as default to a user: ``` sql SET DEFAULT ROLE ALL TO user ``` Purge default roles from a user: ``` sql SET DEFAULT ROLE NONE TO user ``` Set all the granted roles as default except for specific roles `role1` and `role2`: ``` sql SET DEFAULT ROLE ALL EXCEPT role1, role2 TO user ```
Project: VoltDB (App Definition and Development / Database)
File: EnableAuthentication.md

The steps to use security with examples are: If you need more flexibility than the default roles provide, you will need to modify your DDL to create roles and/or add permissions to individual procedures. Change or create a deployment file to enable authentication and create a set of users. There is an example deployment file in the `deployment-file-examples` directory called `deployment-authEnabled`. Edit the run.sh file, under the `client` command. Make sure `--user=username` and `--password=password` are set with real values for user and password. Basic authentication in VoltDB should be viewed as a safety and auditing tool to limit the damage possible from users and programs. It will not be effective against a sophisticated malicious attacker. If stronger security is needed, contact VoltDB and we will walk through your options, including Kerberos authentication. Relevant Documentation -- Using VoltDB Chapter 12: Security https://docs.voltdb.com/UsingVoltDB/ChapSecurity.php How to Use a Deployment File -- In order to use authentication, you're going to need to initialize the server with a deployment file. When you start without one, the server uses a default 1-node deployment file and writes it out to the voltdbroot folder. If you've already run a VoltDB example, you can probably find this default file there. It should have the following contents: ```xml <?xml version="1.0"?> <deployment> <cluster hostcount="1" /> <httpd enabled="true"> <jsonapi enabled="true" /> </httpd> </deployment> ``` So copy that file up one level, or simply create a file named `deployment.xml` with the contents above. You can even borrow a file from the `/examples/HOWTOs/deployment-file-examples` directory. To start with a deployment file add `-C path/to/deployment.xml` to the VoltDB `init` command. For example: ```bash voltdb init --force -C deployment.xml voltdb start ```
Project: StarRocks (App Definition and Development / Database)
File: map_apply.md

displayed_sidebar: "English" Applies a to the keys and values of the original Map and generates a new Map. This function is supported from v3.0. ```Haskell MAP mapapply(lambdafunc, any_map) ``` `lambda_func`: the Lambda expression. `any_map`: the map to which the Lambda expression is applied. Returns a map value. The data types of keys and values in the result map are determined by the result of the Lambda expression. If any input parameter is NULL, NULL is returned. If a key or value in the original map is NULL, NULL is processed as a normal value. The Lambda expression must have two parameters. The first parameter represents the key. The second parameter represents the value. The following example uses to generate a map value `{1:"ab",3:"cd"}`. Then the Lambda expression increments each key by 1 and calculates the length of each value. For example, the length of "ab" is 2. ```SQL mysql> select mapapply((k,v)->(k+1,length(v)), colmap) from (select mapfromarrays([1,3],["ab","cd"]) as col_map)A; +--+ | mapapply((k, v) -> (k + 1, length(v)), colmap) | +--+ | {2:2,4:2} | +--+ 1 row in set (0.01 sec) mysql> select mapapply((k,v)->(k+1,length(v)), colmap) from (select mapfromarrays(null,null) as col_map)A; +--+ | mapapply((k, v) -> (k + 1, length(v)), colmap) | +--+ | NULL | +--+ 1 row in set (0.02 sec) mysql> select mapapply((k,v)->(k+1,length(v)), colmap) from (select mapfromarrays([1,null],["ab","cd"]) as col_map)A; +--+ | mapapply((k, v) -> (k + 1, length(v)), colmap) | +--+ | NULL | +--+ ```
Project: YugabyteDB (App Definition and Development / Database)
File: do-compare-dp-results.md

title: docomparedp_results.sql linkTitle: docomparedp_results.sql headerTitle: docomparedp_results.sql description: docomparedp_results.sql - Part of the code kit for the "Analyzing a normal distribution" section within the YSQL window functions documentation. menu: v2.18: identifier: do-compare-dp-results parent: analyzing-a-normal-distribution weight: 160 type: docs Save this script as `docomparedp_results.sql`. ```plpgsql with nt_results as ( select bucket, n, mins, maxs from dp_results where method = 'ntile') , pr_results as ( select bucket, n, mins, maxs from dp_results where method = 'percent_rank') , cd_results as ( select bucket, n, mins, maxs from dp_results where method = 'cume_dist') select bucket, (nt.n = pr.n )::text as "pr n equal", (nt.mins = pr.mins)::text as "pr min_s equal", (nt.maxs = pr.maxs)::text as "pr max_s equal", (nt.n = cd.n )::text as "cd n equal", (nt.mins = cd.mins)::text as "cd min_s equal", (nt.maxs = cd.maxs)::text as "cd max_s equal" from nt_results nt inner join pr_results pr using (bucket) inner join cd_results cd using (bucket) order by bucket; ```
Project: Sonobuoy (Provisioning / Security & Compliance)
File: 2019-05-13-Sonobuoy-101.md

title: Sonobuoy 101 image: /img/sonobuoy.svg excerpt: Given that there are many ways to create Kubernetes clusters and many environments used to host them, those tasked with maintaining a cluster are often left wondering whether it is correct. author_name: Sonobuoy Team categories: [kubernetes] tags: ['Sonobuoy Team'] date: 2019-05-13 slug: sonobuoy-101 Given that there are many ways to create Kubernetes clusters and many environments used to host them, those tasked with maintaining a cluster are often left wondering whether it is correct. Is it properly configured? Does it work as it should? Sonobuoy is a diagnostic tool that aims to address these questions. Sonobuoy makes it easier to understand the state of a Kubernetes cluster by running a set of Kubernetes conformance tests in an accessible and non-destructive manner. Its diagnostics provide a customizable, extendable, and cluster-agnostic way to generate clear, informative reports about your cluster, regardless of your deployment details. Sonobuoy (n): A naval term for an immersive device that provides a view of the ocean using sonar. Sonobuoy is also built to be cluster-agnostic. Regardless of your setup, it creates a readout of your clusters core characteristics, which you can use to verify that things are as you expect. You can also use the output as a way to capture and communicate your cluster configuration when looking for support or filing a bug report. Why is conformance so important? A key goal for Kubernetes is portability. Developers can build an application in one environment and then deploy it into another with minimal changes. Businesses can pick the hosting platform that best meets their needs based on application requirements. If the requirements change or new offerings emerge the application isnt tied to a single Kubernetes environment. Without conformance, the key goals of Kubernetes, including portability and automated deployment, cannot be achieved. In addition, Sonobuoy supports customizable plug-in tests. We expect that the types of tests users run to verify cluster interoperability will change over time; in addition, individual users may have different types of configurations they need to test for. Plug-in support allows developers and operators to extend the system with additional tests. The Sonobuoy team is community driven and would love to hear of any plug-ins that you have created or ideas on what you would like to see developed. Please open an or find us on the Kubernetes Slack! Interested in joining the Sonobuoy community or contributing to the project? By creating or commenting on Github issues and communicating in Slack you can help influence future priorities. Issues labeled with or are a great place to start engaging with the project. Join the Sonobuoy community Get updates on Twitter () Chat with us on Slack ( on Kubernetes) Join the K8s-conformance working group: <https://github.com/cncf/k8s-conformance>
Project: Beam (App Definition and Development / Streaming & Messaging)
File: beamquest.md

title: "Getting started with Apache Beam: An open source proficiency credential sponsored by Google Cloud" date: 2023-06-06 00:00:01 -0800 categories: blog aliases: /blog/2023/06/06/beam-quest.html authors: svetakvsundhar <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <img class="center-block" src="/images/blog/beam-badge-image-scaled.png" alt="Quest image"> Were excited to announce the release of the , a series of four online labs that venture into different Apache Beam concepts. When you complete all four labs, youll earn a Google Cloud badge that you can share on platforms like LinkedIn. Earning this badge should take less than seven hours total, and signing up for the quest costs $20 (there are often free specials for people who attend Beam events, such as , , and ). "I really like the workshop to be honest. I learnt a lot from doing those labs. I would suggest we offer that for any new members to Beam" -- Shunping Huang, Software Engineer Beam is one of the largest big data open source projects actively in development. Over the past six years, the Apache Beam community has seen tremendous growth in the number of contributors, committers, and users. If youre a long time Beam user, you can now earn a badge to show your skills to potential employers. If youre new to Beam, you can begin your learning journey with this quest. To attempt this quest, you dont need any prior knowledge of data processing or distributed systems. All you need is elementary knowledge about programming. Individuals arent the only ones who can benefit from completing this quest - organizations can too! Because earning this badge represents deep knowledge of an industry leading big data library, having the badge validates your organizations understanding of Beam. In addition, you can run the Beam library on a wide variety of runners, including Google Cloud Dataflow, Flink, Spark, and more, making knowledge about this library highly transferable. Finally, your organization can use this quest as onboarding material for new hires on big data teams, allowing teams and organizations to get their newest employees up-to-date on the latest and greatest that Apache Beam has to offer. Data Processing is a key part of AI/ML workflows. Given the recent advancements in artificial intelligence, nows the time to jump into the world of data processing! Get started on your journey . We are currently offering this quest FREE OF CHARGE. To obtain your badge for FREE, use the , create an account, and search . If the code does not work, please email to obtain a free code. PS: Once you earn your badge, please !
Project: KICS (Provisioning / Security & Compliance)
File: cdbb0467-2957-4a77-9992-7b55b29df7b7.md

title: Security Groups With Exposed Admin Ports hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cdbb0467-2957-4a77-9992-7b55b29df7b7 Query name: Security Groups With Exposed Admin Ports Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: Security Groups should not have ports open in (20, 21, 22, 23, 115, 137, 138, 139, 2049, 3389)<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="15" Resources: Ec2Instance: Type: 'AWS::EC2::Instance' Properties: SecurityGroups: !Ref InstanceSecurityGroup KeyName: mykey ImageId: '' InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow http to client host VpcId: Ref: myVPC SecurityGroupIngress: IpProtocol: tcp FromPort: 20 ToPort: 20 CidrIp: 0.0.0.0/0 SecurityGroupEgress: IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: 0.0.0.0/0 ``` ```json title="Positive test num. 2 - json file" hl_lines="19" { "Resources": { "Ec2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": "", "SecurityGroups": [ "InstanceSecurityGroup" ], "KeyName": "mykey" } }, "InstanceSecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "VpcId": { "Ref": "myVPC" }, "SecurityGroupIngress": [ { "CidrIp": "0.0.0.0/0", "IpProtocol": "tcp", "FromPort": 20, "ToPort": 20 } ], "SecurityGroupEgress": [ { "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "CidrIp": "0.0.0.0/0" } ], "GroupDescription": "Allow http to client host" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: Ec2Instance: Type: 'AWS::EC2::Instance' Properties: SecurityGroups: !Ref InstanceSecurityGroup KeyName: mykey ImageId: '' InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow http to client host VpcId: Ref: myVPC SecurityGroupIngress: IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: 127.0.0.1/32 SecurityGroupEgress: IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: 127.0.0.1/33 ``` ```json title="Negative test num. 2 - json file" { "Resources": { "Ec2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "SecurityGroups": [ "InstanceSecurityGroup" ], "KeyName": "mykey", "ImageId": "" } }, "InstanceSecurityGroup": { "Properties": { "VpcId": { "Ref": "myVPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "CidrIp": "127.0.0.1/32" } ], "SecurityGroupEgress": [ { "CidrIp": "127.0.0.1/33", "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80 } ], "GroupDescription": "Allow http to client host" }, "Type": "AWS::EC2::SecurityGroup" } } } ``` ```yaml title="Negative test num. 3 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Allow http to client host VpcId: Ref: myVPC SecurityGroupIngress: IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: 11.22.33.44/32 ```
Project: kpt (Provisioning / Automation & Configuration)
File: publishinfo-repository.md

For easier orientation, an overview of the contents of the `publishinfo-repository.tar`. The repository in `publishinfo-repository.tar` has the following contents in `main` branch: ``` . basens Kptfile namespace.yaml package-context.yaml README.md empty Kptfile README.md istions istions.yaml Kptfile package-context.yaml README.md ``` The commit graph of the repository is: ``` be44230bd839acd9d858a043f8c18ee7122a72b2 Approval for some-pkg/v1 | * 95a763c92a74e2083a7370e5a21085ecdfd8f552 (drafts/draft-pkg/v1) Intermediate commit: eval | * 59c9c0a2922cb1c774bdb3d92012e6f12257790c Intermediate commit: init |/ e5cba80404423634a363ad48b5053f5858fa100e (tag: tag: pkg-without-anno/v1) Approval for package pkg-without-anno/v1 32ff5cca76b53939a6d4ba1d963a277aadbf7d11 (tag: pkg-with-anno/v1) Approve pkg-with-anno/v1 c5cad50cc87e87ae89a108b9ab683124bf47dc53 Intermediate commit: eval 5db484f0431493935c140b760441b65cf1c34608 Intermediate commit: init ```
Project: ShardingSphere (App Definition and Development / Database)
File: drop-mask-rule.en.md

+++ title = "DROP MASK RULE" weight = 3 +++ The `DROP MASK RULE` syntax is used to drop existing mask rule. {{< tabs >}} {{% tab name="Grammar" %}} ```sql DropEncryptRule ::= 'DROP' 'MASK' 'RULE' ifExists? ruleName (',' ruleName)* ifExists ::= 'IF' 'EXISTS' ruleName ::= identifier ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} `ifExists` clause used for avoid `Mask rule not exists` error. Drop mask rule ```sql DROP MASK RULE tmask, tmask_1; ``` Drop mask rule with `ifExists` clause ```sql DROP MASK RULE IF EXISTS tmask, tmask_1; ``` `DROP`, `MASK`, `RULE`
Project: ClickHouse (App Definition and Development / Database)
File: v23.3.17.13-lts.md

sidebar_position: 1 sidebar_label: 2023 Backported in : Do not fetch changed submodules in the builder container. (). Fix segfault during Kerberos initialization (). Fix crash in FPC codec (). Rewrite jobs to use callable workflow (). Continue rewriting workflows to reusable tests (). Better exception messages ().
Project: ClickHouse (App Definition and Development / Database)
File: string.md

slug: /en/sql-reference/data-types/string sidebar_position: 8 sidebar_label: String Strings of an arbitrary length. The length is not limited. The value can contain an arbitrary set of bytes, including null bytes. The String type replaces the types VARCHAR, BLOB, CLOB, and others from other DBMSs. When creating tables, numeric parameters for string fields can be set (e.g. `VARCHAR(255)`), but ClickHouse ignores them. Aliases: `String` `LONGTEXT`, `MEDIUMTEXT`, `TINYTEXT`, `TEXT`, `LONGBLOB`, `MEDIUMBLOB`, `TINYBLOB`, `BLOB`, `VARCHAR`, `CHAR`, `CHAR LARGE OBJECT`, `CHAR VARYING`, `CHARACTER LARGE OBJECT`, `CHARACTER VARYING`, `NCHAR LARGE OBJECT`, `NCHAR VARYING`, `NATIONAL CHARACTER LARGE OBJECT`, `NATIONAL CHARACTER VARYING`, `NATIONAL CHAR VARYING`, `NATIONAL CHARACTER`, `NATIONAL CHAR`, `BINARY LARGE OBJECT`, `BINARY VARYING`, ClickHouse does not have the concept of encodings. Strings can contain an arbitrary set of bytes, which are stored and output as-is. If you need to store texts, we recommend using UTF-8 encoding. At the very least, if your terminal uses UTF-8 (as recommended), you can read and write your values without making conversions. Similarly, certain functions for working with strings have separate variations that work under the assumption that the string contains a set of bytes representing a UTF-8 encoded text. For example, the function calculates the string length in bytes, while the function calculates the string length in Unicode code points, assuming that the value is UTF-8 encoded.