cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: e835bd0d-65da-49f7-b6d1-b646da8727e6.md

title: IAM Policy Grants 'AssumeRole' Permission Across All Services hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e835bd0d-65da-49f7-b6d1-b646da8727e6 Query name: IAM Policy Grants 'AssumeRole' Permission Across All Services Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: IAM Policy should not grant 'AssumeRole' permission across all services.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: mypolicy: Type: AWS::IAM::Policy Properties: PolicyName: mygrouppolicy PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: ["sts:AssumeRole"] Resource: "*" Users: ["SomeUser"] ``` ```json title="Positive test num. 2 - json file" hl_lines="8" { "Description": "A sample template", "Resources": { "mypolicy": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "mygrouppolicy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sts:AssumeRole" ], "Resource": "*" } ] }, "Users": [ "SomeUser" ] } } }, "AWSTemplateFormatVersion": "2010-09-09" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: MyPolicy: Type: AWS::IAM::Policy Properties: PolicyName: mygrouppolicy PolicyDocument: Version: "2012-10-17" Statement: Effect: Allow Action: s3:GetObject s3:PutObject s3:PutObjectAcl Resource: arn:aws:s3:::myAWSBucket/* Groups: myexistinggroup1 !Ref mygroup ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "MyPolicy": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "mygrouppolicy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::myAWSBucket/*" } ] }, "Groups": [ "myexistinggroup1", "mygroup" ] } } } } ```
Project: KICS (Provisioning / Security & Compliance)
File: b7652612-de4e-4466-a0bf-1cd81f0c6063.md

title: Volume Mount With OS Directory Write Permissions hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b7652612-de4e-4466-a0bf-1cd81f0c6063 Query name: Volume Mount With OS Directory Write Permissions Platform: Kubernetes Severity: <span style="color:#bb2124">High</span> Category: Resource Management URL: Containers can mount sensitive folders from the hosts, giving them potentially dangerous access to critical host configurations and binaries.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="40 11 37 14" apiVersion: v1 kind: Pod metadata: name: pod-0 spec: containers: image: k8s.gcr.io/test-webserver name: pod-0 volumeMounts: mountPath: /bin name: vol-0 mountPath: /var/run name: vol-1 readOnly: false volumes: name: vol-0 scaleIO: gateway: https://localhost:443/api system: scaleio protectionDomain: sd0 storagePool: sp1 volumeName: vol-0 secretRef: name: sio-secret fsType: xfs apiVersion: v1 kind: Pod metadata: name: pod-1 spec: containers: image: k8s.gcr.io/test-webserver name: pod-1 volumeMounts: mountPath: /var/run name: vol-0 mountPath: /bin name: vol-1 readOnly: false volumes: name: vol-0 scaleIO: gateway: https://localhost:443/api system: scaleio protectionDomain: sd0 storagePool: sp1 volumeName: vol-0 secretRef: name: sio-secret fsType: xfs ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: pod-0 spec: containers: image: k8s.gcr.io/test-webserver name: pod-0 volumeMounts: mountPath: /bin name: vol-0 readOnly: true volumes: name: vol-0 scaleIO: gateway: https://localhost:443/api system: scaleio protectionDomain: sd0 storagePool: sp1 volumeName: vol-0 secretRef: name: sio-secret fsType: xfs apiVersion: v1 kind: Pod metadata: name: pod-1 spec: containers: image: k8s.gcr.io/test-webserver name: pod-0 volumeMounts: mountPath: /project-mount name: vol-0 volumes: name: vol-0 scaleIO: gateway: https://localhost:443/api system: scaleio protectionDomain: sd0 storagePool: sp1 volumeName: vol-0 secretRef: name: sio-secret fsType: xfs apiVersion: v1 kind: Pod metadata: name: pod-2 spec: containers: image: k8s.gcr.io/test-webserver name: pod-0 volumeMounts: mountPath: /var/run name: vol-0 readOnly: true volumes: name: vol-0 scaleIO: gateway: https://localhost:443/api system: scaleio protectionDomain: sd0 storagePool: sp1 volumeName: vol-0 secretRef: name: sio-secret fsType: xfs ```
Project: KICS (Provisioning / Security & Compliance)
File: community.md

KICS is a true community project. It's built as an open source from day one, and everyone can find their own way to contribute to the project. , within just minutes, you can start making a difference, by sharing your expertise with a community of thousands of security experts and software developers. <a href="https://github.com/checkmarx/kics/graphs/contributors"> <img src="https://contrib.rocks/image?repo=checkmarx/kics" /> </a> " is a month-long celebration of open source projects, their maintainers, and the entire community of contributors. Each October, open source maintainers give new contributors extra attention as they guide developers through their first pull requests on GitHub."<br /> (video TBD) () () () () () ()
Project: KICS (Provisioning / Security & Compliance)
File: cf3c7631-cd1e-42f3-8801-a561214a6e79.md

title: SQL DB Instance Backup Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cf3c7631-cd1e-42f3-8801-a561214a6e79 Query name: SQL DB Instance Backup Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Backup URL: Checks if backup configuration is enabled for all Cloud SQL Database instances<br> ```tf title="Positive test num. 1 - tf file" hl_lines="18 6 31" resource "googlesqldatabase_instance" "positive1" { name = "master-instance" databaseversion = "POSTGRES11" region = "us-central1" settings { tier = "db-f1-micro" } } resource "googlesqldatabase_instance" "positive2" { name = "master-instance" databaseversion = "POSTGRES11" region = "us-central1" settings { tier = "db-f1-micro" backup_configuration{ binarylogenabled = true } } } resource "googlesqldatabase_instance" "positive3" { name = "master-instance" databaseversion = "POSTGRES11" region = "us-central1" settings { backup_configuration{ enabled = false } } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlesqldatabase_instance" "negative1" { name = "master-instance" databaseversion = "POSTGRES11" region = "us-central1" settings { backup_configuration{ enabled = true } } } ```
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_connect.md

title: Kubectl-Dba Connect menu: docs_{{ .version }}: identifier: kubectl-dba-connect name: Kubectl-Dba Connect parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Connect to a database. Connect to a database. ``` kubectl-dba connect ``` ``` -h, --help help for connect ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - kubectl plugin for KubeDB - Connect to a shell to run elasticsearch api calls - Connect to a mariadb object - Connect to a telnet shell to run command against a memcached database - Connect to a mongodb object - Connect to a mysql object - Connect to a postgres object - Connect to a redis object's pod
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: opa-wasm-java.md

title: OPA Wasm Java Gradle SDK software: java inventors: sangkeon labels: category: wasm type: poweredbyopa tutorials: https://github.com/sangkeon/java-opa-wasm#usage code: https://github.com/sangkeon/java-opa-wasm docs_features: wasm-integration: note: 'This project implements the OPA Wasm module interface in Java. ' SDK to illustrate how to use Wasm compiled Rego policies from a Java application
Project: Apache Heron (App Definition and Development / Streaming & Messaging)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: '' assignees: '' Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] Describe the solution you'd like A clear and concise description of what you want to happen. Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered. Additional context Add any other context or screenshots about the feature request here.
Project: Apache Storm (App Definition and Development / Streaming & Messaging)
File: Logs.md

title: Storm Logs layout: documentation documentation: true Logs in Storm are essential for tracking the status, operations, error messages and debug information for all the daemons (e.g., nimbus, supervisor, logviewer, drpc, ui, pacemaker) and topologies' workers. All the daemon logs are placed under ${storm.log.dir} directory, which an administrator can set in the System properties or in the cluster configuration. By default, ${storm.log.dir} points to ${storm.home}/logs. All the worker logs are placed under the workers-artifacts directory in a hierarchical manner, e.g., ${workers-artifacts}/${topologyId}/${port}/worker.log. Users can set the workers-artifacts directory by configuring the variable "storm.workers.artifacts.dir". By default, workers-artifacts directory locates at ${storm.log.dir}/logs/workers-artifacts. Daemon and worker logs are allowed to view and download through Storm UI by authorized users. To improve the debugging of Storm, we provide the Log Search feature. Log Search supports searching in a certain log file or in all of a topology's log files: String search in a log file: In the log page for a worker, a user can search a certain string, e.g., "Exception", in a certain worker log. This search can happen for both normal text log or rolled zip log files. In the results, the offset and matched lines will be displayed. Search in a topology: a user can also search a string for a certain topology by clicking the icon of the magnifying lens at the top right corner of the UI page. This means the UI will try to search on all the supervisor nodes in a distributed way to find the matched string in all logs for this topology. The search can happen for either normal text log files or rolled zip log files by checking/unchecking the "Search archived logs:" box. Then the matched results can be shown on the UI with url links, directing the user to the certain logs on each supervisor node. This powerful feature is very helpful for users to find certain problematic supervisor nodes running this topology.
Project: KICS (Provisioning / Security & Compliance)
File: cdc8b54e-6b16-4538-a1b0-35849dbe29cf.md

title: Kubelet HTTPS Set To False hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cdc8b54e-6b16-4538-a1b0-35849dbe29cf Query name: Kubelet HTTPS Set To False Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: When using kube-apiserver command, the '--kubelet-https' flag should not be set to false<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--kubelet-https=false"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--kubelet-https=true"] restartPolicy: OnFailure ```
Project: SeaTunnel (App Definition and Development / Streaming & Messaging)
File: tcp.md

sidebar_position: 6 If multicast is not the preferred way of discovery for your environment, then you can configure SeaTunnel Engine to be a full TCP/IP cluster. When you configure SeaTunnel Engine to discover members by TCP/IP, you must list all or a subset of the members' host names and/or IP addresses as cluster members. You do not have to list all of these cluster members, but at least one of the listed members has to be active in the cluster when a new member joins. To configure your Hazelcast to be a full TCP/IP cluster, set the following configuration elements. See the tcp-ip element section for the full descriptions of the TCP/IP discovery configuration elements. Set the enabled attribute of the tcp-ip element to true. Provide your member elements within the tcp-ip element. The following is an example declarative configuration. ```yaml hazelcast: network: join: tcp-ip: enabled: true member-list: machine1 machine2 machine3:5799 192.168.1.0-7 192.168.1.21 ``` As shown above, you can provide IP addresses or host names for member elements. You can also give a range of IP addresses, such as `192.168.1.0-7`. Instead of providing members line-by-line as shown above, you also have the option to use the members element and write comma-separated IP addresses, as shown below. `<members>192.168.1.0-7,192.168.1.21</members>` If you do not provide ports for the members, Hazelcast automatically tries the ports `5701`, `5702` and so on.
Project: Numaflow (App Definition and Development / Streaming & Messaging)
File: local-users.md

In addition to the authentication using Dex, we also provide an authentication mechanism for local user based on JSON Web Token (JWT). When you create local users, each of those users will need additional rules set up, otherwise they will fall back to the default policy specified by `policy.default` field of the `numaflow-server-rbac-config` ConfigMap. Numaflow comes with a built-in `admin` user that has full access to the system. It is recommended to use `admin` user for initial configuration then switch to local users or configure SSO integration. A built-in `admin` user comes with a randomly generated password that is stored in `numaflow-server-secrets` Secret: ```shell kubectl get secret numaflow-server-secrets -n <namespace> -o jsonpath='{.data.admin\.initial-password}' | base64 --decode ``` Use the `admin` username and password obtained above to log in to the UI. Users can be created by updating the `numaflow-server-local-user-config` ConfigMap: ```shell apiVersion: v1 kind: ConfigMap metadata: name: numaflow-server-local-user-config data: bob.enabled: "true" ``` When adding new users, it is necessary to generate a bcrypt hash of their password: ```shell htpasswd -bnBC 10 "" password | tr -d ':\n' ``` To add the password generated above for the respective user, you can update the `numaflow-server-secrets` Secret: ```shell apiVersion: v1 kind: Secret metadata: name: numaflow-server-secrets type: Opaque stringData: bob.password: $2y$10$0TCvrnLHQsQtEJVdXNNL6eeXaxHmGnQO.R8zhh0Mwr2RM7s42knTK ``` You can also update the password for `admin` user similarly, it will be considered over the initial password For the example above, the username is `bob` and the password is `password`. Users can be disabled by updating the `numaflow-server-local-user-config` ConfigMap, including the system generated `admin` user: ```shell apiVersion: v1 kind: ConfigMap metadata: name: numaflow-server-local-user-config data: bob.enabled: "false" ``` Users can be deleted by removing the corresponding entries: ```shell kubectl patch configmap <configmap-name> -n <namespace> -p '{"data": {"bob.enabled": null}}' --type merge ``` ```shell kubectl patch secret <secret-name> -n <namespace> -p '{"data": {"bob.password": null}}' --type merge ```
Project: KICS (Provisioning / Security & Compliance)
File: 2b13c6ff-b87a-484d-86fd-21ef6e97d426.md

title: OSS Bucket Has Static Website hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2b13c6ff-b87a-484d-86fd-21ef6e97d426 Query name: OSS Bucket Has Static Website Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Checks if any static websties are hosted on buckets. Be aware of any website you are running.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4" resource "alicloudossbucket" "bucket-website1" { bucket = "bucket-1-website" website { index_document = "index.html" error_document = "error.html" } } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudossbucket" "bucket-acl1" { bucket = "bucket-1-acl" acl = "private" } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: gitlab-runner-operator.md

layout: integration title: Gitlab Runner Operator subtitle: Collaborative and visual infrastructure as code for Gitlab Runner Operator image: /assets/img/integrations/gitlab-runner-operator/icons/color/gitlab-runner-operator-color.svg permalink: extensibility/integrations/gitlab-runner-operator docURL: https://docs.meshery.io/extensibility/integrations/gitlab-runner-operator description: integrations-category: App Definition and Development integrations-subcategory: Source Version Control registrant: Artifact Hub components: name: runner colorIcon: assets/img/integrations/gitlab-runner-operator/components/runner/icons/color/runner-color.svg whiteIcon: assets/img/integrations/gitlab-runner-operator/components/runner/icons/white/runner-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: device-read-bps.md

Limit read rate (in bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb). On some systems, changing the resource limits may not be allowed for non-root users. For more details, see https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error This option is not supported on cgroups V1 rootless systems.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: veolia.md

title: "Veolia" icon: /images/logos/powered-by/veolia.png hasLink: "https://cloud.google.com/blog/products/gcp/support-for-python-on-cloud-dataflow-is-going-beta/" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: Apache Hadoop (App Definition and Development / Database)
File: RELEASENOTES.3.2.4.md

<! --> These release notes cover new developer and user-facing incompatibilities, important issues, features, and major improvements. | Major | Make GetClusterNodesRequestPBImpl thread safe* Added syncronization so that the "yarn node list" command does not fail intermittently | Critical | Improve RM system metrics publisher's performance by pushing events to timeline server in batch* When Timeline Service V1 or V1.5 is used, if "yarn.resourcemanager.system-metrics-publisher.timeline-server-v1.enable-batch" is set to true, ResourceManager sends timeline events in batch. The default value is false. If this functionality is enabled, the maximum number that events published in batch is configured by "yarn.resourcemanager.system-metrics-publisher.timeline-server-v1.batch-size". The default value is 1000. The interval of publishing events can be configured by "yarn.resourcemanager.system-metrics-publisher.timeline-server-v1.interval-seconds". By default, it is set to 60 seconds. | Major | Replace log4j 1.x with reload4j* log4j 1 was replaced with reload4j which is fork of log4j 1.2.17 with the goal of fixing pressing security issues. If you are depending on the hadoop artifacts in your build were explicitly excluding log4 artifacts, and now want to exclude the reload4j files, you will need to update your exclusion lists \<exclusion\> \<groupId\>org.slf4j\</groupId\> \<artifactId\>slf4j-reload4j\</artifactId\> \</exclusion\> \<exclusion\> \<groupId\>ch.qos.reload4j\</groupId\> \<artifactId\>reload4j\</artifactId\> \</exclusion\>