cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 9f85c3f6-26fd-4007-938a-2e0cb0100980.md

title: RBAC Roles with Impersonate Permission hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9f85c3f6-26fd-4007-938a-2e0cb0100980 Query name: RBAC Roles with Impersonate Permission Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Roles or ClusterRoles with the permission 'impersonate' allow subjects to assume the rights of other users, groups, or service accounts. In case of compromise, attackers may abuse this sudo-like functionality to achieve privilege escalation<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9" apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: impersonator-role namespace: default rules: apiGroups: [""] resources: ["users", "groups", "serviceaccounts"] verbs: ["impersonate"] apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: rbac-impersonate-binding subjects: kind: ServiceAccount name: impersonator-sa namespace: default apiGroup: "" roleRef: kind: ClusterRole name: impersonator-role apiGroup: "" ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: impersonator-role-neg namespace: default rules: apiGroups: [""] resources: ["users", "groups", "serviceaccounts"] verbs: ["get"] apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: rbac-impersonate-binding subjects: kind: ServiceAccount name: impersonator-sa-neg namespace: default apiGroup: "" roleRef: kind: ClusterRole name: impersonator-role-neg apiGroup: "" ```
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: restart-a-postgresql-cluster.md

title: Restart PostgreSQL cluster description: How to restart a PostgreSQL cluster keywords: [postgresql, restart] sidebar_position: 4 sidebar_label: Restart You can restart all pods of the cluster. When an exception occurs in a database, you can try to restart it. :::note Restarting a PostgreSQL cluster triggers a concurrent restart and the leader may change after the cluster restarts. ::: Restart a cluster. You can use `kbcli` or create an OpsRequest to restart a cluster. Option 1. (Recommended) Use kbcli Configure the values of `components` and `ttlSecondsAfterSucceed` and run the command below to restart a specified cluster. ```bash kbcli cluster restart NAME --components="postgresql" \ --ttlSecondsAfterSucceed=30 ``` `components` describes the component name that needs to be restarted. `ttlSecondsAfterSucceed` describes the time to live of an OpsRequest job after the restarting succeeds. Option 2. Create an OpsRequest Run the command below to apply the restarting to a cluster. ```bash kubectl apply -f - <<EOF apiVersion: apps.kubeblocks.io/v1alpha1 kind: OpsRequest metadata: name: ops-restart spec: clusterRef: pg-cluster type: Restart restart: componentName: postgresql EOF ``` Validate the restarting. Run the command below to check the cluster status to check the restarting status. ```bash kbcli cluster list <name> ``` *Example* ```bash kbcli cluster list pg-cluster > NAME NAMESPACE CLUSTER-DEFINITION VERSION TERMINATION-POLICY STATUS CREATED-TIME pg-cluster default postgresql-cluster postgresql-14.7.0 Delete Running Mar 03,2023 18:28 UTC+0800 ``` STATUS=Restarting: it means the cluster restart is in progress. STATUS=Running: it means the cluster has been restarted.
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.5.40.md

layout: release date: 2021-07-27 tag: v0.5.40 patch NavigatetoBrowser for missing xdg-open @navendu-pottekkat (#3665) added swagger api video link to docs @warunicorn19 (#3663) added check for docker or kubernetes platform @nehaLohia27 (#3562) Migrated GraphQL resolver logic to models @dhruv0000 (#3652) [mesheryctl] Added PreRunE Health Checks for multiple system commands @piyushsingariya (#3649) Open API Docs /system endpoint @piyushsingariya (#3641) [UI] Bulk selection and delete operation in Filters UI @Chadha93 (#3650) Update Maintainer.md @sayantan1413 (#3648) [Docs] Open API: Provider endpoint @piyushsingariya (#3578) Thank you to our contributors for making this release possible: @Chadha93, @Nikhil-Ladha, @dhruv0000, @leecalcote, @navendu-pottekkat, @nehaLohia27, @piyushsingariya, @sayantan1413 and @warunicorn19
Project: Scylla (App Definition and Development / Database)
File: rust.md

Rust introduces many useful features that are missing in C++. This document shows how to use them in Scylla. To create a Rust package `new_pkg` and use it in a C++ source file: Create a new package in the `rust` directory using `cargo new new_pkg --lib` Add `newpkg = { path = "newpkg", version = "0.1.0" }` to the dependencies list in `rust/Cargo.toml` Add `extern crate new_pkg;` to `rust/src/lib.rs` Configure your package in `newpkg/Cargo.toml` and write your Rust code in `newpkg/src/lib.rs` (and other `new_pkg/src/*.rs` files) To export a function `fn inc(x: i32) -> i32` in the namespace `xyz`, add its declaration to `new_pkg/src/lib.rs` as follows: ``` mod ffi { extern "Rust" { fn inc(x: i32) -> i32; } } ``` Add `new_pkg/src/lib.rs` to the `configure.py` dependencies where you'll need the Rust exports Include the `rust/new_pkg.hh` header and use `xyz::foo()` in the selected c++ file. You can put the `cxx::bridge` segment into some file other than `lib.rs` as well, for example `abc.rs`. If you do that, remember to add `mod abc` to `lib.rs` to make sure that the bridge is compiled with the entire package. Additionally, the definitions of exported functions must be visible in `abc.rs`. You can achieve this writing them in the same file or using `mod` and `use` statements. Then, use this file instead of `lib.rs` in the `configure.py` dependencies. Additionally to the source code, Scylla tracks the Cargo.lock file that contains precise information about dependency versions used in the last successful build. Dependency modification may include: adding a new local package (it is used in Scylla as a dependency) updating a dependency version in an existing package adding a new dependency to a package After each such modification, a new Cargo.lock file should be submitted. Cargo.lock can be generated by the `cargo update` command. Using Rust alongside C++ in scylla is made possible by the Rust crate CXX. The `cxx::bridge` macro, together with `mod ffi` and `extern "Rust"` mark items to be exported to C++. During compilation of Rust files, a static library using C++ ABI is generated. The library exports Rust methods under special names. These names are used in the implementations of C++ methods with the original names. The C++ methods are listed in .hh files, and their implementations in .cc files, both generated from the Rust source code using `cxxbridge` command. The header exposes all items with original names and can be included like any other C++ header. Compilation is managed by `cargo`. Like in any Rust project, modules added to Scylla can be fully customized using corresponding `Cargo.toml` files. All modules are compiled to single static library, as this is the only officially supported way of linking Rust against C++. In the future, more linking methods may become supported, possibly using `rlib` ("Rust library") files.
Project: KubeArmor (Provisioning / Security & Compliance)
File: fim-alert.md

```sh kubectl exec -it mysql-74775b4bf4-65nqf -n wordpress-mysql -- bash root@mysql-74775b4bf4-65nqf:/# cd sbin root@mysql-74775b4bf4-65nqf:/sbin# touch file touch: cannot touch 'file': Permission denied root@mysql-74775b4bf4-65nqf:/sbin# cd .. ``` ``` { "ATags": [ "NIST", "NIST800-53AU-2", "NIST800-53SI-4", "MITRE", "MITRET1036masquerading", "MITRET1565data_manipulation" ], "Action": "Block", "ClusterName": "aditya", "ContainerID": "b75628d4225b8071d5795da342cf2a5c03b1d67b22b40016697fcd17a0db20e4", "ContainerImage": "docker.io/library/mysql:5.6@sha256:20575ecebe6216036d25dab5903808211f1e9ba63dc7825ac20cb975e34cfcae", "ContainerName": "mysql", "Data": "syscall=SYSOPEN flags=OWRONLY|OCREAT|ONOCTTY|O_NONBLOCK", "Enforcer": "AppArmor", "HashID": "f0b220bfa3b7aeae754f3bf8a60dd1a0af001f5956ad22f625bdf83406a7fea3", "HostName": "aditya", "HostPID": 16462, "HostPPID": 16435, "Labels": "app=mysql", "Message": "Detected and prevented compromise to File integrity", "NamespaceName": "wordpress-mysql", "Operation": "File", "Owner": { "Name": "mysql", "Namespace": "wordpress-mysql", "Ref": "Deployment" }, "PID": 167, "PPID": 160, "PodName": "mysql-74775b4bf4-65nqf", "PolicyName": "harden-mysql-file-integrity-monitoring", "ProcessName": "/bin/touch", "Resource": "/sbin/file", "Result": "Permission denied", "Severity": "1", "Source": "/usr/bin/touch file", "Tags": "NIST,NIST800-53AU-2,NIST800-53SI-4,MITRE,MITRET1036masquerading,MITRET1565data_manipulation", "Timestamp": 1696316210, "Type": "MatchedPolicy", "UID": 0, "UpdatedTime": "2023-10-03T06:56:50.829165Z", "cluster_id": "3896", "component_name": "kubearmor", "instanceGroup": "0", "instanceID": "0", "workload": "1" } ```
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_list_vars.md

title: "Command - devspace list vars" sidebar_label: devspace list vars Lists the vars in the active config ``` devspace list vars [flags] ``` ``` Lists the defined vars in the devspace config with their values ``` ``` -h, --help help for vars -o, --output string The output format of the command. Can be either empty, keyvalue or json ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: FOSSA (Provisioning / Security & Compliance)
File: delete.md

`fossa release-group delete` allows you to delete a FOSSA release group. Argument | Required | Description -|-|-- `--title` / `-t ` | Yes | The name of your FOSSA release group. NOTE: `fossa release-group delete` does not use `.fossa.yml` configurations. ```bash fossa release-group delete --title example-title ```
Project: MongoDB (App Definition and Development / Database)
File: compatibility.md

This document details what we expect from well-behaved users. Any usage of TCMalloc libraries outside of these technical boundaries may result in breakage when upgrading to newer versions of TCMalloc. Put another way: don't do things that make TCMalloc API maintenance tasks harder. If you misuse TCMalloc APIs, you're on your own. Additionally, because TCMalloc depends on Abseil, Abseil's also apply. Do not depend on a compiled representation of TCMalloc.* We do not promise any ABI compatibility &mdash; we intend for TCMalloc to be built from source, hopefully from head. The internal layout of our types may change at any point, without notice. Building TCMalloc in the presence of different C++ standard library types may change Abseil types, especially for pre-adopted types (`string_view`, `variant`, etc) &mdash; these will become typedefs and their ABI will change accordingly. Do not rely on dynamic loading/unloading.* TCMalloc does not support dynamic loading and unloading. You may not open namespace `tcmalloc`.* You are not allowed to define additional names in namespace `tcmalloc`, nor are you allowed to specialize anything we provide. You may not depend on the signatures of TCMalloc APIs.* You cannot take the address of APIs in TCMalloc (that would prevent us from adding overloads without breaking you). You cannot use metaprogramming tricks to depend on those signatures either. (This is also similar to the restrictions in the C++ standard.) You may not forward declare TCMalloc APIs.* This is actually a sub-point of "do not depend on the signatures of TCMalloc APIs" as well as "do not open namespace `tcmalloc`", but can be surprising. Any refactoring that changes template parameters, default parameters, or namespaces will be a breaking change in the face of forward-declarations. Do not depend upon internal details.* This should go without saying: if something is in a namespace or filename/path that includes the word "internal", you are not allowed to depend upon it. It's an implementation detail. You cannot friend it, you cannot include it, you cannot mention it or refer to it in any way. Include What You Use.* We may make changes to the internal `#include` graph for TCMalloc headers - if you use an API, please include the relevant header file directly.
Project: YugabyteDB (App Definition and Development / Database)
File: drop_extension.diagram.md

<svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="639" height="100" viewbox="0 0 639 100"><path class="connector" d="M0 52h15m53 0h10m91 0h30m32 0h10m64 0h20m-141 0q5 0 5 5v8q0 5 5 5h116q5 0 5-5v-8q0-5 5-5m5 0h30m-5 0q-5 0-5-5v-20q0-5 5-5h53m24 0h53q5 0 5 5v20q0 5-5 5m-5 0h50m77 0h22m-109 25q0 5 5 5h5m79 0h5q5 0 5-5m-104-25q5 0 5 5v33q0 5 5 5h89q5 0 5-5v-33q0-5 5-5m5 0h15"/><polygon points="0,59 5,52 0,45" style="fill:black;stroke-width:0"/><rect class="literal" x="15" y="35" width="53" height="25" rx="7"/><text class="text" x="25" y="52">DROP</text><rect class="literal" x="78" y="35" width="91" height="25" rx="7"/><text class="text" x="88" y="52">EXTENSION</text><rect class="literal" x="199" y="35" width="32" height="25" rx="7"/><text class="text" x="209" y="52">IF</text><rect class="literal" x="241" y="35" width="64" height="25" rx="7"/><text class="text" x="251" y="52">EXISTS</text><rect class="literal" x="403" y="5" width="24" height="25" rx="7"/><text class="text" x="413" y="22">,</text><a xlink:href="../../../syntaxresources/grammardiagrams#extension-name"><rect class="rule" x="355" y="35" width="120" height="25"/><text class="text" x="365" y="52">extension_name</text></a><rect class="literal" x="525" y="35" width="77" height="25" rx="7"/><text class="text" x="535" y="52">CASCADE</text><rect class="literal" x="525" y="65" width="79" height="25" rx="7"/><text class="text" x="535" y="82">RESTRICT</text><polygon points="635,59 639,59 639,45 635,45" style="fill:black;stroke-width:0"/></svg>
Project: KubeArmor (Provisioning / Security & Compliance)
File: ADOPTERS.md

This list captures the set of organizations that are using KubeArmor within their environments. If you are an adopter of KubeArmor and not yet on this list, we encourage you to add your organization here! Contributing to this list is a small effort that has a big impact to the project's growth, maturity, and momentum. Thank you to all adopters and contributors of the KubeArmor project! To add your organization to this list, to directly update this list, or directly in GitHub. This list is sorted in the order that organizations were added to it. | Organization | Contact | Description of Use | | - | - | | | | | AccuKnox uses KubeArmor as part of its enterprise offering to harden the workloads, propose Zero Trust security posture and get application behavior at scale. | | | | KubeArmor is as the default security engine. | | | | KubeArmor integration is made available on Intel Smart Edge. | | | | KubeArmor integration for securing . Integration done as part of . | | | KubeArmor integration for securing ECU in IDSM Automotive| | | | for R6 Security's Automated Moving Target Defense operator for using Kubearmor as a triggering method| | | | KubeArmor is to provide visualization, alerts and monitoring of the security events without centralizing the data, eliminating cloud contracts and cloud costs. |
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: garbage-collect.eg.md

It's used in scenario. It can be used to configure the collection policy, e.g. don't delete the legacy resources when updating. ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: first-vela-app spec: components: name: express-server type: webservice properties: image: oamdev/hello-world port: 8000 traits: type: ingress-1-20 properties: domain: testsvc.example.com http: "/": 8000 policies: name: keep-legacy-resource type: garbage-collect properties: keepLegacyResource: true ``` ```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: garbage-collect-app spec: components: name: hello-world-new type: webservice properties: image: oamdev/hello-world traits: type: expose properties: port: [8000] policies: name: garbage-collect type: garbage-collect properties: rules: selector: traitTypes: expose strategy: onAppDelete ```
Project: StarRocks (App Definition and Development / Database)
File: array_unique_agg.md

displayed_sidebar: "English" Aggregates distinct values (including `NULL`) in an ARRAY column into an array (from multiple rows to one row). This function is supported from v3.2. ```Haskell ARRAYUNIQUEAGG(col) ``` `col`: the column whose values you want to aggregate. Supported data type is ARRAY. Returns a value of the ARRAY type. The order of the elements in an array is random. The data type of the elements in the returned array is the same as the data type of the elements in the input column. Returns `NULL` if there is no matched value. Take the following data table as an example: ```plaintext mysql > select * from arrayuniqueagg_example; ++--+ | a | b | ++--+ | 2 | [1,null,2,4] | | 2 | [1,null,3] | | 1 | [1,1,2,3] | | 1 | [2,3,4] | ++--+ ``` Example 1: Group the values in column `a` and aggregate distinct values in column `b` into an array. ```plaintext mysql > select a, arrayuniqueagg(b) from arrayuniqueagg_example group by a; +++ | a | arrayuniqueagg(b) | +++ | 1 | [4,1,2,3] | | 2 | [4,1,2,3,null] | +++ ``` Example 2: Aggregate values in column `b` using the WHERE clause. If no data meets the filter condition, a `NULL` value is returned. ```plaintext mysql > select arrayuniqueagg(b) from arrayuniqueagg_example where a < 0; ++ | arrayuniqueagg(b) | ++ | NULL | ++ ``` ARRAYUNIQUEAGG, ARRAY
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-components-view.md

layout: default title: mesheryctl-components-view permalink: reference/mesheryctl/components/view redirect_from: reference/mesheryctl/components/view/ type: reference display-title: "false" language: en command: components subcommand: view view registered components view a component registered in Meshery Server <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl components view [flags] </div> </pre> View details of a specific component <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl exp components view [component-name] </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -h, --help help for view -o, --output-format string (optional) format to display in [json|yaml] (default "yaml") -s, --save (optional) save output as a JSON/YAML file </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -v, --verbose verbose output </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: ClickHouse (App Definition and Development / Database)
File: dropped_tables.md

slug: /en/operations/system-tables/dropped_tables Contains information about tables that drop table has been executed but data cleanup has not been actually performed. Columns: `index` () Index in markeddroppedtables queue. `database` () Database. `table` () Table name. `uuid` () Table uuid. `engine` () Table engine name. `metadatadroppedpath` () Path of table's metadata file in metadata_dropped directory. `tabledroppedtime` () The time when the next attempt to remove table's data is scheduled on. Usually it's the table when the table was dropped plus `databaseatomicdelaybeforedroptablesec` Example The following example shows how to get information about dropped_tables. ``` sql SELECT * FROM system.dropped_tables\G ``` ``` text Row 1: index: 0 database: default table: test uuid: 03141bb2-e97a-4d7c-a172-95cc066bb3bd engine: MergeTree metadatadroppedpath: /data/ClickHouse/build/programs/data/metadata_dropped/default.test.03141bb2-e97a-4d7c-a172-95cc066bb3bd.sql tabledroppedtime: 2023-03-16 23:43:31 ```
Project: KICS (Provisioning / Security & Compliance)
File: 6d64f311-3da6-45f3-80f1-14db9771ea40.md

title: Permissive Web ACL Default Action hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6d64f311-3da6-45f3-80f1-14db9771ea40 Query name: Permissive Web ACL Default Action Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Insecure Defaults URL: WebAcl DefaultAction should not be ALLOW<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" Resources: MyWebACL: Type: "AWS::WAF::WebACL" Properties: Name: "WebACL to with three rules" DefaultAction: Type: "ALLOW" MetricName: "MyWebACL" Rules: Action: Type: "BLOCK" Priority: 1 RuleId: Ref: "MyRule" Action: Type: "BLOCK" Priority: 2 RuleId: Ref: "BadReferersRule" Action: Type: "BLOCK" Priority: 3 RuleId: Ref: "SqlInjRule" ``` ```json title="Positive test num. 2 - json file" hl_lines="8" { "Resources": { "MyWebACL": { "Type": "AWS::WAF::WebACL", "Properties": { "Name": "WebACL to with three rules", "DefaultAction": { "Type": "ALLOW" }, "MetricName": "MyWebACL", "Rules": [ { "Action": { "Type": "BLOCK" }, "Priority": 1, "RuleId": { "Ref": "MyRule" } }, { "RuleId": { "Ref": "BadReferersRule" }, "Action": { "Type": "BLOCK" }, "Priority": 2 }, { "RuleId": { "Ref": "SqlInjRule" }, "Action": { "Type": "BLOCK" }, "Priority": 3 } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: MyWebACL: Type: "AWS::WAF::WebACL" Properties: Name: "WebACL to with one rule" DefaultAction: Type: "BLOCK" MetricName: "MyWebACL" Rules: Action: Type: "ALLOW" Priority: 1 RuleId: Ref: "MyRule" ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyWebACL": { "Type": "AWS::WAF::WebACL", "Properties": { "Name": "WebACL to with one rule", "DefaultAction": { "Type": "BLOCK" }, "MetricName": "MyWebACL", "Rules": [ { "Action": { "Type": "ALLOW" }, "Priority": 1, "RuleId": { "Ref": "MyRule" } } ] } } } } ```