cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 5b9d237a-57d5-4177-be0e-71434b0fef47.md

title: KMS Key With Vulnerable Policy hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5b9d237a-57d5-4177-be0e-71434b0fef47 Query name: KMS Key With Vulnerable Policy Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Checks if the policy is vulnerable and needs updating.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" name: Update IAM policy on an existing KMS key community.aws.aws_kms: alias: my-kms-key policy: {'Id': 'auto-ebs-2', 'Statement': [{'Action': ['kms:'], 'Effect': 'Allow', 'Principal': {'AWS': ''}, 'Resource': '', 'Sid': 'Allow access through EBS for all principals in the account that are authorized to use EBS'}, {'Action': ['kms:Describe', 'kms:Get', 'kms:List', 'kms:RevokeGrant'], 'Effect': 'Allow', 'Principal': {'AWS': 'arn:aws:iam::111111111111:root'}, 'Resource': '*', 'Sid': 'Allow direct access to key metadata to the account'}], 'Version': '2012-10-17'} state: present ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="3" name: Update IAM policy on an existing KMS key2 community.aws.aws_kms: alias: my-kms-key state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: Update IAM policy on an existing KMS key community.aws.aws_kms: alias: my-kms-key policy: | { Id: auto-ebs-2, Statement: [{Action: [kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, kms:CreateGrant, kms:DescribeKey], Condition: { StringEquals: {kms:CallerAccount: '111111111111', kms:ViaService: ec2.ap-southeast-2.amazonaws.com}}, Effect: Allow, Principal: {AWS: ''}, Resource: '', Sid: Allow access through EBS for all principals in the account that are authorized to use EBS }, { Action: [kms:Describe, kms:Get, kms:List*, kms:RevokeGrant], Effect: Allow, Principal: {AWS: arn:aws:iam::111111111111:root}, Resource: '*', Sid: Allow direct access to key metadata to the account}], Version: '2012-10-17' } state: present ```
Project: ClickHouse (App Definition and Development / Database)
File: trace_log.md

slug: /en/operations/system-tables/trace_log Contains stack traces collected by the sampling query profiler. ClickHouse creates this table when the server configuration section is set. Also see settings: , , , , . To analyze logs, use the `addressToLine`, `addressToLineWithInlines`, `addressToSymbol` and `demangle` introspection functions. Columns: `hostname` () Hostname of the server executing the query. `event_date` () Date of sampling moment. `event_time` () Timestamp of the sampling moment. `eventtimemicroseconds` () Timestamp of the sampling moment with microseconds precision. `timestamp_ns` () Timestamp of the sampling moment in nanoseconds. `revision` () ClickHouse server build revision. When connecting to the server by `clickhouse-client`, you see the string similar to `Connected to ClickHouse server version 19.18.1.`. This field contains the `revision`, but not the `version` of a server. `trace_type` () Trace type: `Real` represents collecting stack traces by wall-clock time. `CPU` represents collecting stack traces by CPU time. `Memory` represents collecting allocations and deallocations when memory allocation exceeds the subsequent watermark. `MemorySample` represents collecting random allocations and deallocations. `MemoryPeak` represents collecting updates of peak memory usage. `ProfileEvent` represents collecting of increments of profile events. `thread_id` () Thread identifier. `query_id` () Query identifier that can be used to get details about a query that was running from the system table. `trace` () Stack trace at the moment of sampling. Each element is a virtual memory address inside ClickHouse server process. `size` () - For trace types `Memory`, `MemorySample` or `MemoryPeak` is the amount of memory allocated, for other trace types is 0. `event` () - For trace type `ProfileEvent` is the name of updated profile event, for other trace types is an empty string. `increment` () - For trace type `ProfileEvent` is the amount of increment of profile event, for other trace types is 0. Example ``` sql SELECT * FROM system.trace_log LIMIT 1 \G ``` ``` text Row 1: hostname: clickhouse.eu-central1.internal event_date: 2020-09-10 event_time: 2020-09-10 11:23:09 eventtimemicroseconds: 2020-09-10 11:23:09.872924 timestamp_ns: 1599762189872924510 revision: 54440 trace_type: Memory thread_id: 564963 query_id: trace: [371912858,371912789,371798468,371799717,371801313,371790250,624462773,566365041,566440261,566445834,566460071,566459914,566459842,566459580,566459469,566459389,566459341,566455774,371993941,371988245,372158848,372187428,372187309,372187093,372185478,140222123165193,140222122205443] size: 5244400 ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: sshd_config.md

+++ title = "sshd_config resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "sshd_config" identifier = "inspec/resources/os/sshdconfig.md sshdconfig resource" parent = "inspec/resources/os" +++ Use the `sshdconfig` Chef InSpec audit resource to test configuration data for the OpenSSH daemon located at `/etc/ssh/sshdconfig` on Linux and Unix platforms. sshdthe OpenSSH daemonlistens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. An `sshd_config` resource block declares the OpenSSH daemon configuration data to be tested: describe sshd_config('path') do its('name') { should include('foo') } end where `name` is a configuration setting in `sshd_config` `('path')` is the non-default `/path/to/sshd_config` `{ should include('foo') }` tests the value of `name` as read from `sshd_config` versus the value declared in the test The following examples show how to use this Chef InSpec audit resource. describe sshd_config do its('AcceptEnv') { should include('CIENABLECOVERAGE') } end describe sshd_config do its('AddressFamily') { should cmp 'inet6' } end describe sshd_config do its('Protocol') { should cmp 2 } end describe sshd_config do its('Ciphers') { should cmp('chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr') } end describe sshd_config do its('Port') { should cmp 22 } its('UsePAM') { should eq 'yes' } its('ListenAddress') { should eq nil } its('HostKey') do should eq [ '/etc/ssh/sshhostrsa_key', '/etc/ssh/sshhostdsa_key', '/etc/ssh/sshhostecdsa_key', ] end end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `name` matcher tests the value of `name` as read from `sshd_config` versus the value declared in the test: its('name') { should cmp 'foo' } or: its('name') {should include('bar') }
Project: KICS (Provisioning / Security & Compliance)
File: a8b0c58b-cd25-4b53-9ad0-55bca0be0bc1.md

title: EC2 Instance Has Public IP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a8b0c58b-cd25-4b53-9ad0-55bca0be0bc1 Query name: EC2 Instance Has Public IP Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: EC2 Instance should not have a public IP address.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="24 15 7" name: example amazon.aws.ec2: key_name: mykey instance_type: t2.micro count: 3 vpcsubnetid: subnet-29e63245 assignpublicip: yes name: Create an ec2 launch template community.aws.ec2launchtemplate: name: "my_template" image_id: "ami-04b762b4289fba92b" keyname: myssh_key instance_type: t2.micro network_interfaces: associatepublicip_address: true name: start an instance with a public IP address community.aws.ec2_instance: name: "public-compute-instance" key_name: "prod-ssh-key" vpcsubnetid: subnet-5ca1ab1e instance_type: c5.large security_group: default network: assignpublicip: true ``` ```yaml title="Negative test num. 1 - yaml file" amazon.aws.ec2: key_name: mykey instance_type: t2.micro count: 3 vpcsubnetid: subnet-29e63245 assignpublicip: false name: Create an ec2 launch template community.aws.ec2launchtemplate: name: my_template image_id: ami-04b762b4289fba92b keyname: myssh_key instance_type: t2.micro name: Create an ec2 launch template community.aws.ec2launchtemplate: name: "my_template" image_id: "ami-04b762b4289fba92b" keyname: myssh_key instance_type: t2.micro network_interfaces: interface_type: interface ipv6_addresses: [] mac_address: '0 e: 0 e: 36: 60: 67: cf' networkinterfaceid: eni - 061 dee20eba3b445a owner_id: '721066863947' sourcedestcheck: true status: " in -use" ```
Project: YugabyteDB (App Definition and Development / Database)
File: yba_provider_onprem_delete.md

Delete an On-premises YugabyteDB Anywhere provider Delete an On-premises provider in YugabyteDB Anywhere ``` yba provider onprem delete [flags] ``` ``` -f, --force [Optional] Bypass the prompt for non-interactive usage. -h, --help help for delete ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -n, --name string [Optional] The name of the provider for the action. Required for create, delete, describe, instance-types and nodes. -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Manage a YugabyteDB Anywhere on-premises provider
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_clusterdefinition_list-components.md

title: kbcli clusterdefinition list-components List cluster definition components. ``` kbcli clusterdefinition list-components [flags] ``` ``` kbcli clusterdefinition list-components apecloud-mysql ``` ``` -h, --help help for list-components ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - ClusterDefinition command.
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-sns-controller.md

layout: integration title: AWS Simple Notification Service subtitle: Collaborative and visual infrastructure as code for AWS Simple Notification Service image: /assets/img/integrations/aws-sns-controller/icons/color/aws-sns-controller-color.svg permalink: extensibility/integrations/aws-sns-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-sns-controller description: integrations-category: App Definition and Development integrations-subcategory: App Integration registrant: GitHub components: name: platform-endpoint colorIcon: assets/img/integrations/aws-sns-controller/components/platform-endpoint/icons/color/platform-endpoint-color.svg whiteIcon: assets/img/integrations/aws-sns-controller/components/platform-endpoint/icons/white/platform-endpoint-white.svg description: name: platform-application colorIcon: assets/img/integrations/aws-sns-controller/components/platform-application/icons/color/platform-application-color.svg whiteIcon: assets/img/integrations/aws-sns-controller/components/platform-application/icons/white/platform-application-white.svg description: name: field-export colorIcon: assets/img/integrations/aws-sns-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-sns-controller/components/field-export/icons/white/field-export-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-sns-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-sns-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: subscription colorIcon: assets/img/integrations/aws-sns-controller/components/subscription/icons/color/subscription-color.svg whiteIcon: assets/img/integrations/aws-sns-controller/components/subscription/icons/white/subscription-white.svg description: name: topic colorIcon: assets/img/integrations/aws-sns-controller/components/topic/icons/color/topic-color.svg whiteIcon: assets/img/integrations/aws-sns-controller/components/topic/icons/white/topic-white.svg description: featureList: [ "Message fanout: Each account can support 100,000 Standard topics and each topic supports up to 12.5M subscriptions.", "Amazon SNS supports VPC Endpoints (VPCE) via AWS PrivateLink.", "Amazon SNS mobile notifications make it simple and cost effective to fan out mobile push notifications to iOS, Android, Fire, Windows, and Baidu devices." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Meshery (Provisioning / Automation & Configuration)
File: 404.md

layout: page title: 404 permalink: /404.html excludedinsearch: true language: en list: exclude <div> <h1 id="funny-message" style="font-weight:bold;margin-bottom:1.5em;" class="text-center noTOC"></h1> <h3 style="font-style:italic;" class="text-center noTOC">Things tend to get a bit meshy around here...</h3> <div style="text-align:center;" class="alert-info alert">Please <a href="https://github.com/meshery/meshery/issues/new?assignees=&labels=docs&template=documentation.md&title=Docs:" target="_blank">report this issue</a> (thank you!) and return to the <a href="{{ site.url }}">Meshery Documentation</a>.</div> </div> <script type="text/javascript"> var messages = [ "Oh, no. Please pardon our meshy site.", "Oops. Please excuse the mesh.", "Looks like this page doesn't exists. What a mesh!", "Please pardon our mesh.", "Lost in the mesh! Our apologies.", "404: Mesh not found. Sorry about that!", "Oops, caught in the mesh. Bear with us!", "Looks like this page got tangled in our mesh. Apologies!", "Mesh happens! We're working on it.", "Oh mesh, where did that page go? Our bad!", "404 error: Page meltdown. We're on the case!", "Lost in the mesh maze. Sorry for the inconvenience!" "Meshed up! Page not found. We're untangling it.", ]; var message = messages[Math.floor(Math.random()*messages.length)]; document.getElementById("funny-message").innerHTML = message; </script>
Project: Puppet (Provisioning / Automation & Configuration)
File: quickstart.md

Before diving into the code, you should first take the time to make sure you have an environment where you can run puppet as a developer. In a nutshell you need: the puppet codebase, ruby versions, and dependencies. Once you've got all of that in place you can make sure that you have a working development system by running the puppet spec tests. In order to contribute to puppet you'll need to have a GitHub account. Once you have your account, fork the puppetlabs/puppet repo, and clone it onto your local machine. The [GitHub docs have a good explanation](https://help.github.com/articles/fork-a-repo) of how to do all of this. Puppet needs to work across a variety of ruby versions. Popular ways of making sure you have access to the various versions of ruby are to use either or . You can read up on the linked sites for how to get them installed on your system. Make sure you have installed. This should be as simple as: $ gem install bundler Now you can get all of the dependencies using: $ bundle install --path .bundle Once this is done, you can interact with puppet through bundler using `bundle exec <command>` which will ensure that `<command>` is executed in the context of puppet's dependencies. For example to run the specs: $ bundle exec rake spec To run puppet itself (for a resource lookup say): $ bundle exec puppet resource host localhost To apply a test manifest: $ bundle exec puppet apply -e 'notify { "hello world": }' Puppet projects use a common convention of using Rake to run unit tests. The tests can be run with the following rake task: $ bundle exec rake spec To run a single file's worth of tests (much faster!), give the filename: $ bundle exec rake spec TEST=spec/unit/filesystemspec.rb To run a single test or group of tests, give the filename and line number: $ bundle exec rake spec TEST=spec/unit/filesystemspec.rb:42 To run all tests in parallel, process count is the number of processes to use when running the tests: $ bundle exec rake parallel:spec[process_count] When tests fail, it is often useful to capture Puppet's log of a test run. The test harness pays attention to two environment variables that can be used to send logs to a file, and to adjust the log level: `PUPPETTESTLOG`: when set, must be an absolute path to a file. Puppet's log messages will be sent to that file. Note that the log file will contain lots of spurious warnings `Unable to set ownership of log file` you can safely ignore them. `PUPPETTESTLOG_LEVEL`: change the log level to adjust how much detail is captured. It defaults to `notice`; useful values include `info` and `debug`. For details on how to run puppet acceptance tests, please see the
Project: secureCodeBox (Provisioning / Security & Compliance)
File: templates-dir.md

title: templates (Directory) sidebar_position: 7 The `templates` directory contains multiple files and dirs per default (using `helm create`). Those are not needed and should be deleted. For the secureCodeBox we will need files for the `ScanType`, `ParseDefinition` and `CascadingRule`. Please replace new-scanner with the name of your scanner for the following files. This file contains the Specification of your `ScanType`. Please take a look at on how to configure your `ScanType`. This file contains the ParseDefinition of your scanner. We use the convention where the values to the parse definition are taken from the `values.yaml` in the scanner's folder. ```yaml apiVersion: execution.securecodebox.io/v1 kind: ParseDefinition metadata: name: zap-json spec: image: "{{ .Values.parser.image.repository }}:{{ .Values.parser.image.tag | default .Chart.Version }}" ttlSecondsAfterFinished: {{ .Values.parser.ttlSecondsAfterFinished }} env: {{ - toYaml .Values.parser.env | nindent 4 }} ``` More information under The `CascadingRules` define under which conditions your scanner will be run after other scanners. Please take a look at on how to configure your `CascadingRules`. The CascadingRules are not directly in the /templates directory as their curly bracket syntax clashes with helms templates. We import them as raw files to avoid these clashes as escaping them is even more messy. Your `cascading-rules.yaml` should look like the following: ```yaml {{ if .Values.cascadingRules.enabled }} {{ range $path, $_ := .Files.Glob "cascading-rules/*" }} {{ $.Files.Get $path }} {{ end }} {{ end }} ``` In addition, you should add the following to your `values.yaml` to allow that the inclusion of the default cascading rules of your scanner can be skipped: ```yaml cascadingRules: enabled: true ```
Project: StarRocks (App Definition and Development / Database)
File: SET_DEFAULT_ROLE.md

displayed_sidebar: "English" Sets the roles that are activated by default when the user connects to the server. This command is supported from v3.0. :::tip Common users can set default roles for themselves. Users with the `user_admin` role can set default roles for other users. Before you perform this operation, make sure that the user has already been assigned these roles. You can query the roles of a user using . ::: ```SQL -- Set specified roles as default roles. SET DEFAULT ROLE <rolename>[,<rolename>,..] TO <user_identity>; -- Set all roles of the user, including roles that will be assigned to this user, as default roles. SET DEFAULT ROLE ALL TO <user_identity>; -- No default role is set but the public role is still enabled after a user login. SET DEFAULT ROLE NONE TO <user_identity>; ``` `role_name`: the role name `user_identity`: the user identity Query the roles of the current user. ```SQL SHOW GRANTS FOR test; +--++-+ | UserIdentity | Catalog | Grants | +--++-+ | 'test'@'%' | NULL | GRANT 'dbadmin', 'useradmin' TO 'test'@'%' | +--++-+ ``` Example 1: Set roles `dbadmin` and `useradmin` as the default roles for the user `test`. ```SQL SET DEFAULT ROLE db_admin TO test; ``` Example 2: Set all roles of the user `test`, including roles that will be assigned to this user as default roles. ```SQL SET DEFAULT ROLE ALL TO test; ``` Example 3: Clear all the default roles of the user `test`. ```SQL SET DEFAULT ROLE NONE TO test; ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-farm-create.1.md

% podman-farm-create 1 podman\-farm\-create - Create a new farm podman farm create name [connections] Create a new farm with connections that Podman knows about which were added via the podman system connection add command. An empty farm can be created without adding any connections to it. Add or remove connections from a farm via the podman farm update command. Create the specified farm: ``` $ podman farm create farm2 ``` Create multiple farms: ``` $ podman farm create farm1 f37 f38 ``` , , , July 2023, Originally compiled by Urvashi Mohnani (umohnani at redhat dot com)