cwielenb/CNCF-Dataset huggingface dataset:
Project: LinuxKit (Provisioning / Automation & Configuration)
File: vendoring.md

Vendoring ========= The Go code in this repo depends on a number of Go libraries. These are vendored in to the `src/cmd/linuxkit/vendor` directory using Go modules should install any required dependencies to `go.mod` and `go.sum` when running normal go commands such as `go build`, `go vet`, etc. To install specific versions, use `go get <dependency>@<reference>`. See the documentation for more information. LinuxKit vendors all dependencies to make it completely self-contained. Once `go.mod` is up to date, you must update the dependencies, either using your local go toolchain or in a container. To vendor all dependencies: `cd src/cmd/linuxkit` Run `go mod vendor` To update all dependencies: ``` docker run -it --rm \ -v $(pwd):/go/src/github.com/linuxkit/linuxkit \ -w /go/src/github.com/linuxkit/linuxkit/src/cmd/linuxkit \ --entrypoint=go linuxkit/go-compile:7b1f5a37d2a93cd4a9aa2a87db264d8145944006 mod vendor ```
Project: kube-bench (Provisioning / Security & Compliance)
File: installation.md

You can choose to Run kube-bench from inside a container (sharing PID namespace with the host). See for additional details. Run a container that installs kube-bench on the host, and then run kube-bench directly on the host. See for additional details. install the latest binaries from the , though please note that you also need to download the config and test files from the `cfg` directory. See for details. Compile it from source. See for details. It is possible to manually install and run kube-bench release binaries. In order to do that, you must have access to your Kubernetes cluster nodes. Note that if you're using one of the managed Kubernetes services (e.g. EKS, AKS, GKE, ACK, OCP), you will not have access to the master nodes of your cluster and you cant perform any tests on the master nodes. First, log into one of the nodes using SSH. Install kube-bench binary for your platform using the commands below. Note that there may be newer releases available. See . Ubuntu/Debian: ``` curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.6.2/kube-bench0.6.2linuxamd64.deb -o kube-bench0.6.2linuxamd64.deb sudo apt install ./kube-bench0.6.2linux_amd64.deb -f ``` RHEL: ``` curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.6.2/kube-bench0.6.2linuxamd64.rpm -o kube-bench0.6.2linuxamd64.rpm sudo yum install kube-bench0.6.2linux_amd64.rpm -y ``` Alternatively, you can manually download and extract the kube-bench binary: ``` curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.6.2/kube-bench0.6.2linuxamd64.tar.gz -o kube-bench0.6.2linuxamd64.tar.gz tar -xvf kube-bench0.6.2linux_amd64.tar.gz ``` You can then run kube-bench directly: ``` kube-bench ``` If you manually downloaded the kube-bench binary (using curl command above), you have to specify the location of configuration directory and file. For example: ``` ./kube-bench --config-dir `pwd`/cfg --config `pwd`/cfg/config.yaml ``` See previous section on for further details on using the kube-bench binary. If Go is installed on the target machines, you can simply clone this repository and run as follows (assuming your ) as per this example: ```shell mkdir -p $GOPATH/src/github.com/aquasecurity/kube-bench git clone git@github.com:aquasecurity/kube-bench.git $GOPATH/src/github.com/aquasecurity/kube-bench go get github.com/aquasecurity/kube-bench cd $GOPATH/src/github.com/aquasecurity/kube-bench go build -o kube-bench . ./kube-bench --help ./kube-bench ``` This command copies the kube-bench binary and configuration files to your host from the Docker container: binaries compiled for linux-x86-64 only (so they won't run on macOS or Windows) ``` docker run --rm -v `pwd`:/host docker.io/aquasec/kube-bench:latest install ``` You can then run `./kube-bench`.
Project: TiDB (App Definition and Development / Database)
File: pull_request_template.md

<!-- Thank you for contributing to TiDB! PR Title Format: pkg [, pkg2, pkg3]: what's changed *: what's changed --> <!-- Please create an issue first to describe the problem. There MUST be one line starting with "Issue Number: " and linking the relevant issues via the "close" or "ref". For more info, check https://pingcap.github.io/tidb-dev-guide/contribute-to-tidb/contribute-code.html#referring-to-an-issue. --> Issue Number: close #xxx Problem Summary: Tests <!-- At least one of them must be included. --> [ ] Unit test [ ] Integration test [ ] Manual test (add detailed scripts or steps below) [ ] No need to test > - [ ] I checked and no code files have been changed. > <!-- Or your custom "No need to test" reasons --> Side effects [ ] Performance regression: Consumes more CPU [ ] Performance regression: Consumes more Memory [ ] Breaking backward compatibility Documentation [ ] Affects user behaviors [ ] Contains syntax changes [ ] Contains variable changes [ ] Contains experimental features [ ] Changes MySQL compatibility <!-- compatibility change, improvement, bugfix, and new feature need a release note --> Please refer to to write a quality release note. ```release-note None ```
Project: KICS (Provisioning / Security & Compliance)
File: b0d3ef3f-845d-4b1b-83d6-63a5a380375f.md

title: Secretsmanager Secret Encrypted With AWS Managed Key hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b0d3ef3f-845d-4b1b-83d6-63a5a380375f Query name: Secretsmanager Secret Encrypted With AWS Managed Key Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: Secrets Manager secret should be encrypted with customer-managed KMS keys instead of AWS managed keys<br> ```tf title="Positive test num. 1 - tf file" hl_lines="3" resource "awssecretsmanagersecret" "test2" { name = "test-cloudrail-1" kmskeyid = "alias/aws/secretsmanager" } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="11" provider "aws" { region = "us-east-1" } data "awskmskey" "by_alias" { key_id = "alias/aws/secretsmanager" } resource "awssecretsmanagersecret" "test" { name = "test-cloudrail-1" kmskeyid = data.awskmskey.by_alias.arn } ``` ```tf title="Negative test num. 1 - tf file" resource "awssecretsmanagersecret" "test222" { name = "test-cloudrail-1" kmskeyid = "alias/MyAlias" } ```
Project: Chef Habitat (App Definition and Development / Application Definition & Image Build)
File: sup_rings.md

+++ title = "Setting Up a Ring" description = "Setting Up a Ring" gh_repo = "habitat" [menu] [menu.habitat] title = "Setting Up a Ring" identifier = "habitat/supervisors/sup-rings" parent = "habitat/supervisors" weight = 50 +++ A "Bastion Ring" is a pattern for preventing rumor loss and a split brain in a network of Chef Habitat Supervisors - it is highly recommended for any real environment use case. Create a minimum of 3 Supervisors and join them together. They should not run any services and they should be marked as permanent peers - their only job is to spread rumors to each other. Then, when you provision additional Supervisors pass the network address of each Supervisor running in the Bastion Ring to the `--peer` argument of `hab sup run`. It's recommended to create a Bastion Ring in any network zones which may become partitioned due to a hardware failure. For example, if you have a Chef Habitat ring spanning multiple data centers and clouds, each should have a bastion ring of a minimum of 3 Supervisors in addition to the Supervisors running your services. Note: If you are using a container scheduler such as the Kubernetes `kube-scheduler`, Docker Swarm mode, Mesos DC/OS's Marathon or Chronos, or a PaaS such as Cloud Foundry, you should not follow the bastion ring pattern, because the scheduler handles persistence and orchestration on your behalf. More resources on schedulers: Kubernetes `kube-scheduler`: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler Docker Swarm mode: https://docs.docker.com/engine/swarm Mesos DC/OS Marathon or Chronos: https://mesosphere.github.io/marathon/ Cloud Foundry: https://www.habitat.sh/get-started/cloudfoundry The initial peer(s) is a requirement of any distributed system. In Chef Habitat, a new Supervisor that is starting up looks for an initial peer(s) to join to begin sharing information about the health and status of peers and other services, to increase the health of the overall Ring.
Project: ArangoDB (App Definition and Development / Database)
File: inspecting.md

+++ title = "Inspecting outcome<T, EC, EP>" description = "" weight = 30 tags = ["outcome", "value", "error", "exception"] +++ Continuing with the previous example, in `Layer3` we have function `z` which again reports failures via exceptions. It will call function `h` from `Layer2old` which returns `outcome<int>` (which may store an `int` or a `std::errorcode` or a `std::exception_ptr`). The goal is to unpack it to either the successful return value `int` or to throw an appropriate exception: if we are storing an `std::exception_ptr`, just rethrow it. If we are storing a `std::errorcode` throw it as `std::systemerror`, which is designed to store `std::error_code`'s: {{% snippet "usingoutcome.cpp" "defz" %}} Function `hasexception()` checks if it is `EP` (`std::exceptionptr`) that is stored, function `exception()` accesses it. Similarly, function `error()` accesses the `EC` (`std::error_code`) if it is stored. `outcome<>` also has a function `has_failure()` to check if either `EC` or `EP` is being stored. It would seem obvious that the above pattern of 'unpacking' `outcome<>` is so common that it ought to be implemented inside function `.value()`, so function `z` could be written as: ```c++ return old::h().value(); ``` And this is exactly what the aforementioned no-value policy template argument is for, which is described in the next section.son for failure. {{% snippet "usingresult.cpp" "fromstring" %}} Our control statement means: if `fromString` returned failure, this same error information should be returned from `print_half`, even though the type of `result<>` is different. If `fromString` returned success, we create variable `i` of type `BigInt` with the value returned from `fromString`. If control goes to subsequent line, it means `fromString` succeeded and variable of type `BigInt` is in scope. and it would have the same effect, but `r.as_failure()` will work when implicit construction from `E` has been disabled due to `T` and `E` having a constructibility relationship. all `result` and `outcome` types into a successful return, default constructing any `T` if necessary.
Project: KICS (Provisioning / Security & Compliance)
File: 3f2cf811-88fa-4eda-be45-7a191a18aba9.md

title: Misconfigured Password Policy Expiration hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3f2cf811-88fa-4eda-be45-7a191a18aba9 Query name: Misconfigured Password Policy Expiration Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: No password expiration policy<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="33 2 21" name: Missing Password policy for AWS account community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwreuseprevent: 5 pw_expire: false name: Extreme Password policy for AWS account community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwmaxage: 180 pwreuseprevent: 5 pw_expire: false name: Alias extreme Password policy for AWS account community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true passwordmaxage: 95 pwreuseprevent: 5 pw_expire: false ``` ```yaml title="Negative test num. 1 - yaml file" name: Missing Password policy for AWS account community.aws.iampasswordpolicy: state: present minpwlength: 8 require_symbols: false require_numbers: true require_uppercase: true require_lowercase: true allowpwchange: true pwmaxage: 20 pwreuseprevent: 5 pw_expire: false ```
Project: StarRocks (App Definition and Development / Database)
File: convert_tz.md

displayed_sidebar: "English" Converts a DATE or DATETIME value from one time zone to another. This function may return different results for different time zones. For more information, see . ```Haskell DATETIME CONVERTTZ(DATETIME|DATE dt, VARCHAR fromtz, VARCHAR to_tz) ``` `dt`: the DATE or DATETIME value to convert. `from_tz`: the source time zone. VARCHAR is supported. The time zone can be represented in two formats: one is Time Zone Database (for example, Asia/Shanghai) and the other is UTC offset (for example, +08:00). `totz`: the destination time zone. VARCHAR is supported. Its format is the same as `fromtz`. Returns a value of the DATETIME data type. If the input is a DATE value, it will be converted into a DATETIME value. This function returns NULL if any of the input parameters is invalid or NULL. For Time Zone Database, see (in Wikipedia). Example 1: Convert a datetime in Shanghai to Los_Angeles. ```plaintext select converttz('2019-08-01 13:21:03', 'Asia/Shanghai', 'America/LosAngeles'); ++ | converttz('2019-08-01 13:21:03', 'Asia/Shanghai', 'America/LosAngeles') | ++ | 2019-07-31 22:21:03 | ++ 1 row in set (0.00 sec) | ``` Example 2: Convert a date in Shanghai to Los_Angeles. ```plaintext select converttz('2019-08-01', 'Asia/Shanghai', 'America/LosAngeles'); ++ | converttz('2019-08-01', 'Asia/Shanghai', 'America/LosAngeles') | ++ | 2019-07-31 09:00:00 | ++ 1 row in set (0.00 sec) ``` Example 3: Convert a datetime in UTC+08:00 to Los_Angeles. ```plaintext select converttz('2019-08-01 13:21:03', '+08:00', 'America/LosAngeles'); +--+ | converttz('2019-08-01 13:21:03', '+08:00', 'America/LosAngeles') | +--+ | 2019-07-31 22:21:03 | +--+ 1 row in set (0.00 sec) ``` CONVERT_TZ, timezone, time zone
Project: kube-hunter (Provisioning / Security & Compliance)
File: KHV044.md

vid: KHV044 title: Privileged Container categories: [Access Risk] severity: high A privileged container is given access to all devices on the host and can work at the kernel level. It is declared using the `Pod.spec.containers[].securityContext.privileged` attribute. This may be useful for infrastructure containers that perform setup work on the host, but is a dangerous attack vector. Minimize the use of privileged containers. Use Pod Security Policies to enforce using `privileged: false` policy.
Project: YDB (App Definition and Development / Database)
File: run_docker.md

To connect to a locally deployed {{ ydb-short-name }} database according to the use case, run the following command in the default configuration: ```bash YDBANONYMOUSCREDENTIALS=1 \ python3 ydb-python-sdk/examples/basicexamplev1/ -e grpc://localhost:2136 -d /local ``` al" ) ``` atabase=/local ) ```
Project: Meshery (Provisioning / Automation & Configuration)
File: submariner.md

layout: integration title: Submariner subtitle: Collaborative and visual infrastructure as code for Submariner image: /assets/img/integrations/submariner/icons/color/submariner-color.svg permalink: extensibility/integrations/submariner docURL: https://docs.meshery.io/extensibility/integrations/submariner description: integrations-category: Runtime integrations-subcategory: Cloud Native Network registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: KOTS (App Definition and Development / Application Definition & Image Build)
File: dashboard-links-browser-address.md

Currently, any vendor-defined dashboard button that are included in a KOTS application (https://kots.io/vendor/config/dashboard-buttons/) always refer to "localhost". This doesn't work when accessing the cluster over a connection that isn't "localhost", for example, when using the embeded kURL cluster. The proposal here is to udpate the implementation of this button to be compatible with all environments. The dashboard buttons defined in https://kots.io/vendor/config/dashboard-buttons/ should link to the same hostname/IP that the Admin Console is being accessed from Enabling the KOTS application to specify the protocol to use Enabling portfowarding or firewall configuration for these buttons Enabling TLS termination for these buttons Enabling ingress for these buttons Currently, the dashboard buttons redirect to localhost. If a KOTS application adds a button to expose a linked service on port 80, the link will be to http://localhost:80. Not all use of the Admin Console is over "localhost", and these buttons only work if the Admin Console is being accessed over localhost. This design will change the hostname to the browser-supplied hostname. Additionally, this design will allow the KOTS manifest to change the protocol from http to https, with a default of http. When the React frontend creates the button resource, it should use the hostname/ip from the browser, not localhost. Currently, these are read directly from the API (https://github.com/replicatedhq/kotsadm/blob/cdb2add1296632b69e347afebd67af965f3bc8eb/web/src/components/apps/Dashboard.jsx#L94). The design will make the API return these as an object containing protocol, port, path. The UI will calculate the link. A KOTS application spec currently contains: ```yaml ports: serviceName: "sentry" servicePort: 9000 localPort: 9000 applicationUrl: "https://sentry" ``` This link is currently sent down as `https://localhost:9000`. The link field will be updated to be an object, and in the above example, it will contain: ```json { "protocol": "https", "port": 9000, "path": "/" } ``` All fields will be required in the JSON object. The React front end will build the link by determining the hostname or IP address that is currently being used to access the Admin Console. It will build a string using `${link.protocol}://${browser.hostname}:${link.port}/${link.path}` If the port is `80`, it will not be included in the link. If the path is `/`, there will not be a duplicate `/` on the link. No alternatives considered. There are no known security implications here. This is building a link, not port forwarding or otherwise making a service accessible from outside the cluster.
Project: Seata (App Definition and Development / Database)
File: BUG_REPORT.md

name: Bug Report about: If you would like to report an issue to Seata, please use this template. <!-- Please do not use this issue template to report security vulnerabilities but refer to our . --> of this repository and believe that this is not a duplicate. If there is an exception, please attach the exception trace: ``` Just paste your stack trace here! ``` xxx xxx xxx Minimal yet complete reproducer code (or URL to code): JDK version(e.g. `java -version`): Seata client/server version: Database version: OS(e.g. `uname -a`): Others:
Project: KubeZoo (Provisioning / Automation & Configuration)
File: MAINTAINERS.md

This file lists the maintainers of the KubeZoo project. The responsibilities of maintainers are listed in the file. | Name | GitHub ID | Affiliation | | - | | -- | | Jingsi Ren | | ByteDance | | Chen Xu | | ByteDance | | Deliang Fan | | ByteDance | | Jun Zhang | | ByteDance | | Charles Zheng | | ByteDance | | He Cao | | ByteDance | | Kwan Yin Chan | | ByteDance |
Project: KICS (Provisioning / Security & Compliance)
File: f2ea6481-1d31-4d40-946a-520dc6321dd7.md

title: Kinesis Not Encrypted With KMS hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f2ea6481-1d31-4d40-946a-520dc6321dd7 Query name: Kinesis Not Encrypted With KMS Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: AWS Kinesis Streams and metadata should be protected with KMS<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2 38 44 16 23" name: Encrypt Kinesis Stream test-stream. community.aws.kinesis_stream: name: test-stream state: present shards: 1 encryption_type: KMS key_id: alias/aws/kinesis wait: yes wait_timeout: 600 register: test_stream name: Encrypt Kinesis Stream test-stream. v2 community.aws.kinesis_stream: name: test-stream state: present shards: 1 encryption_state: disabled encryption_type: KMS key_id: alias/aws/kinesis wait: yes wait_timeout: 600 register: test_stream name: Encrypt Kinesis Stream test-stream. v3 community.aws.kinesis_stream: name: test-stream state: present shards: 1 encryption_state: enabled key_id: alias/aws/kinesis wait: yes wait_timeout: 600 register: test_stream name: Encrypt Kinesis Stream test-stream. v4 community.aws.kinesis_stream: name: test-stream state: present shards: 1 encryption_state: enabled encryption_type: NONE key_id: alias/aws/kinesis wait: yes wait_timeout: 600 register: test_stream name: Encrypt Kinesis Stream test-stream. v5 community.aws.kinesis_stream: name: test-stream state: present shards: 1 encryption_state: enabled encryption_type: KMS wait: yes wait_timeout: 600 register: test_stream ``` ```yaml title="Negative test num. 1 - yaml file" name: Encrypt Kinesis Stream test-stream. v6 community.aws.kinesis_stream: name: test-stream state: present shards: 1 encryption_state: enabled encryption_type: KMS key_id: alias/aws/kinesis wait: yes wait_timeout: 600 ```