cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 46883ce1-dc3e-4b17-9195-c6a601624c73.md

title: Default Security Groups With Unrestricted Traffic hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 46883ce1-dc3e-4b17-9195-c6a601624c73 Query name: Default Security Groups With Unrestricted Traffic Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: Check if default security group does not restrict all inbound and outbound traffic.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="24 1 13" resource "awsdefaultsecurity_group" "positive1" { vpcid = awsvpc.mainvpc.id ingress { protocol = -1 self = true from_port = 0 to_port = 0 cidr_blocks = ["0.0.0.0/0"] } } resource "awsdefaultsecurity_group" "positive2" { vpcid = awsvpc.mainvpc.id egress { from_port = 0 to_port = 0 protocol = "-1" ipv6cidrblocks = ["::/0"] } } resource "awsdefaultsecurity_group" "positive3" { vpcid = awsvpc.mainvpc.id ingress { protocol = -1 self = true from_port = 0 to_port = 0 cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" ipv6cidrblocks = ["::/0"] } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsdefaultsecurity_group" "negative1" { vpcid = awsvpc.mainvpc.id ingress { protocol = -1 self = true from_port = 0 to_port = 0 cidr_blocks = ["10.1.0.0/16"] ipv6cidrblocks = ["250.250.250.1:8451"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["10.1.0.0/16"] ipv6cidrblocks = ["250.250.250.1:8451"] } } ```
Project: StarRocks (App Definition and Development / Database)
File: Insert_into_faq.md

displayed_sidebar: "English" It is not recommended to insert data piece by piece to OLAP. It is usually inserted in batches. Both methods take up the same amount of time. You can solve this problem by changing the timeout duration for the Stream Load RPC. Change the following item in be.conf and restart the machines to allow the change to take effect: `streamingloadrpcmaxalivetimesec`: The RPC timeout for Stream Load. Unit: Seconds. Default: `1200`. Or you can set the query timeout using the following variable: `query_timeout`: The timeout duration for queries. Its unit is seconds, and the default value is `300`. By default, the query timeout duration is 300s. You can set the variable `query_timeout` to extend this duration. The unit is second.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: security_identifier.md

+++ title = "security_identifier resource" draft = false gh_repo = "inspec" platform = "windows" [menu] [menu.inspec] title = "security_identifier" identifier = "inspec/resources/os/securityidentifier.md securityidentifier resource" parent = "inspec/resources/os" +++ Use the `security_identifier` Chef InSpec resource to test the for user and group trustees on Windows. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} A `security_identifier` resource should specify the name and type of the trustee to test the SID for: describe security_identifier(group: 'Everyone') do its('sid') { should eq 'S-1-1-0' } end where `group:` specifies that `'Everyone'` should be a group. `user:` can be used to specify a user account. \\ It is necessary to declare the type of the trustee because Windows allows users, groups and other entities to share names. If you really need to not specify the type, `unspecified:` can be used. This will attempt to match the name to a group and then a user account. This may take longer to execute and comes with the risk of Chef InSpec matching the name to an unintended trustee. The following examples show how to use this Chef InSpec resource. describe security_identifier(user: 'Administrator') do it { should exist } end describe security_identifier(group: 'Everyone') do its('sid') { should eq 'S-1-1-0' } end describe security_policy do its("SeRemoteInteractiveLogonRight") { shouldnot include securityidentifier(group: 'Guests') } end describe security_identifier(group: 'Everyone') do its('sid') { should eq 'S-1-1-0' } end This Chef InSpec audit resource has the following special matchers. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. For this resource, `exist` is true if a Security Identifier (SID) exists on the target host for the specified trustee.
Project: YugabyteDB (App Definition and Development / Database)
File: scaling-simple-workloads.md

title: Simple workloads headerTitle: Simple workloads linkTitle: Simple workloads description: Simple workloads headcontent: Performance running simple workloads when scaling out menu: v2.18: name: Simple workloads identifier: scaling-simple-workloads parent: explore-scalability weight: 70 type: docs , YugabyteDB's underlying distributed document store, uses a heavily customized version of RocksDB for node-local persistence. It has been engineered ground up to deliver high performance at a massive scale. Several features have been built into DocDB to support this design goal, including the following: Scan-resistant global block cache Bloom/index data splitting Global memstore limit Separate compaction queues to reduce read amplification Smart load balancing across disks These features enable YugabyteDB to handle massive datasets with ease. The following scenario loads 1 billion rows into a 3-node cluster. This experiment uses the with the standard JDBC binding to load 1 billion rows. The expected dataset at the end of the data load is 1TB on each node (or a 3TB total data set size in each cluster). | Cluster configuration | | | --: | : | | Region | AWS us-west-2 | | Release | v2.1.5 | | API | YSQL | | Nodes | 3 | | Instance type | c5.4xlarge | | Storage | 2 x 5TB SSDs (gp2 EBS) | | Sharding | Range and Hash | | Isolation level | Snapshot | 1B row data load completed successfully for YSQL (using a range-sharded table) in about 26 hours. The following graphs show the throughput and average latency for the range-sharded load phase of the YCSB benchmark during the load phase. The total dataset was 3.2TB across the two nodes. Each node had just over 1TB of data.
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-ecs-controller.md

layout: integration title: AWS Elastic Container Service subtitle: Collaborative and visual infrastructure as code for AWS Elastic Container Service image: /assets/img/integrations/aws-ecs-controller/icons/color/aws-ecs-controller-color.svg permalink: extensibility/integrations/aws-ecs-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-ecs-controller description: integrations-category: Provisioning integrations-subcategory: Automation & Configuration registrant: GitHub components: name: cluster colorIcon: assets/img/integrations/aws-ecs-controller/components/cluster/icons/color/cluster-color.svg whiteIcon: assets/img/integrations/aws-ecs-controller/components/cluster/icons/white/cluster-white.svg description: name: service colorIcon: assets/img/integrations/aws-ecs-controller/components/service/icons/color/service-color.svg whiteIcon: assets/img/integrations/aws-ecs-controller/components/service/icons/white/service-white.svg description: name: task-definition colorIcon: assets/img/integrations/aws-ecs-controller/components/task-definition/icons/color/task-definition-color.svg whiteIcon: assets/img/integrations/aws-ecs-controller/components/task-definition/icons/white/task-definition-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-ecs-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-ecs-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: field-export colorIcon: assets/img/integrations/aws-ecs-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-ecs-controller/components/field-export/icons/white/field-export-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Trivy (Provisioning / Security & Compliance)
File: ide.md

is an open source versatile code editor and development environment. Get it at: <https://github.com/aquasecurity/trivy-vscode-extension> makes IDEs such as Goland, Pycharm, IntelliJ, Webstorm, and more. The Trivy plugin for JetBrains IDEs lets you use Trivy right from your development environment. Get it at: <https://plugins.jetbrains.com/plugin/18690-trivy-findings-explorer> is a management application for Kubernetes clusters. Trivy has an extension for Kubernetes Lens that lets you scan Kubernetes workloads and view the results in the Lens UI. Get it at: <https://github.com/aquasecurity/trivy-operator-lens-extension> is a terminal based text editor. Vim plugin for Trivy to install and run Trivy. Get it at: <https://github.com/aquasecurity/vim-trivy> is an easy way to install container engine on your development machine, and manage it in a GUI . Trivy Docker Desktop extension for scanning container images for vulnerabilities and generating SBOMs Get it at: <https://github.com/aquasecurity/trivy-docker-extension> is an easy way to use containers and Kubernetes on your development machine, and manage it in a GUI. Trivy is natively integrated with Rancher, no installation is needed. More info in Rancher documentation: <https://docs.rancherdesktop.io/getting-started/features#scanning-images> A terminal native UI for Trivy Get it at: <https://github.com/owenrumney/lazytrivy> Web application that allows to load a Trivy report in json format and displays the vulnerabilities of a single target in an interactive data table Get it at: <https://github.com/dbsystel/trivy-vulnerability-explorer> A trivy pre-commit hook that runs a `trivy fs` in your git repo before commiting, preventing you from commiting secrets in the first place. Get it at: <https://github.com/mxab/pre-commit-trivy> is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. A CDK Construct Library to scan an image with trivy in CDK codes. Get it at: <https://constructs.dev/packages/image-scanner-with-trivy>
Project: Trivy (Provisioning / Security & Compliance)
File: cicd.md

is Microsoft Azure cloud native CI/CD service. Trivy has a "Azure Devops Pipelines Task" for Trivy, that lets you easily introduce security scanning into your workflow, with an integrated Azure Devops UI. Get it at: <https://github.com/aquasecurity/trivy-azure-pipelines-task> is GitHub's native CI/CD and job orchestration service. GitHub Action for integrating Trivy into your GitHub pipeline Get it at: <https://github.com/aquasecurity/trivy-action> GitHub Action to scan vulnerability using Trivy. If vulnerabilities are found by Trivy, it creates a GitHub Issue. Get it at: <https://github.com/marketplace/actions/trivy-action> In this action, Trivy scans the dependency files such as package-lock.json and go.sum in your repository, then create GitHub issues according to the result. Get it at: <https://github.com/marketplace/actions/trivy-github-issues> The trivy buildkite plugin provides a convenient mechanism for running the open-source trivy static analysis tool on your project. Get it at: https://github.com/equinixmetal-buildkite/trivy-buildkite-plugin is CI/CD as code that runs anywhere. The Dagger module for Trivy provides functions for scanning container images from registries as well as Dagger Container objects from any Dagger SDK (e.g. Go, Python, Node.js, etc). Get it at: <https://daggerverse.dev/mod/github.com/jpadams/daggerverse/trivy> is a CI/CD service. You can use Trivy in Semaphore for scanning code, containers, infrastructure, and Kubernetes in Semaphore workflow. Get it at: <https://semaphoreci.com/blog/continuous-container-vulnerability-testing-with-trivy> is a CI/CD service. You can use the Trivy Orb for Circle CI to introduce security scanning into your workflow. Get it at: <https://circleci.com/developer/orbs/orb/fifteen5/trivy-orb> Source: <https://github.com/15five/trivy-orb> Example Trivy step in pipeline ```yml pipeline: securitycheck: image: aquasec/trivy:latest commands: trivy fs --exit-code 1 --skip-dirs web/ --skip-dirs docs/ --severity MEDIUM,HIGH,CRITICAL . ``` Woodpecker does use Trivy itself so you can . is a CI/CD service. You can use Trivy Resource in Concourse for scanning containers and introducing security scanning into your workflow. It has capabilities to fail the pipeline, create issues, alert communication channels (using respective resources) based on Trivy scan output. Get it at: <https://github.com/Comcast/trivy-resource/> run various vulnerability scanners, providing uniform methods and parameters for launching the tools. The Trivy integration supports scanning Docker images and local filesystems for vulnerabilities as well as scanning IaC files for misconfigurations. Get it at: <https://github.com/MaibornWolff/secobserveactionstemplates>
Project: ClickHouse (App Definition and Development / Database)
File: v21.8.9.13-lts.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Update zoneinfo files to 2021c. (). Backported in : Allow using a materialized column as the sharding key in a distributed table even if `insertallowmaterialized_columns=0`:. (). Backported in : Fix shutdown of `AccessControlManager`. Now there can't be reloading of the configuration after AccessControlManager has been destroyed. This PR fixes the flaky test .html). (). Backported in : Fix vertical merges of projection parts. This fixes . This PR also fixes several projection merge/mutation issues introduced in https://github.com/ClickHouse/ClickHouse/pull/25165. (). Backported in : Fix possible `Block structure mismatch` for subqueries with pushed-down `HAVING` predicate. Fixes . (). Backported in : In ODBC bridge add retries for error Invalid cursor state. It is a retriable error. Closes . (). Backported in : Fix bug in check `pathStartsWith` becuase there was bug with the usage of `std::mismatch`: ` The behavior is undefined if the second range is shorter than the first range.`. (). Backported in : Fix rare segfault in `ALTER MODIFY` query when using incorrect table identifier in `DEFAULT` expression like `x.y.z...` Fixes . (). Backported in : Condition in filter predicate could be lost after push-down optimisation. (). Backported in : Fixed incorrect behaviour of setting `materializedpostgresqltables_list` at server restart. Found in . (). Backported in : Fix concurrent access to `LowCardinality` during `GROUP BY` (leads to SIGSEGV). (). Backported in : Fix bad cast in `ATTACH TABLE ... FROM 'path'` query when non-string literal is used instead of path. It may lead to reading of uninitialized memory. (). Backported in : Avoid `Timeout exceeded: elapsed 18446744073.709553 seconds` error that might happen in extremely rare cases, presumably due to some bug in kernel. Fixes . (). Backported in : Fix system tables recreation check (fails to detect changes in enum values). (). Backported in : Fix possible data-race between `FileChecker` and `StorageLog`/`StorageStripeLog`. (). Backported in : Fix crash of sample by `tuple()`, closes . (). Backported in : Dropped `Memory` database might reappear after server restart, it's fixed (). Also added `forceremovedatarecursivelyon_drop` setting as a workaround for `Directory not empty` error when dropping `Ordinary` database (because it's not possible to remove data leftovers manually in cloud environment). (). Backported in : FlatDictionary, HashedDictionary fix bytes_allocated calculation for nullable attributes. (). Avoid deadlocks when reading and writting on JOIN Engine tables at the same time. (). Maybe fix livelock in ZooKeeper client (). May be fix s3 tests (). Update BoringSSL ().
Project: Monokle (App Definition and Development / Application Definition & Image Build)
File: README.md

Simple aks-helloworld chart. Add the Azure Samples chart repository. ``` helm repo add azure-samples https://azure-samples.github.io/helm-charts/ ``` Install the chart. ``` helm install azure-samples/aks-helloworld ``` The following tables lists the configurable parameters of the azure-vote chart and the default values. | Parameter | Description | Default | |||| | title | Title for hello world app. | Azure Vote App | | serviceName | Name for Kubernetes service. | aks-helloworld | | serviceType | Type for Kubernetes service. | ClusterIP |
Project: ShardingSphere (App Definition and Development / Database)
File: show-status-from-readwrite-splitting-rule.en.md

+++ title = "SHOW STATUS FROM READWRITE_SPLITTING RULE" weight = 2 +++ The `SHOW STATUS FROM READWRITE_SPLITTING RULE` syntax is used to query readwrite-splitting storage unit status for specified readwrite-splitting rule in specified database. {{< tabs >}} {{% tab name="Grammar" %}} ```sql ShowStatusFromReadwriteSplittingRule ::= 'SHOW' 'STATUS' 'FROM' 'READWRITE_SPLITTING' ('RULES' | 'RULE' groupName) ('FROM' databaseName)? groupName ::= identifier databaseName ::= identifier ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} When `databaseName` is not specified, the default is the currently used `DATABASE`. If `DATABASE` is not used, `No database selected` will be prompted. | Columns | Description | |-|| | storage_unit | storage unit name | | status | storage unit status | Query readwrite-splitting storage unit status for specified readwrite-splitting rule in specified database. ```sql SHOW STATUS FROM READWRITESPLITTING RULE msgroup0 FROM shardingdb; ``` ```sql mysql> SHOW STATUS FROM READWRITESPLITTING RULE msgroup0 FROM shardingdb; +--+-+ | storage_unit | status | +--+-+ | ds_0 | disabled | +--+-+ 1 rows in set (0.01 sec) ``` Query all readwrite-splitting storage unit from specified database ```sql SHOW STATUS FROM READWRITESPLITTING RULES FROM shardingdb; ``` ```sql mysql> SHOW STATUS FROM READWRITESPLITTING RULES FROM shardingdb; +--+-+ | storage_unit | status | +--+-+ | ds_0 | disabled | +--+-+ 1 rows in set (0.01 sec) ``` Query readwrite-splitting storage unit status for specified readwrite-splitting rule in current database ```sql SHOW STATUS FROM READWRITESPLITTING RULE msgroup_0; ``` ```sql mysql> SHOW STATUS FROM READWRITESPLITTING RULE msgroup_0; +--+-+ | storage_unit | status | +--+-+ | ds_0 | disabled | +--+-+ 1 rows in set (0.01 sec) ``` Query all readwrite-splitting storage unit from current database ```sql mysql> SHOW STATUS FROM READWRITE_SPLITTING RULES; ``` ```sql mysql> SHOW STATUS FROM READWRITE_SPLITTING RULES; +--+-+ | storage_unit | status | +--+-+ | ds_0 | disabled | +--+-+ 1 rows in set (0.01 sec) ``` `SHOW`, `STATUS`, `FROM`, `READWRITE_SPLITTING`, `RULE`, `RULES`
Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_subnets.md

+++ title = "azurerm_subnets resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurerm_subnets" identifier = "inspec/resources/azure/azurermsubnets.md azurermsubnets resource" parent = "inspec/resources/azure" +++ {{< inspec/azurermdeprecated resource="azuresubnet" >}} Use the `azurerm_subnets` InSpec audit resource to test properties related to subnets for a resource group. This resource interacts with version `2018-02-01` of the Azure Management API. For more information see the . At the moment, there doesn't appear to be a way to select the version of the Azure API docs. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: name: inspec-azure git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . This resource first became available in 1.2.0 of the inspec-azure resource pack. The `resource_group` and 'vnet' must be given as a parameter. describe azurermsubnets(resourcegroup: 'MyResourceGroup', vnet: 'MyVnetName') do ... end describe azurermsubnets(resourcegroup: 'MyResourceGroup', vnet: 'MyVnetName') do it { should exist } end `resource_group` 'vnet' Defines the resource group of the subnet that you wish to test resides in. describe azurermsubnets(resourcegroup: 'MyResourceGroup', vnet: 'MyVnetName') do ... end Defines the virtual network that the subnet that you wish to test is a part of. describe azurermsubnets(resourcegroup: 'MyResourceGroup', vnet: 'MyVnetName') do ... end Filters the results to only those that match the given name. describe azurermsubnets(resourcegroup: 'MyResourceGroup', vnet: 'MyVnetName') do .where(name: 'MySubnet') do it { should exist } end `names` Gives a list of all the subnet names in the virtual network. its('names') { should include('SubnetName1', 'SubnetName2') } {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. describe azurermsubnets(resourcegroup: 'MyResourceGroup', vnet: 'MyVnetName') do it { should_not exist } end Your [Service Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal) must be setup with a `contributor` role on the subscription you wish to test.