cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 3deec14b-03d2-4d27-9670-7d79322e3340.md

title: CodeBuild Project Encrypted With AWS Managed Key hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3deec14b-03d2-4d27-9670-7d79322e3340 Query name: CodeBuild Project Encrypted With AWS Managed Key Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Encryption URL: CodeBuild Project should be encrypted with customer-managed KMS keys instead of AWS managed keys<br> ```tf title="Positive test num. 1 - tf file" hl_lines="35" provider "aws" { region = "us-east-1" } data "awskmskey" "by_alias" { key_id = "alias/aws/s3" } resource "awsiamrole" "codebuild" { name = "codebuild-cloudrail-test" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } EOF } resource "awscodebuildproject" "project-cloudrail-test" { name = "project-cloudrail-test" description = "project-cloudrail-test" build_timeout = "5" queued_timeout = "5" servicerole = awsiam_role.codebuild.arn encryptionkey = data.awskmskey.byalias.arn artifacts { type = "NO_ARTIFACTS" } cache { type = "LOCAL" modes = ["LOCALDOCKERLAYERCACHE", "LOCALSOURCE_CACHE"] } environment { computetype = "BUILDGENERAL1_SMALL" image = "aws/codebuild/standard:1.0" type = "LINUX_CONTAINER" imagepullcredentials_type = "CODEBUILD" environment_variable { name = "SOME_KEY1" value = "SOME_VALUE1" } } source { type = "GITHUB" location = "https://github.com/foo/bar.git" gitclonedepth = 1 } } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } data "awskmskey" "by_alias2" { key_id = "alias/myAlias" } resource "awsiamrole" "codebuild2" { name = "codebuild-cloudrail-test" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } EOF } resource "awscodebuildproject" "project-cloudrail-test2" { name = "project-cloudrail-test" description = "project-cloudrail-test" build_timeout = "5" queued_timeout = "5" servicerole = awsiam_role.codebuild2.arn encryptionkey = data.awskmskey.byalias2.arn artifacts { type = "NO_ARTIFACTS" } cache { type = "LOCAL" modes = ["LOCALDOCKERLAYERCACHE", "LOCALSOURCE_CACHE"] } environment { computetype = "BUILDGENERAL1_SMALL" image = "aws/codebuild/standard:1.0" type = "LINUX_CONTAINER" imagepullcredentials_type = "CODEBUILD" environment_variable { name = "SOME_KEY1" value = "SOME_VALUE1" } } source { type = "GITHUB" location = "https://github.com/foo/bar.git" gitclonedepth = 1 } } ```
Project: KICS (Provisioning / Security & Compliance)
File: ce089fd4-1406-47bd-8aad-c259772bb294.md

title: DynamoDB Table Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ce089fd4-1406-47bd-8aad-c259772bb294 Query name: DynamoDB Table Not Encrypted Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: AWS DynamoDB Tables should have server-side encryption<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 30" resource "awsdynamodbtable" "example" { name = "example" hash_key = "TestTableHashKey" billingmode = "PAYPER_REQUEST" stream_enabled = true streamviewtype = "NEWANDOLD_IMAGES" attribute { name = "TestTableHashKey" type = "S" } replica { region_name = "us-east-2" } replica { region_name = "us-west-2" } } resource "awsdynamodbtable" "example_2" { name = "example" hash_key = "TestTableHashKey" billingmode = "PAYPER_REQUEST" stream_enabled = true streamviewtype = "NEWANDOLD_IMAGES" serversideencryption { enabled = false } attribute { name = "TestTableHashKey" type = "S" } replica { region_name = "us-east-2" } replica { region_name = "us-west-2" } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsdynamodbtable" "example" { name = "example" hash_key = "TestTableHashKey" billingmode = "PAYPER_REQUEST" stream_enabled = true streamviewtype = "NEWANDOLD_IMAGES" serversideencryption { enabled = true } attribute { name = "TestTableHashKey" type = "S" } replica { region_name = "us-east-2" } replica { region_name = "us-west-2" } } ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: virtualization.md

+++ title = "virtualization resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "virtualization" identifier = "inspec/resources/os/virtualization.md virtualization resource" parent = "inspec/resources/os" +++ Use the `virtualization` Chef InSpec audit resource to test the virtualization platform on which the system is running. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.28.0 of InSpec. An `virtualization` resource block declares the virtualization platform that should be tested: describe virtualization do its('system') { should MATCHER 'value' } end where `('system')` is the name of the system information of the virtualization platform (e.g. docker, lxc, vbox, kvm, etc) `MATCHER` is a valid matcher for this resource `'value'` is the value to be tested The following examples show how to use this Chef InSpec audit resource. describe virtualization do its('system') { should eq 'docker' } end describe virtualization do its('system') { should eq 'vbox' } its('role') { should eq 'guest' } end if virtualization.system == 'vbox' describe package('name') do it { should be_installed } end end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. This helper returns, if any of the supported virtualization platforms was detected and the machine under test is a guest. You can use this in a `onlyif { virtualsystem? }` clause to execute test only on virtualized systems. If no virtualization platform is detected, this will return `true`. For unsupported virtualization platforms this can result in false positives. The resource supports the following virtualization platforms: On Linux machines: `docker` (`guest` role only) `hyper-v` (`guest` role only) `kvm` `linux vserver` `lxc` / `lxd` `openstack` (`host` role only) `openvz` `parallels` (`guest` role only) `virtualbox` `vmware` (`guest` role only) `xen` On Windows machines (`guest` role only) `hyper-v` `kvm` `vmware` `virtualbox` `xen` Can be either `guest` `host` Please see the documentation on `virtualization.system` to check supported roles per platform.
Project: KICS (Provisioning / Security & Compliance)
File: 62c8cf50-87f0-4295-a974-8184ed78fe02.md

title: GKE Master Authorized Networks Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 62c8cf50-87f0-4295-a974-8184ed78fe02 Query name: GKE Master Authorized Networks Disabled Platform: GoogleDeploymentManager Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Master authorized networks must be enabled in GKE clusters<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4" resources: name: my-cluster type: container.v1.cluster properties: description: cluster ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="7" resources: name: my-cluster type: container.v1.cluster properties: description: cluster masterAuthorizedNetworksConfig: enabled: false ``` ```yaml title="Negative test num. 1 - yaml file" resources: name: my-cluster type: container.v1.cluster properties: description: cluster masterAuthorizedNetworksConfig: enabled: true ```
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-route53resolver-controller.md

layout: integration title: AWS Route 53 Resolver subtitle: Collaborative and visual infrastructure as code for AWS Route 53 Resolver image: /assets/img/integrations/aws-route53resolver-controller/icons/color/aws-route53resolver-controller-color.svg permalink: extensibility/integrations/aws-route53resolver-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-route53resolver-controller description: integrations-category: Cloud Native Network integrations-subcategory: Networking Content Delivery registrant: GitHub components: name: field-export colorIcon: assets/img/integrations/aws-route53resolver-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-route53resolver-controller/components/field-export/icons/white/field-export-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-route53resolver-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-route53resolver-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: resolver-endpoint colorIcon: assets/img/integrations/aws-route53resolver-controller/components/resolver-endpoint/icons/color/resolver-endpoint-color.svg whiteIcon: assets/img/integrations/aws-route53resolver-controller/components/resolver-endpoint/icons/white/resolver-endpoint-white.svg description: name: resolver-rule colorIcon: assets/img/integrations/aws-route53resolver-controller/components/resolver-rule/icons/color/resolver-rule-color.svg whiteIcon: assets/img/integrations/aws-route53resolver-controller/components/resolver-rule/icons/white/resolver-rule-white.svg description: featureList: [ "Local VPC domain names for EC2 instances (for example, ec2-192-0-2-44.compute-1.amazonaws.com). ", "Records in private hosted zones (for example, acme.example.com). ", "For public domain names, Route 53 Resolver performs recursive lookups against public name servers on the internet. " ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: KICS (Provisioning / Security & Compliance)
File: 4bd15dd9-8d5e-4008-8532-27eb0c3706d3.md

title: Redis Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4bd15dd9-8d5e-4008-8532-27eb0c3706d3 Query name: Redis Disabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: ElastiCache should have Redis enabled, since it covers Compliance Certifications such as FedRAMP, HIPAA, and PCI DSS. For more information, take a look at 'https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/SelectEngine.html'<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4" resource "awselasticachecluster" "positive1" { cluster_id = "cluster-example" engine = "memcached" node_type = "cache.m4.large" numcachenodes = 1 engine_version = "3.2.10" port = 6379 } ``` ```tf title="Negative test num. 1 - tf file" resource "awselasticachecluster" "negative1" { cluster_id = "cluster-example" engine = "redis" node_type = "cache.m4.large" numcachenodes = 2 port = 11211 } ```
Project: YugabyteDB (App Definition and Development / Database)
File: client-to-server.md

title: Enable client-to-server encryption headerTitle: Enable client-to-server encryption linkTitle: Enable client-to-server encryption description: Enable client-to-server encryption (using TLS) for YSQL and YCQL. headcontent: Enable client-to-server encryption (using TLS) for YSQL and YCQL. menu: v2.18: identifier: client-to-server parent: tls-encryption weight: 30 type: docs YugabyteDB clusters can be configured to use client-to-server encryption to protect data in transit between YugabyteDB servers and clients, tools, and APIs. When enabled, , the successor to the deprecated Secure Sockets Layer (SSL), is used to ensure data protection for YSQL and YCQL only. Note that there is no planned support for YEDIS. Before you can enable client-to-server encryption, you first must . To enable client-to-server encryption for YSQL and YCQL, start your YB-TServer services with the required flags described below. Your YB-Master services do not require additional configuration. Configuration flag | Process | Description | -||| | YB-TServer | Set to `true` to enable encryption between the various YugabyteDB clients and the database cluster. Default value is `false`. | | YB-TServer | Set to `false` to disallow any client with unencrypted communication from joining this cluster. Default value is `true`. Note that this flag requires `--useclienttoserverencryption` to be enabled. | | YB-TServer | Optional. Defaults to the same directory as the server-to-server encryption. This directory should contain the configuration for the client to perform TLS communication with the cluster. Default value for YB-TServer is `<data drive>/yb-data/tserver/data/certs` | To enable access control, follow these steps, start the `yb-tserver` services with the following flag (described above): ```output --useclienttoserverencryption=true ``` This flag enables both encrypted and unencrypted clients to connect to the cluster. To prevent clients without the appropriate encryption from connecting, you must add the following flag: ```output --allowinsecureconnections=false ``` Your command should look similar to this: ```output bin/yb-tserver \ --fsdatadirs=<data directories> \ --tservermasteraddrs=<master addresses> \ --certsforclientdir /home/centos/tls/$NODEIP \ --allowinsecureconnections=false \ --useclienttoserverencryption=true & ``` For details about starting YB-TServer nodes in manual deployments, see .
Project: Scylla (App Definition and Development / Database)
File: lua-type-mapping.md

This document describes how CQL types are mapped to and from Lua in UDF. When converting to Lua, these types are mapped to Lua strings. When converting to CQL, types that Lua coerces to string are accepted. The values are verified to be valid ASCII or UTF8 as appropriate. Lua strings can hold arbitrary data, so blobs are converted to and from Lua strings. Lua 5.3 has native support for 64 bit integers, so all these types are converted to a native integer. When converting to CQL, types that Lua coerces to integers are supported. If the value is too large for the CQL type, it wraps. This maps exactly to and from a Lua boolean. Since UDF are pure functions, a counter is mapped to and from a native integer. When converting to Lua, these are mapped o Lua's native double. When converting to CQL, a number is rounded to a float or double value as appropriate. For example, it is valid to return a integer that is too large to have an exact representation as a double. These are mapped to a userdata since there is no native support for large numbers is Lua. We try to provide type coercions similar to those Lua has. For example, a UDF returning the CQL type bigint, can return the value 42 with Lua code that returns The integer 42 The double 42 The string "42" The varint 42 The decimal 42 When converting to Lua, a date is mapped to the number of days since epoch + 2^31. When converting to CQL, we support: integer (number of days since epoch + 2^31). CQL date literal in a string. A lua "date table", but with only year, month and day When converting to Lua we produce the table { months = v1, days = v2, nanoseconds = v3 }. When converting to CQL we support a table in the same format or a CQL duration literal in a string. This is converted to and from a string ("127.0.0.1" or "::1"). When converting to Lua we pass an integer with the number of seconds since midnight. When converting to CQL we support an integer with the same meaning or a CQL time literal in a string. When converting to Lua we pass an integer with the number of milliseconds since the epoch. When converting to CQL we support integers with the same meaning or CQL timestamp literal in a string. These are converted to and from the string representation. A list is represented as a sequence in lua. A list with "foo" and "bar" is represented as {"foo", "bar"}. It is an error to return a table that is not a sequence. A tuple is represented the same way as a list, but on return we check the number of elements and the types. These are converted to and from lua tables. A map from "foo" to 42 is represented as {foo = 42}. A UDT is represented by a table like a map, but on return we check that: There are no unexpected keys All expected keys are present The fields have valid types A set is represented in lua by the keys of a table. A set with 1, 2 and 3 is represented by as {[1] = true, [2] = true, [3] = true}. On return the values are checked to be true. Note that, like every other Lua table, the set is underscored. It is sorted when converting back to CQL.
Project: Tremor (App Definition and Development / Streaming & Messaging)
File: intrinsic.md

The `intrinsic` rule defines intrinsic function signatures. This rule allows tremor maintainers to document the builtin functions implemented as native rust code. The facility also allows document generation tools to document builtin intrinsic functions in the same way as user defined functions. In short, these can be thought of as runtime provided. For information on how to define user defined functions see the rule.
Project: Harbor (Provisioning / Container Registry)
File: 10-05-Schedule-daily-scan.md

Test 10-05 Schedule daily scan ======= To verify daily scan work correctly User guide This test requires that a Harbor instance is running and available. Harbor is installed with trivy enable. A linux host with Docker CLI installed. Trivy has been updated to the latest. Login Harbor as admin. Create at least 3 projects. Push at least 2 images to each project. Schedule a daily scan that time is before current time. Wait one day. Check the timestamp of scan. Schedule a daily scan that time is after current time. Wait until time is after the scheduled time. Check the timestamp of scan. Step6 the timestamp should be the same as scheduled. Step9 the timestamp should be the same as scheduled. None
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-kinesis-controller.md

layout: integration title: AWS Kinesis subtitle: Collaborative and visual infrastructure as code for AWS Kinesis image: /assets/img/integrations/aws-kinesis-controller/icons/color/aws-kinesis-controller-color.svg permalink: extensibility/integrations/aws-kinesis-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-kinesis-controller description: integrations-category: App Definition and Development integrations-subcategory: Streaming & Messaging registrant: GitHub components: name: field-export colorIcon: assets/img/integrations/aws-kinesis-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-kinesis-controller/components/field-export/icons/white/field-export-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-kinesis-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-kinesis-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: stream colorIcon: assets/img/integrations/aws-kinesis-controller/components/stream/icons/color/stream-color.svg whiteIcon: assets/img/integrations/aws-kinesis-controller/components/stream/icons/white/stream-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: KubeArmor (Provisioning / Security & Compliance)
File: disc-tools.md

```sh kubectl exec -it dvwa-web-566855bc5b-xtgwq -- bash root@dvwa-web-566855bc5b-xtgwq:/var/www/html# netstat bash: /bin/netstat: Permission denied root@dvwa-web-566855bc5b-xtgwq:/var/www/html# ifconfig bash: /sbin/ifconfig: Permission denied root@dvwa-web-566855bc5b-xtgwq:/var/www/html# root@dvwa-web-566855bc5b-xtgwq:/var/www/html# arp bash: /usr/sbin/arp: Permission denied ``` ``` { "Action": "Block", "ClusterName": "no-trust", "ContainerID": "e8ac2e227d293e76ab81a34945b68f72a2618ed3275ac64bb6a82f9cd2d014f1", "ContainerImage": "docker.io/cytopia/dvwa:php-8.1@sha256:f7a9d03b1dfcec55757cc39ca2470bdec1618b11c4a51052bb4f5f5e7d78ca39", "ContainerName": "dvwa", "Data": "syscall=SYS_EXECVE", "Enforcer": "AppArmor", "HostName": "aditya", "HostPID": 35592, "HostPPID": 35557, "Labels": "tier=frontend,app=dvwa-web", "Message": "Network service has been scanned!", "NamespaceName": "default", "Operation": "Process", "Owner": { "Name": "dvwa-web", "Namespace": "default", "Ref": "Deployment" }, "PID": 989, "PPID": 983, "ParentProcessName": "/bin/bash", "PodName": "dvwa-web-566855bc5b-npjn8", "PolicyName": "harden-dvwa-web-network-service-scanning", "ProcessName": "/bin/netstat", "Resource": "/bin/netstat", "Result": "Permission denied", "Severity": "5", "Source": "/bin/bash", "Tags": "MITRE,FGT1046,CIS", "Timestamp": 1696501152, "Type": "MatchedPolicy", "UpdatedTime": "2023-10-05T10:19:12.809606Z", "cluster_id": "4225", "component_name": "kubearmor", "instanceGroup": "0", "instanceID": "0", "tenant_id": "167", "workload": "1" } ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.9.11.md

RabbitMQ `3.9.11` is a maintenance release in the `3.9.x` release series. Please refer to the Upgrading to 3.9 section from if upgrading from a version prior to 3.9.0. This release requires at least Erlang 23.2, and supports Erlang 24. has more details on Erlang version requirements for RabbitMQ. Release notes are kept under . Contributors are encouraged to update them together with their changes. This helps with release automation and a more consistent release schedule. When a TLS-enabled listener failed to stop, it logged all of its settings which could contain sensitive values. GitHub issue: Quorum queues now store commands for enqueued messages in a more compact format on disk (some derivative data has been dropped). GitHub issue: `queue.declare-ok` response to AMQP 0-9-1 clients operating on a stream could return a ready-for-delivery message count value that was out of sync with the stream leader replica. GitHub issue: Classic queues now deliver more efficiently on channels that had global QoS changed during consumer operation. Contributed by @tomyouyou. GitHub issue: New optional metrics provided by the `GET /metrics/detailed` endpoint. These metrics are cluster-wide*, and therefore must not be aggregated. GitHub issue: A help tip on the policies page was misplaced. Contributed by @johanrhodin GitHub issue: Disabling the plugin will stop metric collection performed periodically by queues, streams, connections, et cetera. Contributed by @tomyouyou. GitHub issue: None in this release. To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.9.11.tar.xz` instead of the source tarball produced by GitHub.