cwielenb/CNCF-Dataset huggingface dataset:
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_bench_pgbench_cleanup.md

title: kbcli bench pgbench cleanup Cleanup pgbench test data for a PostgreSQL cluster ``` kbcli bench pgbench cleanup [flags] ``` ``` kbcli bench pgbench cleanup pgcluster --database postgres --user xxx --password xxx ``` ``` -h, --help help for cleanup ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --database string database name --disable-compression If true, opt-out of response compression for all requests to the server --host string the host of database --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string the password of database --port int the port of database --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string the user of database ``` - Run pgbench against a PostgreSQL cluster
Project: KICS (Provisioning / Security & Compliance)
File: 8833f180-96f1-46f4-9147-849aafa56029.md

title: EC2 Instance Using Default VPC hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8833f180-96f1-46f4-9147-849aafa56029 Query name: EC2 Instance Using Default VPC Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: EC2 Instances should not be configured under a default VPC network<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" name: example amazon.aws.ec2: key_name: mykey instance_type: t2.micro image: ami-123456 wait: yes count: 3 vpcsubnetid: "{{ my_subnet.subnet.id }}" assignpublicip: yes name: Create subnet for database server amazon.aws.ec2vpcsubnet: state: present vpc_id: "{{ defaultVPC.vpcs.0.id }}" cidr: 10.0.1.16/28 tags: Name: Database Subnet register: my_subnet ``` ```yaml title="Negative test num. 1 - yaml file" name: example2 amazon.aws.ec2: key_name: mykey instance_type: t2.micro image: ami-123456 wait: yes count: 3 vpcsubnetid: "{{ my_subnet2.subnet.id }}" assignpublicip: yes name: Create subnet for database server2 amazon.aws.ec2vpcsubnet: state: present vpc_id: "{{ myVPC.vpcs.0.id }}" cidr: 10.0.1.16/28 tags: Name: Database Subnet register: my_subnet2 ```
Project: StarRocks (App Definition and Development / Database)
File: curtime.md

displayed_sidebar: "English" Obtains the current time and returns a value of the TIME type. This function may return different results for different time zones. For more information, see . ```Haskell TIME CURTIME() ``` ```Plain Text MySQL > select current_time(); +-+ | current_time() | +-+ | 15:25:47 | +-+ ``` CURTIME,CURRENT_TIME
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: graphene-graphql.md

title: Custom Application with Field-level Authorization in Graphene GraphQL labels: layer: network category: application software: graphene-graphql code: https://github.com/dolevf/graphql-open-policy-agent This integration demonstrates using Open Policy Agent to perform field-level Authorization with GraphQL for a custom Python application backed by Graphene.
Project: StarRocks (App Definition and Development / Database)
File: Load_balance.md

displayed_sidebar: "English" When deploying multiple FE nodes, users can deploy a load balancing layer on top of the FEs to achieve high availability. The following are some high availability options: One way is to implement code at the application layer to perform retry and load balancing . For example, if a connection is broken, it will automatically retry on other connections. This approach requires users to configure multiple FE node addresses. JDBC connector supports automatic retry: ~~~sql jdbc:mysql:loadbalance://,]......] ~~~ ProxySQL is a MySQL proxy layer that supports read/write separation, query routing, SQL caching, dynamic load configuration, failover, and SQL filtering. StarRocks FE is responsible for receiving connection and query requests, and its horizontally scalable and highly available. However FE requires users to set up a proxy layer on top of it to achieve automatic load balancing. See the following steps for setup: ~~~shell yum install -y gnutls perl-DBD-MySQL perl-DBI perl-devel ~~~ ~~~shell wget https://github.com/sysown/proxysql/releases/download/v2.0.14/proxysql-2.0.14-1-centos7.x86_64.rpm ~~~ ~~~shell rpm2cpio proxysql-2.0.14-1-centos7.x86_64.rpm | cpio -ivdm ~~~ ~~~shell vim ./etc/proxysql.cnf ~~~ Direct to a directory that the user has privilege to access (absolute path): ~~~vim datadir="/var/lib/proxysql" errorlog="/var/lib/proxysql/proxysql.log" ~~~ ~~~shell ./usr/bin/proxysql -c ./etc/proxysql.cnf --no-monitor ~~~ ~~~shell mysql -u admin -padmin -h 127.0.0.1 -P6032 ~~~ ~~~shell SET mysql-eventslogfilename='proxysqlqueries.log'; SET mysql-eventslogdefaultlog=1; SET mysql-eventslog_format=2; LOAD MYSQL VARIABLES TO RUNTIME; SAVE MYSQL VARIABLES TO DISK; ~~~ ~~~sql insert into mysqlservers(hostgroupid, hostname, port) values(1, '172.26.92.139', 8533); ~~~ ~~~sql insert into mysqlservers(hostgroupid, hostname, port) values(2, '172.26.34.139', 9931); insert into mysqlservers(hostgroupid, hostname, port) values(2, '172.26.34.140', 9931); ~~~ ~~~sql load mysql servers to runtime; save mysql servers to disk; ~~~ ~~~sql insert into mysqlusers(username, password, active, defaulthostgroup, backend, frontend) values('root', '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29', 1, 1, 1, 1); ~~~ ~~~sql load mysql users to runtime; save mysql users to disk; ~~~ ~~~sql insert into mysqlqueryrules(ruleid, active, matchdigest, destinationhostgroup, mirrorhostgroup, apply) values(1, 1, '.', 1, 2, 1); ~~~ ~~~sql load mysql query rules to runtime; save mysql query rules to disk; ~~~
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: cpu-quota.md

Limit the CPU Completely Fair Scheduler (CFS) quota. Limit the container's CPU usage. By default, containers run with the full CPU resource. The limit is a number in microseconds. If a number is provided, the container is allowed to use that much CPU time until the CPU period ends (controllable via --cpu-period). On some systems, changing the resource limits may not be allowed for non-root users. For more details, see https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error This option is not supported on cgroups V1 rootless systems.
Project: KICS (Provisioning / Security & Compliance)
File: b2fbf1df-76dd-4d78-a6c0-e538f4a9b016.md

title: SSH Access Is Not Restricted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b2fbf1df-76dd-4d78-a6c0-e538f4a9b016 Query name: SSH Access Is Not Restricted Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Google Firewall should not allow SSH access (port 22) from the Internet (public CIDR block) to ensure the principle of least privileges<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" name: ssh_unrestricted google.cloud.gcpcomputefirewall: name: test_object allowed: ip_protocol: tcp ports: '22' target_tags: test-ssh-server staging-ssh-server source_tags: test-ssh-clients project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present source_ranges: "0.0.0.0/0" ``` ```yaml title="Negative test num. 1 - yaml file" name: ssh_restricted google.cloud.gcpcomputefirewall: name: test_object denied: ip_protocol: tcp ports: '22' target_tags: test-ssh-server staging-ssh-server source_tags: test-ssh-clients project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present source_ranges: 0.0.0.0 ```
Project: Trivy (Provisioning / Security & Compliance)
File: azure-arm.md

Trivy supports the scanners listed in the table below. | Scanner | Supported | | :-: | :-: | | [Misconfiguration] | | | [Secret] | | It supports the following configurations: | Format | Supported | | :-: | :-: | | ARM template | | | Bicep | [^1] | To scan Bicep codes, you need to convert them into ARM templates first. ``` az bicep build -f main.bicep or bicep build main.bicep ``` Trivy recursively searches directories and scans all found Azure ARM templates. The secret scan is performed on plain text files, with no special treatment for Azure ARM templates.
Project: KICS (Provisioning / Security & Compliance)
File: af173fde-95ea-4584-b904-bb3923ac4bda.md

title: Redshift Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: af173fde-95ea-4584-b904-bb3923ac4bda Query name: Redshift Publicly Accessible Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: AWS Redshift Clusters must not be publicly accessible. Check if 'publicly_accessible' field is true or undefined (default is true)<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 17" resource "awsredshiftcluster" "positive1" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" } resource "awsredshiftcluster" "positive2" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" publicly_accessible = true } ``` ```tf title="Negative test num. 1 - tf file" resource "awsredshiftcluster" "negative1" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" publicly_accessible = false } ```
Project: Checkov (Provisioning / Security & Compliance)
File: Terms and Concepts.md

layout: default published: true title: Terms and Concepts nav_order: 2 Policy: Security policies define various aspects of your cloud configuration that impact the overall security of the environment. For example, multi-factor authentication should be enabled for the root account. A resource that is not in the state defined in a policy is non-compliant and will appear in scan results. Composite Policy: A composite, or connection-state is one in which Checkov looks for resources, or types of resources that are or are not connected to other resources. For example, it may be essential for certain resource types to be connected to security groups; or it may be important that certain resource types are not connected to other resources with public access. On each scan, Checkov creates a virtual connection graph based on Composite Policies. Learn more about . Incident: Upon each scan, Checkov creates Incidents for each case of non-conformance to a Policy. Resource: A Resource is a Cloud Platform entity, for example, an Amazon EC2 instance, a CloudFormation stack, or an Amazon S3 bucket. Suppression: This is an action that can be taken to indicate that an Incident reported by Checkov is not problematic. When Suppressing an Incident, you can Suppress it for all relevant Resources or only specific Resources. Infrastructure as code frameworks are systems for automating infrastructure deployment, scaling and management using machine-readable configuration files. Declarative configurations are absolute methods to design the execution of well-defined infrastructure building blocks. Imperative configurations are procedural methods to design the steps required to build a required end-result. Immutable infrastructure defines a version-controlled data model that enables reproducing point-in-time changes to individual attributes of a configuration manifest. Terraform is a popular open source declarative infrastructure as code framework used primarily to define resource in public cloud services. CloudFormation is a declarative infrastructure as code framework used to define resources in Amazon Web Services. Kubernetes is a popular open source declarative infrastructure as code framework used primarily to orchestrate containers in a virtual computing environment.
Project: YDB (App Definition and Development / Database)
File: s_expressions.md

For the full list of internal YQL functions, see the , an alternative low-level YQL syntax. Any of the functions listed there can also be called from the SQL syntax by adding the `YQL::` prefix to its name. However, we don't recommend doing this, because this mechanism is primarily intended to temporarily bypass possible issues and for internal testing purposes. If the function is available in SQL syntax without the `YQL::` prefix, then its behavior may differ from the same-name function from the s-expressions documentation, if any.
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: v5.3.2.en.md

Introduced the LDAP as a new authentication and authorization backend. Changed default RPC driver from `gen_rpc` to `rpc` for core-replica database synchronization. This improves core-replica data replication latency. Allowed users with the "Viewer" role to change their own passwords. However, those with the "Viewer" role do not have permission to change the passwords of other users. Improved the performance of the `emqx` command. Added validation to Redis commands in Redis authorization source. Additionally, this improvement refines the parsing of Redis commands during authentication and authorization processes. The parsing now aligns with `redis-cli` compatibility standards and supports quoted arguments. Fixed the error response code when downloading non-existent trace files. Now the response returns `404` instead of `500`. Fixed an issue in EMQX's `builtindatabase` authorization source. With this update, all Access Control List (ACL) records are completely removed when an authorization source is deleted. This resolves the issue of residual records remaining in the database when re-creating authorization sources. Fixed validation of Bcrypt salt rounds in authentication management through the API/Dashboard. Fixed validation of the `iterations` field of the `pbkdf2` password hashing algorithm. Now, `iterations` must be strictly positive. Previously, it could be set to 0, which led to a nonfunctional authenticator. Fixed an issue in the EMQX CoAP Gateway where heartbeats were not effectively maintaining the connection's active status. This fix ensures that the heartbeat mechanism properly sustains the liveliness of CoAP Gateway connections. Modified HTTP API behavior for APIs managing the `builtindatabase` authorization source. They will now return a `404` status code if `builtindatabase` is not set as the authorization source, replacing the former `20X` response. Improved the termination of EMQX services to ensure a graceful stop even in the presence of an unavailable MongoDB resource. This fix addresses an issue where redundant error logs were generated due to a race condition during simultaneous socket closure by a peer and the server. Previously, concurrent socket close events triggered by the operating system and EMQX resulted in unnecessary error logging. The implemented fix improves event handling to eliminate unnecessary error messages. Fixed a bug where attempting to set the `active_n` option on a TCP/SSL socket could lead to a connection crash. The problem occurred if the socket had already been closed by the time the connection process attempted to apply the `activen` setting, resulting in a `caseclause` crash.
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: create-user.md

Add user via Lagoon CLI: ```bash title="Add user" lagoon add user --email user@example.com --firstName MyFirstName --lastName MyLastName ``` Go to your email and click the password reset link in the email. Follow the instructions and log in to Lagoon UI with created password. Add the SSH public key of the user via Settings.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: mozilla.md

title: "The Nitty-Gritty of Moving Data with Beam" icon: /images/logos/powered-by/mozilla.png hasNav: true cardDescription: "Mozilla is the non-profit Firefox browser. This use case focuses on complexity that comes from moving data from one system to another safely, modeling data as it passes from one transform to another, handling errors, testing the system, and organizing the code to make the pipeline configurable for different source and destination systems in their open source codebase for ingesting telemetry data from Firefox clients" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <div> <header class="case-study-header"> <h2 itemprop="name headline">The Nitty-Gritty of Moving Data with Beam</h2> </header> Mozilla is the non-profit Firefox browser. This use case focuses on complexity that comes from moving data from one system to another safely, modeling data as it passes from one transform to another, handling errors, testing the system, and organizing the code to make the pipeline configurable for different source and destination systems in their open source codebase for ingesting telemetry data from Firefox clients. </div>
Project: CloudEvents (App Definition and Development / Streaming & Messaging)
File: aws-sns.md

This document describes how to convert into CloudEvents. Amazon SNS MAY send a subscription confirmation, notification, or unsubscribe confirmation message to your HTTP/HTTPS endpoints. Each section below describes how to determine the CloudEvents attributes based on the specified type of SNS messages. | CloudEvents Attribute | Value | | :-- | :- | | `id` | "x-amz-sns-message-id" value | | `source` | "x-amz-sns-topic-arn" value | | `specversion` | `1.0` | | `type` | `com.amazonaws.sns.` + "x-amz-sns-message-type" value | | `datacontenttype` | `application/json` | | `dataschema` | Omit | | `subject` | Omit | | `time` | "Timestamp" value | | `data` | HTTP payload | | CloudEvents Attribute | Value | | :-- | :- | | `id` | "x-amz-sns-message-id" value | | `source` | "x-amz-sns-subscription-arn" value | | `specversion` | `1.0` | | `type` | `com.amazonaws.sns.` + "x-amz-sns-message-type" value | | `datacontenttype` | `application/json` | | `dataschema` | Omit | | `subject` | "Subject" value (if present) | | `time` | "Timestamp" value | | `data` | HTTP payload | | CloudEvents Attribute | Value | | :-- | :- | | `id` | "x-amz-sns-message-id" value | | `source` | "x-amz-sns-subscription-arn" value | | `specversion` | `1.0` | | `type` | `com.amazonaws.sns.` + "x-amz-sns-message-type" value | | `datacontenttype` | `application/json` | | `dataschema` | Omit | | `subject` | Omit | | `time` | "Timestamp" value | | `data` | HTTP payload |
Project: Databend (App Definition and Development / Database)
File: PULL_REQUEST_TEMPLATE.md

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/ Briefly describe what this PR aims to solve. Include background context that will help reviewers understand the purpose of the PR. Fixes #[Link the issue here] [ ] Unit Test [ ] Logic Test [ ] Benchmark Test [ ] No Test - Explain why [ ] Bug Fix (non-breaking change which fixes an issue) [ ] New Feature (non-breaking change which adds functionality) [ ] Breaking Change (fix or feature that could cause existing functionality not to work as expected) [ ] Documentation Update [ ] Refactoring [ ] Performance Improvement [ ] Other (please describe):
Project: Checkov (Provisioning / Security & Compliance)
File: github_actions.md

layout: default title: github_actions resource scans nav_order: 1 | | Id | Type | Entity | Policy | IaC | Resource Link | |-||-|-|--|-|-| | 0 | CKVGHA1 | jobs | jobs | Ensure ACTIONSALLOWUNSECURECOMMANDS isn't true on environment variables | githubactions | | | 1 | CKVGHA1 | jobs | jobs.*.steps | | 2 | CKVGHA2 | jobs | jobs | Ensure run commands are not vulnerable to shell injection | github_actions | | | 3 | CKVGHA2 | jobs | jobs.*.steps | | 4 | CKVGHA3 | jobs | jobs | Suspicious use of curl with secrets | github_actions | | | 5 | CKVGHA3 | jobs | jobs.*.steps | | 6 | CKVGHA4 | jobs | jobs | Suspicious use of netcat with IP address | github_actions | | | 7 | CKVGHA4 | jobs | jobs.*.steps | | 8 | CKVGHA5 | jobs | jobs | Found artifact build without evidence of cosign sign execution in pipeline | github_actions | | | 9 | CKVGHA6 | jobs | jobs | Found artifact build without evidence of cosign sbom attestation in pipeline | github_actions | | | 10 | CKVGHA7 | jobs | on | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflowdispatch inputs MUST be empty. | githubactions | | | 11 | CKV2GHA1 | resource | permissions | Ensure top-level permissions are not set to write-all | github_actions | |