cwielenb/CNCF-Dataset huggingface dataset:
Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_load_balancers.md

+++ title = "azurermloadbalancers resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurermloadbalancers" identifier = "inspec/resources/azure/azurermloadbalancers.md azurermloadbalancers resource" parent = "inspec/resources/azure" +++ {{< inspec/azurermdeprecated resource="azureload_balancer" >}} Use the `azurermloadbalancers` InSpec audit resource to test properties and configuration of Azure Load Balancers. This resource interacts with version `2018-11-01` of the Azure Management API. For more information see the . At the moment, there doesn't appear to be a way to select the version of the Azure API docs. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: inspec-azure: git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . This resource first became available in 1.7.2 of the inspec-azure resource pack. An `azurermloadbalancers` resource block returns all Azure Load Balancers, either within a Resource Group (if provided), or within an entire Subscription. describe azurermloadbalancer do ... end or describe azurermloadbalancers(resource_group: 'my-rg') do ... end The following examples show how to use this InSpec audit resource. describe azurermloadbalancers do it { should exist } its('names') { should include 'my-lb' } end Filters the results to include only those load balancers which match the given name. This is a string value. describe azurermloadbalancers.where{ name.eql?('production-lb-5') } do it { should exist } end Filters the results to include only those load balancers which reside in a given location. This is a string value. describe azurermloadbalancers.where{ location.eql?('eastus') } do it { should exist } end `id` `name` `sku` `location` `properties` `tags` `type` Azure resource ID. Load balancer name, e.g. `my-lb`. its('names') { should include 'my-lb' } SKU of load balancer. This is metadata used for the Azure portal experience. Resource location, e.g. `eastus`. its('locations') { should_not include 'eastus' } A collection of additional configuration properties related to the Load Balancer, e.g. `loadBalancingRules`. Resource tags applied to the Load balancer. The type of Resource, typically `Microsoft.Network/loadBalancers`. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The control will pass if the filter returns at least one result. Use `should_not` if you expect zero matches. describe azurermloadbalancers do it { should exist } end Your [Service Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal) must be setup with a `contributor` role on the subscription you wish to test.
Project: TDengine (App Definition and Development / Database)
File: 07-icinga2.md

title: icinga2 writing sidebar_label: icinga2 description: This document describes how to integrate TDengine with icinga2. import Icinga2 from "../14-reference/_icinga2.mdx" icinga2 is an open-source, host and network monitoring software initially developed from the Nagios network monitoring application. Currently, icinga2 is distributed under the GNU GPL v2 license. You can write the data collected by icinga2 to TDengine by simply modifying the icinga2 configuration to point to the taosAdapter server and the corresponding port, taking advantage of TDengine's efficient storage and query performance and clustering capabilities for time-series data. To write icinga2 data to TDengine requires the following preparations. The TDengine cluster is deployed and working properly taosAdapter is installed and running properly. Please refer to the for details. icinga2 has been installed. Please refer to the for icinga2 installation <Icinga2 /> Restart taosAdapter: ``` sudo systemctl restart taosadapter ``` Restart icinga2: ``` sudo systemctl restart icinga2 ``` After waiting about 10 seconds, use the TDengine CLI to query TDengine to verify that the appropriate database has been created and data are written. ``` taos> show databases; name | ================================= information_schema | performance_schema | icinga2 | Query OK, 3 row(s) in set (0.001867s) taos> use icinga2; Database changed. taos> show stables; name | ================================= icinga.service.users.state_... | icinga.service.users.acknow... | icinga.service.procs.downti... | icinga.service.users.users | icinga.service.procs.procs_min | icinga.service.users.users_min | icinga.check.maxcheckatte... | icinga.service.procs.state_... | icinga.service.procs.procs_... | icinga.service.users.users_... | icinga.check.latency | icinga.service.procs.procs_... | icinga.service.users.downti... | icinga.service.users.users_... | icinga.service.users.reachable | icinga.service.procs.procs | icinga.service.procs.acknow... | icinga.service.procs.state | icinga.service.procs.reachable | icinga.check.current_attempt | icinga.check.execution_time | icinga.service.users.state | Query OK, 22 row(s) in set (0.002317s) ``` :::note TDengine will automatically create unique IDs for sub-table names by the rule. :::
Project: Chef InSpec (Provisioning / Security & Compliance)
File: ssh_config.md

+++ title = "ssh_config resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "ssh_config" identifier = "inspec/resources/os/sshconfig.md sshconfig resource" parent = "inspec/resources/os" +++ Use the `sshconfig` Chef InSpec audit resource to test OpenSSH client configuration data located at `/etc/ssh/sshconfig` on Linux and Unix platforms. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. An `ssh_config` resource block declares the client OpenSSH configuration data to be tested: describe ssh_config('path') do its('name') { should include('foo') } end where `name` is a configuration setting in `ssh_config` `('path')` is the non-default `/path/to/ssh_config` `{ should include('foo') }` tests the value of `name` as read from `ssh_config` versus the value declared in the test The following examples show how to use this Chef InSpec audit resource. describe ssh_config do its('cipher') { should contain '3des' } its('port') { should eq '22' } its('hostname') { should include('example.com') } end only_if do command('sshd').exist? or command('ssh').exists? end describe ssh_config do its('SendEnv') { should include('CIENABLECOVERAGE') } end describe ssh_config do its('Host') { should eq '*' } its('Tunnel') { should eq nil } its('SendEnv') { should eq 'LANG LC_*' } its('HashKnownHosts') { should eq 'yes' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `name` matcher tests the value of `name` as read from `ssh_config` versus the value declared in the test: its('name') { should eq 'foo' } or: its('name') { should include('bar') }
Project: Carvel (App Definition and Development / Application Definition & Image Build)
File: README_S3.md

The following is a sample class and Lambda function that receives Amazon S3 event record data as an input and writes some of the record data to CloudWatch Logs. (Note that anything written to stdout or stderr will be logged as CloudWatch Logs events.) ```go // main.go package main import ( "fmt" "context" "github.com/aws/aws-lambda-go/lambda" "github.com/aws/aws-lambda-go/events" ) func handler(ctx context.Context, s3Event events.S3Event) { for _, record := range s3Event.Records { s3 := record.S3 fmt.Printf("[%s - %s] Bucket = %s, Key = %s \n", record.EventSource, record.EventTime, s3.Bucket.Name, s3.Object.Key) } } func main() { // Make the handler available for Remote Procedure Call by AWS Lambda lambda.Start(handler) } ```
Project: KICS (Provisioning / Security & Compliance)
File: 84d36481-fd63-48cb-838e-635c44806ec2.md

title: Google Project IAM Member Service Account Has Admin Role hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 84d36481-fd63-48cb-838e-635c44806ec2 Query name: Google Project IAM Member Service Account Has Admin Role Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Verifies that Google Project IAM Member Service Account doesn't have an Admin Role associated<br> ```tf title="Positive test num. 1 - tf file" hl_lines="9 3" resource "googleprojectiam_member" "positive1" { project = "your-project-id" role = "roles/iam.serviceAccountAdmin" member = "serviceAccount:my-other-app@appspot.gserviceacccount.com" } resource "googleprojectiam_member" "positive2" { project = "your-project-id" role = "roles/iam.serviceAccountAdmin" members = ["user:jane@example.com", "serviceAccount:my-other-app@appspot.gserviceacccount.com"] } ``` ```tf title="Negative test num. 1 - tf file" resource "googleprojectiam_member" "negative1" { project = "your-project-id" role = "roles/editor" members = "user:jane@example.com" } ```
Project: ORY Hydra (Provisioning / Key Management)
File: HealthNotReadyStatus.md

Name | Type | Description | Notes | - | - | - Errors | Pointer to map[string]string | Errors contains a list of errors that caused the not ready status. | [optional] `func NewHealthNotReadyStatus() *HealthNotReadyStatus` NewHealthNotReadyStatus instantiates a new HealthNotReadyStatus object This constructor will assign default values to properties that have it defined, and makes sure properties required by API are set, but the set of arguments will change when the set of required properties is changed `func NewHealthNotReadyStatusWithDefaults() *HealthNotReadyStatus` NewHealthNotReadyStatusWithDefaults instantiates a new HealthNotReadyStatus object This constructor will only assign default values to properties that have it defined, but it doesn't guarantee that properties required by API are set `func (o *HealthNotReadyStatus) GetErrors() map[string]string` GetErrors returns the Errors field if non-nil, zero value otherwise. `func (o HealthNotReadyStatus) GetErrorsOk() (map[string]string, bool)` GetErrorsOk returns a tuple with the Errors field if it's non-nil, zero value otherwise and a boolean to check if the value has been set. `func (o *HealthNotReadyStatus) SetErrors(v map[string]string)` SetErrors sets Errors field to given value. `func (o *HealthNotReadyStatus) HasErrors() bool` HasErrors returns a boolean if a field has been set.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: oracledb_conf.md

+++ title = "oracledb_conf resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "oracledb_conf" identifier = "inspec/resources/os/oracledbconf.md oracledbconf resource" parent = "inspec/resources/os" +++ Use the `oracledb_conf` Chef InSpec audit resource to test the Oracle system parameters. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} You must have access to a database user with `DBA` role. A `oracledbconf` resource block declares user and password to use. It fetches system parameters which are defined in the `V$SYSTEMPARAMETER` database view, and then compares those parameters to the values stated in the test: describe oracledb_conf(user: 'USER', password: 'PASSWORD') do its("config item") { should cmp "value" } end `oracledbconf` is based on `oracledbsession`, and accepts all parameters that `oracledb_session` accepts. The following examples show how to use this Chef InSpec audit resource. describe oracledb_conf(user: 'USER', password: 'PASSWORD') do its("auditsysoperations") { should cmp "true" } its("sql92_security") { should cmp "true" } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: YDB (App Definition and Development / Database)
File: commit.md

By default, the entire YQL query is executed within a single transaction, and independent parts inside it are executed in parallel, if possible. Using the `COMMIT;` keyword you can add a barrier to the execution process to delay execution of expressions that follow until all the preceding expressions have completed. To commit in the same way automatically after each expression in the query, you can use `PRAGMA autocommit;`. Examples: ```yql INSERT INTO result1 SELECT * FROM my_table; INSERT INTO result2 SELECT * FROM my_table; COMMIT; -- result2 will already include the SELECT contents from the second line: INSERT INTO result3 SELECT * FROM result2; ```
Project: Open Service Broker API (App Definition and Development / Application Definition & Image Build)
File: README.md

](https://travis-ci.org/openservicebrokerapi/servicebroker "Travis") Changes in these documents have been accepted by the working group for the next version of the specification, however are still subject to change. See The document provides a list of sample Service Brokers, frameworks and libraries that might be useful to developers wanting to implement a Platform or Service Broker. The document is a quick way to track the state of current and pending feature additions, how they align with releases, and which platforms are currently supporting them. One of the of the Open Service Broker API project is to provide conformance test suites to verify compliance with the specification. The conformance test suites below can be used to verify Service Broker behaviour against different versions of the specification. If you are a maintainer of a test suite which is not listed below, we would welcome a pull request to add a link to it alongside the relevant information. \ Latest supported version: v2.14 \ Language: Golang \ Maintainers: , , , \ Latest supported version: v2.14 \ Language: Kotlin \ Maintainers: , , , , , ,
Project: kube-bench (Provisioning / Security & Compliance)
File: platforms.md

kube-bench supports running tests for Kubernetes. Most of our supported benchmarks are defined in one of the following: Some defined by other hardenening guides. | Source | Kubernetes Benchmark | kube-bench config | Kubernetes versions | |--||--|| | CIS | | cis-1.5 | 1.15 | | CIS | | cis-1.6 | 1.16-1.18 | | CIS | | cis-1.20 | 1.19-1.21 | | CIS | | cis-1.23 | 1.22-1.23 | | CIS | | cis-1.24 | 1.24 | | CIS | | cis-1.7 | 1.25 | | CIS | | cis-1.8 | 1.26 | | CIS | | gke-1.0 | GKE | | CIS | | gke-1.2.0 | GKE | | CIS | | eks-1.0.1 | EKS | | CIS | | eks-1.1.0 | EKS | | CIS | | eks-1.2.0 | EKS | | CIS | | ack-1.0 | ACK | | CIS | | aks-1.0 | AKS | | RHEL | RedHat OpenShift hardening guide | rh-0.7 | OCP 3.10-3.11 | | CIS | | rh-1.0 | OCP 4.1- | | CIS | | cis-1.6-k3s | k3s v1.16-v1.24 | | DISA | | eks-stig-kubernetes-v1r6 | EKS | | CIS | | tkgi-1.2.53 | vmware | | CIS | | rke-cis-1.7 | rke v1.25-v1.27 | | CIS | | rke2-cis-1.6 | rke2 v1.25-v1.27 | | CIS | | k3s-cis-1.7 | k3s v1.25-v1.27 |
Project: Pachyderm (App Definition and Development / Streaming & Messaging)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: feature request assignees: '' <!-- This form is for feature requests ONLY! If you're looking for help, please check: Docs: https://docs.pachyderm.com/latest/ Slack: http://slack.pachyderm.io/ --> What is the goal / desired outcome? If there is a way to accomplish this today via workaround, what does that require? (Optional) What is your proposal for a feature to solve this? <!-- If the ask is specific to a version of k8s, cloud provider, etc, please provide these details --> Environment?: Kubernetes version (use `kubectl version`): Pachyderm CLI version (use `pachctl version`): Cloud provider (e.g. aws, azure, gke) or local deployment (e.g. minikube vs dockerized k8s): OS (e.g. from /etc/os-release): Others:
Project: ArangoDB (App Definition and Development / Database)
File: error_rvalue_const.md

+++ title = "`const error_type &&error() const &&`" description = "Wide contract const rvalue reference observer of the stored error. Constexpr propagating." categories = ["observers"] weight = 770 +++ Wide contract const rvalue reference observer of the stored error. `NoValuePolicy::wideerrorcheck()` is first invoked, then the reference to the error is returned. As a valid default constructed error is always present, no undefined behaviour occurs if `NoValuePolicy::wideerrorcheck()` returns. Note that if `error_type` is `void`, only a `const` overload returning `void` is present. Requires: Always available. Complexity: Depends on `NoValuePolicy::wideerrorcheck()`. Guarantees: None.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: python-sdk-now-public.md

title: "Dataflow Python SDK is now public!" date: 2016-02-25 13:00:00 -0800 categories: beam python sdk aliases: /beam/python/sdk/2016/02/25/python-sdk-now-public.html authors: jamesmalone <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> When the Apache Beam project proposed entry into the the proposal included the . In the long term, however, Apache Beam aims to support SDKs implemented in multiple languages, such as Python. <!--more--> Today, Google submitted the on GitHub. Google is committed to including the in progress python SDK in Apache Beam and, in that spirit, we've moved development of the Python SDK to a public repository. While this SDK will not be included with the initial (incubating) releases of Apache Beam, our we plan on incorporating the Python SDK into beam during incubation. We want to take the time to implement changes from the into the Java SDK before we introduce a Python SDK for Apache Beam. We believe this will allow us to work on the model and SDKs in an ordered fashion. You can look for the Apache Beam Python SDK in the coming months once we finish forking and refactoring the Java SDK. Best, Apache Beam Team
Project: KICS (Provisioning / Security & Compliance)
File: 730675f9-52ed-49b6-8ead-0acb5dd7df7f.md

title: SQS Policy With Public Access hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 730675f9-52ed-49b6-8ead-0acb5dd7df7f Query name: SQS Policy With Public Access Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Checks for dangerous permissions in Action statements in an SQS Queue Policy. This is deemed a potential security risk as it would allow various attacks to the queue<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8 64 39" resource "awssqsqueue" "q" { name = "examplequeue" } resource "awssqsqueue_policy" "test" { queueurl = awssqs_queue.q.id policy = <<EOF { "Version": "2012-10-17", "Id": "Queue1PolicyUUID", "Statement": [{ "Sid":"Queue1AnonymousAccessAllActions_AllowlistIP", "Effect": "Allow", "Principal": "*", "Action": "sqs:*", "Resource": "arn:aws:sqs:*:111122223333:queue1", "Condition" : { "IpAddress" : { "aws:SourceIp":"192.168.143.0/24" } } }] } EOF } resource "awssqsqueue" "qawsarray" { name = "examplequeueawsarray" } resource "awssqsqueue" "q_aws" { name = "examplequeue_aws" } resource "awssqsqueuepolicy" "testaws" { queueurl = awssqsqueue.qaws.id policy = <<EOF { "Version": "2012-10-17", "Id": "Queue1PolicyUUID", "Statement": [{ "Sid":"Queue1AnonymousAccessAllActions_AllowlistIP", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "sqs:*", "Resource": "arn:aws:sqs:*:111122223333:queue1", "Condition" : { "IpAddress" : { "aws:SourceIp":"192.168.143.0/24" } } }] } EOF } resource "awssqsqueuepolicy" "testaws_array" { queueurl = awssqsqueue.qaws_array.id policy = <<EOF { "Version": "2012-10-17", "Id": "Queue1PolicyUUID", "Statement": [{ "Sid":"Queue1AnonymousAccessAllActions_AllowlistIP", "Effect": "Allow", "Principal": { "AWS": ["*"] }, "Action": "sqs:*", "Resource": "arn:aws:sqs:*:111122223333:queue1", "Condition" : { "IpAddress" : { "aws:SourceIp":"192.168.143.0/24" } } }] } EOF } ``` ```tf title="Negative test num. 1 - tf file" resource "awssqsqueue" "q" { name = "examplequeue" } resource "awssqsqueue_policy" "test" { queueurl = awssqs_queue.q.id policy = <<POLICY { "Version": "2012-10-17", "Id": "Queue1PolicyUUID", "Statement": [{ "Sid":"Queue1AnonymousAccessAllActions_AllowlistIP", "Effect": "Allow", "Principal": "SOMETHING", "Action": "sqs:*", "Resource": "arn:aws:sqs:*:111122223333:queue1", "Condition" : { "IpAddress" : { "aws:SourceIp":"192.168.143.0/24" } } }] } POLICY } ```
Project: CloudEvents (App Definition and Development / Streaming & Messaging)
File: expirytime.md

This extension provides a mechanism to hint to or a timestamp after which an can be ignored. In distributed systems with message delivery guarantees, events might be delivered to a consumer some significant amount of time after an event has been sent. In this situation, it might be desirable to ignore events that are no longer relevant. The could be used to handle this on the consumer side but can be tricky if the logic varies depending on the event type or producer. As with the main , the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . However, the scope of these key words is limited to when this extension is used. For example, an attribute being marked as "REQUIRED" does not mean it needs to be in all CloudEvents, rather it needs to be included only when this extension is being used. Type: `Timestamp` Description: Timestamp indicating an event is no longer useful after the indicated time. Constraints: REQUIRED SHOULD be equal to or later than the `time` attribute, if present When this extension is used, producers MUST set the value of the `expirytime` attribute. Intermediaries and consumers MAY ignore and discard an event that has an `expirytime` at or before the current timestamp at the time of any checks. Any system that directly or indirectly interacts with a consumer SHOULD NOT make any assumptions on whether a consumer will keep or discard an event based on this extension alone. The reasoning for this is that time-keeping can be inaccurate between any two given systems. Intermediaries MAY modify the `expirytime` attribute, however, they MUST NOT remove it. A series of sensors produce CloudEvents at regular intervals that vary per sensor. Each sensor can pick an `expirytime` that suits its configured sample rate. In the event that an intermediary delays delivery of events to a consumer, older events can be skipped to avoid excessive processing or UI updates upon resuming delivery. A Continuous Integration (CI) system uses CloudEvents to delegate a job to a runner machine. The job has a set deadline and needs to complete before that time has elapsed to be considered successful. The CI system can set the `expirytime` to match the deadline. The job runner would ignore/reject the job if the `expirytime` has elapsed since the CI might have likely already determined the job state.