cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: e6cd49ba-77ed-417f-9bca-4f5303554308.md

title: DocDB Logging Is Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e6cd49ba-77ed-417f-9bca-4f5303554308 Query name: DocDB Logging Is Disabled Platform: Crossplane Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: DocDB logging should be enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" apiVersion: docdb.aws.crossplane.io/v1alpha1 kind: DBCluster metadata: name: example-cluster-autogen-password spec: forProvider: autogeneratePassword: true availabilityZones: us-east-1b us-east-1c dbClusterParameterGroupName: example-parameter-group dbSubnetGroupName: example-subnet-group engine: docdb masterUserPasswordSecretRef: key: password name: my-docdb-creds namespace: crossplane-system masterUsername: master region: us-east-1 skipFinalSnapshot: true tags: key: cluster value: my-cluster vpcSecurityGroupIDsRefs: name: sample-cluster-sg providerConfigRef: name: example ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="26" apiVersion: docdb.aws.crossplane.io/v1alpha1 kind: DBCluster metadata: name: example-cluster-autogen-password spec: forProvider: autogeneratePassword: true availabilityZones: us-east-1b us-east-1c dbClusterParameterGroupName: example-parameter-group dbSubnetGroupName: example-subnet-group engine: docdb masterUserPasswordSecretRef: key: password name: my-docdb-creds namespace: crossplane-system masterUsername: master region: us-east-1 skipFinalSnapshot: true tags: key: cluster value: my-cluster vpcSecurityGroupIDsRefs: name: sample-cluster-sg enableCloudwatchLogsExports: [] providerConfigRef: name: example ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="26" apiVersion: docdb.aws.crossplane.io/v1alpha1 kind: DBCluster metadata: name: example-cluster-autogen-password spec: forProvider: autogeneratePassword: true availabilityZones: us-east-1b us-east-1c dbClusterParameterGroupName: example-parameter-group dbSubnetGroupName: example-subnet-group engine: docdb masterUserPasswordSecretRef: key: password name: my-docdb-creds namespace: crossplane-system masterUsername: master region: us-east-1 skipFinalSnapshot: true tags: key: cluster value: my-cluster vpcSecurityGroupIDsRefs: name: sample-cluster-sg enableCloudwatchLogsExports: audit error providerConfigRef: name: example ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: docdb.aws.crossplane.io/v1alpha1 kind: DBCluster metadata: name: example-cluster-autogen-password spec: forProvider: autogeneratePassword: true availabilityZones: us-east-1b us-east-1c dbClusterParameterGroupName: example-parameter-group dbSubnetGroupName: example-subnet-group engine: docdb masterUserPasswordSecretRef: key: password name: my-docdb-creds namespace: crossplane-system masterUsername: master region: us-east-1 skipFinalSnapshot: true tags: key: cluster value: my-cluster vpcSecurityGroupIDsRefs: name: sample-cluster-sg enableCloudwatchLogsExports: audit profiler providerConfigRef: name: example ```
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_update.md

title: "Command - devspace update" sidebar_label: devspace update Updates the current config ``` ``` ``` -h, --help help for update ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: KICS (Provisioning / Security & Compliance)
File: d395a950-12ce-4314-a742-ac5a785ab44e.md

title: S3 Bucket Allows List Action From All Principals hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d395a950-12ce-4314-a742-ac5a785ab44e Query name: S3 Bucket Allows List Action From All Principals Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: S3 Buckets must not allow List Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is List, for all Principals.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" name: Bucket amazon.aws.s3_bucket: name: mys3bucket state: present policy: Version: "2020-10-07" Statement: Effect: Allow Action: ListObject Principal: "*" ``` ```yaml title="Negative test num. 1 - yaml file" name: Bucket amazon.aws.s3_bucket: name: mys3bucket state: present policy: Version: '2020-10-07' Statement: Effect: Allow Action: ListObject Principal: NotAll ```
Project: KICS (Provisioning / Security & Compliance)
File: 65c1bc7a-4835-4ac4-a2b6-13d310b0648d.md

title: Cluster Labels Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 65c1bc7a-4835-4ac4-a2b6-13d310b0648d Query name: Cluster Labels Disabled Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Kubernetes Clusters must be configured with labels, which means the attribute 'resource_labels' must be defined<br> ```tf title="Positive test num. 1 - tf file" hl_lines="2" resource "googlecontainercluster" "positive1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 timeouts { create = "30m" update = "40m" } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecontainercluster" "negative1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 resource_labels { } timeouts { create = "30m" update = "40m" } } ```
Project: Artifact Hub (App Definition and Development / Application Definition & Image Build)
File: _index.md

title: "Documentation" weight: 1 Welcome to the documentation. Artifact Hub is a web-based application that enables finding, installing, and publishing Cloud Native packages. The documentation is organized in the following topics: | Topic | Description | | - | - | | | The repositories guide explains how to add repositories to Artifact Hub, as well as other related concepts like Verified publisher or Ownership Claim. | | | Describes some custom annotations that allow enriching the existing metadata in Argo templates to improve users' experience in Artifact Hub. | | | Describes some custom annotations that allow enriching the existing metadata in Headlamp plugins to improve users' experience in Artifact Hub. | | | Describes some custom annotations that allow enriching the existing metadata in Helm Charts to improve users' experience in Artifact Hub. | | | Describes some custom annotations that allow enriching the existing metadata in Keptn integrations to improve users' experience in Artifact Hub. | | | Describes some custom annotations that allow enriching the existing metadata in Krew kubectl plugins to improve users' experience in Artifact Hub. | | | Describes some custom annotations that allow enriching the existing metadata in Kubewarden policies to improve users' experience in Artifact Hub. | | | Describes some custom annotations that allow enriching the existing metadata in Kyverno policies to improve users' experience in Artifact Hub. | | | Describes some custom annotations that allow enriching the existing metadata in OLM operators to improve users' experience in Artifact Hub. | | | Describes some custom annotations that allow enriching the existing metadata in Tekton tasks to improve users' experience in Artifact Hub. | | | Explains how to embed a single artifact or a group of them in other websites. | | | Explains how packages are scanned for security vulnerabilities and the structure of the security report. | | | Explains how the authorization mechanism that allows organizations to define what actions can be performed by their members works and how to set it up. | | | Describes the components that form Artifact Hub, what each of them do and the layout of the source repository. | | | This guide will help contributors setup their development environment to do some work on Artifact Hub. | | | Describes the infrastructure used to deploy the production and staging environments of `artifacthub.io`. | | | Explains how to install and use the Artifact Hub command line interface tool. |
Project: KICS (Provisioning / Security & Compliance)
File: f6397a20-4cf1-4540-a997-1d363c25ef58.md

title: S3 Bucket Allows Put Action From All Principals hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f6397a20-4cf1-4540-a997-1d363c25ef58 Query name: S3 Bucket Allows Put Action From All Principals Platform: CloudFormation Severity: <span style="color:#ff0000">Critical</span> Category: Access Control URL: S3 Buckets must not allow Put Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Put, for all Principals.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="22 7" Resources: SampleBucketPolicy3: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: "PutObject" Effect: Allow Resource: "*" Principal: "*" Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' SampleBucketPolicy4: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: "PutObject" "GetObject" Effect: Allow Resource: "*" Principal: "*" Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Positive test num. 2 - json file" hl_lines="9 35" { "Resources": { "SampleBucketPolicy5": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": "PutObject", "Effect": "Allow", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } }, "SampleBucketPolicy6": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": [ "PutObject", "GetObject" ], "Effect": "Allow", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: SampleBucketPolicy1: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: 's3:PutObject' Effect: Deny Resource: '*' Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Negative test num. 2 - json file" { "Resources": { "SampleBucketPolicy2": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": [ "s3:PutObject" ], "Effect": "Deny", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } } } } ```
Project: KICS (Provisioning / Security & Compliance)
File: 5d89db57-8b51-4b38-bb76-b9bd42bd40f0.md

title: ElastiCache Using Default Port hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5d89db57-8b51-4b38-bb76-b9bd42bd40f0 Query name: ElastiCache Using Default Port Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: ElastiCache should not use the default port (an attacker can easily guess the port). For engine set to Redis, the default port is 6379. The Memcached default port is 11211<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awselasticachecluster" "positive1" { cluster_id = "cluster" engine = "redis" node_type = "cache.m5.large" numcachenodes = 1 parametergroupname = awselasticacheparameter_group.default.id } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "awselasticachecluster" "positive2" { cluster_id = "cluster" engine = "memcached" node_type = "cache.m5.large" numcachenodes = 1 parametergroupname = awselasticacheparameter_group.default.id } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="7" resource "awselasticachecluster" "positive3" { cluster_id = "cluster" engine = "redis" node_type = "cache.m5.large" numcachenodes = 1 parametergroupname = awselasticacheparameter_group.default.id port = 6379 } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="7" resource "awselasticachecluster" "positive2" { cluster_id = "cluster" engine = "memcached" node_type = "cache.m5.large" numcachenodes = 1 parametergroupname = awselasticacheparameter_group.default.id port = 11211 } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awselasticachecluster" "negative1" { cluster_id = "cluster" engine = "redis" node_type = "cache.m5.large" numcachenodes = 1 parametergroupname = awselasticacheparameter_group.default.id port = 6380 } ``` ```tf title="Negative test num. 2 - tf file" resource "awselasticachecluster" "negative2" { cluster_id = "cluster" engine = "memcached" node_type = "cache.m5.large" numcachenodes = 1 parametergroupname = awselasticacheparameter_group.default.id port = 11212 } ```
Project: ThreatMapper (Provisioning / Security & Compliance)
File: cloudscanner.md

title: Cloud Scanner task ThreatMapper performs Compliance Posture Scanning to: Build an inventory of cloud assets, such as network security groups, storage objects, key management services. The types of assets discovered are specific to each cloud platform. Perform 'posture scanning', where ThreatMapper matches infrastructure configuration against a set of best-practice benchmarks, such as CIS, PCI-DSS and HIPAA. The benchmarks that are supported are specific to each cloud platform. ThreatMapper then summarises the results in a 'Threat Graph' visualization, to help you to prioritize compliance issues that pose the greatest risk of exploit. Compliance Posture Scanning for Clouds* requires access (typically read-only) to the cloud platform APIs, and uses the Cloud Scanner task Compliance Posture Scanning for Hosts* requires direct access to the host, and uses the Sensor Agent. The ThreatMapper Console does not access the cloud platform APIs directly; there is no need to open the APIs up for remote access. Instead, you deploy a 'Cloud Scanner' task which acts as a local relay, taking instructions from the remote ThreatMapper console and performing local API calls from within your cloud infrastructure. Each Cloud Scanner task runs in your cloud environment, gathering inventory and compliance information for the assets deployed in that environment. It submits that information to your ThreatMapper console. You can deploy as many Cloud Scanner tasks as are required by your security policy and any restrictions in place that affect API access. Cloud Scanner tasks are deployed using the appropriate Terraform module for each cloud, and are configured with the address and API key of your management console. They 'phone home' to your management console and take instructions on demand; they do not listen for remote connections or control. :::info Refer to the Installation Documentation to ::: ThreatMapper can perform compliance posture scanning on linux hosts and Kubernetes master and worker nodes. Scanning is done directly, using a local rather than by using the Cloud Scanner task employed by the cloud platform integrations.
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: bug-report.md

name: Bug report about: Create a report to help us reproduce and fix a bug labels: kind/bug <!-- Please use this template for reporting bugs and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!--> What happened? What did you expect to happen instead? How can we reproduce the bug? (as minimally and precisely as possible) My devspace.yaml: ``` version: ... ... ``` Local Environment: DevSpace Version: [use `devspace --version`] Operating System: windows | linux | mac ARCH of the OS: AMD64 | ARM64 | i386 Kubernetes Cluster: Cloud Provider: google | aws | azure | other Kubernetes Version: [use `kubectl version`] Anything else we need to know?
Project: YugabyteDB (App Definition and Development / Database)
File: replace_master.md

title: Replace a failed YB-Master headerTitle: Replace a failed YB-Master linkTitle: Replace a failed YB-Master description: Steps to replace a failed YB-Master in a YugabyteDB cluster. aliases: /troubleshoot/cluster/replace-master/ /preview/troubleshoot/cluster/replace-master/ menu: preview: identifier: replace-failed-master parent: troubleshoot-cluster weight: 831 type: docs You can replace a failed YB-Master server in a YugabyteDB cluster. Examples included in this document use the following scenario: The cluster includes three `yb-master` servers: `M1`, `M2`, `M3`. YB-Master server `M1` failed and needs to be replaced. A new YB-Master server (`M4`) will replace `M1`. The default master RPC port is `7100` If the YB-Master to be replaced is already dead (for example, the VM was terminated), you would need to perform the `REMOVE` step first, and then the `ADD` step. Start the replacement YB-Master server in standby mode by setting the `--master_addresses` flag to an empty string (`""`), as follows: ```sh ./bin/yb-master --masteraddresses="" --fsdatadirs=<yourdata_directories> [any other flags you would typically pass to this master process] ``` When the `--master_addresses` is `""`, this YB-Master server starts without joining any existing master quorum. The node will be added to the master quorum in a later step. Add the replacement YB-Master server into the existing cluster by running the command, as follows: ```sh ./bin/yb-admin -masteraddresses M1:7100,M2:7100,M3:7100 changemasterconfig ADDSERVER M4 7100 ``` Remove the failed YB-Master server from the cluster by using the command, as follows: ```sh ./yb-admin -masteraddresses M1:7100,M2:7100,M3:7100,M4:7100 changemasterconfig REMOVESERVER M1 7100 ``` Make sure to specify all YB-Master addresses, including M4, to make sure that if M4 becomes the leader, then yb-admin can find it. Validate cluster by checking that your set of masters is now `M2`, `M3` and `M4`, as follows: ```bash ./yb-admin -masteraddresses M2:7100,M3:7100,M4:7100 listall_masters ``` Until is implemented, the YB-TServer by default can only be aware of the YB-Master servers that are encoded in the `--tservermasteraddrs` flag with which they are started. If any of those YB-Master servers are still part of the active quorum, then they can propagate the new master quorum via heartbeats. If none of the current YB-Master servers are present in the YB-TServer flag, then the YB-TServer cannot join the cluster. Therefore, it is important to update `--tservermasteraddrs` on every YB-TServer to the new set of master addresses as `M2:7100,M3:7100,M4:7100`.
Project: Meshery (Provisioning / Automation & Configuration)
File: jaeger-operator.md

layout: integration title: Jaeger Operator subtitle: Collaborative and visual infrastructure as code for Jaeger Operator image: /assets/img/integrations/jaeger-operator/icons/color/jaeger-operator-color.svg permalink: extensibility/integrations/jaeger-operator docURL: https://docs.meshery.io/extensibility/integrations/jaeger-operator description: integrations-category: Observability and Analysis integrations-subcategory: Tracing registrant: Artifact Hub components: name: jaeger colorIcon: assets/img/integrations/jaeger-operator/components/jaeger/icons/color/jaeger-color.svg whiteIcon: assets/img/integrations/jaeger-operator/components/jaeger/icons/white/jaeger-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: NeuVector (Provisioning / Security & Compliance)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: '' assignees: '' Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] Describe the solution you'd like A clear and concise description of what you want to happen. Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered. Additional context Add any other context or screenshots about the feature request here.
Project: KICS (Provisioning / Security & Compliance)
File: b8a9852c-9943-4973-b8d5-77dae9352851.md

title: EFS Without Tags hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b8a9852c-9943-4973-b8d5-77dae9352851 Query name: EFS Without Tags Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Build Process URL: Amazon Elastic Filesystem should have filesystem tags associated<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2" name: EFS provisioning without tags community.aws.efs: state: present name: myTestEFS targets: subnet_id: subnet-748c5d03 security_groups: [ "sg-1a2b3c4d" ] ``` ```yaml title="Negative test num. 1 - yaml file" name: EFS provisioning community.aws.efs: state: present name: myTestEFS tags: Name: myTestNameTag purpose: file-storage targets: subnet_id: subnet-748c5d03 security_groups: [ "sg-1a2b3c4d" ] ```