cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 52f04a44-6bfa-4c41-b1d3-4ae99a2de05c.md

title: VPC Subnet Assigns Public IP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 52f04a44-6bfa-4c41-b1d3-4ae99a2de05c Query name: VPC Subnet Assigns Public IP Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: VPC Subnet should not assign public IP<br> ```tf title="Positive test num. 1 - tf file" hl_lines="13" resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } resource "aws_subnet" "positive" { vpcid = awsvpc.main.id cidr_block = "10.0.1.0/24" tags = { Name = "Positive" } mappubliciponlaunch = true } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="11" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] mappubliciponlaunch = true enablenatgateway = true enablevpngateway = true tags = { Terraform = "true" Environment = "dev" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] enablenatgateway = true enablevpngateway = true tags = { Terraform = "true" Environment = "dev" } } ``` ```tf title="Negative test num. 1 - tf file" resource "aws_vpc" "main2" { cidr_block = "10.0.0.0/16" } resource "aws_subnet" "negative1" { vpcid = awsvpc.main2.id cidr_block = "10.0.1.0/24" tags = { Name = "Negative1" } } ``` ```tf title="Negative test num. 2 - tf file" resource "aws_vpc" "main3" { cidr_block = "10.0.0.0/16" } resource "aws_subnet" "negative2" { vpcid = awsvpc.main3.id cidr_block = "10.0.1.0/24" tags = { Name = "Negative2" } mappubliciponlaunch = false } ``` ```tf title="Negative test num. 3 - tf file" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] mappubliciponlaunch = false enablenatgateway = true enablevpngateway = true tags = { Terraform = "true" Environment = "dev" } } ```
Project: KICS (Provisioning / Security & Compliance)
File: bd6bd46c-57db-4887-956d-d372f21291b6.md

title: Missing App Armor Config hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: bd6bd46c-57db-4887-956d-d372f21291b6 Query name: Missing App Armor Config Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Containers should be configured with AppArmor for any application to reduce its potential attack<br> ```tf title="Positive test num. 1 - tf file" hl_lines="58 4" resource "kubernetes_pod" "example1" { metadata { name = "terraform-example1" annotations = { "container.apparmor" = "localhost" } } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetes_pod" "example2" { metadata { name = "terraform-example2" } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_pod" "test" { metadata { name = "terraform-example" annotations = { "container.apparmor.security.beta.kubernetes.io" = "localhost/k8s-apparmor-example-allow-write" } } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.5.46.md

layout: release date: 2021-08-13 tag: v0.5.46 [mesheryctl] added test for view and list @Revolyssup (#3861) [mesheryctl] Avoid returning error if browser fails to open after starting meshery @Revolyssup (#3871) [mesheryctl] Unit Tests for `mesheryctl app` @suhaniii (#3814) Quick refactor @metonymic-smokey (#3851) [mesheryctl] exit codes in mesh validate sub commands @DelusionalOptimist (#3864) [CI] Updated the github workflow for swagger docs @sayantan1413 (#3867) Added the unit test for mesheryctl system restart command @Shreyas220 (#3858) [mesheryctl] fix bugs in `mesheryctl mesh` sub commands @DelusionalOptimist (#3850) added documentation for the eslint plugin @warunicorn19 (#3859) [mesheryctl] Enhanced error for `mesherycytl exp filter list` @Revolyssup (#3849) [meshery] Shifting `/application/` endpoints from "experimental" @piyushsingariya (#3852) [Docs] Updated description of Hipster store sample app @afzal442 (#3842) [UI] block fetch to grafana or prometheus if not configured @bariqhibat (#3847) added swagger docs and fixed the error @warunicorn19 (#3839) Fix a typo in connection wizard step two @sudo-NithishKarthik (#3832) [mesheryctl] Fixing `mesheryctl filter` command @piyushsingariya (#3843) Bump next from 11.0.1 to 11.1.0 in /provider-ui @dependabot (#3866) add meshery docs release for v0.5.40 @nehaLohia27 (#3846) Fix broken links in Docs #3764 @sgibson19 (#3818) [Docs] Release notes for v0.5.38 added @ghulamyazdani-bot (#3804) Thank you to our contributors for making this release possible: @DelusionalOptimist, @Revolyssup, @Shreyas220, @adithyaakrishna, @afzal442, @bariqhibat, @dependabot, @dependabot[bot], @ghulamyazdani-bot, @leecalcote, @metonymic-smokey, @navendu-pottekkat, @nehaLohia27, @piyushsingariya, @sayantan1413, @sgibson19, @sudo-NithishKarthik, @suhaniii and @warunicorn19
Project: Dragonfly (Provisioning / Container Registry)
File: dfcache_plugin.md

% DFCACHE(1) Version v2.1.0 | Frivolous "Dfcache" Documentation dfcache plugin show plugin Show the plugin details of dragonfly. ```shell dfcache plugin [flags] ``` ```shell -i, --cid string content or cache ID, e.g. sha256 digest of the content --config string the path of configuration file with yaml extension name, default is /etc/dragonfly/dfcache.yaml, it can also be set by env var: DFCACHE_CONFIG --console whether logger output records to the stdout --jaeger string jaeger endpoint url, like: http://localhost:14250/api/traces --logdir string Dfcache log directory --pprof-port int listen port for pprof, 0 represents random port (default -1) --service-name string name of the service for tracer (default "dragonfly-dfcache") -t, --tag string different tags for the same cid will be recognized as different files in P2P network --timeout duration Timeout for this cache operation, 0 is infinite --verbose whether logger use debug level --workhome string Dfcache working directory -h, --help help for plugin ``` - the P2P cache client of dragonfly
Project: KICS (Provisioning / Security & Compliance)
File: 94e47f3f-b90b-43a1-a36d-521580bae863.md

title: Nifcloud LB Use HTTP Port hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 94e47f3f-b90b-43a1-a36d-521580bae863 Query name: Nifcloud LB Use HTTP Port Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: The lb use http port<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "nifcloudloadbalancer" "positive" { loadbalancername = "example" instance_port = 80 loadbalancerport = 80 } ``` ```tf title="Negative test num. 1 - tf file" resource "nifcloudloadbalancer" "negative" { loadbalancername = "example" instance_port = 443 loadbalancerport = 443 } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.177.md

layout: release date: 2023-11-17 tag: v0.6.177 [Model] Add connection definition for `kubernetes` model @MUzairS15 (#9368) [chore] Bump MeshKit v0.6.85 @theBeginner86 (#9380) Added MAINTAINERS.md @ankushbhardwaj408 (#9365) make isAnnotation update dynamic @MUzairS15 (#9366) fix width of connection chip @sudhanshutech (#9386) Reuse connections chip @sudhanshutech (#9382) Color of FavIcon in the footer is changed to keppel green @VivekBaldha0712 (#9039) fixed prettier error @captain-Akshay (#9381) [bug] Fix URL import @theBeginner86 (#9378) Bump the npmandyarn at /ui security update group in /ui with 1 update @dependabot (#9234) Bump the npmandyarn at /ui security update group in /ui with 1 update @dependabot (#9234) [Docs] Update connections.md @leecalcote (#9373) Thank you to our contributors for making this release possible: @MUzairS15, @VivekBaldha0712, @Yashsharma1911, @ankushbhardwaj408, @captain-Akshay, @dependabot, @l5io, @leecalcote, @sudhanshutech, @theBeginner86 and l5io
Project: Hazelcast IMDG (App Definition and Development / Database)
File: 01-membership-listener.md

| Since: 4.1| |-| CP Subsystem requires manual user intervention in some cases, especially if CP members crash or become unreachable. But there's no programmatic way of monitoring CP members. Users should track Hazelcast logs or look at Management Center to see any problems in CP membership healthiness. Our goal in this work is to add a new listener to the CP Subsystem to listen events for CP member additions and removals. Two new methods will be added to the CPSubsystem interface, to register and deregister listeners. ```java / Registers a new CPMembershipListener to listen CP membership changes. * @param listener membership listener @return id of the listener registration @since 4.1 */ UUID addMembershipListener(CPMembershipListener listener); / Removes membership listener registration. Previously registered listener will not receive further events. * @param id of the registration @return true if listener registration is removed, false otherwise @since 4.1 */ boolean removeMembershipListener(UUID id); ``` A new `CPMembershipListener` interface and a new `CPMembershipEvent` interface will be added to the CP Subsystem module under `com.hazelcast.cp.event` package. ```java / CPMembershipListener is notified when a CP member is added to or removed from the CP Subsystem. * @since 4.1 */ public interface CPMembershipListener extends EventListener { / Called when a new CP member is added to the CP Subsystem. * @param event membership event */ void memberAdded(CPMembershipEvent event); / Called when a CP member is removed from the CP Subsystem. * @param event membership event */ void memberRemoved(CPMembershipEvent event); } ``` ```java / CPMembershipEvent is published when a CP member is added to or removed from the CP Subsystem. * @since 4.1 */ public interface CPMembershipEvent { / Membership event type. */ enum EventType { ADDED, REMOVED } / Returns the CPMember that is added to or removed from CP Subsystem. * @return the CP member */ CPMember getMember(); / Returns the type of membership change. * @return membership event type */ EventType getType(); } ``` `CPMembershipListener` can be registered in declarative configuration too, similar to regular `MembershipListener`. ```xml <hazelcast> ... <listeners> <listener>com.hazelcast.examples.CPMembershipListener</listener> </listeners> ... </hazelcast> ``` ```yaml hazelcast: ... listeners: com.hazelcast.examples.CPMembershipListener ... ``` CP membership changes are performed by METADATA group using Raft consensus mechanism. Because of this, events for membership changes can be published only by METADATA members. After committing a membership change, a new CPMembershipEvent is published by the leader of the METADATA group.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: latest.md

title: "Latest" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> {{< localstorage language language-py >}} {{< button-pydoc path="apache_beam.transforms.combiners" class="Latest" >}} Gets the element with the latest timestamp. In the following examples, we create a pipeline with a `PCollection` of produce with a timestamp for their harvest date. We use `Latest` to get the element with the latest timestamp from the `PCollection`. We use `Latest.Globally()` to get the element with the latest timestamp in the entire `PCollection`. {{< playground height="700px" >}} {{< playgroundsnippet language="py" path="SDKPYTHONLatestGlobally" show="latestglobally" >}} {{< /playground >}} We use `Latest.PerKey()` to get the elements with the latest timestamp for each key in a `PCollection` of key-values. {{< playground height="700px" >}} {{< playgroundsnippet language="py" path="SDKPYTHONLatestPerKey" show="latestper_key" >}} {{< /playground >}} randomly takes some number of elements in a collection. {{< button-pydoc path="apache_beam.transforms.combiners" class="Latest" >}}
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_ml_engine_model.md

+++ title = "googlemlengine_model resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlemlengine_model" identifier = "inspec/resources/gcp/googlemlenginemodel.md googlemlenginemodel resource" parent = "inspec/resources/gcp" +++ A `googlemlengine_model` is used to test a Google Model resource ```ruby describe googlemlenginemodel(project: 'chef-gcp-inspec', name: 'mlmodel') do it { should exist } its('description') { should cmp 'My awesome ML model' } its('regions') { should include 'us-central1' } its('onlinepredictionlogging') { should cmp 'true' } its('onlinepredictionconsole_logging') { should cmp 'true' } end describe googlemlengine_model(project: 'chef-gcp-inspec', name: 'nonexistent') do it { should_not exist } end ``` Properties that can be accessed from the `googlemlengine_model` resource: `name` : The name specified for the model. `description` : The description specified for the model when it was created. `default_version` : The default version of the model. This version will be used to handle prediction requests that do not specify a version. `name` : The name specified for the version when it was created. `regions` : The list of regions where the model is going to be deployed. Currently only one region per model is supported `onlinepredictionlogging` : If true, online prediction access logs are sent to StackDriver Logging. `onlinepredictionconsole_logging` : If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging `labels` : One or more labels that you can add, to organize your models. Ensure the is enabled for the current project.
Project: Kyverno (Provisioning / Security & Compliance)
File: kyverno_jp_query.md

Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions. Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions. For more information visit https://kyverno.io/docs/kyverno-cli/#jp ``` kyverno jp query [-i input] [-q query|query]... [flags] ``` ``` kyverno jp query -i object.yaml 'request.object.metadata.name | truncate(@, `9`)' kyverno jp query -i object.yaml -q query-file kyverno jp query -i object.yaml -q query-file-1 -q query-file-2 'request.object.metadata.name | truncate(@, `9`)' cat query-file | kyverno jp query -i object.yaml cat object.yaml | kyverno jp query -q query-file ``` ``` -c, --compact Produce compact JSON output that omits non essential whitespace -h, --help help for query -i, --input string Read input from a JSON or YAML file instead of stdin -q, --query strings Read JMESPath expression from the specified file -u, --unquoted If the final result is a string, it will be printed without quotes ``` ``` --adddirheader If true, adds the file directory to the header of the log messages --alsologtostderr log to standard error as well as files (no effect when -logtostderr=true) --logbacktraceat traceLocation when logging hits line file:N, emit a stack trace (default :0) --log_dir string If non-empty, write log files in this directory (no effect when -logtostderr=true) --log_file string If non-empty, use this log file (no effect when -logtostderr=true) --logfilemax_size uint Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) --logtostderr log to standard error instead of files (default true) --one_output If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true) --skip_headers If true, avoid header prefixes in the log messages --skiplogheaders If true, avoid headers when opening log files (no effect when -logtostderr=true) --stderrthreshold severity logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2) -v, --v Level number for the log level verbosity --vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging ``` - Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.
Project: DragonflyDB (App Definition and Development / Database)
File: memcached_benchmark.md

Contention in memcached under the high write throughput. <img src="http://static.dragonflydb.io/repo-assets/memcachedperftop.png" width="100%" border="0"/> Overall CPU usage of memcached when performing SETS benchmark: <img src="http://static.dragonflydb.io/repo-assets/memcachedcpuusage.png" width="100%" border="0"/>
Project: Harbor (Provisioning / Container Registry)
File: 1-15-admin-role-create-delete-user.md

Test 1-15 - Admin Role User Create, Delete and Recreate a User(DB Mode) ======= To verify that an admin user can create/delete/recreate a user when users are managed locally by Harbor (DB mode). User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against a local database. A linux host with Docker CLI installed (Docker client). NOTE: The below non-admin user M should NOT be the same as the non-admin user in Test 1-09. Assign an non-admin user M with system admin role and act as an admin user. Repeat all steps in Test 1-09. A user with system admin role can perform all operations the same as the admin user. Same as Test 1-09. None
Project: KICS (Provisioning / Security & Compliance)
File: cefdad16-0dd5-4ac5-8ed2-a37502c78672.md

title: Service Account with Improper Privileges hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cefdad16-0dd5-4ac5-8ed2-a37502c78672 Query name: Service Account with Improper Privileges Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: Service account should not have improper privileges like admin, editor, owner, or write roles<br> ```tf title="Positive test num. 1 - tf file" hl_lines="3" data "googleiampolicy" "admin" { binding { role = "roles/editor" members = [ "serviceAccount:jane@example.com", ] } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="18 3" resource "googleprojectiam_binding" "project1" { project = "your-project-id" role = "roles/container.admin" members = [ "serviceAccount:jane@example.com", ] condition { title = "expiresafter20191231" description = "Expiring at midnight of 2019-12-31" expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")" } } resource "googleprojectiam_member" "project2" { project = "your-project-id" role = "roles/editor" member = "serviceAccount:jane@example.com" } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="10" data "googleiampolicy" "admin" { binding { role = "roles/compute.imageUser" members = [ "serviceAccount:jane@example.com", ] } binding { role = "roles/owner" members = [ "serviceAccount:john@example.com", ] } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="9 3" data "googleiampolicy" "admin" { binding { role = "roles/admin" members = [ "serviceAccount:your-custom-sa@your-project.iam.gserviceaccount.com", ] } binding { role = "roles/editor" members = [ "serviceAccount:alice@gmail.com", ] } } ``` </details> ```tf title="Negative test num. 1 - tf file" data "googleiampolicy" "policy5" { binding { role = "roles/apigee.runtimeAgent" members = [ "user:jane@example.com", ] } } ``` ```tf title="Negative test num. 2 - tf file" resource "googleprojectiam_binding" "project3" { project = "your-project-id" role = "roles/apigee.runtimeAgent" members = [ "user:jane@example.com", ] condition { title = "expiresafter20191231" description = "Expiring at midnight of 2019-12-31" expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")" } } resource "googleprojectiam_member" "project4" { project = "your-project-id" role = "roles/apigee.runtimeAgent" member = "user:jane@example.com" } ``` ```tf title="Negative test num. 3 - tf file" resource "googleprojectiam_binding" "project5" { role = "roles/viewer" members = [ "serviceAccount:jane@example.com", ] } data "googleiampolicy" "policy6" { binding { role = "roles/viewer" members = [ "user:jane@example.com", ] } } ```