cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 611ab018-c4aa-4ba2-b0f6-a448337509a6.md

title: Using Unrecommended Namespace hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 611ab018-c4aa-4ba2-b0f6-a448337509a6 Query name: Using Unrecommended Namespace Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Namespaces like 'default', 'kube-system' or 'kube-public' should not be used<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" apiVersion: v1 kind: Pod metadata: name: frontend namespace: default spec: containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" name: log-aggregator image: images.my-company.example/log-aggregator:v6 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="4" apiVersion: v1 kind: Pod metadata: name: frontend2 spec: containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" name: log-aggregator image: images.my-company.example/log-aggregator:v6 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="5" apiVersion: v1 kind: Pod metadata: name: mongo.db.collection.com namespace: kube-public ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="5" apiVersion: v1 kind: Pod metadata: name: mongo.db.collection.com namespace: kube-system ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="5" apiVersion: serving.knative.dev/v1 kind: Configuration metadata: name: dummy-config namespace: default spec: template: spec: automountServiceAccountToken: true securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: name: sec-ctx-vol emptyDir: { } containers: name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: frontend namespace: cosmicPod spec: securityContext: runAsUser: 1000 containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" name: log-aggregator image: images.my-company.example/log-aggregator:v6 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" apiVersion: v1 kind: CustomResourceDefinition metadata: name: mongo.db.collection.com ```
Project: Open Policy Containers (Provisioning / Security & Compliance)
File: SLACK.md

The [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md) applies in all areas in addition to these rules: Outside of the issue queues, Slack is our best communication medium for projects. Please keep your messages on topic for each channel, and please use the appropriate channel. Please do not cross-post. Spamming channels with unsolicited or frequent messages is not allowed. This workspace is intended for conversations related to OPCR projects. Please do not use the Slack to advertise proprietary vendor products, services, webinars, blogs, etc. Please report issues to Vlad Iovanov (vlad@aserto.com or @viovanov) or Gert Drapers (gert@aserto.com). Unacceptable behavior from any community member will not be tolerated. If a community member engages in unacceptable behavior, an admin may take any action deemed appropriate, up to and including a warning or temporary 30 day ban, along with a permanent ban for repeated violation of these guidelines. Admins may also remove content that violates the above guidelines.
Project: Open Application Model (App Definition and Development / Application Definition & Image Build)
File: governance.md

are responsible for activities around maintaining and updating the Open Application Model (OAM) documentations. Maintainers MUST remain active. If they are unresponsive for >3 months, they will be automatically removed unless a of the other project maintainers agrees to extend the period to be greater than 3 months. New maintainers can be added to the project by a vote of the existing maintainers. A potential maintainer may be nominated by an existing maintainer. A vote is conducted in private between the current maintainers over the course of a one week voting period. At the end of the week, votes are counted and a pull request is made on the repo adding the new maintainer to the file. A maintainer may step down by submitting an stating their intent. Changes to this governance document require a pull request with approval from a of the current maintainers. This project has adopted the .
Project: YDB (App Definition and Development / Database)
File: create-tables.md

```yql CREATE TABLE series ( series_id Uint64 NOT NULL, title Utf8, series_info Utf8, release_date Date, PRIMARY KEY (series_id) ); CREATE TABLE seasons ( series_id Uint64, season_id Uint64, title Utf8, first_aired Date, last_aired Date, PRIMARY KEY (seriesid, seasonid) ); CREATE TABLE episodes ( series_id Uint64, season_id Uint64, episode_id Uint64, title Utf8, air_date Date, PRIMARY KEY (seriesid, seasonid, episode_id) ); ```
Project: KICS (Provisioning / Security & Compliance)
File: 4d8681a2-3d30-4c89-8070-08acd142748e.md

title: CloudTrail Log File Validation Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4d8681a2-3d30-4c89-8070-08acd142748e Query name: CloudTrail Log File Validation Disabled Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: CloudTrail log file validation should be enabled to determine whether a log file has not been tampered<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2 21" name: create multi-region trail with validation and tags community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket region: us-east-1 ismultiregion_trail: true cloudwatchlogsrolearn: "arn:aws:iam::123456789012:role/CloudTrailCloudWatchLogs_Role" cloudwatchlogsloggrouparn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*" kmskeyid: "alias/MyAliasName" tags: environment: dev Name: default name: create multi-region trail with validation and tags v7 community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket region: us-east-1 ismultiregion_trail: true enablelogfile_validation: false cloudwatchlogsrolearn: "arn:aws:iam::123456789012:role/CloudTrailCloudWatchLogs_Role" cloudwatchlogsloggrouparn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*" kmskeyid: "alias/MyAliasName" tags: environment: dev Name: default ``` ```yaml title="Negative test num. 1 - yaml file" name: create multi-region trail with validation and tags v2 community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket region: us-east-1 ismultiregion_trail: true enablelogfile_validation: true cloudwatchlogsrolearn: arn:aws:iam::123456789012:role/CloudTrailCloudWatchLogs_Role cloudwatchlogsloggrouparn: arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:* kmskeyid: alias/MyAliasName tags: environment: dev Name: default name: create multi-region trail with validation and tags v3 community.aws.cloudtrail: state: present name: default s3bucketname: mylogbucket region: us-east-1 ismultiregion_trail: true logfilevalidation_enabled: true cloudwatchlogsrolearn: arn:aws:iam::123456789012:role/CloudTrailCloudWatchLogs_Role cloudwatchlogsloggrouparn: arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:* kmskeyid: alias/MyAliasName tags: environment: dev Name: default ```
Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: API-002-actor-api-design.md

Accepted Given Dapr is going out with language specific Actor SDKs, we formally introduced an Actor API into Dapr to make Actors are first-class citizen in Dapr. The goal of this review was to ensure Dapr can provide strong support of Service Fabric stateful actors programming model so that we can offer a migration path to the majority of existing actor users. A separate Actor interface is defined. Actors should support multiple reminders and timers. Actor state access methods are encapsulated in the Actor interface itself. Actor interface shall support updating a group of key-value states in a single operation. Actor interface shall support deletion of an actor. If the actor is activated when the method is called, the in-flight transaction is allowed to complete, then the actor is deactivated, deleted, with associated state removed. Transaction across multiple API calls is left for future versions, if proven necessary. Due to single-threaded guarantee, such transaction scope might be unnecessary. However, if developer expects an Actor code to behave atomically (in an implied transaction scope), we may have to implement this. Dapr can provide strong support of Service Fabric stateful actors programming model so that we can offer a migration path to most existing actor users.
Project: YDB (App Definition and Development / Database)
File: aws.md

Create an in AWS and add enough balance to run 9 VMs. Using the [calculator] (https://calculator.aws/#/createCalculator/ec2-enhancement), you can estimate the approximate cost of maintaining infrastructure depending on the region and other circumstances. Create a user and connection key in AWS Cloud to run the AWS CLI: The user is created in the Security credentials Access management Create User section. The next step is to assign rights to the user. Select `AmazonEC2FullAccess`. After creating a user, go to its page, open the `Security credentials` tab, and click the Create access key button in the Access keys section. Select `Command Line Interface` from the proposed options. Next, create a tag for the key and click the Create access key button. Copy the values of the `Access key` and `Secret access key` fields. Install and run the `aws configure` command. Enter the values of the `Access key` and `Secret access key` fields saved earlier. Edit the `~/.aws/credentials` and `~/.aws/config` files as follows: Add `[AWSdefreg]` to `~/.aws/config` before `region = ...`. Add `[AWS]` before the connection key secret information. Go to the `aws` directory in the downloaded repository and edit the following variables in the `variable.tf` file: `aws_region` the region in which the infrastructure will be deployed. `aws_profile` security profile name from the file `~/.aws/credentials`. `availability_zones` list of region availability zones. It is formed from the name of the region and the serial letter. For example, for the `us-west-2` region, the list of availability zones will look like this: `["us-west-2a", "us-west-2b", "us-west-2c"]`. Now, being in the `aws` subdirectory, you can run the following sequence of commands to install the provider, initialize modules, and create the infrastructure: `terraform init` installing the provider and initializing modules. `terraform plan` creating a plan for future infrastructure. `terraform init` create resources in the cloud. Next, use the commands `terraform plan`, `terraform init`, and `terraform destroy` (destruction of the created infrastructure) to apply further changes as necessary.
Project: ShardingSphere (App Definition and Development / Database)
File: show-sharding-table-reference-rules.en.md

+++ title = "SHOW SHARDING TABLE REFERENCE RULE" weight = 13 +++ `SHOW SHARDING TABLE REFERENCE RULE` syntax is used to query specified sharding table reference rule in the specified logical database. {{< tabs >}} {{% tab name="Grammar" %}} ```sql ShowShardingBindingTableRules::= 'SHOW' 'SHARDING' 'TABLE' 'REFERENCE' ('RULE' ruleName | 'RULES') ('FROM' databaseName)? ruleName ::= identifier databaseName ::= identifier ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} When `databaseName` is not specified, the default is the currently used `DATABASE`. If `DATABASE` is not used, No database selected will be prompted. | Columns | Descriptions | |--|| | name | Sharding table reference rule name | | shardingtablereference | sharding table reference | Query sharding table reference rules for the specified logical database ```sql SHOW SHARDING TABLE REFERENCE RULES FROM sharding_db; ``` ```sql mysql> SHOW SHARDING TABLE REFERENCE RULES FROM sharding_db; +-+--+ | name | shardingtablereference | +-+--+ | ref0 | ta,t_b | | ref1 | tc,t_d | +-+--+ 2 rows in set (0.00 sec) ``` Query sharding table reference rules for the current logical database ```sql SHOW SHARDING TABLE REFERENCE RULES; ``` ```sql mysql> SHOW SHARDING TABLE REFERENCE RULES; +-+--+ | name | shardingtablereference | +-+--+ | ref0 | ta,t_b | | ref1 | tc,t_d | +-+--+ 2 rows in set (0.00 sec) ``` Query specified sharding table reference rule for the specified logical database ```sql SHOW SHARDING TABLE REFERENCE RULE ref0 FROM shardingdb; ``` ```sql mysql> SHOW SHARDING TABLE REFERENCE RULE FROM sharding_db; +-+--+ | name | shardingtablereference | +-+--+ | ref0 | ta,t_b | +-+--+ 1 row in set (0.00 sec) ``` Query specified sharding table reference rule for the current logical database ```sql SHOW SHARDING TABLE REFERENCE RULE ref_0; ``` ```sql mysql> SHOW SHARDING TABLE REFERENCE RULE ref_0; +-+--+ | name | shardingtablereference | +-+--+ | ref0 | ta,t_b | +-+--+ 1 row in set (0.00 sec) ``` `SHOW`, `SHARDING`, `TABLE`, `REFERENCE`, `RULE`, `RULES`, `FROM`
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_pubsub_topic.md

+++ title = "googlepubsubtopic resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlepubsubtopic" identifier = "inspec/resources/gcp/googlepubsubtopic.md googlepubsubtopic resource" parent = "inspec/resources/gcp" +++ A `googlepubsubtopic` is used to test a Google Topic resource ```ruby describe googlepubsubtopic(project: 'chef-gcp-inspec', name: 'inspec-gcp-topic') do it { should exist } end describe googlepubsubtopic(project: 'chef-gcp-inspec', name: 'nonexistent') do it { should_not exist } end ``` Properties that can be accessed from the `googlepubsubtopic` resource: `name` : Name of the topic. `kmskeyname` : The resource name of the Cloud KMS CryptoKey to be used to protect access to messages published on this topic. Your project's PubSub service account (`service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com`) must have `roles/cloudkms.cryptoKeyEncrypterDecrypter` to use this feature. The expected format is `projects//locations//keyRings//cryptoKeys/` `labels` : A set of key/value label pairs to assign to this Topic. `messagestoragepolicy` : Policy constraining the set of Google Cloud Platform regions where messages published to the topic may be stored. If not present, then no constraints are in effect. `allowedpersistenceregions` : A list of IDs of GCP regions where messages that are published to the topic may be persisted in storage. Messages published by publishers running in non-allowed GCP regions (or running outside of GCP altogether) will be routed for storage in one of the allowed regions. An empty list means that no regions are allowed, and is not a valid configuration. Ensure the is enabled for the current project.
Project: Meshery (Provisioning / Automation & Configuration)
File: github.md

layout: integration title: Github subtitle: Integrate GitOps into your cloud native management process image: /assets/img/integrations/github/icons/color/github-color.svg permalink: extensibility/integrations/github docURL: https://layer5.io/resources/cloud-native/what-is-gitops description: integrations-category: App Definition and Development integrations-subcategory: Source Version Control registrant: Artifact Hub components: featureList: [ "Pipeline your cloud native infrastructure as code changes with GitOps", "Integrate Meshery into your GitHub workflow", "Use Meshery GitHub Actions" ] howItWorks: "Visual GitOps" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: kube-hunter (Provisioning / Security & Compliance)
File: KHV020.md

vid: KHV020 title: Possible Arp Spoof categories: [IdentityTheft] severity: high When using a basic (but common) container networking in the cluster, containers on the same host are bridged togeather to form a virtual layer 2 network. This setup, which is also common for Kubernetes installations. What's also common in Kubernetes installations, is that the `NET_RAW` capability is granted to Pods, allowing them low level access to network interactions. By pairing these two issues together, a malicious Pod running on the cluster could abusing the ARP protocol (used to discover MAC address by IP) in order to spoof the IP address of another pod on same node, thus making other pods on the node talk to the attacker's Pod instead of the legitimate Pod. Consider dropping the `NET_RAW` capability from your pods using `Pod.spec.securityContext.capabilities`
Project: Akri (Provisioning / Automation & Configuration)
File: pull_request_template.md

<!-- Thank you for contributing to the Akri repo! Before submitting this PR, please make sure: Read the Contributing Guide before submitting your PR: https://docs.akri.sh/community/contributing Decide whether you need to add any labels to your PR, such as `same version` if the version should not be changed and your change will trigger the version check workflow. This will cause the workflow to automatically succeed: https://github.com/project-akri/akri/blob/main/.github/workflows/check-versioning.yml If this PR closes another issue, add 'closes #<issue number>' somewhere in the PR summary. GitHub will automatically close that issue when this PR gets merged. Alternatively, adding 'refs #<issue number>' will not close the issue, but help provide the reviewer more context. --> What this PR does / why we need it: Special notes for your reviewer: If applicable: [ ] this PR contains unit tests [ ] added code adheres to standard Rust formatting (`cargo fmt`) [ ] code builds properly (`cargo build`) [ ] code is free of common mistakes (`cargo clippy`) [ ] all Akri tests succeed (`cargo test`) [ ] inline documentation builds (`cargo doc`) by being signed off -- see the failing DCO check for instructions on how to retroactively sign commits
Project: zot (Provisioning / Container Registry)
File: SECURITY.md

| Version | Supported | | - | | | 2.0.x | :whitecheckmark: | | < 2.0.0 | :x: | When a vulnerability is found, please DO NOT file a public issue. Instead, send an email to one of the core and await acknowledgement OR file a . Normally we expect to resolve the issue in 60 days. However should there be an exception the team will reach out for next steps.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: apache.md

+++ title = "apache resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "apache" identifier = "inspec/resources/os/apache.md apache resource" parent = "inspec/resources/os" +++ {{< warning >}} This resource is deprecated and should not be used. It was removed in Chef InSpec 4.0. The documentation below is preserved as a reference. Replacement functionality is available in the resource. {{< /warning >}} Use the `apache` Chef InSpec audit resource to test the state of the Apache server on Linux/Unix systems. This resource was distributed along with Chef InSpec itself. This resource first became available in v1.51.15 of InSpec and was removed in version 4.0. An `apache` Chef InSpec audit resource block declares settings that should be tested: describe apache do its('setting_name') { should cmp 'value' } end where `'setting_name'` is description of the Apache configuration file `{ should cmp 'value' }` is the value that is expected `service`, `confdir`, `confpath`, `user` The following examples show how to use this Chef InSpec audit resource. describe apache do its ('service') { should cmp 'apache2' } end describe apache do its ('conf_dir') { should cmp '/etc/apache2' } end describe apache do its ('conf_path') { should cmp '/etc/apache2/apache2.conf' } end describe apache do its ('user') { should cmp 'www-data' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Harbor (Provisioning / Container Registry)
File: 2-21-admin-view-project.md

Test 2-21 - Admin View Projects (DB Mode) ======= To verify that an admin user can view all projects when users are managed locally by Harbor (DB mode). User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against a local database. ( auth_mode is set to db_auth* .) The user data is stored in a local database. A linux host with Docker CLI installed (Docker client). At least a non-admin user is in Harbor. NOTE: In below test, user A is non-admin user. User A and project X, Y should be replaced by longer and meaningful names. Log in to UI as user A (non-admin). Create a new project X with publicity is off (default). Create another new project Y with publicity is on. On a Docker client host, use `docker login <harbor_host>` to log in as user A. Push an image to project X, push another image to project Y. In UI, logs out and log in as admin user. Check "Public Projects" to verify that project Y is listed and project X is not listed. Verify that project "library" is listed. Click project Y and view the newly pushed image in project Y. Click "Users" to view the members of project Y. Check "My projects" to verify that both project X and project Y are listed. Verify that project "library" is listed. Click project X and view the newly pushed image in project X. Click "Users" to view the members of project X. Step 7, admin should see project Y is listed and project X is not listed. Step 8, project library should be listed. Step 9, the image pushed by user A should be listed under project Y. Step 10, user A should be project admin of project Y. Step 11, admin should see project X and Y are both listed. Step 12, project library should be listed. Step 13, the image pushed by user A should be listed under project X. Step 14, user A should be project admin of project X. None
Project: ClickHouse (App Definition and Development / Database)
File: exists.md

slug: /en/sql-reference/statements/exists sidebar_position: 45 sidebar_label: EXISTS ``` sql EXISTS [TEMPORARY] [TABLE|DICTIONARY] [db.]name [INTO OUTFILE filename] [FORMAT format] ``` Returns a single `UInt8`-type column, which contains the single value `0` if the table or database does not exist, or `1` if the table exists in the specified database.
Project: YDB (App Definition and Development / Database)
File: variant.md

`Variant()` creates a variant value over a tuple or structure. Arguments: Value String with a field name or tuple index Variant type Example ```yql $var_type = Variant<foo: Int32, bar: Bool>; SELECT Variant(6, "foo", $var_type) as Variant1Value, Variant(false, "bar", $var_type) as Variant2Value; ``` `AsVariant()` creates a value of a including one field. This value can be implicitly converted to any variant over a structure that has a matching data type for this field name and might include more fields with other names. Arguments: Value A string with the field name Example ```yql SELECT AsVariant(6, "foo") as VariantValue ```