cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: certifications-cis.md

CIS is an independent, nonprofit organization with a mission to create confidence in the connected world. CIS Benchmarks are best practices for the secure configuration of a target system. Available for more than 100 CIS Benchmarks across 25+ vendor product families, CIS Benchmarks are developed through a unique consensus-based process comprised of cybersecurity professionals and subject matter experts around the world. CIS Benchmarks are the only consensus-based, best-practice security configuration guides both developed and accepted by government, business, industry, and academia. KICS has been awarded the following certifications: CIS Amazon Web Services Foundations Benchmark v1.4.0, Level 1 CIS Amazon Web Services Foundations Benchmark v1.4.0, Level 2 KICS has been awarded the following certifications: CIS Kubernetes Benchmark v1.6.1, Level 1 - Master Node CIS Kubernetes Benchmark v1.6.1, Level 1 - Worker Node CIS Kubernetes Benchmark v1.6.1, Level 2 - Master Node CIS Kubernetes Benchmark v1.6.1, Level 2 - Worker Node Most CIS Benchmarks include multiple configuration profiles. A profile definition describes the configurations assigned to benchmark recommendations. <br> The Level 1 profile is considered a base recommendation that can be implemented fairly promptly and is designed to not have an extensive performance impact. The intent of the Level 1 profile benchmark is to lower the attack surface of your organization while keeping machines usable and not hindering business functionality. <br> The Level 2 profile is considered to be "defense in depth" and is intended for environments where security is paramount. The recommendations associated with the Level 2 profile can have an adverse effect on your organization if not implemented appropriately or without due care. https://www.cisecurity.org/cis-benchmarks/cis-benchmarks-faq/
Project: BigchainDB (App Definition and Development / Database)
File: README.md

<! Copyright 2020 Interplanetary Database Association e.V., BigchainDB and IPDB software contributors. SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0) Code is Apache-2.0 and docs are CC-BY-4.0 > Most of the tests in the `tests/` folder are unit tests. For info about how to write and run tests, see , especially: , especially `make test` [ Notes on Running a Local Dev Node as Processes (and Running All Tests)](http://docs.bigchaindb.com/projects/contributing/en/latest/dev-setup-coding-and-contribution-process/run-node-as-processes.html) Note: There are acceptance tests in the `acceptance/` folder (at the same level in the hierarchy as the `tests/` folder).
Project: StarRocks (App Definition and Development / Database)
File: log.md

displayed_sidebar: "English" Calculates the logarithm of a number to a specified base (or radix). If the base is not specified, this function is equivalent to . ```SQL log([base,] arg) ``` `base`: Optional. The base. Only DOUBLE data type is supported. If this parameter is not specified, this function is equivalent to . NOTE StarRocks returns NULL if `base` is specified as a negative, 0, or 1. `arg`: The value whose logarithm you want to calculate. Only DOUBLE data type is supported. NOTE StarRocks returns NULL if `arg` is specified as a negative or 0. Returns a value of the DOUBLE data type. Example 1: Calculate the logarithm of 8 to the base 2. ```Plain mysql> select log(2,8); +--+ | log(2, 8) | +--+ | 3 | +--+ 1 row in set (0.01 sec) ``` Example 2: Calculate the logarithm of 10 to the base e (with the base not specified). ```Plain mysql> select log(10); +-+ | log(10) | +-+ | 2.302585092994046 | +-+ 1 row in set (0.09 sec) ```
Project: KICS (Provisioning / Security & Compliance)
File: fb8f8929-afeb-4c46-99f0-a6cf410f7df4.md

title: Vulnerable Default SSL Certificate hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: fb8f8929-afeb-4c46-99f0-a6cf410f7df4 Query name: Vulnerable Default SSL Certificate Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Defaults URL: CloudFront web distributions should use custom (and not default) SSL certificates. Custom SSL certificates allow only defined users to access content by using an alternate domain name instead of the default one.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6 15" name: create a basic distribution with defaults, tags and default SSL certificate community.aws.cloudfront_distribution: state: present defaultorigindomain_name: www.my-cloudfront-origin.com viewer_certificate: cloudfrontdefaultcertificate: true tags: Name: example distribution Project: example project Priority: '1' name: create a basic distribution with defaults, tags and misconfigured custom SSL certificate community.aws.cloudfront_distribution: state: present defaultorigindomain_name: www.my-cloudfront-origin.com viewer_certificate: acmcertificatearn: arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012 tags: Name: example distribution Project: example project Priority: '1' ``` ```yaml title="Negative test num. 1 - yaml file" name: create a basic distribution with defaults, tags and custom SSL certificate community.aws.cloudfront_distribution: state: present defaultorigindomain_name: www.my-cloudfront-origin.com viewer_certificate: acmcertificatearn: arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012 sslsupportmethod: sni-only minimumprotocolversion: TLS1.2_2018 tags: Name: example distribution Project: example project Priority: '1' ```
Project: NeuVector (Provisioning / Security & Compliance)
File: RELEASE.md

The `yaml` Project is released on an as-needed basis. The process is as follows: An issue is proposing a new release with a changelog since the last release All must LGTM this release An OWNER runs `git tag -s $VERSION` and inserts the changelog and pushes the tag with `git push $VERSION` The release issue is closed An announcement email is sent to `kubernetes-dev@googlegroups.com` with the subject `[ANNOUNCE] kubernetes-template-project $VERSION is released`
Project: ThreatMapper (Provisioning / Security & Compliance)
File: aws-fargate.md

title: AWS Fargate On AWS Fargate, the ThreatMapper sensor agents are deployed as a sidecar container, using a task definition. Grant IAM permissions for ECS task execution role to access this secret as outlined . Create an AWS secret that contains the user credentials needed to pull the Deepfence sensor container image from a private repository. Once the secret is created, it can be linked to an IAM policy and added to an IAM role. You can also create secrets and policies for any other container images that are hosted in private repositories and need to be deployed as part of the Fargate task definition. Create one or more IAM roles that contain the ```AmazonECSTaskExecutionRolePolicy``` policy, along with the policy that references the AWS secrets. Select EC2 launch type: Fargate Configure the task definition: Name - provide an appropriate name Task Role - select an IAM role that contains the ```AmazonECSTaskExecutionRolePolicy``` Task Execution Role - select the IAM role that contains the policy that references the correct AWS secrets to access the private repositories. This can be the same IAM role as specified in the Task Role if the role contains the AmazonECSTaskExecutionRolePolicy and the policies referencing the AWS secrets. CPU and Memory - 0.5 vCPU, 1.0 Gb is appropriate Define the sidecar containers - Name - deepfence-agent Image - ```docker.io/deepfenceio/deepfencefargateagent_ce:2.1.1``` Select the checkbox for "Private registry authentication" and provide the Secrets Manager ARN or name Unselect the checkbox for "Essential" - the sidecar container is transient and exits once the sensor is installed Define your application containers Entry Point - Define the entry point shell script that invokes the Deepfence sensor: /deepfence/usr/local/bin/deepfence-entry-point-scratch.sh Set the command to the entry point as specified by the application container: /entry-point.sh Set the environment variables that configure the Deepfence sensor: ```DFBACKENDIP```: IP address of management console ```DFFIMON```: ```DF_SERVERLESS```: Mount the volume from the Deepfence sidecar container by specifying the sidecar container name: deepfence-agent You can optionally add the ```SYS_PTRACE``` capability to the Linux Parameters through the JSON view as this cannot be added through the UI wizard. Adding this capability will allow the Deepfence sensor to get memory dumps of the processes started by the default user. Once you've created the task definition, you can go ahead and launch it. The Deepfence sensor deployed as a sidecar container will automatically register itself with the Deepfence console.
Project: ArangoDB (App Definition and Development / Database)
File: error_code.md

+++ title = "`decltype(auto) error_code(T &&)`" description = "Extracts a `boost::system::errorcode` or `std::errorcode` from the input via ADL discovery of a suitable `makeerrorcode(T)` function." +++ Extracts a `boost::system::errorcode` or {{% api "std::errorcode" %}} from the input via ADL discovery of a suitable `makeerrorcode(T)` function. Overridable: Argument dependent lookup. Requires: Always available. Namespace: `BOOSTOUTCOMEV2_NAMESPACE::policy` Header: `<boost/outcome/std_result.hpp>`
Project: Keylime (Provisioning / Security & Compliance)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at <core@keylime.groups.io>. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at
Project: KICS (Provisioning / Security & Compliance)
File: 5907595b-5b6d-4142-b173-dbb0e73fbff8.md

title: Exposing Port 22 (SSH) hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5907595b-5b6d-4142-b173-dbb0e73fbff8 Query name: Exposing Port 22 (SSH) Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: Expose only the ports that your application needs and avoid exposing ports like SSH (22)<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="3" FROM gliderlabs/alpine:3.3 RUN apk --no-cache add nginx EXPOSE 3000 80 443 22 CMD ["nginx", "-g", "daemon off;"] ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM gliderlabs/alpine:3.3 RUN apk --no-cache add nginx EXPOSE 80 CMD ["nginx", "-g", "daemon off;"] ```
Project: YugabyteDB (App Definition and Development / Database)
File: with_clause.diagram.md

<svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="493" height="95" viewbox="0 0 493 95"><path class="connector" d="M0 52h35m53 0h30m90 0h20m-125 0q5 0 5 5v8q0 5 5 5h100q5 0 5-5v-8q0-5 5-5m5 0h30m-5 0q-5 0-5-5v-20q0-5 5-5h83m24 0h83q5 0 5 5v20q0 5-5 5m-5 0h40m-458 0q5 0 5 5v23q0 5 5 5h433q5 0 5-5v-23q0-5 5-5m5 0h15"/><polygon points="0,59 5,52 0,45" style="fill:black;stroke-width:0"/><rect class="literal" x="35" y="35" width="53" height="25" rx="7"/><text class="text" x="45" y="52">WITH</text><rect class="literal" x="118" y="35" width="90" height="25" rx="7"/><text class="text" x="128" y="52">RECURSIVE</text><rect class="literal" x="336" y="5" width="24" height="25" rx="7"/><text class="text" x="346" y="22">,</text><a xlink:href="../../../syntaxresources/grammardiagrams#common-table-expression"><rect class="rule" x="258" y="35" width="180" height="25"/><text class="text" x="268" y="52">commontableexpression</text></a><polygon points="489,59 493,59 493,45 489,45" style="fill:black;stroke-width:0"/></svg>
Project: KICS (Provisioning / Security & Compliance)
File: 846646e3-2af1-428c-ac5d-271eccfa6faf.md

title: Group With Privilege Escalation By Actions 'iam:CreateAccessKey' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 846646e3-2af1-428c-ac5d-271eccfa6faf Query name: Group With Privilege Escalation By Actions 'iam:CreateAccessKey' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Group with privilege escalation by actions 'iam:CreateAccessKey' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamgroup" "cosmic" { name = "cosmic" } resource "awsiamgrouppolicy" "testinline_policy" { name = "testinlinepolicy" group = awsiamgroup.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:CreateAccessKey", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_pubsub_topic_iam_policy.md

+++ title = "googlepubsubtopiciampolicy resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlepubsubtopiciampolicy" identifier = "inspec/resources/gcp/googlepubsubtopiciampolicy.md googlepubsubtopiciampolicy resource" parent = "inspec/resources/gcp" +++ A `googlepubsubtopiciampolicy` is used to test a Google Topic Iam Policy resource ```ruby describe googlepubsubtopiciampolicy(project: "project", name: "name") do it { should exist } end googlepubsubtopiciampolicy(project: "project", name: "name").bindings.each do |binding| describe binding do its('role') { should eq 'roles/editor'} its('members') { should include 'user:testuser@example.com'} end end ``` Properties that can be accessed from the `googlepubsubtopiciampolicy` resource: `iambindingroles` : The list of roles that exist on the policy. `bindings` : Associates a list of members to a role. `role` : Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. `members` : Specifies the identities requesting access for a Cloud Platform resource. `audit_configs` : Specifies cloud audit logging configuration for this policy. `service` : Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services. `auditlogconfigs` : The configuration for logging of each type of permission. `log_type` : The log type that this config enables. For example, ADMINREAD, DATAWRITE or DATA_READ `exempted_members` : Specifies the identities that do not cause logging for this type of permission. Ensure the is enabled for the current project.
Project: YugabyteDB (App Definition and Development / Database)
File: ysql-pg.md

title: Ruby PostgreSQL driver headerTitle: Connect an application linkTitle: Connect an app description: Connect a Ruby application using the Pg Gem Driver for YSQL menu: v2.18: identifier: ysql-pg-driver parent: ruby-drivers weight: 410 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li class="active"> <a href="../ysql-pg/" class="nav-link"> YSQL </a> </li> <li> <a href="../ycql/" class="nav-link"> YCQL </a> </li> </ul> <ul class="nav nav-tabs-alt nav-tabs-yb"> <li > <a href="../ysql-pg/" class="nav-link active"> <i class="icon-postgres" aria-hidden="true"></i> Pg Gem Driver </a> </li> </ul> Install the Ruby PostgreSQL driver (`pg`) using the following command: ```sh $ gem install pg -- --with-pg-config=<yugabyte-install-dir>/postgres/bin/pg_config ``` For more information on the driver, see the . Create a file `yb-sql-helloworld.rb` and add the following content to it. ```python require 'pg' begin conn = PG.connect(host: '127.0.0.1', port: '5433', dbname: 'yugabyte', user: 'yugabyte', password: 'yugabyte') conn.exec ("CREATE TABLE employee (id int PRIMARY KEY, \ name varchar, age int, \ language varchar)"); puts "Created table employee\n"; conn.exec ("INSERT INTO employee (id, name, age, language) \ VALUES (1, 'John', 35, 'Ruby')"); puts "Inserted data (1, 'John', 35, 'Ruby')\n"; rs = conn.exec ("SELECT name, age, language FROM employee WHERE id = 1"); rs.each do |row| puts "Query returned: %s %s %s" % [ row['name'], row['age'], row['language'] ] end rescue PG::Error => e puts e.message ensure rs.clear if rs conn.close if conn end ``` To use the application, run the following command: ```sh $ ./yb-sql-helloworld.rb ``` You should see the following output. ```output Created table employee Inserted data (1, 'John', 35, 'Ruby') Query returned: John 35 Ruby ``` Build Ruby applications using Build Ruby applications using
Project: KICS (Provisioning / Security & Compliance)
File: a05331ee-1653-45cb-91e6-13637a76e4f0.md

title: Deployment Without PodDisruptionBudget hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a05331ee-1653-45cb-91e6-13637a76e4f0 Query name: Deployment Without PodDisruptionBudget Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Availability URL: Deployments should be assigned with a PodDisruptionBudget to ensure high availability<br> ```tf title="Positive test num. 1 - tf file" hl_lines="13" resource "kubernetes_deployment" "example" { metadata { name = "terraform-example" labels = { k8s-app = "prometheus" } } spec { replicas = 3 selector { match_labels = { k8s-app = "prometheus" } } template { metadata { labels = { k8s-app = "prometheus" } } spec { container { image = "nginx:1.7.8" name = "example" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } resource "kubernetespoddisruption_budget" "demo" { metadata { name = "demo" } spec { max_unavailable = "20%" selector { match_labels = { test = "MyExampleApp" } } } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_deployment" "example2" { metadata { name = "terraform-example" labels = { k8s-app2 = "prometheus2" } } spec { replicas = 3 selector { match_labels = { k8s-app2 = "prometheus2" } } template { metadata { labels = { k8s-app2 = "prometheus2" } } spec { container { image = "nginx:1.7.8" name = "example" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } resource "kubernetespoddisruption_budget" "demo2" { metadata { name = "demo" } spec { max_unavailable = "20%" selector { match_labels = { k8s-app2 = "prometheus2" } } } } resource "kubernetes_deployment" "example3" { metadata { name = "terraform-example" labels = { k8s-app2 = "prometheus2" } } spec { replicas = 3 selector { match_labels = { k8s-app2 = "kubernetespoddisruptionbudget.demo2.spec.selector.0.matchlabels.k8s-app2" } } template { metadata { labels = { k8s-app2 = "prometheus2" } } spec { container { image = "nginx:1.7.8" name = "example" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } ```
Project: Beam (App Definition and Development / Streaming & Messaging)
File: sql.md

title: "Beam SQL Roadmap" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> This roadmap is in progress. In the meantime, here are available resources: - Issues: