cwielenb/CNCF-Dataset huggingface dataset:
Project: Checkov (Provisioning / Security & Compliance)
File: GitLab CI.md

layout: default published: true title: GitLab CI nav_order: 4 Integrating Checkov into your GitLab CI pipelines provides a simple, automatic way of applying policies to your Terraform code both during merge request review and as part of your build process. Add a new job in `.gitlab-ci.yml` in your repository (at whatever stage is appropriate for you). Here is a basic example: ```yaml stages: test checkov: stage: test allow_failure: true # True for AutoDevOps compatibility image: name: bridgecrew/checkov:latest entrypoint: '/usr/bin/env' 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' rules: if: $SAST_DISABLED when: never if: $CICOMMITBRANCH exists: '/*.yml' '/*.yaml' '/*.json' '/*.template' '/*.tf' '/serverless.yml' '/serverless.yaml' script: checkov -d . -o junitxml | tee checkov.test.xml artifacts: reports: junit: "checkov.test.xml" paths: "checkov.test.xml" ``` When your pipeline executes, it will run this job. If Checkov finds any issues, it will fail the build. For example, I have an S3 bucket that does not have versioning enabled. Checkov detects this and fails the job and pipeline. This will comment on an associated merge request or fail the build depending on the context. GitLab will collect the results into the normal unit testing area of the pipeline and/or the merge request. Once you correct the configuration, Checkov verifies that no errors have been found. Note that in the examples above, the output of the test results does not display colors. This is because GitLab Runner runs without an interactive TTY. Although Checkov does not currently support an environment variable to force colored output, the `script` command can be used to emulate `tty` so colors are displayed: ```yaml stages: test checkov: stage: test allow_failure: true # True for AutoDevOps compatibility image: name: bridgecrew/checkov:latest entrypoint: '/usr/bin/env' 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' rules: if: $SAST_DISABLED when: never if: $CICOMMITBRANCH exists: '/*.yml' '/*.yaml' '/*.json' '/*.template' '/*.tf' '/serverless.yml' '/serverless.yaml' script: script -q -c 'checkov -d . ; echo $? > CKVEXIT' exit $(cat CKVEXIT) ``` See the for additional information. There is also a working example of using GitLab CI with Checkov . This example shows how to use the same Checkov YAML file as an includable extension so that all your jobs reuse the same job definition.
Project: Checkov (Provisioning / Security & Compliance)
File: Contribute YAML-based Policies.md

layout: default published: true title: Contribute YAML-based Policies nav_order: 3 Define a policy as described . Create a branch under the `checkov2` fork (will be changed + the URLs after merge) - `https://github.com/bridgecrewio/checkov` Add `<policyname>.yaml` file to `https://github.com/bridgecrewio/checkov/tree/main/checkov/terraform/checks/graphchecks` inside the relevant provider folder that matches your current policy. `checkov/terraform/checks/graph_checks/aws/EBSAddedBackup.yaml` ```yaml metadata: name: "Ensure that EBS are added in the backup plans of AWS Backup" id: "CKV2AWS9" category: "BACKUPANDRECOVERY" definition: and: cond_type: connection resource_types: awsbackupselection connectedresourcetypes: awsebsvolume operator: exists cond_type: filter attribute: resource_type value: awsebsvolume operator: within ``` 1 - Add the test resources directory to: `https://github.com/bridgecrewio/checkov/tree/main/tests/terraform/graph/checks/resources` and create a folder with the same name as your Custom Policy. In this folder, add the Terraform file(s) which are resources for testing the policy, and `expected.yaml` - all the resources that should pass and the resources that should fail. `tests//terraform/graph/checks/resources/EBSAddedBackup/main.tf` ```yaml resource "awsebsvolume" "ebs_good" { availability_zone = "us-west-2a" size = 40 tags = { Name = "HelloWorld" } } resource "awsebsvolume" "ebs_bad" { availability_zone = "us-west-2a" size = 40 tags = { Name = "HelloWorld" } } resource "awsbackupselection" "backup_good" { iamrolearn = "arn" name = "tfexamplebackup_selection" plan_id = "123456" resources = [ awsebsvolume.ebs_good.arn ] } resource "awsbackupselection" "backup_bad" { iamrolearn = "arn" name = "tfexamplebackup_selection" plan_id = "123456" resources = [ ] } ``` `tests/terraform/graph/checks/resources/EBSAddedBackup/expected.yaml` ```yaml pass: "awsebsvolume.ebs_good" fail: "awsebsvolume.ebs_bad" ``` 2 - Add the test call into tests file - `tests/terraform/graph/checks/testyamlpolicies.py` ```yaml ... def test_EBSAddedBackup(self): self.go("EBSAddedBackup") ... ```
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.Row.md

/ / Row .Row new Row(`row`) | Name | Type | | :- | :-- | | `row` | | `Optional` attributes: [] `Optional` beforeAttributes: [] `Optional` css: `string` `Optional` done: `boolean` `Optional` drilldownTo: `"side-split"` \| `"this-split"` \| `"new-window"` `Optional` fontawesome: `string` `Optional` fontawesomeCSS: `string` `Optional` fullName: `string` `Optional` isDeleted: `boolean` does this row represent a recently deleted resource? `Optional` key: `string` the key-value pair for the first column `Optional` kind: `string` name: `string` `Optional` nameCss: `string` \| `string`[] `Optional` nameDom: `Element` `Optional` object: `Pick`<, `"metadata"`\> & { `spec?`: { `selector?`: { `matchLabels?`: `Record`<`string`, `string`\> } } } optional associated metadata for the corresponding resource `Optional` onclick: `any` `Optional` onclickExec: `"pexec"` \| `"qexec"` `Optional` onclickIdempotent: `boolean` `Optional` outerCSS: `string` `Optional` packageName: `string` `Optional` prettyKind: `string` `Optional` prettyName: `string` `Optional` prettyType: `string` `Optional` prettyVersion: `string` `Optional` rowCSS: `string` \| `string`[] `Optional` rowKey: `string` uniquely identifies this row in a given table; if not defined, we will use the name field as the row key `Optional` setSelected: () => `void` (): `void` `void` `Optional` setUnselected: () => `void` (): `void` `void` `Optional` status: `string` `Optional` type: `string` `Optional` version: `string`
Project: ArangoDB (App Definition and Development / Database)
File: on_outcome_copy_construction2.md

+++ title = "`static void onoutcomecopy_construction(T *, U &&, V &&) noexcept`" description = "(>= Outcome v2.2.0) Hook invoked by the converting copy constructors of `basic_outcome`." categories = ["observer-policies"] weight = 450 +++ One of the constructor hooks for {{% api "basicoutcome<T, EC, EP, NoValuePolicy>" %}}, generally invoked by the converting copy constructors of `basicoutcome` (NOT the standard copy constructor) which consume two arguments. See each constructor's documentation to see which specific hook it invokes. Requires: Always available. Guarantees: Never throws an exception.
Project: KICS (Provisioning / Security & Compliance)
File: 10efce34-5af6-4d83-b414-9e096d5a06a9.md

title: Encryption Provider Not Properly Configured hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 10efce34-5af6-4d83-b414-9e096d5a06a9 Query name: Encryption Provider Not Properly Configured Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: The EncryptionConfiguration should be configured to have at least one 'aescbc', 'kms' or 'secretbox' provider<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: resources: secrets providers: identity: {} aesgcm: keys: name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== name: key2 secret: dGhpcyBpcyBwYXNzd29yZA== ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: resources: secrets providers: identity: {} aesgcm: keys: name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== name: key2 secret: dGhpcyBpcyBwYXNzd29yZA== aescbc: keys: name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== name: key2 secret: dGhpcyBpcyBwYXNzd29yZA== secretbox: keys: name: key1 secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY= ```
Project: Trivy (Provisioning / Security & Compliance)
File: photon.md

Trivy supports the following scanners for OS packages. | Scanner | Supported | | :--: | :-: | | SBOM | | | Vulnerability | | | License | | Please see for supported versions. The table below outlines the features offered by Trivy. | Feature | Supported | |::|::| | Unfixed vulnerabilities | - | | | | Trivy detects packages that have been installed through package managers such as `tdnf` and `yum`. Photon OS offers its own security advisories, and these are utilized when scanning Photon OS for vulnerabilities. See . Trivy takes fixed versions from . Trivy determines the severity of vulnerabilities based on the CVSSv3 score provided by Photon OS. See for the conversion table from CVSS score to severity. Trivy supports the following [vulnerability statuses] for Photon OS. | Status | Supported | | :--: | :-: | | Fixed | | | Affected | | | Under Investigation | | | Will Not Fix | | | Fix Deferred | | | End of Life | | Trivy identifies licenses by examining the metadata of RPM packages.
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_remove_plugin.md

title: "Command - devspace remove plugin" sidebar_label: devspace remove plugin Removes a devspace plugin ``` devspace remove plugin [flags] ``` ``` Removes a plugin devspace remove plugin my-plugin ``` ``` -h, --help help for plugin ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: StarRocks (App Definition and Development / Database)
File: tan.md

displayed_sidebar: "English" Returns the tangent of `x`, where `x` is in radians. ```Haskell TAN(x); ``` `x`: supports the DOUBLE data type. Returns a value of the DOUBLE data type. ```Plain mysql> select tan(3.14); +--+ | tan(3.14) | +--+ | -0.001592654936407223 | +--+ 1 row in set (0.12 sec) ```
Project: KICS (Provisioning / Security & Compliance)
File: 5e7acff5-095b-40ac-9073-ac2e4ad8a512.md

title: IAM Policies Without Groups hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5e7acff5-095b-40ac-9073-ac2e4ad8a512 Query name: IAM Policies Without Groups Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: IAM policy should not apply directly to users, should be with a group<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="25" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: myuser: Type: AWS::IAM::Policy Properties: Path: "/" LoginProfile: Password: myP@ssW0rd Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn Users: existinguser1 existinguser2 ``` ```json title="Positive test num. 2 - json file" hl_lines="38" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "myuser": { "Type": "AWS::IAM::Policy", "Properties": { "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd" }, "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Statement": [ { "Effect": "Allow", "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ] }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ], "Version": "2012-10-17" }, "Users": [ "existinguser1", "existinguser2" ] } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: myuser: Type: AWS::IAM::Policy Properties: Path: "/" LoginProfile: Password: myP@ssW0rd Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn Groups: myexistinggroup1 ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "myuser": { "Type": "AWS::IAM::Policy", "Properties": { "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Statement": [ { "Resource": [ "myqueue.Arn" ], "Effect": "Allow", "Action": [ "sqs:*" ] }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ], "Version": "2012-10-17" }, "Groups": [ "myexistinggroup1" ] } ], "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd" } } } } } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: kanister-operator.md

layout: integration title: Kanister Operator subtitle: Collaborative and visual infrastructure as code for Kanister Operator image: /assets/img/integrations/kanister-operator/icons/color/kanister-operator-color.svg permalink: extensibility/integrations/kanister-operator docURL: https://docs.meshery.io/extensibility/integrations/kanister-operator description: integrations-category: App Definition and Development integrations-subcategory: Provisioning registrant: Artifact Hub components: name: action-set colorIcon: assets/img/integrations/kanister-operator/components/action-set/icons/color/action-set-color.svg whiteIcon: assets/img/integrations/kanister-operator/components/action-set/icons/white/action-set-white.svg description: name: blueprint colorIcon: assets/img/integrations/kanister-operator/components/blueprint/icons/color/blueprint-color.svg whiteIcon: assets/img/integrations/kanister-operator/components/blueprint/icons/white/blueprint-white.svg description: name: profile colorIcon: assets/img/integrations/kanister-operator/components/profile/icons/color/profile-color.svg whiteIcon: assets/img/integrations/kanister-operator/components/profile/icons/white/profile-white.svg description: name: repository-server colorIcon: assets/img/integrations/kanister-operator/components/repository-server/icons/color/repository-server-color.svg whiteIcon: assets/img/integrations/kanister-operator/components/repository-server/icons/white/repository-server-white.svg description: featureList: [ "Encapsulate key data management tasks in blueprints that allow uniform operations at scale.", "Customize blueprints to fit specific needs of your environment and workload without starting from scratch.", "Keep application images unchanged by including required tools as a sidecar container or as a separate pod." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Tetragon (Provisioning / Security & Compliance)
File: fuzzy_mode_convert_table.md

| json type \ dest type | bool | int | uint | float |string| | | | | |--|--| | number | positive => true <br/> negative => true <br/> zero => false| 23.2 => 23 <br/> -32.1 => -32| 12.1 => 12 <br/> -12.1 => 0|as normal|same as origin| | string | empty string => false <br/> string "0" => false <br/> other strings => true | "123.32" => 123 <br/> "-123.4" => -123 <br/> "123.23xxxw" => 123 <br/> "abcde12" => 0 <br/> "-32.1" => -32| 13.2 => 13 <br/> -1.1 => 0 |12.1 => 12.1 <br/> -12.3 => -12.3<br/> 12.4xxa => 12.4 <br/> +1.1e2 =>110 |same as origin| | bool | true => true <br/> false => false| true => 1 <br/> false => 0 | true => 1 <br/> false => 0 |true => 1 <br/>false => 0|true => "true" <br/> false => "false"| | object | true | 0 | 0 |0|originnal json| | array | empty array => false <br/> nonempty array => true| [] => 0 <br/> [1,2] => 1 | [] => 0 <br/> [1,2] => 1 |[] => 0<br/>[1,2] => 1|original json|
Project: KCL (Provisioning / Automation & Configuration)
File: E2A31.md

This error indicates that the illegal attribute error has occurred. Erroneous code example: ```kcl,E2A31 error[E2A31]: IllegalAttributeError --> /path/to/file.k:1:6 | 1 | x = {None: None} | ^ A attribute must be string type, got 'NoneType' | ```
Project: Devfile (App Definition and Development / Application Definition & Image Build)
File: registry_update.md

name: Emergency registry update about: Request for an emergency registry update title: '' labels: '' assignees: johnmcollier /area registry <!-- The staging devfile registry, https://registry.stage.devfile.io is refreshed upon each commit to main in this repository. Production, https://registry.devfile.io, is promoted manually each Wednesday, as needed. If you are a stack or sample owner and need to request an urgent refresh of https://registry.devfile.io before Wednesday (for example if a stack is broken), please fill out the issue template below. --> Stack name: Why is the refresh needed: Why the refresh cannot wait until the next regularly scheduled refresh:
Project: ShardingSphere (App Definition and Development / Database)
File: java-api.en.md

+++ title = "Use Java API" weight = 1 +++ With ShardingSphere-JDBC, XA and BASE mode transactions can be used through the API. Introducing Maven dependency ```xml <dependency> <groupId>org.apache.shardingsphere</groupId> <artifactId>shardingsphere-jdbc</artifactId> <version>${shardingsphere.version}</version> </dependency> <!-- This module is required when using XA transactions --> <dependency> <groupId>org.apache.shardingsphere</groupId> <artifactId>shardingsphere-transaction-xa-core</artifactId> <version>${shardingsphere.version}</version> </dependency> <!-- This module is required when using the Narayana mode with XA transactions --> <dependency> <groupId>org.apache.shardingsphere</groupId> <artifactId>shardingsphere-transaction-xa-narayana</artifactId> <version>${project.version}</version> </dependency> <!-- This module is required when using BASE transactions --> <dependency> <groupId>org.apache.shardingsphere</groupId> <artifactId>shardingsphere-transaction-base-seata-at</artifactId> <version>${shardingsphere.version}</version> </dependency> ``` Perform the business logic using transactions ```java // Use ShardingSphereDataSource to get a connection and perform transaction operations. try (Connection connection = dataSource.getConnection()) { connection.setAutoCommit(false); PreparedStatement preparedStatement = connection.prepareStatement("INSERT INTO torder (userid, status) VALUES (?, ?)"); preparedStatement.setObject(1, 1000); preparedStatement.setObject(2, "init"); preparedStatement.executeUpdate(); connection.commit(); } ```
Project: KICS (Provisioning / Security & Compliance)
File: 0ad60203-c050-4115-83b6-b94bde92541d.md

title: Container Runs Unmasked hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0ad60203-c050-4115-83b6-b94bde92541d Query name: Container Runs Unmasked Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Check if a container has full access (unmasked) to the host's /proc command, which would allow to retrieve sensitive information and possibly change the kernel parameters in runtime.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8" resource "kubernetespodsecurity_policy" "example" { metadata { name = "terraform-example" } spec { privileged = false allowprivilegeescalation = false allowedprocmount_types = ["Unmasked"] volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetespodsecurity_policy" "example" { metadata { name = "terraform-example" } spec { privileged = false allowprivilegeescalation = false allowedprocmount_types = ["Default"] volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ```
Project: KICS (Provisioning / Security & Compliance)
File: 92d65c51-5d82-4507-a2a1-d252e9706855.md

title: ROS Stack Without Template hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 92d65c51-5d82-4507-a2a1-d252e9706855 Query name: ROS Stack Without Template Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Build Process URL: Alicloud ROS Stack should have a template defined through the attribute templateurl or attribute templatebody<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "alicloudrosstack" "example" { stack_name = "tf-testaccstack" stackpolicybody = <<EOF { "Statement": [{ "Action": "Update:Delete", "Resource": "*", "Effect": "Allow", "Principal": "*" }] } EOF } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudrosstack" "example1" { stack_name = "tf-testaccstack1" template_body = <<EOF { "ROSTemplateFormatVersion": "2015-09-01" } EOF stackpolicybody = <<EOF { "Statement": [{ "Action": "Update:Delete", "Resource": "*", "Effect": "Allow", "Principal": "*" }] } EOF } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: keylime.md

layout: integration title: Keylime subtitle: Collaborative and visual infrastructure as code for Keylime image: /assets/img/integrations/keylime/icons/color/keylime-color.svg permalink: extensibility/integrations/keylime docURL: https://docs.meshery.io/extensibility/integrations/keylime description: integrations-category: Provisioning integrations-subcategory: Security & Compliance registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations