cwielenb/CNCF-Dataset huggingface dataset:
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-secret-rm.1.md

% podman-secret-rm 1 podman\-secret\-rm - Remove one or more secrets podman secret rm [options] secret [...] Removes one or more secrets. `podman secret rm` is safe to use on secrets that are in use by a container. The created container has access to the secret data because secrets are copied and mounted into the container when a container is created. If a secret is deleted and another secret is created with the same name, the secret inside the container does not change; the old secret value still remains. Remove all existing secrets. Print usage statement. Ignore errors when specified secrets are not present. Remove secrets mysecret1 and mysecret2. ``` $ podman secret rm mysecret1 mysecret2 ``` , January 2021, Originally compiled by Ashley Cui <acui@redhat.com>
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_migration_templates.md

title: kbcli migration templates List migration templates. ``` kbcli migration templates [NAME] [flags] ``` ``` kbcli migration templates kbcli migration templates mytemplate kbcli migration templates mytemplate -o yaml kbcli migration templates mytemplate -o json kbcli migration templates mytemplate -o wide ``` ``` -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace. -h, --help help for templates -o, --output format prints the output in the specified format. Allowed values: table, json, yaml, wide (default table) -l, --selector string Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2). Matching objects must satisfy all of the specified label constraints. --show-labels When printing, show all labels as the last column (default hide labels column) ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Data migration between two data sources.
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-image-mount.1.md

% podman-image-mount 1 podman\-image\-mount - Mount an image's root filesystem podman image mount [options] [image ...] Mounts the specified images' root file system in a location which can be accessed from the host, and returns its location. The `podman image mount` command without any arguments lists all of the currently mounted images. Rootless mode only supports mounting VFS driver, unless podman is run in a user namespace. Use the `podman unshare` command to enter the user namespace. All other storage drivers fail to mount. The location of the mounted file system. On error an empty string and errno is returned. Mount all images. Print the mounted images in specified format (json). Mount multiple images. Note: In rootless mode, image mounting works only after executing the podman unshare command to enter the user namespace. ``` podman image mount fedora ubi8-init /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged ``` List mounted images: ``` podman image mount registry.fedoraproject.org/fedora:latest /var/lib/containers/storage/overlay/f3ac502d97b5681989dff84dfedc8354239bcecbdc2692f9a639f4e080a02364/merged registry.access.redhat.com/ubi8-init:latest /var/lib/containers/storage/overlay/0ff7d7ca68bed1ace424f9df154d2dd7b5a125c19d887f17653cbcd5b6e30ba1/merged ``` List mounted images in JSON format: ``` podman image mount --format json [ { "id": "00ff39a8bf19f810a7e641f7eb3ddc47635913a19c4996debd91fafb6b379069", "Names": [ "sha256:58de585a231aca14a511347bc85b912a6f000159b49bc2b0582032911e5d3a6c" ], "Repositories": [ "registry.fedoraproject.org/fedora:latest" ], "mountpoint": "/var/lib/containers/storage/overlay/0ccfac04663bbe8813b5f24502ee0b7371ce5bf3c5adeb12e4258d191c2cf7bc/merged" }, { "id": "bcc2dc9a261774ad25a15e07bb515f9b77424266abf2a1252ec7bcfed1dd0ac2", "Names": [ "sha256:d5f260b2e51b3ee9d05de1c31d261efc9af28e7d2d47cedf054c496d71424d63" ], "Repositories": [ "registry.access.redhat.com/ubi8-init:latest" ], "mountpoint": "/var/lib/containers/storage/overlay/d66b58e3391ea8ce4c81316c72e22b332618f2a28b461a32ed673e8998cdaeb8/merged" } ] ``` , , , , mount(8)
Project: Checkov (Provisioning / Security & Compliance)
File: skips_issue.md

name: Skipping Issue about: Create an issue regarding checkov's skipping mechanism title: '' labels: 'skips' assignees: '' Describe the issue Please explain the functionality that is missing for you, what you did and what was the actual output. Examples Please share an example code sample (in the IaC of your choice) + the expected outcomes. Version (please complete the following information): Checkov Version [e.g. 22] Additional context Add any other context about the problem here.
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_plugin_client_common.TabModel.md

/ / TabModel .TabModel new TabModel(`uuid?`, `desiredStatusStripeDecoration?`, `doNotChangeActiveTab?`, `title?`, `state?`, `buttons?`, `initialCommandLine?`, `onClose?`, `_exec?`) | Name | Type | Default value | | :- | :- | : | | `_uuid` | `string` | `undefined` | | `desiredStatusStripeDecoration?` | `StatusStripeChangeEvent` | `undefined` | | `doNotChangeActiveTab?` | `boolean` | `undefined` | | `_title?` | `string` | `undefined` | | `_state` | `default` | `undefined` | | `_buttons` | `TopTabButton`<{ `key`: `string` }\>[] | `[]` | | `_initialCommandLine?` | `string` | `undefined` | | `_onClose?` | `string` | `undefined` | | `_exec?` | `"pexec"` \| `"qexec"` | `undefined` | `get` buttons(): `TopTabButton`<{ `key`: `string` }\>[] `TopTabButton`<{ `key`: `string` }\>[] `get` exec(): `"pexec"` \| `"qexec"` `"pexec"` \| `"qexec"` `get` initialCommandLine(): `string` `string` `get` onClose(): `string` `string` `get` state(): `default` `default` `get` title(): `string` `string` `get` uuid(): `string` `string` setTitle(`newTitle`): | Name | Type | | : | :- | | `newTitle` | `string` | update(`buttons`, `newTitle?`): | Name | Type | | :- | :- | | `buttons` | `TopTabButton`<{ `key`: `string` }\>[] | | `newTitle?` | `string` |
Project: KICS (Provisioning / Security & Compliance)
File: b3535a48-910c-47f8-8b3b-14222f29ef80.md

title: Nifcloud Vpn Gateway Undefined Security Group To Vpn Gateway hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b3535a48-910c-47f8-8b3b-14222f29ef80 Query name: Nifcloud Vpn Gateway Undefined Security Group To Vpn Gateway Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: Missing security group for vpn gateway<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "nifcloudvpngateway" "positive" { network_interface { networkid = "net-COMMONGLOBAL" } } ``` ```tf title="Negative test num. 1 - tf file" resource "nifcloudvpngateway" "negative" { securitygroup = nifcloudsecuritygroup.example.groupname network_interface { networkid = "net-COMMONGLOBAL" } } ```
Project: KICS (Provisioning / Security & Compliance)
File: environment_variables_list.md

This document lists all the environment variables that can be used in KICS grouped by their purpose. `KICS<targetflag>` `AWSACCESSKEY_ID` `AWSSECRETACCESS_KEY` `AWSSESSIONTOKEN` `ARMSUBSCRIPTIONID` `ARMCLIENTID` `ARMCLIENTCERTIFICATE_PATH` `ARMCLIENTCERTIFICATE_PASSWORD` `ARMTENANTID` `GOOGLEAPPLICATIONCREDENTIALS` `AWSACCOUNTID` `AWS_REGION` `ANSIBLEVAULTPASSWORD_FILE` `HTTP_PROXY` `HTTPS_PROXY` `NO_PROXY` `DISABLECRASHREPORT`
Project: KICS (Provisioning / Security & Compliance)
File: f465fff1-0a0f-457d-aa4d-1bddb6f204ff.md

title: Role With Privilege Escalation By Actions 'iam:AttachRolePolicy' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f465fff1-0a0f-457d-aa4d-1bddb6f204ff Query name: Role With Privilege Escalation By Actions 'iam:AttachRolePolicy' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Role with privilege escalation by actions 'iam:AttachRolePolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamrole" "cosmic" { name = "cosmic" } resource "awsiamrolepolicy" "testinline_policy" { name = "testinlinepolicy" role = awsiamrole.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:AttachRolePolicy", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Apollo (Provisioning / Automation & Configuration)
File: bug_report_en.md

name: Bug report about: Create a report to help us improve title: '' labels: '' assignees: '' <!-- The content in here will not be showTo forbid duplicationeasier search in the featurebefore you create an issueplease check the following. If your question is a newer/beginner'srecommend to https://github.com/ctripcorp/apollo/discussions to ask it. --> of this repository and believe that this is not a duplicate. of this repository and believe that this is not a duplicate. Describe the bug A clear and concise description of what the bug is. To Reproduce Steps to reproduce the behavior: Expected behavior A clear and concise description of what you expected to happen. Screenshots If applicable, add screenshots to help explain your problem. Version Error logs Configuration Platform and Operating System
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_kms_key_ring.md

+++ title = "googlekmskey_ring resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlekmskey_ring" identifier = "inspec/resources/gcp/googlekmskeyring.md googlekmskeyring resource" parent = "inspec/resources/gcp" +++ A `googlekmskey_ring` is used to test a Google KeyRing resource ```ruby describe googlekmskey_ring(project: 'chef-gcp-inspec', location: 'europe-west2', name: 'kms-key-ring') do it { should exist } its('create_time') { should be > Time.now - 36560602410 } its('keyringname'){ should eq 'kms-key-ring' } its('keyringurl'){ should match 'kms-key-ring' } end describe googlekmskey_ring(project: 'chef-gcp-inspec', location: 'europe-west2', name: "nonexistent") do it { should_not exist } end ``` describe googlekmskey_ring(project: 'chef-inspec-gcp', location: 'us-east1', name: 'key-ring-name') do it { should exist } end For any existing key ring, below should definitely be true! describe googlekmskey_ring(project: 'chef-inspec-gcp', location: 'us-east1', name: 'key-ring-name') do its('createtimedate') { should be > Time.now - 36560602450 } end Properties that can be accessed from the `googlekmskey_ring` resource: `create_time` : The time that this resource was created on the server. This is in RFC3339 text format. `keyringurl` : The full resource name for the KeyRing `location` : The location for the KeyRing. A full list of valid locations can be found by running `gcloud kms locations list`. Ensure the is enabled for the current project.
Project: ArangoDB (App Definition and Development / Database)
File: adl_bridging.md

+++ title = "ADL bridging" description = "" weight = 20 tags = [ "adl-bridging"] +++ {{% notice note %}} In Outcome v2.2 the ADL-based event hooks were replaced with policy-based event hooks (next page). The code in this section is still valid in v2.2 onwards, it's just that ADL is no longer used to find the hooks. {{% /notice %}} In a previous section, we used the `failure_info` type to create the ADL bridge into the namespace where the ADL discovered function was to be found. Here we do the same, but more directly by creating a thin clone of `std::error_code` into the local namespace. This ensures that this namespace will be searched by the compiler when discovering the event hooks (Outcome v2.1 and earlier only). {{% snippet "errorcodeextended.cpp" "errorcodeextended2" %}} For convenience, we template alias local copies of `result` and `outcome` in this namespace bound to the ADL bridging `error_code`.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: sybase_conf.md

+++ title = "sybase_conf resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "sybase_conf" identifier = "inspec/resources/os/sybaseconf.md sybaseconf resource" parent = "inspec/resources/os" +++ Use the `sybase_conf` Chef InSpec audit resource to test the configuration of an SAP Adaptive Server Enterprise (ASE) database. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} The `isql` command line tool must be installed on the target system. You must have access to a database user that has access to the `sa` role on the `master` database. A `sybase_conf` resource block declares the configuration item name, server, and password to use. describe sybase_session('config item', server: 'SYBASE', password: 'PASSWORD') do its('run_value') { should cmp 'EXPECTED' } its('config_value') { should cmp 'EXPECTED' } end where `sybaseconf` declares a configuration item, server, and password with permission to run `spconfigure`. `its('run_value') { should cmp 'expected' }` compares the current running value of the configuration item against an expected value. `its('config_value') { should cmp 'expected' }` compares the saved value of the configuration item against an expected value. The `sybaseconf` resource is based on the `sybasesession` resource and accepts all parameters that `sybasesession` accepts, including optional parameters `username`, `database`, `sybasehome`, and `bin`. In particular: Defaults to `master`. Defaults to `sa`. The following examples show how to use this Chef InSpec audit resource. ```ruby describe sybase_session('max memory', server: 'SYBASE', password: 'PASSWORD') do its('run_value') { should cmp 180224 } its('config_value') { should cmp 180224 } end ``` {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Docker Compose (App Definition and Development / Application Definition & Image Build)
File: compose_exec.md

<!MARKERGENSTART--> Execute a command in a running container | Name | Type | Default | Description | |:|:--|:--|:| | `-d`, `--detach` | | | Detached mode: Run command in the background | | `--dry-run` | | | Execute command in dry run mode | | `-e`, `--env` | `stringArray` | | Set environment variables | | `--index` | `int` | `0` | Index of the container if service has multiple replicas | | `-T`, `--no-TTY` | `bool` | `true` | Disable pseudo-TTY allocation. By default `docker compose exec` allocates a TTY. | | `--privileged` | | | Give extended privileges to the process | | `-u`, `--user` | `string` | | Run the command as this user | | `-w`, `--workdir` | `string` | | Path to workdir directory for this command | <!MARKERGENEND--> This is the equivalent of `docker exec` targeting a Compose service. With this subcommand, you can run arbitrary commands in your services. Commands allocate a TTY by default, so you can use a command such as `docker compose exec web sh` to get an interactive prompt.
Project: Distribution (Provisioning / Container Registry)
File: glossary.md

draft: true This page contains definitions for distribution related terms. <dl> <dt id="blob"><h4>Blob</h4></dt> <dd> <blockquote>A blob is any kind of content that is stored by a Registry under a content-addressable identifier (a "digest").</blockquote> <p> <a href="#layer">Layers</a> are a good example of "blobs". </p> </dd> <dt id="image"><h4>Image</h4></dt> <dd> <blockquote>An image is a named set of immutable data from which a container can be created.</blockquote> <p> An image is represented by a json file called a <a href="#manifest">manifest</a>, and is conceptually a set of <a href="#layer">layers</a>. Image names indicate the location where they can be pulled from and pushed to, as they usually start with a <a href="#registry">registry</a> domain name and port. </p> </dd> <dt id="layer"><h4>Layer</h4></dt> <dd> <blockquote>A layer is a tar archive bundling partial content from a filesystem.</blockquote> <p> Layers from an <a href="#image">image</a> are usually extracted in order on top of each other to make up a root filesystem from which containers run out. </p> </dd> <dt id="manifest"><h4>Manifest</h4></dt> <dd><blockquote>A manifest is the JSON representation of an image.</blockquote></dd> <dt id="namespace"><h4>Namespace</h4></dt> <dd><blockquote>A namespace is a collection of repositories with a common name prefix.</blockquote> <p> The namespace with an empty prefix is considered the Global Namespace. </p> </dd> <dt id="registry"><h4>Registry</h4></dt> <dd><blockquote>A registry is a service that let you store and deliver <a href="#images">images</a> and other content.</blockquote> </dd> <dt id="registry"><h4>Repository</h4></dt> <dd> <blockquote>A repository is a set of data containing all versions of a given image.</blockquote> </dd> <dt id="scope"><h4>Scope</h4></dt> <dd><blockquote>A scope is the portion of a namespace onto which a given authorization token is granted.</blockquote></dd> <dt id="tag"><h4>Tag</h4></dt> <dd><blockquote>A tag is conceptually a "version" of a <a href="#image">named image</a>.</blockquote> <p> Example: `docker pull myimage:latest` instructs docker to pull the image "myimage" in version "latest". </p> </dd> </dl>
Project: ko (App Definition and Development / Application Definition & Image Build)
File: install.md

``` $ VERSION=TODO # choose the latest version (without v prefix) $ OS=Linux # or Darwin $ ARCH=x86_64 # or arm64, i386, s390x ``` We generate using the OpenSSF's . To verify our release, install the verification tool from and verify as follows: ```shell $ curl -sSfL "https://github.com/ko-build/ko/releases/download/v${VERSION}/ko${VERSION}${OS}_${ARCH}.tar.gz" > ko.tar.gz $ curl -sSfL https://github.com/ko-build/ko/releases/download/v${VERSION}/multiple.intoto.jsonl > multiple.intoto.jsonl $ slsa-verifier verify-artifact --provenance-path multiple.intoto.jsonl --source-uri github.com/ko-build/ko --source-tag "v${VERSION}" ko.tar.gz Verified signature against tlog entry index 24413745 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77ab97a5263b5fa8f35789618348a39358b1f9470b0c31045effbbe5e23e77a5836 Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generatorgenericslsa3.yml@refs/tags/v1.7.0" at commit 200db7243f02b5c0303e21d8ab8e3b4ad3a229d0 Verifying artifact /Users/batuhanapaydin/workspace/ko/ko.tar.gz: PASSED PASSED: Verified SLSA provenance ``` ```shell $ tar xzf ko.tar.gz ko $ chmod +x ./ko ``` ```plaintext brew install ko ``` ```plaintext sudo port install ko ``` More info ```plaintext scoop install ko ``` Installation on Alpine requires using the ``` echo https://dl-cdn.alpinelinux.org/alpine/edge/testing/ >> /etc/apk/repositories apk update apk add ko ``` With Go 1.16+, build and install the latest released version: ```plaintext go install github.com/google/ko@latest ``` You can use the action to install ko and setup auth to in a GitHub Action workflow: ```plaintext steps: uses: ko-build/setup-ko@v0.6 ```
Project: FOSSA (Provisioning / Security & Compliance)
File: parsing-best-practices.md

We use `megaparsec` for text parsing. There are out there, and those are just the top 3 . Note: FOSSA employees can also talk to the analysis team directly, we can walk you through this. Some of this advice is directly given in the first tutorial, and is repeated here for emphasis. PLEASE READ THE TUTORIALS. Usually, you should add `type Parser = Parsec Void Text` to your parsing module, so that your parser functions can be of type `Parser a`, rather than the long-form `Parsec` version, or worse, the fully-verbose `ParsecT` version. When writing a non-trivial text parser, you should create the following helper functions: `sc`/`scn` - Space Consumer (or Space Consumer with Newlines) Use to create your whitespace consumer. READ THE DOCS FOR THAT FUNCTION IF YOU HAVEN'T YET! There's a lot of useful info there, and you'll need to know it. You don't always need to create both `sc` and `scn`, but you'll almost always need at least one. `symbol` - Parser for verbatim text strings. Use to create this helper. Use your `sc` or `scn` function for the whitespace consumer. You can use `Lexer.symbol'` if your text is case-insensitive. `lexeme` - Parser for any basic unit of the language. While `symbol` is for verbatim text parsing, `lexeme` is used with any parser that should consume space after finishing. For example, `Lexer.symbol` is implemented via `Lexer.lexeme`. Use to define this helper. Use your `sc` or `scn` function for the whitespace consumer. Don't use space parsers directly, since space is usually consumed by the helpers listed above. You can do this if absolutely necessary, but it is not likely to be necessary in the first place. Instead, `lexeme` and `symbol` will consume all whitespace after their parser automatically. There are some known exceptions, like HTTP messages, which require exactly two consecutive newlines to separate the header section from the body. Parsing arbitrary amounts of whitespace would be incorrect for an HTTP message parser. In this case, you should directly parse the newlines. Every parser must consume something, or fail. Successfully parsing after consuming no input commonly leads to infinite parsing loops. Using `pure` in an applicative parser is a sign that you may be consuming nothing, but indicating success. Usually, you're writing a parser which must consume an entire file. In this case, you should terminate the top-level parser with `eof`, which forces a parser to reach the end of input while successfully parsing along the way.