cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: e38a8e0a-b88b-4902-b3fe-b0fcb17d5c10.md

title: Resource Not Using Tags hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e38a8e0a-b88b-4902-b3fe-b0fcb17d5c10 Query name: Resource Not Using Tags Platform: Terraform Severity: <span style="color:#5bc0de">Info</span> Category: Best Practices URL: AWS services resource tags are an essential part of managing components. As a best practice, the field 'tags' should have additional tags defined other than 'Name'<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 14" resource "awsacmcertificate" "cert" { domain_name = "example.com" validation_method = "DNS" lifecycle { createbeforedestroy = true } } resource "awsacmcertificate" "cert_2" { domain_name = "example.com" validation_method = "DNS" tags = { Name = "test" } lifecycle { createbeforedestroy = true } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsacmcertificate" "cert" { domain_name = "example.com" validation_method = "DNS" tags = { Environment = "test" } lifecycle { createbeforedestroy = true } } resource "awsacmcertificate_validation" "example" { certificatearn = awsacm_certificate.example.arn validationrecordfqdns = [for record in awsroute53record.example : record.fqdn] } ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_network_security_groups.md

+++ title = "azurermnetworksecurity_groups resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurermnetworksecurity_groups" identifier = "inspec/resources/azure/azurermnetworksecuritygroups.md azurermnetworksecuritygroups resource" parent = "inspec/resources/azure" +++ {{< inspec/azurermdeprecated resource="azurenetworksecuritygroups" >}} Use the `azurermnetworksecurity_groups` InSpec audit resource to enumerate Network Security Groups. This resource interacts with version `2018-02-01` of the Azure Management API. For more information see the . At the moment, there doesn't appear to be a way to select the version of the Azure API docs. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: name: inspec-azure git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . An `azurermnetworksecurity_groups` resource block identifies Network Security Groups by Resource Group. describe azurermnetworksecuritygroups(resourcegroup: 'ExampleGroup') do ... end describe azurermnetworksecuritygroups(resourcegroup: 'ExampleGroup') do its('names') { should include('ExampleNetworkSecurityGroup') } end `names` The name of the Network Security Group its('names') { should include('ExampleNetworkSecurityGroup') } {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The control will pass if the resource returns a result. Use `should_not` if you expect zero matches. describe azurermnetworksecuritygroups(resourcegroup: 'ExampleGroup') do it { should exist } end describe azurermnetworksecuritygroups(resourcegroup: 'EmptyExampleGroup') do it { should_not exist } end Your [Service Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal) must be setup with a `contributor` role on the subscription you wish to test.
Project: Meshery (Provisioning / Automation & Configuration)
File: argocd-operator.md

layout: integration title: Argo CD Operator subtitle: Collaborative and visual infrastructure as code for Argo CD Operator image: /assets/img/integrations/argocd-operator/icons/color/argocd-operator-color.svg permalink: extensibility/integrations/argocd-operator docURL: https://docs.meshery.io/extensibility/integrations/argocd-operator description: integrations-category: App Definition and Development integrations-subcategory: Continuous Integration & Delivery registrant: Artifact Hub components: name: argo-cd-export colorIcon: assets/img/integrations/argocd-operator/components/argo-cd-export/icons/color/argo-cd-export-color.svg whiteIcon: assets/img/integrations/argocd-operator/components/argo-cd-export/icons/white/argo-cd-export-white.svg description: name: argo-cd colorIcon: assets/img/integrations/argocd-operator/components/argo-cd/icons/color/argo-cd-color.svg whiteIcon: assets/img/integrations/argocd-operator/components/argo-cd/icons/white/argo-cd-white.svg description: name: application colorIcon: assets/img/integrations/argocd-operator/components/application/icons/color/application-color.svg whiteIcon: assets/img/integrations/argocd-operator/components/application/icons/white/application-white.svg description: name: application-set colorIcon: assets/img/integrations/argocd-operator/components/application-set/icons/color/application-set-color.svg whiteIcon: assets/img/integrations/argocd-operator/components/application-set/icons/white/application-set-white.svg description: name: app-project colorIcon: assets/img/integrations/argocd-operator/components/app-project/icons/color/app-project-color.svg whiteIcon: assets/img/integrations/argocd-operator/components/app-project/icons/white/app-project-white.svg description: featureList: [ "Declarative continuous delivery with a fully-loaded UI.", "Application definitions, configurations, and environments can be declarative and version controlled.", "Application deployment and lifecycle management can be automated, auditable, and easy to understand." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: StarRocks (App Definition and Development / Database)
File: array_max.md

displayed_sidebar: "English" Obtains the maximum value of all data in an ARRAY and return this result. ```Haskell array_max(array(type)) ``` ```plain text mysql> select array_max([113, 11, 12]); ++ | array_max([113,11,12]) | ++ | 113 | ++ mysql> select array_max([11.33, 11.11, 12.324]); ++ | array_max([11.33,11.11,12.324]) | ++ | 12.324 | ++ mysql> select array_max([cast('2020-02-25 11:35:17' as datetime), cast('2019-08-25 17:07:10' as datetime), cast('2025-08-25 17:07:10' as datetime)]); +--+ | array_max([CAST('2020-02-25 11:35:17' AS DATETIME),CAST('2019-08-25 17:07:10' AS DATETIME),CAST('2025-08-25 17:07:10' AS DATETIME)]) | +--+ | 2025-08-25 17:07:10 | +--+ ``` ARRAY_MAX,ARRAY
Project: KICS (Provisioning / Security & Compliance)
File: acc78859-765e-4011-a229-a65ea57db252.md

title: S3 Bucket Allows Delete Action From All Principals hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: acc78859-765e-4011-a229-a65ea57db252 Query name: S3 Bucket Allows Delete Action From All Principals Platform: CloudFormation Severity: <span style="color:#ff0000">Critical</span> Category: Access Control URL: S3 Buckets must not allow Delete Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when the 'Action' is Delete, for all Principals.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="22 7" Resources: SampleBucketPolicy3: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: "DeleteObject" Effect: Allow Resource: "*" Principal: "*" Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' SampleBucketPolicy4: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: "DeleteObject" "GetObject" Effect: Allow Resource: "*" Principal: "*" Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Positive test num. 2 - json file" hl_lines="9 35" { "Resources": { "SampleBucketPolicy5": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": "DeleteObject", "Effect": "Allow", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } }, "SampleBucketPolicy6": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": [ "DeleteObject", "GetObject" ], "Effect": "Allow", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: SampleBucketPolicy1: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Statement: Action: 's3:DeleteObject' Effect: Deny Resource: '*' Principal: '*' Condition: StringLike: 'aws:Referer': 'http://www.example.com/*' 'http://example.net/*' ``` ```json title="Negative test num. 2 - json file" { "Resources": { "SampleBucketPolicy2": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DOC-EXAMPLE-BUCKET" }, "PolicyDocument": { "Statement": [ { "Action": [ "s3:DeleteObject" ], "Effect": "Deny", "Resource": "*", "Principal": "*", "Condition": { "StringLike": { "aws:Referer": [ "http://www.example.com/*", "http://example.net/*" ] } } } ] } } } } } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl.md

layout: default title: mesheryctl permalink: reference/mesheryctl/main redirect_from: reference/mesheryctl/main/ type: reference display-title: "false" language: en command: mesheryctl subcommand: nil Meshery Command Line tool As a self-service engineering platform, Meshery enables collaborative design and operation of cloud native infrastructure. <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl [flags] </div> </pre> Base command: <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl </div> </pre> Display help about command/subcommand: <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl --help </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system start --help </div> </pre> For viewing verbose output: <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl -v [or] --verbose </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -h, --help help for mesheryctl -v, --verbose verbose output </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_restore_vars.md

title: "Command - devspace restore vars" sidebar_label: devspace restore vars Restores variable values from kubernetes ``` devspace restore vars [flags] ``` ``` Restores devspace config variable values from a kubernetes secret. Examples: devspace restore vars devspace restore vars --namespace test devspace restore vars --vars-secret my-secret ``` ``` -h, --help help for vars ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: fix-12672.en.md

Load `{data_dir}/configs/cluster.hocon` when generating node boot config. Logging related config changes made from the dashboard are persisted in `{data_dir}/configs/cluster.hocon`. Prior to this change, it only takes `etc/emqx.conf` to generate the boot config (including the logger part), then `{data_dir}/configs/cluster.hocon` is loaded to reconfigure the logger after boot is complete. This late reconfigure may cause some log segment files to be lost. Now `{data_dir}/configs/cluster.hocon` and `etc/emqx.conf` are both loaded (`emqx.conf` overlaying on top) to generate boot config.
Project: YugabyteDB (App Definition and Development / Database)
File: yedis.md

title: Enable users in YEDIS headerTitle: Enable users in YEDIS description: Enable users in YEDIS. menu: v2.18: name: Enable users identifier: enable-authentication-3-yedis parent: enable-authentication weight: 715 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li > <a href="../ysql/" class="nav-link"> <i class="icon-postgres" aria-hidden="true"></i> YSQL </a> </li> <li > <a href="../ycql/" class="nav-link"> <i class="icon-cassandra" aria-hidden="true"></i> YCQL </a> </li> <li> <a href="../yedis/" class="nav-link active"> <i class="icon-redis" aria-hidden="true"></i> YEDIS </a> </li> </ul> YEDIS authentication is based on passwords. Each client connecting using the YEDIS API should provide a valid password in order to execute any command successfully. NOTE: YEDIS implements a password-only authentication scheme. From the , the open source version of Redis does not try to implement authentication, providing a small layer of authentication that can optionally be enabled in the `redis.conf` file. You can enable password-based authentication in YEDIS API using the command. To do so, connect to the cluster using `redis-cli` and run the following command: ```sql 127.0.0.1:6379> CONFIG SET requirepass "password" ``` ``` "OK" ``` Next exit `redis-cli`, connect to the cluster again using `redis-cli` and run the `PING` command (or any other command). ```sql 127.0.0.1:6379> PING ``` ``` (error) NOAUTH PING: Authentication required. ``` You would need to authenticate the client (`redis-cli` in this case) by running the command: ```sql 127.0.0.1:6379> AUTH password ``` ``` "OK" ``` Subsequently, running any command would succeed: ```sql 127.0.0.1:6379> PING ``` ``` PONG ``` YEDIS allows for multiple passwords (up to 2) to be accepted. This enables performing a graceful change of password without experiencing any application outage. Note that this requires knowing the old password. Let us assume that the old password is `old-password` and the new password you intend to change it to is `new-password`. The preferred sequence is: Add a new password ```sql 127.0.0.1:6379> CONFIG SET requirepass "old-password,new-password" ``` This enables connecting to the database using both passwords. Change password used by the application tier This would involve changing the config or pushing an updated binary to the application tier so that it now connects using `new-password`. Drop old password ```sql 127.0.0.1:6379> CONFIG SET requirepass "new-password" ```
Project: KICS (Provisioning / Security & Compliance)
File: 0c7a76d9-7dc5-499e-81ac-9245839177cb.md

title: ECS Cluster with Container Insights Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0c7a76d9-7dc5-499e-81ac-9245839177cb Query name: ECS Cluster with Container Insights Disabled Platform: Crossplane Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: ECS Cluster should enable container insights<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" apiVersion: ecs.aws.crossplane.io/v1alpha1 kind: Cluster metadata: name: example spec: forProvider: region: us-east-1 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="8" apiVersion: ecs.aws.crossplane.io/v1alpha1 kind: Cluster metadata: name: example spec: forProvider: region: us-east-1 settings: [] ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="8" apiVersion: ecs.aws.crossplane.io/v1alpha1 kind: Cluster metadata: name: example spec: forProvider: region: us-east-1 settings: name: "containerInsights" value: "disabled" ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: ecs.aws.crossplane.io/v1alpha1 kind: Cluster metadata: name: example spec: forProvider: region: us-east-1 settings: name: "containerInsights" value: "enabled" ```
Project: ClickHouse (App Definition and Development / Database)
File: v22.6.4.35-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : - Change `all|noarch` packages to architecture-dependent - Fix some documentation for it - Push aarch64|arm64 packages to artifactory and release assets - Fixes . (). Backported in : Fix possible crash in `Distributed` async insert in case of removing a replica from config. (). Backported in : Fix s3 seekable reads with parallel read buffer. (Affected memory usage during query). Closes . (). Backported in : Update `simdjson`. This fixes . (). Backported in : - Fix settings profile with seconds unit. (). Backported in : Any allocations inside OvercommitTracker may lead to deadlock. Logging was not very informative so it's easier just to remove logging. Fixes . (). Backported in : Fix bug in filesystem cache that could happen in some corner case which coincided with cache capacity hitting the limit. Closes . (). Backported in : Fix error `Block structure mismatch` which could happen for INSERT into table with attached MATERIALIZED VIEW and enabled setting `extremes = 1`. Closes and . (). Backported in : Fixed error `Not found column Type in block` in selects with `PREWHERE` and read-in-order optimizations. (). Backported in : Declare RabbitMQ queue without default arguments `x-max-length` and `x-overflow`. (). Backported in : Fix incorrect fetch postgresql tables query fro PostgreSQL database engine. Closes . (). Backported in :. (). Use native Map type for OpenTelemetry attributes (). Retry docker buildx commands with progressive sleep in between (). Add docker_server.py running to backport and release CIs (). Fix meilisearch tests ().
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: feat-12833.en.md

Added REST API endpoints and CLI commands for durable storage management. New REST endpoints: `/ds/sites` `/ds/sites/:site` `/ds/storages` `/ds/storages/:ds` `/ds/storages/:ds/replicas` `/ds/storages/:ds/replicas/:site` New CLI commands: `ds set_replicas` `ds join` `ds leave`
Project: YugabyteDB (App Definition and Development / Database)
File: tsadd.md

title: TSADD linkTitle: TSADD description: TSADD menu: preview: parent: api-yedis weight: 2400 aliases: /preview/api/redis/tsadd /preview/api/yedis/tsadd type: docs `TSADD key timestamp value [timestamp value ...] [EXPIRE_IN TTL] [EXPIRE_AT UNIX_TIMESTAMP]` This command sets the data for the given `timestamp` with the given `value` in the time series that is specified by `key`. This is useful in storing time series like data where the `key` could be a metric, the `timestamp` is the time when the metric was generated and `value` is the value of the metric at the given `timestamp`. If the given `timestamp` already exists in the specified time series, this command overwrites the existing value with the given `value`. If the given `key` does not exist, a new time series is created for the `key`, and the given values are inserted to the associated given fields. If the given `key` exists, but is not of time series type, an error is raised. If the given `timestamp` is not a valid signed 64 bit integer, an error is raised. `EXPIRE_IN TTL` sets the TTL (time-to-live) in seconds for the entries being added. `EXPIREAT UNIXTIMESTAMP` ensures that the entries added would expire by the given (seconds since January 1, 1970). Returns the appropriate status string. The timestamp can be arbitrary integers used just for sorting values in a certain order. ```sh $ TSADD cpu_usage 10 "70" ``` ``` "OK" ``` ```sh $ TSADD cpu_usage 20 "80" 30 "60" 40 "90" ``` ``` "OK" ``` We could also encode the timestamp as yyyymmddhhmm, since this would still produce integers that are sortable by the actual timestamp. ```sh $ TSADD cpu_usage 201710311100 "50" ``` ``` "OK" ``` A more common option would be to specify the timestamp as the unix timestamp ```sh $ TSADD cpu_usage 1509474505 "75" ``` ``` "OK" ``` ```sh $ TSGET cpu_usage 10 ``` ``` "70" ``` ```sh $ TSGET cpu_usage 201710311100 ``` ``` "50" ``` ```sh $ TSGET cpu_usage 1509474505 ``` ``` "75" ``` Set a TTL of 3600 seconds (1 hour) for an entry that you add. ```sh $ TSADD cpuusage 60 "70" EXPIREIN 3600 ``` ``` "OK" ``` Ensure that the entry we're adding would expire at the unix_timestamp 3513642307. ```sh $ TSADD cpuusage 70 "80" EXPIREAT 3513642307 ``` ``` "OK" ``` , , , , ,