cwielenb/CNCF-Dataset huggingface dataset:
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-route53-controller.md

layout: integration title: AWS Route 53 subtitle: Collaborative and visual infrastructure as code for AWS Route 53 image: /assets/img/integrations/aws-route53-controller/icons/color/aws-route53-controller-color.svg permalink: extensibility/integrations/aws-route53-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-route53-controller description: integrations-category: Cloud Native Network integrations-subcategory: Networking Content Delivery registrant: GitHub components: name: field-export colorIcon: assets/img/integrations/aws-route53-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-route53-controller/components/field-export/icons/white/field-export-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-route53-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-route53-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: hosted-zone colorIcon: assets/img/integrations/aws-route53-controller/components/hosted-zone/icons/color/hosted-zone-color.svg whiteIcon: assets/img/integrations/aws-route53-controller/components/hosted-zone/icons/white/hosted-zone-white.svg description: name: record-set colorIcon: assets/img/integrations/aws-route53-controller/components/record-set/icons/color/record-set-color.svg whiteIcon: assets/img/integrations/aws-route53-controller/components/record-set/icons/white/record-set-white.svg description: featureList: [ "Route end users to your site reliably with globally-dispersed Domain Name System (DNS) servers and automatic scaling.", "Set up your DNS routing in minutes with domain name registration and straightforward visual traffic flow tools.", "Customize your DNS routing policies to reduce latency, improve application availability, and maintain compliance." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: mirrord (App Definition and Development / Application Definition & Image Build)
File: feature_request.md

name: Feature request about: Suggest an idea for this project labels: [enhancement] <!-- Thank you for sharing your idea! Please describe your idea in depth. If you're not sure what to write, imagine the following: How is this important to you? How would you use it? Can you think of any alternatives? Do you have any ideas about how it can be implemented? Are you willing/able to implement it? Do you need mentoring? -->
Project: SPIFFE (Provisioning / Key Management)
File: CODE-OF-CONDUCT.md

We follow the . Additionally, we commit to the following guidelines as detailed on the : Our goal is to foster an inclusive and diverse community of technology enthusiasts. Try to be your best self. Treat your fellow community members with kindness and empathy. We welcome disagreements when they are conducted respectfully and without personal attacks. We ask that you keep unstructured critique to a minimum. Disparaging remarks about the project are unnecessary and a drain on community morale. Feedback should be constructive and relevant. Having passionately held opinions on what should improve is encouraged! We hope you will use that enthusiasm to roll up your sleeves and get involved by submitting pull requests. We have additional guidelines on . We don't tolerate insults, spamming, trolling, flaming, baiting, or harassment. We don't tolerate sexual language, imagery, or unwanted advances. Private harassment is also unacceptable. We do our best to avoid : small actions that make others feel uncomfortable. If you witness a subtle-ism, you may respectfully point it out to the person publicly or privately, or you may ask a moderator to say something. Accidentally saying something biased is common, expected, and readily forgiven. It is not in and of itself a bannable offense. If you feel any of SPIFFE's communication channels require moderation, please e-mail the . The SSC will issue a warning to users who don't follow this code of conduct. A second offense results in a temporary ban. A third offense warrants a permanent ban. It is at the moderator's discretion to un-ban offending users, or to immediately ban a toxic user without warning.
Project: ClickHouse (App Definition and Development / Database)
File: users.md

slug: /en/operations/system-tables/users Contains a list of configured at the server. Columns: `name` () User name. `id` () User ID. `storage` () Path to the storage of users. Configured in the `accesscontrolpath` parameter. `authtype` (('nopassword' = 0, 'plaintextpassword' = 1, 'sha256password' = 2, 'doublesha1password' = 3, 'ldap' = 4, 'kerberos' = 5, 'sslcertificate' = 6, 'bcryptpassword' = 7)) Shows the authentication type. There are multiple ways of user identification: with no password, with plain text password, with -encoded password, with -encoded password or with -encoded password. `authparams` () Authentication parameters in the JSON format depending on the `authtype`. `host_ip` (()) IP addresses of hosts that are allowed to connect to the ClickHouse server. `host_names` (()) Names of hosts that are allowed to connect to the ClickHouse server. `hostnamesregexp` (()) Regular expression for host names that are allowed to connect to the ClickHouse server. `hostnameslike` (()) Names of hosts that are allowed to connect to the ClickHouse server, set using the LIKE predicate. `defaultrolesall` () Shows that all granted roles set for user by default. `defaultroleslist` (()) List of granted roles provided by default. `defaultrolesexcept` (()) All the granted roles set as default excepting of the listed ones.
Project: kube-hunter (Provisioning / Security & Compliance)
File: KHV041.md

vid: KHV041 title: Exposed Port Forward categories: [Remote Code Execution] severity: high An attacker could read and write data from a pod via the kubelet's `/portForward` endpoint. This endpoint is exposed as part of the kubelet's debug handlers. Disable `--enable-debugging-handlers` kubelet flag.
Project: KICS (Provisioning / Security & Compliance)
File: 5ba6229c-8057-433e-91d0-21cf13569ca9.md

title: Service Control Policies Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5ba6229c-8057-433e-91d0-21cf13569ca9 Query name: Service Control Policies Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Check if the Amazon Organizations ensure that all features are enabled to achieve full control over the use of AWS services and actions across multiple AWS accounts using Service Control Policies (SCPs).<br> ```tf title="Positive test num. 1 - tf file" hl_lines="7" resource "awsorganizationsorganization" "positive1" { awsserviceaccess_principals = [ "cloudtrail.amazonaws.com", "config.amazonaws.com", ] featureset = "CONSOLIDATEDBILLING" } ``` ```tf title="Negative test num. 1 - tf file" resource "awsorganizationsorganization" "negative1" { awsserviceaccess_principals = [ "cloudtrail.amazonaws.com", "config.amazonaws.com", ] feature_set = "ALL" } ```
Project: KICS (Provisioning / Security & Compliance)
File: 89f84a1e-75f8-47c5-83b5-bee8e2de4168.md

title: Monitoring Log Profile Without All Activities hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 89f84a1e-75f8-47c5-83b5-bee8e2de4168 Query name: Monitoring Log Profile Without All Activities Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Monitoring log profile captures all the activities (Action, Write, Delete)<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9 21" name: Create a log profile azurermmonitorlogprofile: name: myProfile location: eastus locations: eastus westus categories: Write Action retention_policy: enabled: False days: 1 storage_account: resource_group: myResourceGroup name: myStorageAccount register: output name: Create a log profile2 azurermmonitorlogprofile: name: myProfile location: eastus locations: eastus westus retention_policy: enabled: False days: 1 storage_account: resource_group: myResourceGroup name: myStorageAccount register: output ``` ```yaml title="Negative test num. 1 - yaml file" name: Create a log profile azurermmonitorlogprofile: name: myProfile location: eastus locations: eastus westus categories: Write Action Delete retention_policy: enabled: false days: 1 storage_account: resource_group: myResourceGroup name: myStorageAccount register: output ```
Project: KICS (Provisioning / Security & Compliance)
File: 555ab8f9-2001-455e-a077-f2d0f41e2fb9.md

title: Unpinned Actions Full Length Commit SHA hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 555ab8f9-2001-455e-a077-f2d0f41e2fb9 Query name: Unpinned Actions Full Length Commit SHA Platform: CICD Severity: <span style="color:#edd57e">Low</span> Category: Supply-Chain URL: Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12" name: test-positive on: pull_request: types: [opened, synchronize, edited, reopened] branches: master jobs: test-positive: runs-on: ubuntu-latest steps: name: PR comment uses: thollander/actions-comment-pull-request@v2 with: commenttag: titlecheck mode: recreate createifnot_exists: true ``` ```yaml title="Negative test num. 1 - yaml file" name: test-positive on: pull_request: types: [opened, synchronize, edited, reopened] branches: master jobs: test-positive: runs-on: ubuntu-latest steps: name: PR comment uses: thollander/actions-comment-pull-request@b07c7f86be67002023e6cb13f57df3f21cdd3411 with: commenttag: titlecheck mode: recreate createifnot_exists: true ``` ```yaml title="Negative test num. 2 - yaml file" name: test-positive on: pull_request: types: [opened, synchronize, edited, reopened] branches: master jobs: test-positive: runs-on: ubuntu-latest steps: name: Checkout Code uses: actions/checkout@v4 with: persist-credentials: false ``` ```yaml title="Negative test num. 3 - yaml file" name: test-negative3 on: pull_request: types: [opened, synchronize, edited, reopened] branches: master jobs: test-negative3: runs-on: ubuntu-latest steps: name: Local action uses: ./test.yml ```
Project: KICS (Provisioning / Security & Compliance)
File: 113208f2-a886-4526-9ecc-f3218600e12c.md

title: User With Privilege Escalation By Actions 'iam:CreateAccessKey' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 113208f2-a886-4526-9ecc-f3218600e12c Query name: User With Privilege Escalation By Actions 'iam:CreateAccessKey' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: User with privilege escalation by actions 'iam:CreateAccessKey' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamuser" "cosmic" { name = "cosmic" } resource "awsiamuserpolicy" "testinline_policy" { name = "testinlinepolicy" user = awsiamuser.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:CreateAccessKey", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" users = [awsiamuser.cosmic.name] roles = [awsiamrole.role.name] groups = [awsiamgroup.group.name] } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: ArangoDB (App Definition and Development / Database)
File: error_lvalue_const.md

+++ title = "`const error_type &error() const &`" description = "Wide contract const lvalue reference observer of the stored error. Constexpr propagating." categories = ["observers"] weight = 750 +++ Wide contract const lvalue reference observer of the stored error. `NoValuePolicy::wideerrorcheck()` is first invoked, then the reference to the error is returned. As a valid default constructed error is always present, no undefined behaviour occurs if `NoValuePolicy::wideerrorcheck()` returns. Note that if `error_type` is `void`, only a `const` overload returning `void` is present. Requires: Always available. Complexity: Depends on `NoValuePolicy::wideerrorcheck()`. Guarantees: None.
Project: Distribution (Provisioning / Container Registry)
File: MAINTAINERS.md

This page lists all active maintainers of this repository. If you were a maintainer and would like to add your name to the Emeritus list, please send us a PR. See for governance guidelines and how to become a maintainer. See for general contribution guidelines. , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC , Google LLC
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: daemon.eg.md

```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: addon-node-exporter namespace: vela-system spec: components: name: node-exporter type: daemon properties: image: prom/node-exporter imagePullPolicy: IfNotPresent volumeMounts: hostPath: mountPath: /host/sys mountPropagation: HostToContainer name: sys path: /sys readOnly: true mountPath: /host/root mountPropagation: HostToContainer name: root path: / readOnly: true traits: properties: args: --path.sysfs=/host/sys --path.rootfs=/host/root --no-collector.wifi --no-collector.hwmon --collector.filesystem.ignored-mount-points=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/pods/.+)($|/) --collector.netclass.ignored-devices=^(veth.*)$ type: command properties: annotations: prometheus.io/path: /metrics prometheus.io/port: "8080" prometheus.io/scrape: "true" port: 9100 type: expose properties: cpu: 0.1 memory: 250Mi type: resource ```
Project: YugabyteDB (App Definition and Development / Database)
File: type_serial.md

title: Serial data types [YSQL] headerTitle: Serial data types linkTitle: Serial description: YSQL serial data types include SMALLSERIAL (SMALLINT), SERIAL (INTEGER), and BIGSERIAL (BIGINT). menu: v2.18: identifier: api-ysql-datatypes-serial parent: api-ysql-datatypes type: docs SMALLSERIAL, SERIAL, and BIGSERIAL are short notation for sequences of `SMALLINT`, `INTEGER`, and `BIGINT`, respectively. ```ebnf type_specification ::= SMALLSERIAL | SERIAL | BIGSERIAL ``` Columns of serial types are auto-incremented. `SERIAL` does not imply that an index is created on the column. Serial types are sequences under the hood, and its values can be cached on the YB-TServer using the `ysqlsequencecache_method` flag. For more information, see .
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.7.5.md

layout: release date: 2023-12-28 tag: v0.7.5 [HELM] Fix Ingress Resource of Meshery @theBeginner86 (#9755) preload kubernetesresourceobject_meta @MUzairS15 (#9753) [Connection Register] - Register MeshSync data as a connection @senali-d (#9548) [bug] Fix Searching + Preloading Issue @theBeginner86 (#9754) [Docs] enhance: Customizing Meshery's Installation with values.yaml @leecalcote (#9747) Thank you to our contributors for making this release possible: @MUzairS15, @leecalcote, @senali-d and @theBeginner86
Project: ClickHouse (App Definition and Development / Database)
File: caches.md

slug: /en/operations/caches sidebar_position: 65 sidebar_label: Caches title: "Cache Types" description: When performing queries, ClickHouse uses different caches. When performing queries, ClickHouse uses different caches. Main cache types: `mark_cache` Cache of marks used by table engines of the family. `uncompressed_cache` Cache of uncompressed data used by table engines of the family. Operating system page cache (used indirectly, for files with actual data). Additional cache types: DNS cache. cache. Compiled expressions cache. schemas cache. data cache. Schema inference cache. over S3, Azure, Local and other disks. . To drop one of the caches, use statements.
Project: KICS (Provisioning / Security & Compliance)
File: 4d3817db-dd35-4de4-a80d-3867157e7f7f.md

title: Storage Container Is Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4d3817db-dd35-4de4-a80d-3867157e7f7f Query name: Storage Container Is Publicly Accessible Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Anonymous, public read access to a container and its blobs are enabled in Azure Blob Storage<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9 17" name: Create container foo and upload a file azurermstorageblob: resource_group: myResourceGroup storageaccountname: clh0002 container: foo blob: graylog.png src: ./files/graylog.png content_type: 'application/image' public_access: blob name: Create container foo2 and upload a file azurermstorageblob: resource_group: myResourceGroup storageaccountname: clh0002 container: foo2 blob: graylog.png src: ./files/graylog.png public_access: container content_type: 'application/image' ``` ```yaml title="Negative test num. 1 - yaml file" name: Create container foo and upload a file azurermstorageblob: resource_group: myResourceGroup storageaccountname: clh0002 container: foo blob: graylog.png src: ./files/graylog.png content_type: application/image ```
Project: Trivy (Provisioning / Security & Compliance)
File: signature-verification.md

All binaries and container images are signed by . You need the following tool: Use the following command for keyless : ```shell cosign verify aquasec/trivy:<version> \ --certificate-identity-regexp 'https://github\.com/aquasecurity/trivy/\.github/workflows/.+' \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" ``` You should get the following output ```shell Verification for index.docker.io/aquasec/trivy:latest -- The following checks were performed on each of these signatures: The cosign claims were validated Existence of the claims in the transparency log was verified offline The code-signing certificate was verified using trusted certificate authority certificates .... ``` Download the required tarball, associated signature and certificate files Use the following command for keyless verification: ```shell cosign verify-blob <path to binray> \ --certificate <path to cert> \ --signature <path to sig> \ --certificate-identity-regexp 'https://github\.com/aquasecurity/trivy/\.github/workflows/.+' \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" ``` You should get the following output ``` Verified OK ``` For example: ```shell $ wget "https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy0.45.0Linux-32bit.tar.gz" $ wget "https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy0.45.0Linux-32bit.tar.gz.pem" $ wget "https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy0.45.0Linux-32bit.tar.gz.sig" $ cosign verify-blob trivy0.45.0Linux-32bit.tar.gz \ --certificate trivy0.45.0Linux-32bit.tar.gz.pem \ --signature trivy0.45.0Linux-32bit.tar.gz.sig \ --certificate-identity-regexp 'https://github\.com/aquasecurity/trivy/\.github/workflows/.+' \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" Vetified OK ``` RPM and Deb packages are also signed by GPG. The public key downloaded . Download the public key ```shell curl https://aquasecurity.github.io/trivy-repo/rpm/public.key \ --output pub.key ``` Import the key ```shell rpm --import pub.key ``` Verify that the key has been imported ```shell rpm -q --queryformat "%{SUMMARY}\n" $(rpm -q gpg-pubkey) ``` You should get the following output ```shell gpg(trivy) ``` Download the required binary ```shell curl -L https://github.com/aquasecurity/trivy/releases/download/<version>/<file name>.rpm \ --output trivy.rpm ``` Check the binary with the following command ```shell rpm -K trivy.rpm ``` You should get the following output ```shell trivy.rpm: digests signatures OK ```
Project: Apache Hadoop (App Definition and Development / Database)
File: RELEASENOTES.0.23.9.md

<! --> These release notes cover new developer and user-facing incompatibilities, important issues, features, and major improvements. | Critical | Namenode doesn't change the number of missing blocks in safemode when DNs rejoin or leave* This change makes name node keep its internal replication queues and data node state updated in manual safe mode. This allows metrics and UI to present up-to-date information while in safe mode. The behavior during start-up safe mode is unchanged.
Project: ORY Hydra (Provisioning / Key Management)
File: Pagination.md

Name | Type | Description | Notes | - | - | - PageSize | Pointer to int64 | Items per page This is the number of items per page to return. For details on pagination please head over to the . | [optional] [default to 250] PageToken | Pointer to string | Next Page Token The next page token. For details on pagination please head over to the . | [optional] [default to "1"] `func NewPagination() *Pagination` NewPagination instantiates a new Pagination object This constructor will assign default values to properties that have it defined, and makes sure properties required by API are set, but the set of arguments will change when the set of required properties is changed `func NewPaginationWithDefaults() *Pagination` NewPaginationWithDefaults instantiates a new Pagination object This constructor will only assign default values to properties that have it defined, but it doesn't guarantee that properties required by API are set `func (o *Pagination) GetPageSize() int64` GetPageSize returns the PageSize field if non-nil, zero value otherwise. `func (o Pagination) GetPageSizeOk() (int64, bool)` GetPageSizeOk returns a tuple with the PageSize field if it's non-nil, zero value otherwise and a boolean to check if the value has been set. `func (o *Pagination) SetPageSize(v int64)` SetPageSize sets PageSize field to given value. `func (o *Pagination) HasPageSize() bool` HasPageSize returns a boolean if a field has been set. `func (o *Pagination) GetPageToken() string` GetPageToken returns the PageToken field if non-nil, zero value otherwise. `func (o Pagination) GetPageTokenOk() (string, bool)` GetPageTokenOk returns a tuple with the PageToken field if it's non-nil, zero value otherwise and a boolean to check if the value has been set. `func (o *Pagination) SetPageToken(v string)` SetPageToken sets PageToken field to given value. `func (o *Pagination) HasPageToken() bool` HasPageToken returns a boolean if a field has been set.