cwielenb/CNCF-Dataset huggingface dataset:
Project: Trivy (Provisioning / Security & Compliance)
File: kyverno.md

This tutorial is based on the following blog post by Chip Zoller: This tutorial details Verify the container image has an attestation with Kyverno A running Kubernetes cluster that kubectl is connected to A Container image signed with Cosign and an attestation generated for a Trivy Vulnerability scan. The following policy ensures that the attestation is no older than 168h: vuln-attestation.yaml {% raw %} ```bash apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: check-vulnerabilities spec: validationFailureAction: Enforce background: false webhookTimeoutSeconds: 30 failurePolicy: Fail rules: name: checking-vulnerability-scan-not-older-than-one-hour match: any: resources: kinds: Pod verifyImages: imageReferences: "*" attestations: type: https://cosign.sigstore.dev/attestation/vuln/v1 conditions: all: key: "{{ time_since('','{{ metadata.scanFinishedOn }}', '') }}" operator: LessThanOrEquals value: "1h" attestors: count: 1 entries: keys: publicKeys: |- --BEGIN PUBLIC KEY-- abc xyz --END PUBLIC KEY-- ``` {% endraw %} Ensure that you have Kyverno already deployed and running on your cluster -- for instance through he Kyverno Helm Chart. Next, apply the above policy: ``` kubectl apply -f vuln-attestation.yaml ``` To ensure that the policy worked, we can deploy an example Kubernetes Pod with our container image: ``` kubectl run app-signed --image= docker.io/anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fd ``` Note that the image is based on the Once we apply the deployment, it should pass since our attestation is available: ``` kubectl apply -f deployment.yaml -n app deployment.apps/cns-website created ``` However, if we try to deploy any other container image, our deployment will fail. We can verify this by replacing the image referenced in the deployment with `docker.io/anaisurlichs/cns-website:0.0.5` and applying the deployment: ``` kubectl run app-unsigned --image=docker.io/anaisurlichs/cns-website:0.1.1 Resource: "apps/v1, Resource=deployments", GroupVersionKind: "apps/v1, Kind=Deployment" Name: "cns-website", Namespace: "app" for: "deployment-two.yaml": admission webhook "mutate.kyverno.svc-fail" denied the request: resource Deployment/app/cns-website was blocked due to the following policies check-image: autogen-check-image: | failed to verify signature for docker.io/anaisurlichs/cns-website:0.0.5: .attestors[0].entries[0].keys: no matching signatures: ```
Project: Harbor (Provisioning / Container Registry)
File: 1-12-admin-assign-sys-admin-role.md

Test 1-12 - Admin User Assign and Remove Admin Role to a User. ======= To verify that Admin user can assign/remove admin role to/from a user. User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against a local database. ( auth_mode is set to db_auth* .) The user data is stored in a local database. Log in as the admin user to the UI. The admin user should see a list of users in "Admin Options". From the list, the admin user assigns system admin role to a user A. On a different browser(e.g. if the admin logs in using Chrome, then choose Safari or FireFox ), log in as user A to verify that user A has admin privilege. From the list, the admin user removes system admin role from user A. On a different browser, refresh the UI to verify user A has no admin privilege any more. As described in steps 1-6. None
Project: Meshery (Provisioning / Automation & Configuration)
File: aws-cloudwatchlogs-controller.md

layout: integration title: AWS CloudWatch Logs subtitle: Collaborative and visual infrastructure as code for AWS CloudWatch Logs image: /assets/img/integrations/aws-cloudwatchlogs-controller/icons/color/aws-cloudwatchlogs-controller-color.svg permalink: extensibility/integrations/aws-cloudwatchlogs-controller docURL: https://docs.meshery.io/extensibility/integrations/aws-cloudwatchlogs-controller description: integrations-category: Observability and Analysis integrations-subcategory: Management Governance registrant: GitHub components: name: field-export colorIcon: assets/img/integrations/aws-cloudwatchlogs-controller/components/field-export/icons/color/field-export-color.svg whiteIcon: assets/img/integrations/aws-cloudwatchlogs-controller/components/field-export/icons/white/field-export-white.svg description: name: adopted-resource colorIcon: assets/img/integrations/aws-cloudwatchlogs-controller/components/adopted-resource/icons/color/adopted-resource-color.svg whiteIcon: assets/img/integrations/aws-cloudwatchlogs-controller/components/adopted-resource/icons/white/adopted-resource-white.svg description: name: log-group colorIcon: assets/img/integrations/aws-cloudwatchlogs-controller/components/log-group/icons/color/log-group-color.svg whiteIcon: assets/img/integrations/aws-cloudwatchlogs-controller/components/log-group/icons/white/log-group-white.svg description: featureList: [ "Two classes of log groups for flexibility CloudWatch Logs offers two classes of log groups so that you can have a cost-effective option for logs that you access infrequently. ", "Query your log data You can use CloudWatch Logs Insights to interactively search and analyze your log data. ", "Detect and debug using Live Tail You can use Live Tail to quickly troubleshoot incidents by viewing a streaming list of new log events as they are ingested. " ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: external-secrets (Provisioning / Security & Compliance)
File: gcr.md

GCRAccessToken creates a GCP Access token that can be used to authenticate with GCR in order to pull OCI images. You won't need any extra permissions to request for a token, but the token would only work against a GCR if the token requester (service Account or WI) has the appropriate access You must specify the `spec.projectID` in which GCR is located. | Key | Description | | - | - | | username | username for the `docker login` command. | | password | password for the `docker login` command. | | expiry | time when token expires in UNIX time (seconds since January 1, 1970 UTC). | Use `spec.auth.workloadIdentity` to point to a Service Account that has Workload Identity enabled. For details see . Use `spec.auth.secretRef` to point to a Secret that contains a GCP Service Account. For details see . ```yaml {% include 'generator-gcr.yaml' %} ``` Example `ExternalSecret` that references the GCR generator: ```yaml {% include 'generator-gcr-example.yaml' %} ```
Project: cert-manager (Provisioning / Security & Compliance)
File: PULL_REQUEST_TEMPLATE.md

<!-- Thanks for opening a pull request! Here are some tips to get everything merged smoothly: Read our contributor guidelines: https://cert-manager.io/docs/contributing/ Make sure your commits are signed off: https://cert-manager.io/docs/contributing/sign-off/ If the PR is unfinished, raise it as a draft or prefix the title with "WIP:" so it's clear to everyone. Be sure to allow edits from maintainers so it's easier for us to help: https://help.github.com/en/articles/allowing-changes-to-a-pull-request-branch-created-from-a-fork --> <!-- Explain the motivation behind this PR. If there's a related issue or PR, link to it here! --> <!-- Pick a kind which best describes your PR from the following list: <cleanup | bug | feature | documentation | design | flake> If you're unsure which is best or if you're not sure what we mean by "kind", just ignore this section and a maintainer will fill it in for you! --> <!-- Should we mention this PR in release notes? If so, replace "NONE" with a line of text explaining what changed! For more details, see: https://git.k8s.io/community/contributors/guide/release-notes.md --> ```release-note NONE ```
Project: Harbor (Provisioning / Container Registry)
File: 1-02-DB-user-log-in-log-out.md

Test 1-02 - User Log In and Log Out (DB Mode) ======= To verify that a non-admin user can log in and log out when users are managed locally by Harbor (DB mode). User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against a local database. ( auth_mode is set to db_auth* .) The user data is stored in a local database. A linux host with Docker CLI installed (Docker client). NOTE: Use a non-admin user for this test case. Admin user has other test cases. A non-admin user logs in to the UI by username. The user logs out from the UI. A non-admin user logs in to the UI by email. The user logs out from the UI. Use the incorrect password and username/email of the user to log in to the UI and check the error message. On a Docker client host, use `docker login <harbor_host>` command to verify the user can log in by either the username or email . (check both) Use `docker login <harbor_host>` command to log in with incorrect password by either the username or email . The user can log in via UI in Step 1 & 3, verify the dashboard and navigation bar are for a non-admin user. (should not see admin options) After the user logged out in Step 2 & 4, the login page will be displayed again. The error message in Step 5 should not show which input value is incorrect. It should only display the username(email) and password combination is incorrect. Docker client can log in in Step 6. Docker client fails to log in in Step 7. None
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: mongodb.md

MongoDB is a general purpose, document-based, distributed database built for modern application developers and for the cloud era. MongoDB is a document database, which means it stores data in JSON-like documents. from 4.0 - `uselagoon/mongo-4` This Dockerfile is intended to be used to set up a standalone MongoDB database server. This image is prepared to be used on Lagoon. There are therefore some things already done: Folder permissions are automatically adapted with , so this image will work with a random user, and therefore also on Kubernetes or OpenShift.
Project: KICS (Provisioning / Security & Compliance)
File: 7f79f858-fbe8-4186-8a2c-dfd0d958a40f.md

title: IAM Access Key Is Exposed hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 7f79f858-fbe8-4186-8a2c-dfd0d958a40f Query name: IAM Access Key Is Exposed Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Check if IAM Access Key is active for some user besides 'root'<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="26 36 7" name: Create two new IAM users with API keys community.aws.iam: iam_type: user name: "{{ item }}" state: present password: "{{ temp_pass }}" accesskeystate: active loop: jcleese mpython name: Create two new IAM users with API keys community.aws.iam: iam_type: user name: "{{ item }}" state: present password: "{{ temp_pass }}" accesskeystate: active loop: root mpython name: Create Two Groups, Mario and Luigi community.aws.iam: iam_type: group name: "{{ item }}" state: present accesskeystate: active loop: Mario Luigi register: new_groups name: Update user community.aws.iam: iam_type: user name: jdavila state: update accesskeystate: active groups: "{{ item.createdgroup.groupname }}" loop: "{{ new_groups.results }}" ``` ```yaml title="Negative test num. 1 - yaml file" name: Create two new IAM users with API keys community.aws.iam: iam_type: user name: '{{ item }}' state: present password: '{{ temp_pass }}' accesskeystate: create loop: jcleese mpython name: Create two new IAM users with API keys community.aws.iam: iam_type: user name: root state: present password: '{{ temp_pass }}' accesskeystate: active name: Create Two Groups, Mario and Luigi community.aws.iam: iam_type: group name: '{{ item }}' state: present loop: Mario Luigi register: new_groups name: Update user community.aws.iam: iam_type: user name: jdavila state: update accesskeystate: inactive groups: '{{ item.createdgroup.groupname }}' loop: '{{ new_groups.results }}' ```
Project: Stolon (App Definition and Development / Database)
File: ssl.md

SSL/TLS access to an HA postgres managed by stolon can be configured as usual (see the ). The setup is done . If this is enabled also replication between instances will use tls (currently it'll use the default replication mode of "prefer"). If you want to enable client side full verification (`sslmode=verify-full` in the client connection string) you should configure the certificate CN to contain the FQDN or IP address that your client will use to connect to the stolon proxies. Depending on your architecture you'll have more than one stolon proxies behind a load balancer, a keepealived ip, a k8s service etc... So the certificate CN should be set to the hostname or ip that your client will connect to. For the above reasons, the certificate, key and root CA files will usually be the same for every postgres instance (primary or standbys) so they can be put inside the PGDATA directory (so they could be automatically copied to new instances during a resync) or also outside it (in this case you should ensure that they exists and are available to the postgres instance).
Project: KICS (Provisioning / Security & Compliance)
File: 2bb13841-7575-439e-8e0a-cccd9ede2fa8.md

title: Ram Account Password Policy Max Password Age Unrecommended hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2bb13841-7575-439e-8e0a-cccd9ede2fa8 Query name: Ram Account Password Policy Max Password Age Unrecommended Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: Ram Account Password Policy Password 'maxpasswordage' should be higher than 0 and lower than 91<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true passwordreuseprevention = 5 maxloginattempts = 3 } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="8" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 92 passwordreuseprevention = 5 maxloginattempts = 3 } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="8" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 0 passwordreuseprevention = 5 maxloginattempts = 3 } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudramaccountpasswordpolicy" "corporate" { minimumpasswordlength = 9 requirelowercasecharacters = false requireuppercasecharacters = false require_numbers = false require_symbols = false hard_expiry = true maxpasswordage = 12 passwordreuseprevention = 5 maxloginattempts = 3 } ```
Project: YugabyteDB (App Definition and Development / Database)
File: jsonb-array-elements.md

title: jsonbarrayelements() and jsonarrayelements() linkTitle: jsonbarrayelements() headerTitle: jsonbarrayelements() and jsonarrayelements() description: Transform JSON values of a JSON array into a SQL table of jsonb values using jsonbarrayelements() and jsonarrayelements(). menu: v2.18: identifier: jsonb-array-elements parent: json-functions-operators weight: 60 type: docs Purpose: Transform the JSON values of a JSON array into a SQL table of (i.e., `SETOF`) `jsonb` values. Signature: For the `jsonb` variant: ``` input value: jsonb return value: SETOF jsonb ``` Notes: Each function in this pair requires that the supplied JSON value is an array. They are the counterparts, for an array, to for a JSON object. Notice that the JSON value null becomes a genuine SQL `NULL`. However, SQL array comparison and `record` comparison use `IS NOT DISTINCT FROM` semantics, and not the semantics that the comparison of scalars uses. So the simple `ASSERT` that `elements = expected_elements` is `TRUE` is sufficient. See the section . ```plpgsql do $body$ declare j_array constant jsonb := '["cat", "dog house", 42, true, {"x": 17}, null]'; j jsonb; elements jsonb[]; expected_elements constant jsonb[] := array[ '"cat"'::jsonb, '"dog house"'::jsonb, '42'::jsonb, 'true'::jsonb, '{"x": 17}'::jsonb, 'null'::jsonb ]; n int := 0; begin for j in (select jsonbarrayelements(j_array)) loop n := n + 1; elements[n] := j; end loop; assert elements = expected_elements, 'unexpected'; end; $body$; ```
Project: ClickHouse (App Definition and Development / Database)
File: v22.6.5.22-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Fix seeking while reading from encrypted disk. This PR fixes . (). Backported in : Former packages used to install systemd.service file to `/etc`. The files there are marked as `conf` and are not cleaned out, and not updated automatically. This PR cleans them out. (). Backported in : Fix reading of sparse columns from `MergeTree` tables that store their data in S3. (). Backported in : Fix `parallelviewprocessing=1` with `optimizetrivialinsertselect=1`. Fix `maxinsert_threads` while pushing to views. (). Backported in : Fix data race and possible heap-buffer-overflow in Avro format. Closes Closes . (). Backported in : Fix bug with maxsplit argument for splitByChar, which was not working correctly. (). Backported in : Fix wrong index analysis with tuples and operator `IN`, which could lead to wrong query result. (). Backported in : Fix `CANNOTREADALLDATA` exception with `localfilesystemreadmethod=pread_threadpool`. This bug affected only Linux kernel version 5.9 and 5.10 according to . (). Fix reading from s3 in some corner cases (). Replace MemoryTrackerBlockerInThread to LockMemoryExceptionInThread (). Change mysql-odbc url ().
Project: Dex (Provisioning / Security & Compliance)
File: PULL_REQUEST_TEMPLATE.md

<!-- Thank you for sending a pull request! Here are some tips for contributors: Fill the description template below. Sign a DCO (if you haven't already signed it). Include appropriate tests (if necessary). Make sure that all CI checks passed. If the Pull Request is a work in progress, make use of GitHub's "Draft PR" feature and mark it as such. --> <!-- Describe your changes briefly here. --> <!-- Please state in detail why we need this PR and what it solves. If your PR closes some of the existing issues, please add links to them here. Mentioned issues will be automatically closed. Usage: "Closes #<issue number>", or "Closes (paste link of issue)" -->
Project: SuperEdge (Provisioning / Automation & Configuration)
File: roadmap.md

This document describes some of the major features of SuperEdge development in 2021. The features included here are inspired by the SuperEdge users and community, which mean to give a general idea of what we are planning to inspire further engagement from the community. Let us know on if you have any questions regarding the roadmap. SuperEdge installation Air-gap installation Edge autonomy data caching at the edge with multiple alternative storages Canary deployment for ServiceGroup Support SSH into edge nodes from central cloud Support joining edge nodes in a batch Automatically remove abnormal endpoints via edge autonomy Certificates auto renewal Support statefulSets and headless services in ServiceGroup Support Service Mesh Optimize DNS at the edge Improve logging and monitoring Supports Cambricon device plugin Platform high availability at the edge Security enhancements AI solutions Support containerd runtime Support Kubernetes v1.20 End-to-end tests
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-system.md

layout: default title: mesheryctl-system permalink: reference/mesheryctl/system redirect_from: reference/mesheryctl/system/ type: reference display-title: "false" language: en command: system subcommand: nil Meshery Lifecycle Management Manage the state and configuration of Meshery server, components, and client. <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system [flags] </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -c, --context string (optional) temporarily change the current context. -h, --help help for system -y, --yes (optional) assume yes for user interactive prompts. </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -v, --verbose verbose output </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_compute_project_info.md

+++ title = "googlecomputeproject_info resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlecomputeproject_info" identifier = "inspec/resources/gcp/googlecomputeprojectinfo.md googlecomputeprojectinfo resource" parent = "inspec/resources/gcp" +++ A `googlecomputeproject_info` is used to test a Google ProjectInfo resource This resource has beta fields available. To retrieve these fields, include `beta: true` in the constructor for the resource ``` describe googlecomputeproject_info(project: 'chef-gcp-inspec') do it { should exist } its('defaultserviceaccount') { should match "developer.gserviceaccount.com" } end ``` describe googlecomputeproject_info(project: 'chef-inspec-gcp') do it { should exist } end describe googlecomputeproject_info(project: 'chef-inspec-gcp') do its('defaultserviceaccount') { should eq '12345-compute@developer.gserviceaccount.com' } end Properties that can be accessed from the `googlecomputeproject_info` resource: `name` : The name of this project `commoninstancemetadata` : Metadata shared for all instances in this project `items` : Array of key/values `key` : Key of the metadata key/value pair `value` : Value of the metadata key/value pair `enabled_features` : Restricted features enabled for use on this project `defaultserviceaccount` : Default service account used by VMs in this project `xpnprojectstatus` : The role this project has in a shared VPC configuration. `defaultnetworktier` : The default network tier used for configuring resources in this project `quotas` : Quotas applied to this project `metric` : Name of the quota metric `limit` : Quota limit for this metric `usage` : Current usage of this metric `owner` : Owning resource. This is the resource on which this quota is applied. `creation_timestamp` : Creation timestamp in RFC3339 text format. Ensure the is enabled for the current project.