cwielenb/CNCF-Dataset huggingface dataset:
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.CodedError.md

/ / CodedError .CodedError | Name | Type | | :-- | :- | | `Code` | `number` | `Error` `CodedError` `Optional` body: `string` \| `Record`<`string`, `any`\> `Optional` code: `Code` `Optional` hide: `boolean` message: `string` Error.message node_modules/typescript/lib/lib.es5.d.ts:1023 name: `string` Error.name node_modules/typescript/lib/lib.es5.d.ts:1022 `Optional` partialMatches: [] `Optional` stack: `string` Error.stack node_modules/typescript/lib/lib.es5.d.ts:1024 `Optional` statusCode: `number`
Project: KICS (Provisioning / Security & Compliance)
File: 1db3a5a5-bf75-44e5-9e44-c56cfc8b1ac5.md

title: StatefulSet Without PodDisruptionBudget hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1db3a5a5-bf75-44e5-9e44-c56cfc8b1ac5 Query name: StatefulSet Without PodDisruptionBudget Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Availability URL: StatefulSets should be assigned with a PodDisruptionBudget to ensure high availability<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="19" apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: nginx-pdb spec: maxUnavailable: 1 selector: matchLabels: app: xpto apiVersion: apps/v1 kind: StatefulSet metadata: name: web spec: requiredDropCapabilities: ALL selector: matchLabels: app: nginx serviceName: "nginx" replicas: 3 template: metadata: labels: app: nginx spec: terminationGracePeriodSeconds: 10 containers: name: nginx image: k8s.gcr.io/nginx-slim:0.8 ports: containerPort: 80 name: web volumeMounts: name: www mountPath: /usr/share/nginx/html ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: nginx-pdb spec: maxUnavailable: 1 selector: matchLabels: app: nginx33 run: test apiVersion: apps/v1 kind: StatefulSet metadata: name: web spec: selector: matchLabels: app: nginx123 run: test serviceName: "nginx" replicas: 3 template: metadata: labels: app: nginx spec: terminationGracePeriodSeconds: 10 containers: name: nginx image: k8s.gcr.io/nginx-slim:0.8 ports: containerPort: 80 name: web volumeMounts: name: www mountPath: /usr/share/nginx/html ```
Project: KICS (Provisioning / Security & Compliance)
File: ae8827e2-4af9-4baa-9998-87539ae0d6f0.md

title: Peer Auto TLS Set To True hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ae8827e2-4af9-4baa-9998-87539ae0d6f0 Query name: Peer Auto TLS Set To True Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: When using etcd commands, the '--peer-auto-tls' should be set to false<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="21" apiVersion: apps/v1 kind: Deployment metadata: name: app-etcd-deployment spec: selector: matchLabels: app: app replicas: 1 template: metadata: labels: app: app version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/etcd:v3.2.18 imagePullPolicy: IfNotPresent command: ["etcd"] args: ["--peer-auto-tls=true"] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: app-etcd-deployment spec: selector: matchLabels: app: app replicas: 1 template: metadata: labels: app: app version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/etcd:v3.2.18 imagePullPolicy: IfNotPresent command: ["etcd"] args: [] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: app-etcd-deployment spec: selector: matchLabels: app: app replicas: 1 template: metadata: labels: app: app version: v1 spec: serviceAccountName: database containers: name: database image: gcr.io/google_containers/etcd:v3.2.18 imagePullPolicy: IfNotPresent command: ["etcd", "--peer-auto-tls=false"] args: [] nodeSelector: kubernetes.io/hostname: worker02 restartPolicy: OnFailure ```
Project: KICS (Provisioning / Security & Compliance)
File: 2263b286-2fe9-4747-a0ae-8b4768a2bbd2.md

title: BigQuery Dataset Is Public hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2263b286-2fe9-4747-a0ae-8b4768a2bbd2 Query name: BigQuery Dataset Is Public Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: BigQuery dataset is anonymously or publicly accessible<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" name: create a dataset google.cloud.gcpbigquerydataset: name: myexampledataset access: special_group: allAuthenticatedUsers dataset_reference: datasetid: myexample_dataset project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: create a dataset google.cloud.gcpbigquerydataset: name: myexampledataset dataset_reference: datasetid: myexample_dataset project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.10.7.md

RabbitMQ `3.10.7` is a maintenance release in the `3.10.x` release series. Please refer to the upgrade section from if upgrading from a version prior to 3.10.0. This release requires Erlang 24.x and supports Erlang 25. has more details on Erlang version requirements for RabbitMQ. Release notes can be found on GitHub at . Classic queue that used CQv2 (2nd generation index and message store) could run into an exception when lazy mode was enabled for them. GitHub issue: Stream coordinator now handles lots of client connections on a single stream more efficiently. Previously its memory footprint was likely to begin creeping up. GitHub issue: In environments where DNS resolution is not yet available at the time RabbitMQ nodes boot and try to perform , such as CoreDNS with default caching interval of 30s on Kubernetes, nodes now will retry hostname resolution (including of their own host) several times with a wait interval. The recommended solution is to . GitHub issue: Free disk space monitoring on Windows was reworked to rely on standard runtime features more instead of a 3rd party, closed source `handle.exe`. GitHub issues: , Reduce log noise when `sysctl` cannot be accessed by node memory monitor. GitHub issue: Prometheus plugin now exposes one more metric, `processstarttime_seconds`, the moment of node process startup in seconds. GitHub issue: Three more security-related response headers now can be set for all HTTP API endpoints: `X-Frame-Options` `X-Xss-Protection` `X-Content-Type-Options` ``` ini management.headers.contenttypeoptions = nosniff management.headers.xss_protection = 1; mode=block management.headers.frame_options = DENY ``` This is in addition to the , , and headers: ``` ini management.hsts.policy = max-age=31536000; includeSubDomains management.csp.policy = default-src 'self'; script-src 'self' 'unsafe-eval' management.headers.contenttypeoptions = nosniff management.headers.xss_protection = 1; mode=block management.headers.frame_options = DENY ``` GitHub issue: Shovels now handle consumer delivery timeouts gracefully and restart. Contributed by @Haster2004. GitHub issue: `osiris` upgraded from To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.10.7.tar.xz` instead of the source tarball produced by GitHub.
Project: YugabyteDB (App Definition and Development / Database)
File: upgrade-yp-airgapped.md

title: Upgrade air-gapped YugabyteDB Anywhere installation headerTitle: Upgrade air-gapped YugabyteDB Anywhere installation linkTitle: Upgrade air-gapped installation description: Upgrade air-gapped YugabyteDB Anywhere installation menu: v2.16_yugabyte-platform: identifier: upgrade-yp-airgapped parent: upgrade weight: 81 type: docs You can upgrade your air-gapped installation of YugabyteDB Anywhere to a newer version as follows: Manually obtain and move the binary Replicated license file `<filename>.rli` to the `/home/{username}/` directory. Manually obtain and move the YugabyteDB Anywhere air-gapped package to the `/opt/yugabyte/releases/<newversiondir>` directory. For example, if you are upgrading to the YugabyteDB Anywhere version 2.14, you would perform start by xecuting the following command to obtain the package: ```sh wget https://downloads.yugabyte.com/releases/2.14.0.0/yugaware-2.14.0.0-b94-linux-x86_64.airgap ``` Then you would create the `/opt/yugabyte/releases/yugaware-2.14.0.0-b94/` directory and move (or SCP) the `yugaware-2.14.0.0-b94-linux-x86_64.airgap` file into that directory. Log in to the Replicated Admin Console at <https://:8800/> and navigate to Settings to load the new license file, as per the following illustration: Change the two directories to match the ones you used. For example, enter `/opt/yugabyte/releases/yugaware-2.14.0.0-b94/` in the Update Path field and `/home/{user}/` in the License File field. Replicated detects updates based on the updated path information and applies them in the same way it does for connected YugabyteDB Anywhere installations. Proceed with the YugabyteDB Anywhere upgrade process by following instructions provided in . Upgrade your YugabyteDB universe by following instructions provided in .
Project: Apache Spark (App Definition and Development / Streaming & Messaging)
File: sql-ref-syntax-qry-select-offset.md

layout: global title: OFFSET Clause displayTitle: OFFSET Clause license: | Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. The `OFFSET` clause is used to specify the number of rows to skip before beginning to return rows returned by the statement. In general, this clause is used in conjunction with to ensure that the results are deterministic. ```sql OFFSET integer_expression ``` integer_expression* Specifies a foldable expression that returns an integer. ```sql CREATE TABLE person (name STRING, age INT); INSERT INTO person VALUES ('Zen Hui', 25), ('Anil B', 18), ('Shone S', 16), ('Mike A', 25), ('John A', 18), ('Jack N', 16); -- Skip the first two rows. SELECT name, age FROM person ORDER BY name OFFSET 2; +-++ | name|age| +-++ | John A| 18| | Mike A| 25| |Shone S| 16| |Zen Hui| 25| +-++ -- Skip the first two rows and returns the next three rows. SELECT name, age FROM person ORDER BY name LIMIT 3 OFFSET 2; +-++ | name|age| +-++ | John A| 18| | Mike A| 25| |Shone S| 16| +-++ -- A function expression as an input to OFFSET. SELECT name, age FROM person ORDER BY name OFFSET length('SPARK'); +-++ | name|age| +-++ |Zen Hui| 25| +-++ -- A non-foldable expression as an input to OFFSET is not allowed. SELECT name, age FROM person ORDER BY name OFFSET length(name); org.apache.spark.sql.AnalysisException: The offset expression must evaluate to a constant value ... ```
Project: Beam (App Definition and Development / Streaming & Messaging)
File: eBay.md

title: "Feature Powered by Apache Beam - Beyond Lambda" icon: /images/logos/powered-by/eBay.png hasNav: true cardDescription: "eBay is an American e-commerce company that provides business-to-consumer and consumer-to-consumer sales through the online website. They build feature pipelines with Apache Beam: unify feature extraction and selection in online and offline, speed up E2E iteration for model training, evaluation and serving, support different types (streaming, runtime, batch) of features, etc. eBay leverages Apache Beam for the streaming feature SDK as a foundation to integrate with Kafka, Hadoop, Flink, Airflow and others in eBay." <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <div> <header class="case-study-header"> <h2 itemprop="name headline">Feature Powered by Apache Beam - Beyond Lambda</h2> </header> eBay is an American e-commerce company that provides business-to-consumer and consumer-to-consumer sales through the online website. They build feature pipelines with Apache Beam: unify feature extraction and selection in online and offline, speed up E2E iteration for model training, evaluation and serving, support different types (streaming, runtime, batch) of features, etc. eBay leverages Apache Beam for the streaming feature SDK as a foundation to integrate with Kafka, Hadoop, Flink, Airflow and others in eBay. </div>
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_cloudfunctions_cloud_functions.md

+++ title = "googlecloudfunctionscloud_functions resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlecloudfunctionscloud_functions" identifier = "inspec/resources/gcp/googlecloudfunctionscloudfunctions.md googlecloudfunctionscloudfunctions resource" parent = "inspec/resources/gcp" +++ A `googlecloudfunctionscloud_functions` is used to test a Google CloudFunction resource ```ruby describe googlecloudfunctionscloud_functions(project: 'chef-gcp-inspec', location: 'europe-west1') do its('descriptions') { should include 'A description of the function' } its('entry_points') { should include 'hello' } end ``` Properties that can be accessed from the `googlecloudfunctionscloud_functions` resource: See the resource for more information. `names` : an array of `googlecloudfunctionscloud_function` name `descriptions` : an array of `googlecloudfunctionscloud_function` description `statuses` : an array of `googlecloudfunctionscloud_function` status `entry_points` : an array of `googlecloudfunctionscloudfunction` entrypoint `runtimes` : an array of `googlecloudfunctionscloud_function` runtime `timeouts` : an array of `googlecloudfunctionscloud_function` timeout `availablememorymbs` : an array of `googlecloudfunctionscloudfunction` availablememory_mb `serviceaccountemails` : an array of `googlecloudfunctionscloudfunction` serviceaccount_email `update_times` : an array of `googlecloudfunctionscloudfunction` updatetime `version_ids` : an array of `googlecloudfunctionscloudfunction` versionid `labels` : an array of `googlecloudfunctionscloud_function` labels `environment_variables` : an array of `googlecloudfunctionscloudfunction` environmentvariables `sourcearchiveurls` : an array of `googlecloudfunctionscloudfunction` sourcearchive_url `sourceuploadurls` : an array of `googlecloudfunctionscloudfunction` sourceupload_url `source_repositories` : an array of `googlecloudfunctionscloudfunction` sourcerepository `https_triggers` : an array of `googlecloudfunctionscloudfunction` httpstrigger `event_triggers` : an array of `googlecloudfunctionscloudfunction` eventtrigger `locations` : an array of `googlecloudfunctionscloud_function` location This resource supports all of the above properties as filter criteria, which can be used with `where` as a block or a method. Ensure the is enabled for the current project.
Project: KICS (Provisioning / Security & Compliance)
File: 89218b48-75c9-4cb3-aaba-5299e852e8bc.md

title: Nifcloud Computing Undefined Security Group To Instance hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 89218b48-75c9-4cb3-aaba-5299e852e8bc Query name: Nifcloud Computing Undefined Security Group To Instance Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: Missing security group for instance<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "nifcloud_instance" "positive" { imageid = data.nifcloudimage.ubuntu.id network_interface { networkid = "net-COMMONGLOBAL" } } ``` ```tf title="Negative test num. 1 - tf file" resource "nifcloud_instance" "negative" { imageid = data.nifcloudimage.ubuntu.id securitygroup = nifcloudsecuritygroup.example.groupname network_interface { networkid = "net-COMMONGLOBAL" } } ```
Project: ArangoDB (App Definition and Development / Database)
File: terminate.md

+++ title = "`terminate`" description = "Policy class defining that `std::terminate()` should be called on incorrect wide value, error or exception observation. Inherits publicly from `base`." +++ Policy class defining that {{% api "std::terminate()" %}} should be called on incorrect wide value, error or exception observation. Inherits publicly from {{% api "base" %}}, and its narrow value, error and exception observer policies are inherited from there. Included by `<basicresult.hpp>`, and so is always available when `basicresult` is available. Requires: Nothing. Namespace: `BOOSTOUTCOMEV2_NAMESPACE::policy` Header: `<boost/outcome/policy/terminate.hpp>`
Project: Updatecli (Provisioning / Automation & Configuration)
File: pull_request_template.md

Fix #XXX <!-- Describe the changes introduced by this pull request --> To test this pull request, you can run the following commands: ```shell cd <topackagedirectory> go test ``` <!-- Please describe, if any, the tradeoffs that you found acceptable in this pull request --> <!-- Please describe, if any, potential improvement that you are envisioning -->
Project: KICS (Provisioning / Security & Compliance)
File: c09e3ca5-f08a-4717-9c87-3919c5e6d209.md

title: RDS DB Instance Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c09e3ca5-f08a-4717-9c87-3919c5e6d209 Query name: RDS DB Instance Publicly Accessible Platform: Ansible Severity: <span style="color:#ff0000">Critical</span> Category: Insecure Configurations URL: RDS must not be defined with public interface, which means the field 'publicly_accessible' should not be set to 'true' (default is 'false').<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12 22" name: community - Create a DB instance using the default AWS KMS encryption key community.aws.rds_instance: id: test-encrypted-db state: present engine: mariadb storage_encrypted: True dbinstanceclass: db.t2.medium username: "{{ username }}" password: "{{ password }}" allocatedstorage: "{{ allocatedstorage }}" publicly_accessible: Yes name: community - Basic mysql provisioning example community.aws.rds: command: create instance_name: new-database db_engine: MySQL size: 10 instance_type: db.m1.small username: mysql_admin password: 1nsecure publicly_accessible: "true" tags: Environment: testing Application: cms ``` ```yaml title="Negative test num. 1 - yaml file" name: create RDS instance in default VPC and default subnet group02 community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: '{{ password }}' username: '{{ username }}' cluster_id: ansible-test-cluster publicly_accessible: false name: create RDS instance in default VPC and default subnet group03 rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: '{{ password }}' username: '{{ username }}' cluster_id: ansible-test-cluster ```
Project: CloudEvents (App Definition and Development / Streaming & Messaging)
File: aws-s3.md

This document describes how to convert into CloudEvents. AWS S3 event documentation: https://docs.aws.amazon.com/AmazonS3/latest/dev/notification-content-structure.html All S3 events are converted into CloudEvents using the same pattern as described in the following table: | CloudEvents Attribute | Value | | :-- | :- | | `id` | "responseElements.x-amz-request-id" + `.` + "responseElements.x-amz-id-2" | | `source` | "eventSource" value + `.` + "awsRegion" value + `.` + "s3.buckets.name" value | | `specversion` | `1.0` | | `type` | `com.amazonaws.s3.` + "eventName" value | | `datacontenttype` | S3 event type (e.g. `application/json`) | | `dataschema` | Omit | | `subject` | "s3.object.key" value | | `time` | "eventTime" value | | `data` | S3 event | Comments: While the "eventSource" value will always be static (`aws:s3`) when the event is coming from S3, if some other cloud provider is supporting the S3 event format it is expected that this value will not be `aws:s3` for them - it is expected to be something specific to their environment. Consumers of these events will therefore be able to know if the event is an S3 type of event (regardless of whether it is coming from S3 or an S3-compatible provider) by detecting the `com.amazonaws.s3` prefix on the `type` attribute.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: launchd_service.md

+++ title = "launchd_service resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "launchd_service" identifier = "inspec/resources/os/launchdservice.md launchdservice resource" parent = "inspec/resources/os" +++ Use the `launchd_service` Chef InSpec audit resource to test a service using Launchd. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `launchd_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service: describe launchdservice('servicename') do it { should be_installed } it { should be_enabled } it { should be_running } end where `('service_name')` must specify a service name `beinstalled`, `beenabled`, and `be_running` are valid matchers for this resource; all matchers available to the `service` resource may be used The path to the service manager's control may be specified for situations where the path isn't available in the current `PATH`. For example: describe launchdservice('servicename', '/path/to/control') do it { should be_enabled } it { should be_installed } it { should be_running } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `be_enabled` matcher tests if the named service is enabled: it { should be_enabled } The `be_installed` matcher tests if the named service is installed: it { should be_installed } The `be_running` matcher tests if the named service is running: it { should be_running }
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: creds.md

The [username[:password]] to use to authenticate with the registry, if required. If one or both values are not supplied, a command line prompt appears and the value can be entered. The password is entered without echo. Note that the specified credentials are only used to authenticate against target registries. They are not used for mirrors or when the registry gets rewritten (see `containers-registries.conf(5)`); to authenticate against those consider using a `containers-auth.json(5)` file.