cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: e76cca7c-c3f9-4fc9-884c-b2831168ebd8.md

title: Invalid Image hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e76cca7c-c3f9-4fc9-884c-b2831168ebd8 Query name: Invalid Image Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Supply-Chain URL: Image must be defined and not be empty or equal to latest.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8 113 60" resource "kubernetes_pod" "positive1" { metadata { name = "terraform-example" } spec { container { image = "" name = "example" env = { name = "environment" value = "test" } port = { container_port = 8080 } liveness_probe = { http_get = { path = "/nginx_status" port = 80 http_header = { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetes_pod" "positive2" { metadata { name = "terraform-example" } spec { container { name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetes_pod" "positive3" { metadata { name = "terraform-example" } spec { container = [ { image = "latest" name = "example" env = { name = "environment" value = "test" } port = { container_port = 8080 } liveness_probe = { http_get = { path = "/nginx_status" port = 80 http_header = { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } ] dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_pod" "negative" { metadata { name = "terraform-example" } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ```
Project: ClickHouse (App Definition and Development / Database)
File: uniqcombined.md

slug: /en/sql-reference/aggregate-functions/reference/uniqcombined sidebar_position: 192 Calculates the approximate number of different argument values. ``` sql uniqCombined(HLL_precision)(x[, ...]) ``` The `uniqCombined` function is a good choice for calculating the number of different values. Arguments `HLLprecision`: The base-2 logarithm of the number of cells in . Optional, you can use the function as `uniqCombined(x[, ...])`. The default value for `HLLprecision` is 17, which is effectively 96 KiB of space (2^17 cells, 6 bits each). `X`: A variable number of parameters. Parameters can be `Tuple`, `Array`, `Date`, `DateTime`, `String`, or numeric types. Returned value A number -type number. Implementation details The `uniqCombined` function: Calculates a hash (64-bit hash for `String` and 32-bit otherwise) for all parameters in the aggregate, then uses it in calculations. Uses a combination of three algorithms: array, hash table, and HyperLogLog with an error correction table. For a small number of distinct elements, an array is used. When the set size is larger, a hash table is used. For a larger number of elements, HyperLogLog is used, which will occupy a fixed amount of memory. Provides the result deterministically (it does not depend on the query processing order). :::note Since it uses a 32-bit hash for non-`String` types, the result will have very high error for cardinalities significantly larger than `UINT_MAX` (error will raise quickly after a few tens of billions of distinct values), hence in this case you should use . ::: Compared to the function, the `uniqCombined` function: Consumes several times less memory. Calculates with several times higher accuracy. Usually has slightly lower performance. In some scenarios, `uniqCombined` can perform better than `uniq`, for example, with distributed queries that transmit a large number of aggregation states over the network. Example Query: ```sql SELECT uniqCombined(number) FROM numbers(1e6); ``` Result: ```response uniqCombined(number) 1001148 -- 1.00 million ``` See the example section of for an example of the difference between `uniqCombined` and `uniqCombined64` for much larger inputs. See Also
Project: StarRocks (App Definition and Development / Database)
File: array_avg.md

displayed_sidebar: "English" Calculates the average value of all data in an ARRAY and return this result. ```Haskell array_avg(array(type)) ``` `array(type)` supports the following types of elements: BOOLEAN, TINYINT, SMALLINT, INT, BIGINT, LARGEINT, FLOAT, DOUBLE, DECIMALV2. ```plain text mysql> select array_avg([11, 11, 12]); +--+ | array_avg([11,11,12]) | +--+ | 11.333333333333334 | +--+ mysql> select array_avg([11.33, 11.11, 12.324]); ++ | array_avg([11.33,11.11,12.324]) | ++ | 11.588 | ++ ``` ARRAY_AVG,ARRAY
Project: CloudEvents (App Definition and Development / Streaming & Messaging)
File: demos.md

<!-- no verify-specs --> If you have a demo of CloudEvents in action, please add a link here. If there isn't an associated blog or github repo, feel free to add descriptive text as a markdown file in `docs/demos/`. Simulating CloudEvents with and - Nov 18, 2021 Presentation and Live demo at AsyncAPI Conference 2021: . Blog post: . - May 18, 2020 Blog post about Cloud Events Orchestration using an workflow engine(). Instructions: You can find the . - Jun 23, 2020 Blog post on how to use process events monitoring to understand the business process behind a choreography using Cloud Events Instructions: You can find the . CNCF/Kube-Con EU - May, 2018 CloudEvents interop demo during Austen Collins' Participants: Alibaba, Google, IBM, iguazio, RedHat, Serverless.com, VMware Info on demo structure: https://github.com/ac360/cloudevents-demo Code from demo: - CNCF/Kube-Con NA - Dec, 2018 CloudEvents interop demo during Serverless WG Intro () Participants: IBM, Knative, Oracle, OpenFaaS, VMware, Microsoft, Huawei, SAP, PayPal Info on demo structure: Demo web site (if still available): http://srcdog.com/madlibs
Project: OpenAPI (App Definition and Development / Application Definition & Image Build)
File: schema_object.md

The following content shall be used to replace the Fixed Fields table in the Schema Object section |Field Name | Type | Description | ||::|| | nullable | `boolean` | Allows sending a `null` value for the defined schema. Default value is `false`.| | discriminator | | Adds support for polymorphism. The discriminator is an object name that is used to differentiate between other schemas which may satisfy the payload description. See for more details. | | readOnly | `boolean` | Relevant only for Schema `"properties"` definitions. Declares the property as "read only". This means that it MAY be sent as part of a response but SHOULD NOT be sent as part of the request. If the property is marked as `readOnly` being `true` and is in the `required` list, the `required` will take effect on the response only. A property MUST NOT be marked as both `readOnly` and `writeOnly` being `true`. Default value is `false`. | | writeOnly | `boolean` | Relevant only for Schema `"properties"` definitions. Declares the property as "write only". Therefore, it MAY be sent as part of a request but SHOULD NOT be sent as part of the response. If the property is marked as `writeOnly` being `true` and is in the `required` list, the `required` will take effect on the request only. A property MUST NOT be marked as both `readOnly` and `writeOnly` being `true`. Default value is `false`. | | xml | | This MAY be used only on properties schemas. It has no effect on root schemas. Adds additional metadata to describe the XML representation of this property. | | externalDocs | | Additional external documentation for this schema. | example | Any | A free-form property to include an example of an instance for this schema. To represent examples that cannot be naturally represented in JSON or YAML, a string value can be used to contain the example with escaping where necessary.| | deprecated | `boolean` | Specifies that a schema is deprecated and SHOULD be transitioned out of usage. Default value is `false`.| |x-oas-draft-alternativeSchema |alternative Schema Object |An external schema that participates in the validation of content along with other schema keywords. |
Project: MongoDB (App Definition and Development / Database)
File: parsing_stack_traces.md

is a utility to translate addresses into filenames and line numbers. ``` addr2line -e mongod -ifC <offset> ``` Use to demangle function names by pasting the whole stack trace to stdin. To find the correct binary for a specific log you need to: Get the commit from the header of the logs. Use git to locate that commit and check for the surrounding "version bump" commit. Download and open the binary: ``` curl -O http://s3.amazonaws.com/downloads.mongodb.org/linux/mongodb-linux-x86_64-debugsymbols-1.x.x.tgz ``` You can also get the debugsymbols archive for official builds through . In the Archived Releases section, click on the appropriate platform link to view the available archives. Select the appropriate debug symbols archive. Note that the log has lines like this: ``` /home/abc/mongod(_ZN5mongo15printStackTraceERSo+0x27) [0x689280] ``` You want to use the address in between the brackets `0x689280`. Note that you will get more than one stack frame for the address if the code is inlined. Actual example from a v1.8.1 64-bit Linux build: ``` $ curl http://downloads.mongodb.org/linux/mongodb-linux-x86_64-debugsymbols-1.8.1.tgz > out.tgz $ tar -xzf out.tgz $ cd mongodb-linux-x86_64-debugsymbols-1.8.1/ $ cd bin $ addr2line --help $ addr2line -i -e mongod 0x6d6a74 /mnt/home/buildbot/slave/Linux64bitV1.8/mongo/db/repl/health.cpp:394 $ addr2line -i -e mongod 0x6d0694 /mnt/home/buildbot/slave/Linux64bitV1.8/mongo/db/repl/rs.h:385 /mnt/home/buildbot/slave/Linux64bitV1.8/mongo/db/repl/replset_commands.cpp:111 ```
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: keeping-backstage-updated.md

id: keeping-backstage-updated title: Keeping Backstage Updated description: How to keep your Backstage App updated Backstage is always improving, so it's a good idea to stay in sync with the latest releases. Backstage is more of a library than an application or service; similar to `create-react-app`, the `@backstage/create-app` tool gives you a starting point that's meant to be evolved. The Backstage CLI has a command to bump all `@backstage` packages and dependencies you're using to the latest versions: . ```bash yarn backstage-cli versions:bump ``` The reason for bumping all `@backstage` packages at once is to maintain the dependencies that they have between each other. By default the bump command will upgrade `@backstage` packages to the latest `main` release line which is released monthly. For those in a hurry that want to track the `next` release line which releases weekly can do so using the `--release next` option. ```bash yarn backstage-cli versions:bump --release next ``` If you are using other plugins you can pass in the `--pattern` option to update more than just the `@backstage/*` dependencies. ```bash yarn backstage-cli versions:bump --pattern '@{backstage,roadiehq}/*' ``` The `@backstage/create-app` command creates the initial structure of your Backstage installation from a template. The source of this template in the Backstage repository is updated periodically, but your local `app` and `backend` packages are established at `create-app` time and won't automatically get these template updates. For this reason, any changes made to the template are documented along with upgrade instructions in the of the `@backstage/create-app` package. We recommend peeking at this changelog for any applicable updates when upgrading packages. As an alternative, the provides a consolidated view of all the changes between two versions of Backstage. You can find the current version of your Backstage installation in `backstage.json`. Backstage is structured as a monorepo with . This means the `app` and `backend` packages, as well as any custom plugins you've added, are separate packages with their own `package.json` and dependencies. When a given dependency version is the same between different packages, the dependency is hoisted to the main `node_modules` folder in the monorepo root to be shared between packages. When different versions of the same dependency are encountered, Yarn creates a `node_modules` folder within a particular package. This can lead to confusing situations with type definitions, or anything with global state. React , for example, depends on global referential equality. This can cause problems in Backstage with API lookup, or config loading. To help resolve these situations, the Backstage CLI has . This will validate versions of `@backstage` packages in your app to check for duplicate definitions: ```bash yarn backstage-cli versions:check ```
Project: ArangoDB (App Definition and Development / Database)
File: custom.md

+++ title = "A custom no-value policy" description = "" weight = 10 +++ If you want your `basicoutcome<>` or `basicresult<>` instances to call `std::abort()` whenever `.value()` is called on an object that does not contain a value, or `.error()` is called on an object that does not contain an error, you will need to define your own no-value policy as follows: {{% snippet "policies.cpp" "abort_policy" %}} All policies ought to inherit from {{% api "base" %}} in order to provide your policy implementation with the internal policy API for accessing and manipulating `result` and `outcome` state. Once the policy is defined, you have to specify it when providing your own `basic_outcome` specialization: {{% snippet "policies.cpp" "outcome_spec" %}}
Project: KICS (Provisioning / Security & Compliance)
File: 60263b4a-6801-4587-911d-919c37ed733b.md

title: Group With Privilege Escalation By Actions 'iam:PutUserPolicy' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 60263b4a-6801-4587-911d-919c37ed733b Query name: Group With Privilege Escalation By Actions 'iam:PutUserPolicy' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Group with privilege escalation by actions 'iam:PutUserPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamgroup" "cosmic" { name = "cosmic" } resource "awsiamgrouppolicy" "testinline_policy" { name = "testinlinepolicy" group = awsiamgroup.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:PutUserPolicy", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Druid (App Definition and Development / Database)
File: sqlserver.md

id: sqlserver title: "Microsoft SQLServer" <!-- ~ Licensed to the Apache Software Foundation (ASF) under one ~ or more contributor license agreements. See the NOTICE file ~ distributed with this work for additional information ~ regarding copyright ownership. The ASF licenses this file ~ to you under the Apache License, Version 2.0 (the ~ "License"); you may not use this file except in compliance ~ with the License. You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, ~ software distributed under the License is distributed on an ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY ~ KIND, either express or implied. See the License for the ~ specific language governing permissions and limitations ~ under the License. --> To use this Apache Druid extension, `sqlserver-metadata-storage` in the extensions load list. Install Microsoft SQLServer Create a druid database and user Create the druid user Microsoft SQL Server Management Studio - Security - Logins - New Login... Create a druid user, enter `diurd` when prompted for the password. Create a druid database owned by the user we just created Databases - New Database Database Name: druid, Owner: druid Add the Microsoft JDBC library to the Druid classpath To ensure the com.microsoft.sqlserver.jdbc.SQLServerDriver class is loaded you will have to add the appropriate Microsoft JDBC library (sqljdbc*.jar) to the Druid classpath. For instance, if all jar files in your "druid/lib" directory are automatically added to your Druid classpath, then manually download the Microsoft JDBC drivers from ( https://www.microsoft.com/en-ca/download/details.aspx?id=11774) and drop it into my druid/lib directory. Configure your Druid metadata storage extension: Add the following parameters to your Druid configuration, replacing `<host>` with the location (host name and port) of the database. ```properties druid.metadata.storage.type=sqlserver druid.metadata.storage.connector.connectURI=jdbc:sqlserver://<host>;databaseName=druid druid.metadata.storage.connector.user=druid druid.metadata.storage.connector.password=diurd ```
Project: Meshery (Provisioning / Automation & Configuration)
File: meshery-extensions_bug.md

name: Meshery Extensions Bug Report about: Report a bug in Meshery Extensions title: '[Extensions]' labels: kind/bug, component/extensions assignees: '' <!-- A brief description of what the problem is. (e.g. I need to be able to...) --> <!-- A brief description of the enhancement. --> <!-- Add screenshots, if applicable, to help explain your problem. --> Host OS: Mac Linux Windows Meshery Server Version: stable-v Meshery Client Version: stable-v Platform: Docker Kubernetes UI Design For Meshery Extensions in Figma Questions: and
Project: KICS (Provisioning / Security & Compliance)
File: 7ebc9038-0bde-479a-acc4-6ed7b6758899.md

title: KMS Key With Vulnerable Policy hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 7ebc9038-0bde-479a-acc4-6ed7b6758899 Query name: KMS Key With Vulnerable Policy Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: Checks if the policy is vulnerable and needs updating.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="5" resource "awskmskey" "positive1" { description = "KMS key 1" deletionwindowin_days = 10 policy = <<POLICY { "Version": "2012-10-17", "Statement":[ { "Sid":"AddCannedAcl", "Effect":"Allow", "Principal": {"AWS":"*"}, "Action":["kms:*"], "Resource":"*" } ] } POLICY } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="5" resource "awskmskey" "positive1" { description = "KMS key 1" deletionwindowin_days = 10 policy = <<POLICY { "Version": "2012-10-17", "Statement":[ { "Sid":"AddCannedAcl", "Effect":"Allow", "Principal": "*", "Action":["kms:*"], "Resource":"*" } ] } POLICY } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" resource "awskmskey" "positive3" { description = "KMS key 1" deletionwindowin_days = 10 } ``` ```tf title="Negative test num. 1 - tf file" resource "awskmskey" "negative1" { description = "KMS key 1" deletionwindowin_days = 10 policy = <<POLICY { "Version": "2012-10-17", "Statement":[ { "Sid":"AddCannedAcl", "Effect":"Deny", "Principal": {"AWS": [ "arn:aws:iam::111122223333:user/CMKUser" ]}, "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ], "Resource":"*" } ] } POLICY } ```
Project: KICS (Provisioning / Security & Compliance)
File: f1173d8c-3264-4148-9fdb-61181e031b51.md

title: Role With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f1173d8c-3264-4148-9fdb-61181e031b51 Query name: Role With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Role with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamrole" "cosmic" { name = "cosmic" } resource "awsiamrolepolicy" "testinline_policy" { name = "testinlinepolicy" role = awsiamrole.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:UpdateAssumeRolePolicy", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" roles = [awsiamrole.cosmic.name] policyarn = awsiam_policy.policy.arn } resource "awsiampolicy" "policy" { name = "test-policy" description = "A test policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "sts:AssumeRole", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```