cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: de4421f1-4e35-43b4-9783-737dd4e4a47e.md

title: PSP With Unrestricted Access to Host Path hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: de4421f1-4e35-43b4-9783-737dd4e4a47e Query name: PSP With Unrestricted Access to Host Path Platform: Kubernetes Severity: <span style="color:#bb2124">High</span> Category: Resource Management URL: PodSecurityPolicy should set 'readOnly' to true in every host path allowed<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: example spec: hostIPC: false runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="8" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: example spec: hostIPC: false allowedHostPaths: pathPrefix: /dev runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="9" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: example spec: hostIPC: false allowedHostPaths: pathPrefix: /dev readOnly: false runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: example spec: hostIPC: false allowedHostPaths: pathPrefix: "/foo" readOnly: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ```
Project: CloudTTY (App Definition and Development / Application Definition & Image Build)
File: CONTRIBUTING.md

Welcome to Kubernetes. We are excited about the prospect of you joining our ! The Kubernetes community abides by the CNCF . Here is an excerpt: As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities. We have full documentation on how to get started contributing here: <! If your repo has certain guidelines for contribution, put them here ahead of the general k8s resources --> Kubernetes projects require that you sign a Contributor License Agreement (CLA) before we can accept your pull requests - Main contributor documentation, or you can just jump directly to the - Common resources for existing developers - We have a diverse set of mentorship programs available that are always looking for volunteers! <! Custom Information - if you're copying this template for the first time you can add custom content here, for example: - Replace `kubernetes-users` with your slack channel string, this will send users directly to your channel. -->
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_kms_key_rings.md

+++ title = "googlekmskey_rings resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googlekmskey_rings" identifier = "inspec/resources/gcp/googlekmskeyrings.md googlekmskeyrings resource" parent = "inspec/resources/gcp" +++ A `googlekmskey_rings` is used to test a Google KeyRing resource ```ruby describe googlekmskey_rings(project: 'chef-gcp-inspec', location: 'europe-west2') do its('keyringnames'){ should include 'kms-key-ring' } end describe.one do googlekmskeyrings(project: 'chef-gcp-inspec', location: 'europe-west2').keyring_urls do |url| describe url do it { should match 'kms-key-ring' } end end end ``` describe googlekmskey_rings(project: 'chef-inspec-gcp', location: 'us-east1') do its('count') { should be <= 200} end describe googlekmskey_rings(project: 'chef-inspec-gcp', location: 'us-east1') do its('keyringnames') { should include "a-named-key" } end describe googlekmskeyrings(project: gcpprojectid, location: 'us-east1').keyringnames.each do |keyring_name| describe googlekmskeyring(project: 'chef-inspec-gcp', location: 'us-east1', 'name: keyring_name) do it { should exist } its('createtimedate') { should be > Time.now - 3656060*24 } end end Properties that can be accessed from the `googlekmskey_rings` resource: See the resource for more information. `create_times` : an array of `googlekmskeyring` createtime `keyringurls` : an array of `googlekmskeyring` keyring_url `locations` : an array of `googlekmskey_ring` location This resource supports all of the above properties as filter criteria, which can be used with `where` as a block or a method. Ensure the is enabled for the current project.
Project: Numaflow (App Definition and Development / Streaming & Messaging)
File: user-defined-functions.md

A `Pipeline` consists of multiple vertices, `Source`, `Sink` and `UDF(user-defined functions)`. User-defined functions (UDF) is the vertex where users can run custom code to transform the data. Data processing in the UDF is supposed to be idempotent. UDF runs as a sidecar container in a Vertex Pod, processes the received data. The communication between the main container (platform code) and the sidecar container (user code) is through gRPC over Unix Domain Socket. There are two kinds of processing users can run -
Project: KICS (Provisioning / Security & Compliance)
File: e69890e6-fce5-461d-98ad-cb98318dfc96.md

title: RDS With Backup Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e69890e6-fce5-461d-98ad-cb98318dfc96 Query name: RDS With Backup Disabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Backup URL: Make sure the AWS RDS configuration has automatic backup configured. If the retention period is equal to 0 there is no backup<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10" name: create minimal aurora instance in default VPC and default subnet group community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 0 ``` ```yaml title="Negative test num. 1 - yaml file" name: create minimal aurora instance in default VPC and default subnet group community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: '{{ password }}' username: '{{ username }}' clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 5 name: create minimal aurora instance in default VPC and default subnet group2 community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: '{{ password }}' username: '{{ username }}' clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.7.2.md

RabbitMQ `3.7.2` fixes an issue in the HTTP auth backend plugin that was introduced in `3.7.1`. It has no other functional changes compared to `3.7.1`. This release has no known incompatibilities with earlier 3.7.x versions. See upgrade and compatibility notes if upgrading from an earlier release. See the for general documentation on upgrades. See for release notes of other releases. Plugin threw an exception while performing HTTP requests. GitHub issue: Warning: The source code archive provided by GitHub only contains the source of the broker, not the plugins or the client libraries. Please download the archive named `rabbitmq-3.7.2.tar.gz`.
Project: KICS (Provisioning / Security & Compliance)
File: integrations_circleci.md

You can integrate KICS into your CircleCI workflows. This document provides you with an example on how to run KICS scans in a pipeline. Enable CircleCI to access your personal profile or GitHub organization. Create a `.circleci` directory in your project's root and place a `config.yaml` inside: ```yaml version: 2.1 jobs: kics: docker: image: checkmarx/kics:latest steps: checkout run: name: Run KICS command: | /app/bin/kics scan -p ${PWD} -o ${PWD} --ci store_artifacts: path: ${PWD}/results.json workflows: version: 2 build: jobs: kics ``` After running a pipeline, you will be able to see "Run KICS" step inside workflow's details: <img src="https://raw.githubusercontent.com/Checkmarx/kics/master/docs/img/circleci-build.png" width="850"> Go to the artifacts tab to inspect the results: <img src="https://raw.githubusercontent.com/Checkmarx/kics/master/docs/img/circleci-artifacts.png" width="850"> Results will be displayed in plain text: <img src="https://raw.githubusercontent.com/Checkmarx/kics/0f82e84ccbab376b4606efe5a85432d5b37ecb19/docs/img/circleci-results.png" width="850">
Project: StarRocks (App Definition and Development / Database)
File: sleep.md

displayed_sidebar: "English" Delays the execution of an operation for a specified period of time (in seconds) and returns a BOOLEAN value to indicate whether the sleep is completed without interruption. `1` is returned if the sleep is completed without interruption. Otherwise, `0` is returned. ```Haskell BOOLEAN sleep(INT x); ``` `x`: the duration for which you want to delay the execution of an operation. It must be of the INT type. Unit: seconds. If the input is is NULL, NULL is returned immediately without sleeping. Returns a value of the BOOLEAN type. ```Plain Text select sleep(3); +-+ | sleep(3) | +-+ | 1 | +-+ 1 row in set (3.00 sec) select sleep(NULL); +-+ | sleep(NULL) | +-+ | NULL | +-+ 1 row in set (0.00 sec) ``` SLEEP, sleep
Project: KICS (Provisioning / Security & Compliance)
File: 30c2760c-740e-4672-9d7f-2c29e0cb385d.md

title: Nifcloud Router Has Common Private Network hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 30c2760c-740e-4672-9d7f-2c29e0cb385d Query name: Nifcloud Router Has Common Private Network Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: The router has common private network<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "nifcloud_router" "positive" { securitygroup = nifcloudsecuritygroup.example.groupname network_interface { networkid = "net-COMMONPRIVATE" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "nifcloud_router" "positive" { securitygroup = nifcloudsecuritygroup.example.groupname network_interface { networkid = "net-COMMONGLOBAL" } network_interface { networkid = "net-COMMONPRIVATE" } } ``` ```tf title="Negative test num. 1 - tf file" resource "nifcloud_router" "negative" { securitygroup = nifcloudsecuritygroup.example.groupname network_interface { networkid = nifcloudprivate_lan.main.id } } ```
Project: ArangoDB (App Definition and Development / Database)
File: try.md

+++ title = "TRY operations" description = "" weight = 30 tags = ["try"] +++ In the implementation of function `printhalf` we have seen the usage of the macro {{< api "BOOSTOUTCOMETRYV(expr)/BOOSTOUTCOME_TRY(expr)" >}}: ```c++ BOOSTOUTCOMETRY (auto i, BigInt::fromString(text)); ``` The `BOOSTOUTCOMETRY` macro uses C macro overloading to select between two implementations based on the number of input parameters. If there is exactly one input parameter i.e. without the `i`, the control statement is roughly equivalent to: ```c++ auto result = BigInt::fromString(text); if (!result) return result.as_failure(); ``` Where `result` is a compile time generated unique name. This single argument form is equivalent to `BOOSTOUTCOMETRYV(expr)`, incidentally. If there are between two and eight parameters, this control statement is roughly equivalent to: ```c++ auto result = BigInt::fromString(text); if (!result) return result.as_failure(); auto i = result.value(); ``` So here `i` as the first C macro parameter is set to the value of any successful result. C macro overloads are provided for up to eight arguments. To prevent the confounding of the C preprocessor by commas in template specifications causing more than eight arguments appearing to the C preprocessor, you should consider wrapping the second argument in brackets. If you are within a C++ Coroutine, you ought to use {{< api "BOOSTOUTCOMECOTRYV(expr)/BOOSTOUTCOMECOTRY(expr)" >}} instead. <hr> {{% notice note %}} This macro makes use of a proprietary extension in GCC and clang, and is not portable. The macro is not made available on unsupported compilers, so you can test for its presence using `#ifdef BOOSTOUTCOMETRYX`. {{% /notice %}} GCC and Clang provide an extension to C++ known as . These make it possible to use a more convenient macro: `BOOSTOUTCOMETRYX`, which is an expression. With the above macro, the above declaration of variable `i` can be rewritten to: ```c++ int i = BOOSTOUTCOMETRYX (BigInt::fromString(text)); ``` This has an advantage that you can use it any place where you can put an expression, e.g., in "simple initialization": ```c++ if (int i = BOOSTOUTCOMETRYX(BigInt::fromString(text))) useanonzeroint(i); ``` or in as a subexpression of a bigger full expression: ```c++ int ans = BOOSTOUTCOMETRYX(BigInt::fromString("1")) + BOOSTOUTCOMETRYX(BigInt::fromString("2")); ``` There is also an {{< api "BOOSTOUTCOMECO_TRYX(expr)" >}} if you are inside a C++ Coroutine.
Project: YugabyteDB (App Definition and Development / Database)
File: sadd.md

title: SADD linkTitle: SADD description: SADD menu: preview: parent: api-yedis weight: 2250 aliases: /preview/api/redis/sadd /preview/api/yedis/sadd type: docs `SADD key value [value ...]` This command adds one or more given values to the set that is associated with the given `key`. If the `key` does not exist, a new set is created, and members are added with the given values. If the `key` is associated with a value that is not a set, an error is raised. If a specified `value` already exists in the given set, that `value` is ignored and not counted toward the total of newly added members. Depends on the configuration parameter `emulateredisresponses`. If `emulateredisresponses` is `true`, returns the number of new members that were added by this command not including the duplicates. If `emulateredisresponses` is `false`, returns OK. `emulateredisresponses` is `true`. ```sh $ SADD yuga_world "Africa" ``` ``` 1 ``` ```sh $ SADD yuga_world "America" ``` ``` 1 ``` ```sh $ SMEMBERS yuga_world ``` ``` 1) "Africa" 2) "America" ``` `emulateredisresponses` is `false`. ```sh $ SADD yuga_world "Africa" ``` ``` "OK" ``` ```sh $ SADD yuga_world "America" ``` ``` "OK" ``` ```sh $ SMEMBERS yuga_world ``` ``` 1) "Africa" 2) "America" ``` , , ,
Project: KICS (Provisioning / Security & Compliance)
File: 52d70f2e-3257-474c-b3dc-8ad9ba6a061a.md

title: Kubelet Client Periodic Certificate Switch Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 52d70f2e-3257-474c-b3dc-8ad9ba6a061a Query name: Kubelet Client Periodic Certificate Switch Disabled Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: Kubelet argument --rotate-certificates should be true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--rotate-certificates=false"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="8" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false evictionHard: memory.available: "200Mi" rotateCertificates: false ``` ```json title="Positive test num. 3 - json file" hl_lines="6" { "port": 20250, "evictionHard": { "memory.available": "200Mi" }, "kind": "KubeletConfiguration", "makeIPTablesUtilChains": true, "address": "192.168.0.8", "apiVersion": "kubelet.config.k8s.io/v1beta1" } ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="2" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false evictionHard: memory.available: "200Mi" ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--rotate-certificates"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false evictionHard: memory.available: "200Mi" rotateCertificates: true ``` ```json title="Negative test num. 3 - json file" { "port": 20250, "evictionHard": { "memory.available": "200Mi" }, "kind": "KubeletConfiguration", "rotateCertificates": true, "serializeImagePulls": false, "address": "192.168.0.8", "apiVersion": "kubelet.config.k8s.io/v1beta1" } ```
Project: KubeMQ (App Definition and Development / Streaming & Messaging)
File: kubemq_events_store_receive.md

Events-Store receive a messages from an 'events store' Events-Store receive (Subscribe) command allows to consume messages from an 'events store' with options to set offset parameters ``` kubemq events_store receive [flags] ``` ``` kubemq events_store receive some-channel kubemq events_store receive some-channel -g G1 ``` ``` -g, --group string set 'events_store' channel consumer group (load balancing) -h, --help help for receive --start-duration string start from time duration i.e. 1h --start-first start from first body in the channel --start-last start from last body in the channel --start-new start from new body only --start-sequence int start from body sequence --start-time string start from timestamp format 2006-01-02 15:04:05 ``` - Execute Kubemq 'Events-Store' Pub/Sub commands
Project: YugabyteDB (App Definition and Development / Database)
File: yba_storage-config.md

Manage YugabyteDB Anywhere storage configurations Manage YugabyteDB Anywhere storage configurations ``` yba storage-config [flags] ``` ``` -h, --help help for storage-config ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - yba - Command line tools to manage your YugabyteDB Anywhere (Self-managed Database-as-a-Service) resources. - Manage a YugabyteDB Anywhere Azure storage configuration - Delete a YugabyteDB Anywhere storage configuration - Describe a YugabyteDB Anywhere storage configuration - Manage a YugabyteDB Anywhere GCS storage configuration - List YugabyteDB Anywhere storage-configurations - Manage a YugabyteDB Anywhere NFS storage configuration - Manage a YugabyteDB Anywhere S3 storage configuration
Project: KICS (Provisioning / Security & Compliance)
File: 4cdc88e6-c0c8-4081-a639-bb3a557cbedf.md

title: Elasticsearch with HTTPS disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4cdc88e6-c0c8-4081-a639-bb3a557cbedf Query name: Elasticsearch with HTTPS disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Amazon Elasticsearch does not have encryption for its domains enabled. To prevent such a scenario, update the attribute 'EnforceHTTPS' to true.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="15" AWSTemplateFormatVersion: "2010-09-09" Description: description Resources: OpenSearchDomain: Type: AWS::OpenSearchService::Domain Properties: DomainName: my-opensearch-domain ElasticsearchVersion: "7.9" ElasticsearchClusterConfig: InstanceType: m5.large.search InstanceCount: 1 AdvancedOptions: rest.action.multi.allowexplicitindex: "true" DomainEndpointOptions: EnforceHTTPS: false TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="24" AWSTemplateFormatVersion: "2010-09-09" Description: description Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: my-elasticsearch-domain ElasticsearchVersion: "7.9" ElasticsearchClusterConfig: InstanceType: m5.large.elasticsearch InstanceCount: 1 EBSOptions: EBSEnabled: true VolumeType: gp2 VolumeSize: 10 AccessPolicies: Version: "2012-10-17" Statement: Effect: Allow Principal: AWS: "*" Action: es:* Resource: arn:aws:es:REGION:ACCOUNT_ID:domain/my-elasticsearch-domain/* DomainEndpointOptions: TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07" ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: description Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: my-elasticsearch-domain ElasticsearchVersion: "7.9" ElasticsearchClusterConfig: InstanceType: m5.large.elasticsearch InstanceCount: 1 EBSOptions: EBSEnabled: true VolumeType: gp2 VolumeSize: 10 AccessPolicies: Version: "2012-10-17" Statement: Effect: Allow Principal: AWS: "*" Action: es:* Resource: arn:aws:es:REGION:ACCOUNT_ID:domain/my-elasticsearch-domain/* ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: description Resources: OpenSearchDomain: Type: AWS::OpenSearchService::Domain Properties: DomainName: my-opensearch-domain ElasticsearchVersion: "7.9" ElasticsearchClusterConfig: InstanceType: m5.large.search InstanceCount: 1 AdvancedOptions: rest.action.multi.allowexplicitindex: "true" DomainEndpointOptions: EnforceHTTPS: true TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07" ```