cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 33627268-1445-4385-988a-318fd9d1a512.md

title: User With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 33627268-1445-4385-988a-318fd9d1a512 Query name: User With Privilege Escalation By Actions 'iam:UpdateAssumeRolePolicy' And 'sts:AssumeRole' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: User with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamuser" "cosmic" { name = "cosmic" } resource "awsiamuserpolicy" "testinline_policy" { name = "testinlinepolicy" user = awsiamuser.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:UpdateAssumeRolePolicy", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" users = [awsiamuser.cosmic.name] roles = [awsiamrole.role.name] groups = [awsiamgroup.group.name] policyarn = awsiam_policy.policy.arn } resource "awsiampolicy" "policy" { name = "test-policy" description = "A test policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "sts:AssumeRole", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: Artifact Hub (App Definition and Development / Application Definition & Image Build)
File: cli.md

Artifact Hub includes a command line interface tool named `ah`. You can check that your packages are ready to be listed on AH by using the `lint` subcommand. Integrating the linter into your CI workflow may help catching errors early. You can find an example of how to do it with GitHub Actions . You can install the pre-compiled binary, use Docker or compile from source. Pre-compiled binaries for MacOS, Linux and Windows are available at the . You can also install it using `Homebrew` or `Scoop`. ```sh brew install artifacthub/cmd/ah ``` ```sh scoop bucket add artifacthub https://github.com/artifacthub/scoop-cmd.git scoop install artifacthub/ah ``` You can run `ah` from a Docker container. The latest Docker image available can be found in the . To compile from source you'll need installed. Once you are ready to go, please follow these steps: ```sh git clone https://github.com/artifacthub/hub cd hub/cmd/ah go install ``` Please run `ah help` for more information about the different subcommands and the options available.
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: efs-provisioner.md

!!! Info This is only applicable to AWS installations. Add Helm repository: ```bash title="Add Helm repo" helm repo add stable https://charts.helm.sh/stable ``` Create `efs-provisioner-values.yml` in your config directory and update the values: ```yaml title="efs-provisioner-values.yml" efsProvisioner: efsFileSystemId: <efsFileSystemId> awsRegion: <awsRegion> path: / provisionerName: example.com/aws-efs storageClass: name: bulk isDefault: false reclaimPolicy: Delete mountOptions: [] global: deployEnv: prod ``` Install EFS Provisioner: ```bash title="Install EFS Provisioner" helm upgrade --install --create-namespace \ --namespace efs-provisioner --wait \ -f efs-provisioner-values.yaml \ efs-provisioner stable/efs-provisioner ```
Project: KICS (Provisioning / Security & Compliance)
File: 1402afd8-a95c-4e84-8b0b-6fb43758e6ce.md

title: Hardcoded AWS Access Key In Lambda hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1402afd8-a95c-4e84-8b0b-6fb43758e6ce Query name: Hardcoded AWS Access Key In Lambda Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Secret Management URL: Lambda access/secret keys should not be hardcoded<br> ```tf title="Positive test num. 1 - tf file" hl_lines="57 36" resource "awsiamrole" "positive1" { name = "iamforlambda" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "lambda.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } resource "awslambdafunction" "positive2" { filename = "lambdafunctionpayload.zip" functionname = "lambdafunction_name" role = awsiamrole.iamforlambda.arn handler = "exports.test" sourcecodehash = filebase64sha256("lambdafunctionpayload.zip") runtime = "nodejs12.x" environment { variables = { foo = "AKIAIOSFODNN7EXAMAAA" } } } resource "awslambdafunction" "positive3" { filename = "lambdafunctionpayload.zip" functionname = "lambdafunction_name" role = awsiamrole.iamforlambda.arn handler = "exports.test" sourcecodehash = filebase64sha256("lambdafunctionpayload.zip") runtime = "nodejs12.x" environment { variables = { foo = "AKIASXANV9XVIJ1YCIJ5" } } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamrole" "negative1" { name = "iamforlambda" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "lambda.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } resource "awslambdafunction" "negative2" { filename = "lambdafunctionpayload.zip" functionname = "lambdafunction_name" role = awsiamrole.iamforlambda.arn handler = "exports.test" sourcecodehash = filebase64sha256("lambdafunctionpayload.zip") runtime = "nodejs12.x" environment { variables = { foo = "test" } } } ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: opa_api.md

+++ title = "opa_api resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "opa_api" identifier = "inspec/resources/os/opaapi.md opaapi resource" parent = "inspec/resources/os" +++ Use the `opa_api` Chef InSpec audit resource to query Open Policy Agent (OPA) using the OPA URL and data. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} An `opa_api` resource block declares OPA policy configurations that can be tested. describe opa_api(url: "localhost:8181/v1/data/example/violation", data: "input.json") do its(["result"]) { should eq 'value' } end where `'url'` specifies the url of the OPA server on which OPA is running. `'data'` specifies the json formatted data or json file. `its(["returnedresult"]) { should eq 'expectedresult' }` compares the results of the query against the expected result in the test. The `opa_api` resource InSpec resource requires a `url` and `data` as a JSON file or a string in JSON format. The URL of the OPA API server. An OPA query as a JSON data file or a string in JSON format. The `result` property checks whether the resource query returns an empty result. its('result') { should be nil } The `allow` property checks if a specific input matches the policy defined in OPA. This matcher will not work if `allow` is not defined in the policy file. its('allow') { should eq 'value' } The following examples show how to use this Chef InSpec audit resource. describe opa_api(url: "localhost:8181/v1/data/example/allow", data: "input.json") do its("result") { shoule_not be nil } its(["result"]) { should eq true } its("allow") { should eq "true" } end The above example shows how the `allow` value can be fetched in two ways. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: Chef InSpec (Provisioning / Security & Compliance)
File: google_runtime_config_variable.md

+++ title = "googleruntimeconfig_variable resource" draft = false gh_repo = "inspec" platform = "gcp" [menu] [menu.inspec] title = "googleruntimeconfig_variable" identifier = "inspec/resources/gcp/googleruntimeconfigvariable.md googleruntimeconfigvariable resource" parent = "inspec/resources/gcp" +++ A `googleruntimeconfig_variable` is used to test a Google Variable resource ```ruby describe googleruntimeconfig_variable(project: 'chef-gcp-inspec', config: 'inspec-gcp-runtime-config', name: 'prod-variables/hostname') do it { should exist } its('text') { should cmp 'example.com' } end describe googleruntimeconfig_variable(project: 'chef-gcp-inspec', config: 'inspec-gcp-runtime-config', name: 'nonexistent') do it { should_not exist } end ``` Properties that can be accessed from the `googleruntimeconfig_variable` resource: `value` : The binary value of the variable. Either this or `text` can be set. `text` : The string value of the variable. Either this or `value` can be set. `name` : The name of the variable resource. `config` : The name of the runtime config that this variable belongs to. Ensure the is enabled for the current project.
Project: KICS (Provisioning / Security & Compliance)
File: 507df964-ad97-4035-ab14-94a82eabdfdd.md

title: Cloud Storage Bucket Logging Not Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 507df964-ad97-4035-ab14-94a82eabdfdd Query name: Cloud Storage Bucket Logging Not Enabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Cloud storage bucket should have logging enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3" name: create a bucket google.cloud.gcpstoragebucket: name: ansible-storage-module project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: create a bucket google.cloud.gcpstoragebucket: name: ansible-storage-module project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present logging: logbucket: abucketforlogs logobjectprefix: log ```
Project: Meshery (Provisioning / Automation & Configuration)
File: 09-29-2022-15-59-09_062fe7ca.md

timestamp: "2022-09-29 15:59:32 UTC Thu" meshery-component: meshery-consul meshery-component-version: edge meshery-server-version: "v0.6.9" k8s-distro: minikube k8s-version: "v1.20.11" service-mesh: Consul service-mesh-version: "v0.48.0" tests: consul-client: null consul-server: null overall-status: "failing"
Project: YugabyteDB (App Definition and Development / Database)
File: yba_provider_aws_describe.md

Describe an AWS YugabyteDB Anywhere provider Describe an AWS provider in YugabyteDB Anywhere ``` yba provider aws describe [flags] ``` ``` -h, --help help for describe ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -n, --name string [Optional] The name of the provider for the action. Required for create, delete, describe, update. -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Manage a YugabyteDB Anywhere AWS provider
Project: kaniko (App Definition and Development / Application Definition & Image Build)
File: TROUBLESHOOTING.md

The most common reason for this issue is improper use of struct tags (eg. `yaml` or `json`). Viper uses under the hood for unmarshaling values which uses `mapstructure` tags by default. Please refer to the library's documentation for using other struct tags. Viper installation seems to fail a lot lately with the following (or a similar) error: ``` cannot find package "github.com/hashicorp/hcl/tree/hcl1" in any of: /usr/local/Cellar/go/1.15.7_1/libexec/src/github.com/hashicorp/hcl/tree/hcl1 (from $GOROOT) /Users/user/go/src/github.com/hashicorp/hcl/tree/hcl1 (from $GOPATH) ``` As the error message suggests, Go tries to look up dependencies in `GOPATH` mode (as it's commonly called) from the `GOPATH`. Viper opted to use to manage its dependencies. While in many cases the two methods are interchangeable, once a dependency releases new (major) versions, `GOPATH` mode is no longer able to decide which version to use, so it'll either use one that's already present or pick a version (usually the `master` branch). The solution is easy: switch to using Go Modules. Please refer to the on how to do that. tl;dr* `export GO111MODULE=on` This is a YAML 1.1 feature according to . Potential solutions are: Quoting values resolved as boolean Upgrading to YAML v3 (for the time being this is possible by passing the `viper_yaml3` tag to your build)
Project: YugabyteDB (App Definition and Development / Database)
File: aiopg.md

title: aiopg Driver for YSQL headerTitle: Connect an application linkTitle: Connect an app description: Connect a Python application using aiopg Driver for YSQL menu: stable: identifier: ysql-aiopg parent: python-drivers weight: 571 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li class="active"> <a href="../yugabyte-psycopg2/" class="nav-link"> YSQL </a> </li> <li> <a href="../ycql/" class="nav-link"> YCQL </a> </li> </ul> <ul class="nav nav-tabs-alt nav-tabs-yb"> <li > <a href="../yugabyte-psycopg2" class="nav-link"> <i class="icon-postgres" aria-hidden="true"></i> YugabyteDB Psycopg2 Smart Driver </a> </li> <li > <a href="../postgres-psycopg2" class="nav-link"> <i class="icon-postgres" aria-hidden="true"></i> PostgreSQL Psycopg2 Driver </a> </li> <li > <a href="../aiopg" class="nav-link active"> <i class="icon-postgres" aria-hidden="true"></i> aiopg </a> </li> </ul> The following tutorial creates a basic Python application that connects to a YugabyteDB cluster using the database adapter, performs a few basic database operations creating a table, inserting data, and running a SQL query and prints the results to the screen. Before you start using Aiopg, ensure you have the following: YugabyteDB up and running. If you are new to YugabyteDB, follow the steps in to have YugabyteDB up and running in minutes. , or later, is installed. package is installed. Install the package using the following command: ```sh pip3 install aiopg ``` For details about using this database adapter, see . Create a file `yb-sql-helloworld.py` and copy the following code: ```python import asyncio import aiopg dsn = 'dbname=yugabyte user=yugabyte password=yugabyte host=127.0.0.1 port=5433' async def go(): async with aiopg.create_pool(dsn) as pool: async with pool.acquire() as conn: async with conn.cursor() as cur: await cur.execute(f""" DROP TABLE IF EXISTS employee; CREATE TABLE employee (id int PRIMARY KEY, name varchar, age int, language varchar); """) print("Created table employee") await cur.execute("INSERT INTO employee (id, name, age, language) VALUES (%s, %s, %s, %s)", (1, 'John', 35, 'Python')) print("Inserted (id, name, age, language) = (1, 'John', 35, 'Python')") await cur.execute("SELECT name, age, language FROM employee WHERE id = 1") async for row in cur: print("Query returned: %s, %s, %s" % (row[0], row[1], row[2])) loop = asyncio.geteventloop() loop.rununtilcomplete(go()) ``` To use the application, run the following Python script: ```sh python yb-sql-helloworld.py ``` You should see the following output: ```output Created table employee Inserted (id, name, age, language) = (1, 'John', 35, 'Python') Query returned: John, 35, Python ```
Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: operator-sdk_completion_bash.md

title: "operator-sdk completion bash" Load bash completions ``` operator-sdk completion bash [flags] ``` ``` $ source <(operator-sdk completion bash) Linux: $ operator-sdk completion bash > /etc/bash_completion.d/operator-sdk MacOS: $ operator-sdk completion bash > /usr/local/etc/bash_completion.d/operator-sdk ``` ``` -h, --help help for bash ``` ``` --plugins strings plugin keys to be used for this subcommand execution --verbose Enable verbose logging ``` - Load completions for the specified shell
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.112.md

layout: release date: 2023-07-26 tag: v0.6.112 FIXED: [mesheryctl] `mesheryctl system check` checks wrong platform @zakisk (#8272) Add support to provision CRDs/operators. @MUzairS15 (#8255) [OPA] Add namespace-hierarchichal policy @Abhishek-kumar09 (#7897) Thank you to our contributors for making this release possible: @Abhishek-kumar09, @MUzairS15, @leecalcote and @zakisk
Project: Redis (App Definition and Development / Database)
File: SECURITY.md

Redis is generally backwards compatible with very few exceptions, so we recommend users to always use the latest version to experience stability, performance and security. We generally backport security issues to a single previous major version, unless this is not possible or feasible with a reasonable effort. | Version | Supported | | - | | | 7.2.x | :whitecheckmark: | | 7.0.x | :whitecheckmark: | | 6.2.x | :whitecheckmark: | | < 6.2 | :x: | If you believe you've discovered a serious vulnerability, please contact the Redis core team at redis@redis.io. We will evaluate your report and if necessary issue a fix and an advisory. If the issue was previously undisclosed, we'll also mention your name in the credits. In some cases, we may apply a responsible disclosure process to reported or otherwise discovered vulnerabilities. We will usually do that for a critical vulnerability, and only if we have a good reason to believe information about it is not yet public. This process involves providing an early notification about the vulnerability, its impact and mitigations to a short list of vendors under a time-limited embargo on public disclosure. Vendors on the list are individuals or organizations that maintain Redis distributions or provide Redis as a service, who have third party users who will benefit from the vendor's ability to prepare for a new version or deploy a fix early. If you believe you should be on the list, please contact us and we will consider your request based on the above criteria.
Project: KICS (Provisioning / Security & Compliance)
File: bd77554e-f138-40c5-91b2-2a09f878608e.md

title: EFS Without KMS hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: bd77554e-f138-40c5-91b2-2a09f878608e Query name: EFS Without KMS Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Encryption URL: Amazon Elastic Filesystem should have filesystem encryption enabled using KMS CMK customer-managed keys instead of AWS managed-keys<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3" name: foo community.aws.efs: state: present name: myTestEFS encrypt: no tags: Name: myTestNameTag purpose: file-storage targets: subnet_id: subnet-748c5d03 security_groups: ["sg-1a2b3c4d"] ``` ```yaml title="Negative test num. 1 - yaml file" name: foo community.aws.efs: state: present name: myTestEFS encrypt: yes tags: Name: myTestNameTag purpose: file-storage targets: subnet_id: subnet-748c5d03 security_groups: [sg-1a2b3c4d] kmskeyid: "some-key-id" ```
Project: Backstage (App Definition and Development / Application Definition & Image Build)
File: adr013-use-node-fetch.md

id: adrs-adr013 title: 'ADR013: Proper use of HTTP fetching libraries' description: Architecture Decision Record (ADR) for the proper use of fetchApiRef, node-fetch, and cross-fetch for data fetching. Using multiple HTTP packages for data fetching increases the complexity and the support burden of keeping said package up to date. Backend (node) packages should use the `node-fetch` package for HTTP data fetching. Example: ```ts import fetch from 'node-fetch'; import { ResponseError } from '@backstage/errors'; const response = await fetch('https://example.com/api/v1/users.json'); if (!response.ok) { throw await ResponseError.fromResponse(response); } const users = await response.json(); ``` Frontend plugins and packages should prefer to use the . It uses `cross-fetch` internally. Example: ```ts import { useApi } from '@backstage/core-plugin-api'; const { fetch } = useApi(fetchApiRef); const response = await fetch('https://example.com/api/v1/users.json'); if (!response.ok) { throw await ResponseError.fromResponse(response); } const users = await response.json(); ``` Isomorphic packages should have a dependency on the `cross-fetch` package for mocking and type definitions. Preferably, classes and functions in isomorphic packages should accept an argument of type `typeof fetch` to let callers supply their preferred implementation of `fetch`. This lets them adorn the calls with auth or other information, and track metrics etc, in a cross-platform way. Example: ```ts import crossFetch from 'cross-fetch'; export class MyClient { private readonly fetch: typeof crossFetch; constructor(options: { fetch?: typeof crossFetch }) { this.fetch = options.fetch || crossFetch; } async users() { return await this.fetch('https://example.com/api/v1/users.json'); } } ``` We will gradually transition away from third party packages such as `axios`, `got` and others. Once we have transitioned to `node-fetch` we will add lint rules to enforce this decision.
Project: ArangoDB (App Definition and Development / Database)
File: value_type.md

+++ title = "The payload" weight = 20 +++ We define the code domain's `value_type` -- the payload to be transported by status codes using this code domain -- to be a POSIX `errno` value, an integer line number and a const char pointer. {{% snippet "experimentalstatuscode.cpp" "value_type" %}} You will note that this is a `TriviallyCopyable` type, and so gains an implicit conversion to any `statuscode<erased<T>>` where `sizeof(T) >= sizeof(valuetype)`. `error` is however `statuscode<erased<intptrt>>`, and `sizeof(intptrt) < sizeof(valuetype)`, so it is not possible to implicitly convert status codes from this domain into `error`. Instead, you must tell the compiler how to do the conversion, as we shall see later.
Project: Kraken (Provisioning / Container Registry)
File: ARCHITECTURE.md

Central P2P components that's not specific to docker images: Deployed on every host Implements Docker registry interface Dedicated seeders Pluggable storage backend (e.g. S3) Self-healing hash ring Tracks peers and seeders, instructs them to form a sparse graph Self-healing hash ring Components responsible for image tags and replication to other clusters: Handles image upload and direct download Mapping of human readable tag to blob hash (digest) No consistency guarantees, client should use unique tags Powers image replication between clusters. Simple duplicated queues with retry Pluggable storage Self-healing hash ring
Project: StarRocks (App Definition and Development / Database)
File: version.md

displayed_sidebar: "English" Returns the current version of the MySQL database. You can use to query StarRocks version. ```Haskell VARCHAR version(); ``` None Returns a value of the VARCHAR type. ```Plain Text mysql> select version(); +--+ | version() | +--+ | 5.1.0 | +--+ 1 row in set (0.00 sec) ```