cwielenb/CNCF-Dataset huggingface dataset:
Project: Harbor (Provisioning / Container Registry)
File: 3-04-LDAP-user-manage-project-members.md

Test 3-04 - Manage Project Members (LDAP Mode) ======= To verify that a non system admin user can add members of various roles to a project in LDAP mode. User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against an LDAP or AD server. ( auth_mode is set to ldap_auth* .) The user data is stored in an LDAP or AD server. A linux host with Docker CLI installed (Docker client). At least three non-admin users are in Harbor. NOTE: In below test, user A, B and C are non system admin users. User A, B, C and project X should be replaced by longer and meaningful names. MUST use two kinds of browsers at the same time to ensure independent sessions. For example, use Chrome and Firefox, or Chrome and Safari. DO NOT use the same browser to log in two users at the same time in different windows(tabs). Same as Test 3-01. Same as Test 3-01. None
Project: ArangoDB (App Definition and Development / Database)
File: boost_outcome.md

+++ title = "`boostoutcome<T, EC = boost::system::errorcode, EP = boost::exceptionptr, NoValuePolicy = policy::defaultpolicy<T, EC, EP>>`" description = "A type alias to a `basicoutcome` configured with `boost::system::errorcode`, `boost::exceptionptr` and `policy::defaultpolicy`." +++ A type alias to a {{% api "basicoutcome<T, EC, EP, NoValuePolicy>" %}} configured with {{% api "boost::system::errorcode" %}}, {{% api "boost::exceptionptr" %}} and `policy::`{{% api "defaultpolicy" %}}. This type alias always references the `std` edition of things, unlike {{% api "outcome<T, EC = varies, EP = varies, NoValuePolicy = policy::defaultpolicy<T, EC, EP>>" %}} which references either this alias or {{% api "stdoutcome<T, EC = std::errorcode, EP = std::exceptionptr, NoValuePolicy = policy::default_policy<T, EC, EP>>" %}}. Namespace: `BOOSTOUTCOMEV2_NAMESPACE` Header: `<boost/outcome/boost_outcome.hpp>`
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.8.7.md

RabbitMQ `3.8.7` is a maintenance release that patches a security vulnerability. RabbitMQ Core team would like to thank Ofir Hamam and Tomer Hadad at Ernst & Young's Hacktics Advanced Security Center for researching and responsibly disclosing the vulnerability addressed in this release. This release or later. `22.3` or `23.0` releases are recommended. explains what package repositories and tools can be used to provision latest patch versions of Erlang `22.3.x`. See upgrade and compatibility notes first if upgrading from an earlier release. See the for general documentation on upgrades and for release notes of other releases. When upgrading to this release from `3.7.6` or an older version, extra care has to be taken. Since CLI tools from RabbitMQ releases older than 3.7.7 will fail on Erlang 21 or later, RabbitMQ must be upgraded at the same time as Erlang. Alternatively the node can be upgraded to `3.7.18` first, then Erlang 22.x or 23.x, then RabbitMQ to most recent 3.8.x release. Any questions about this release, upgrades or RabbitMQ in general are welcome on the . Addressed a Windows-specific binary planting security vulnerability that allowed for arbitrary code execution. The vulnerability requires the attacker to have local access and elevated privileges, and cannot be executed remotely. : `6.7` (medium severity). This vulnerability was researched and by Ofir Hamam and Tomer Hadad at Ernst & Young's Hacktics Advanced Security Center. In a mixed version cluster, virtual host limits were incorrectly reported for yet-to-be-upgraded nodes. Contributed by @mnxumalo. GitHub issue: Definition export using `rabbitmqctl export_definitions` exported as blank. Export performed via the HTTP API was not affected by this problem. GitHub issue: Invoking `rabbitmqctl` (or other tools) without any arguments produced help output that was inconsistent from `rabbitmqctl help` in line spacing. Links in some environments upgraded from earlier `3.8.x` versions could run into a data coercion exception when connection credentials were unencrypted. GitHub issue: Shovels where the source is AMQP 1.0 endpoint now gracefully handle link detachment if the remote end set the `closed` attribute to `false`. Contributed by @tstorck. GitHub issue: Removed some debug logging that was unintentionally polluting standard output even when debug logging was not enabled. Contributed by @sircinek. GitHub issue: `credentials_obfuscation` was upgraded Warning: The source code archive provided by GitHub only contains the source of the broker, not the plugins or the client libraries. Please download the archive named `rabbitmq-server-3.8.7.tar.xz`.
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_remove.md

title: "Command - devspace remove" sidebar_label: devspace remove Changes devspace configuration ``` ``` ``` -h, --help help for remove ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: wordpress.md

The is configured to use Composer to install WordPress, its dependencies, and themes. The WordPress template is based on the boilerplate, but extended to match a standardized Lagoon deployment pattern. The template uses Composer to install WordPress and its themes. Lagoon can support MariaDB and PostgreSQL databases, but as support for PostgreSQL is limited in WordPress, it isn't recommended for use. Lagoon doesn't have a built-in configuration for WordPress - instead, the template comes with a - please contribute any improvements you may find! The Lagoon template installs `wp-cli` into the cli image to manage your WordPress install.
Project: YugabyteDB (App Definition and Development / Database)
File: oracle.md

<!-- +++ private=true +++ --> Create a role and a database user, and provide the user with READ access to all the resources which need to be migrated. Create a role that has the privileges as listed in the following table: | Permission | Object type in the source schema | | : | :- | | `SELECT` | VIEW, SEQUENCE, TABLE PARTITION, TABLE, SYNONYM, MATERIALIZED VIEW | | `EXECUTE` | TYPE | Change the `<SCHEMA_NAME>` appropriately in the following snippets, and run the following steps as a privileged user. ```sql CREATE ROLE <SCHEMANAME>reader_role; BEGIN FOR R IN (SELECT owner, objectname FROM allobjects WHERE owner=UPPER('<SCHEMANAME>') and objecttype in ('VIEW','SEQUENCE','TABLE PARTITION','SYNONYM','MATERIALIZED VIEW')) LOOP EXECUTE IMMEDIATE 'grant select on '||R.owner||'."'||R.objectname||'" to <SCHEMANAME>readerrole'; END LOOP; END; / BEGIN FOR R IN (SELECT owner, objectname FROM allobjects WHERE owner=UPPER('<SCHEMANAME>') and objecttype ='TABLE' MINUS SELECT owner, tablename from allnestedtables where owner = UPPER('<SCHEMANAME>')) LOOP EXECUTE IMMEDIATE 'grant select on '||R.owner||'."'||R.objectname||'" to <SCHEMANAME>readerrole'; END LOOP; END; / BEGIN FOR R IN (SELECT owner, objectname FROM allobjects WHERE owner=UPPER('<SCHEMANAME>') and objecttype = 'TYPE') LOOP EXECUTE IMMEDIATE 'grant execute on '||R.owner||'."'||R.objectname||'" to <SCHEMANAME>readerrole'; END LOOP; END; / GRANT SELECTCATALOGROLE TO <SCHEMANAME>reader_role; GRANT SELECT ANY DICTIONARY TO <SCHEMANAME>reader_role; GRANT SELECT ON SYS.ARGUMENT$ TO <SCHEMANAME>reader_role; ``` Create a user `ybvoyager` and grant `CONNECT` and `<SCHEMANAME>reader_role` to the user: ```sql CREATE USER ybvoyager IDENTIFIED BY password; GRANT CONNECT TO ybvoyager; GRANT <SCHEMANAME>reader_role TO ybvoyager; ``` If you're using , run the additional grant as follows: ```sql GRANT FLASHBACK ANY TABLE TO ybvoyager; ``` If you're using , the `log_mode` should be archivelog. Check the value for `log_mode` using the following command for Oracle/Oracle RDS: ```sql SELECT LOG_MODE FROM V$DATABASE; ``` If the `log_mode` value is `NOARCHIVELOG`, run the following commands: For Oracle ```sql sqlplus /nolog SQL>alter system set dbrecoveryfiledestsize = 10G; SQL>alter system set dbrecoveryfiledest = '<oraclepath>/oradata/recovery_area' scope=spfile; SQL> connect / as sysdba SQL> Shutdown immediate SQL> Startup mount SQL> Alter database archivelog; SQL> Alter database open; ``` For Oracle RDS ```sql exec rdsadmin.rdsadminutil.setconfiguration('archivelog retention hours',24); ``` Verify using `archive log list`. If you want yb-voyager to connect to the source database over SSL, refer to . Note that you can use only one of the following arguments to connect to your Oracle instance: --source-db-schema (Schema name of the source database.) --oracle-db-sid (Oracle System Identifier you can use while exporting data from Oracle instances.) --oracle-tns-alias (TNS (Transparent Network Substrate) alias configured to establish a secure connection with the server.)
Project: Cloud Custodian (Provisioning / Automation & Configuration)
File: development.md

If you are just interested in doing local development with GCP, and not the whole c7n collection, then you can do the following. Poetry will create a virtual environment and install the development dependencies. poetry install Normally tests will be run from the root of the c7n project. You can just run local ones, but you will need some environment variables. These are set in `test.env` in the `c7n` project root dir. export GOOGLECLOUDPROJECT=custodian-1291 export GOOGLEAPPLICATIONCREDENTIALS=tests/data/credentials.json You want to ensure that you are using the dependencies installed by poetry, so run the tests with something like this: poetry run pytest <other flags> Some people prefer to use the `poetry shell` functionality to enter the virtual environment. poetry shell pytest <flags>
Project: ArangoDB (App Definition and Development / Database)
File: move_assignment.md

+++ title = "`basicresult &operator=(basicresult &&)`" description = "Move assignment. Constexpr, triviality and noexcept propagating." categories = ["operators", "assignment", "move-assignment"] weight = 130 +++ Move assignment. Requires: that `valuetype` and `errortype` both implement move assignment. Complexity: If the `valuetype` for both is present, uses `valuetype`'s move assignment operator, else either destructs or move constructs `valuetype` as appropriate. `errortype`'s move assignment operator is always used. Constexpr, triviality and noexcept of underlying operations is propagated. Guarantees: If an exception is thrown during the operation, the object is left in a partially completed state, as per the normal rules for the same operation on a `struct`.
Project: KICS (Provisioning / Security & Compliance)
File: integrations_travisci.md

You can integrate KICS into your Travis CI/CD pipelines. This provides you the ability to run KICS scans in your repositories and streamline vulnerabilities and misconfiguration checks to your infrastructure as code (IaC). ```yaml services: docker before_install: docker pull checkmarx/kics:latest script: docker run -v ${PWD}/path checkmarx/kics:latest scan -p /path -o ${PWD} --ci --ignore-on-exit results ```
Project: Harbor (Provisioning / Container Registry)
File: 1-07-LDAP-mode-general.md

Test 1-07 - LDAP Mode general functions ======= To verify that Harbor's UI works properly in LDAP mode. User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against an AD or LDAP server. (auth_mode is set to ldap_auth* .) An Active Directory (AD) or LDAP server has been set up and it has a few users available for testing. The login page should not have "sign up" button. There is no need to allow self-registration. Log in as a non system admin user(LDAP/AD) to the UI, he/she should NOT see the option of changing password or updating account settings. Log out the user. Log in as a system admin user to the UI, he/she should see the option of changing his/her own password or updating account settings. The system admin user should NOT see the option of adding a new user. The system admin user should see above LDAP/AD user in the list. From the list, the system admin assigns system admin role to an AD/LDAP user A. On a different browser(e.g. if the admin logs in using Chrome, then choose Safari or FireFox ), log in as the AD/LDAP user A to verify that user A has admin privilege. From the list, the system admin removes system admin role from user A. On a different browser, refresh the UI to verify user A has no admin privilege any more. The system admin user deletes an AD/LDAP user in Harbor. NOTE: The user can log in again to regain access, however, all the previous projects he/she is a member of are lost. To really disable a user's login, the user must be removed or disabled in AD or LDAP. As described in steps 1-6. A LDAP/AD user can be assigned or removed admin role in Step 7-10. The user can be deleted successfully in Step 11. None
Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_get.md

Fetches Sonobuoy resources of a specified type ``` -h, --help help for get ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Generate reports on your Kubernetes cluster by running plugins - Fetch sonobuoy pods
Project: Veinmind Tools (Provisioning / Security & Compliance)
File: veinmind-runner_scan_image.md

Scan image Scan image from multi source, include dockerd/containerd/registry ``` veinmind-runner scan image [flags] target ``` ``` scan dockerd image nginx:latest veinmind-runner scan image dockerd:nginx:latest scan containerd image bitnami/nginx:latest veinmind-runner scan image containerd:bitnami/nginx:latest scan public registry image library/ubuntu (all tag) veinmind-runner scan image registry-image:library/ubuntu scan private registry image example.com/app/market:v1.11.2 veinmind-runner scan image -c auth.toml registry-image:example.com/app/market:v1.11.2 use openai analyze result veinmind-runner scan image --enable-analyze --openai-token <youropenaitoken> nginx:latest use openai analyze result with yourself questions veinmind-runner scan image --enable-analyze --openai-token <youropenaitoken> -p "explain what happened at this json" nginx:latest scan private registry example.com need admin privilege) veinmind-runner scan image -c auth.toml registry:example.com auth.toml format (yaml): [[auths]] registry = "example.com" username = "<your-username>" password = "<your-password>" scan tarball format image veinmind-runner scan image tarball:/tmp/alpine.tar ``` ``` -c, --config string auth config path -f, --filter string catalog repo filter regex -h, --help help for image ``` ``` --enable-analyze auto use openai analyze result -e, --exit-code int exit-code when veinmind-runner find security issues --format string output format: html/json/cli (default "cli") -g, --glob string specifies the pattern of plugin file to find --insecure-skip skip tls config --openai-token string auto openai analyze openai_key -o, --output string output filepath of report -p, --prefix string training openai limit sentence --threads int threads for scan action (default 5) -v, --verbose output verbose detail ``` - Scan cloud native objects security, include image/container/iac
Project: KICS (Provisioning / Security & Compliance)
File: 48c61fbd-09c9-46cc-a521-012e0c325412.md

title: Private Cluster Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 48c61fbd-09c9-46cc-a521-012e0c325412 Query name: Private Cluster Disabled Platform: GoogleDeploymentManager Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Kubernetes Clusters must be created with Private Clusters enabled, meaning the 'privateClusterConfig' must be defined and the attributes 'enablePrivateEndpoint' and 'enablePrivateNodes' must be true.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4" resources: name: mycluster type: container.v1.cluster properties: zone: us-east1-b ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="6 7" resources: name: mycluster2 type: container.v1.cluster properties: zone: us-east1-b privateClusterConfig: enablePrivateEndpoint: false ``` ```yaml title="Negative test num. 1 - yaml file" resources: name: mycluster3 type: container.v1.cluster properties: zone: us-east1-b privateClusterConfig: enablePrivateEndpoint: true enablePrivateNodes: true ```
Project: Checkov (Provisioning / Security & Compliance)
File: SARIF.md

layout: default published: true title: SARIF nav_order: 20 SARIF (Static Analysis Results Interchange Format) is a standard format for the output of static analysis tools. It can be used to show alerts in your GitHub repository as a part of the code scanning experience. A typical output looks like this ```json { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Checkov", "version": "2.3.55", "informationUri": "https://www.checkov.io/", "rules": [ { "id": "CKVAWS21", "name": "Ensure the S3 bucket has versioning enabled", "shortDescription": { "text": "Ensure the S3 bucket has versioning enabled" }, "fullDescription": { "text": "Ensure the S3 bucket has versioning enabled" }, "help": { "text": "Ensure the S3 bucket has versioning enabled\nResource: awss3bucket.operations" }, "helpUri": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning", "defaultConfiguration": { "level": "error" }, "properties": {"security-severity": 8.9} }, { "id": "CKVAWS3", "name": "Ensure all data stored in the EBS is securely encrypted", "shortDescription": { "text": "Ensure all data stored in the EBS is securely encrypted" }, "fullDescription": { "text": "Ensure all data stored in the EBS is securely encrypted" }, "help": { "text": "Ensure all data stored in the EBS is securely encrypted\nResource: awsebsvolume.webhoststorage" }, "helpUri": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-7", "defaultConfiguration": { "level": "error" }, "properties": {"security-severity": 6.9} } ], "organization": "prisma" } }, "results": [ { "ruleId": "CKVAWS21", "ruleIndex": 0, "level": "error", "attachments": [], "message": { "text": "Ensure the S3 bucket has versioning enabled" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "s3.tf" }, "region": { "startLine": 1, "endLine": 3, "snippet": { "text": "resource awss3bucket \"operations\" {\n bucket = \"example\"\n}\n" } } } } ] }, { "ruleId": "CKVAWS3", "ruleIndex": 1, "level": "error", "attachments": [], "message": { "text": "Ensure all data stored in the EBS is securely encrypted" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "ec2.tf" }, "region": { "startLine": 5, "endLine": 7, "snippet": { "text": "resource awsebsvolume \"webhoststorage\" {\n availability_zone = \"us-west-2a\"\n}\n" } } } } ] } ] } ] }, ``` The output can be created via the output flag ```shell checkov -d . -o sarif ``` Further information on the different elements and attributes can be found .
Project: KICS (Provisioning / Security & Compliance)
File: 609839ae-bd81-4375-9910-5bce72ae7b92.md

title: MSSQL Server Auditing Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 609839ae-bd81-4375-9910-5bce72ae7b92 Query name: MSSQL Server Auditing Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Make sure that for MSSQL Servers, that 'Auditing' is set to 'On'<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "azurermmssqlserver" "positive1" { name = "mssqlserver" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location version = "12.0" administrator_login = "mradministrator" administratorloginpassword = "thisIsDog11" } ``` ```tf title="Negative test num. 1 - tf file" provider "azurerm" { features {} } resource "azurermresourcegroup" "example" { name = "example-resources" location = "West Europe" } resource "azurermmssqlserver" "example" { name = "mssqlserver" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location version = "12.0" administrator_login = "mradministrator" administratorloginpassword = "thisIsDog11" } resource "azurermmssqldatabase" "example" { name = "example-db" serverid = azurermmssql_server.example.id } resource "azurermstorageaccount" "example" { name = "examplesa" resourcegroupname = azurermresourcegroup.example.name location = azurermresourcegroup.example.location account_tier = "Standard" accountreplicationtype = "LRS" } resource "azurermmssqlserverextendedauditing_policy" "example" { databaseid = azurermmssql_database.example.id storageendpoint = azurermstorageaccount.example.primaryblob_endpoint storageaccountaccesskey = azurermstorageaccount.example.primaryaccess_key storageaccountaccesskeyis_secondary = false retentionindays = 6 } ```
Project: KICS (Provisioning / Security & Compliance)
File: 15ffbacc-fa42-4f6f-a57d-2feac7365caa.md

title: Redshift Cluster Logging Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 15ffbacc-fa42-4f6f-a57d-2feac7365caa Query name: Redshift Cluster Logging Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Make sure Logging is enabled for Redshift Cluster<br> ```tf title="Positive test num. 1 - tf file" hl_lines="9 13" resource "awsredshiftcluster" "positive1" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" logging { enable = false } } resource "awsredshiftcluster" "positive2" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" } ``` ```tf title="Negative test num. 1 - tf file" resource "awsredshiftcluster" "negative1" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" logging { enable = true bucket_name = "nameOfAnExistingS3Bucket" } } ```