cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: dcda2d32-e482-43ee-a926-75eaabeaa4e0.md

title: RAM Security Preference Not Enforce MFA Login hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: dcda2d32-e482-43ee-a926-75eaabeaa4e0 Query name: RAM Security Preference Not Enforce MFA Login Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Access Control URL: RAM Security preferences should enforce MFA login for RAM users<br> ```tf title="Positive test num. 1 - tf file" hl_lines="11" resource "alicloudramuser" "user1" { name = "user_test" displayname = "userdisplay_name" mobile = "86-18688888888" email = "hello.uuu@aaa.com" comments = "yoyoyo" force = true } resource "alicloudramsecurity_preference" "example1" { enablesavemfa_ticket = false allowusertochangepassword = true } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="14" resource "alicloudramuser" "user2" { name = "user_test" displayname = "userdisplay_name" mobile = "86-18688888888" email = "hello.uuu@aaa.com" comments = "yoyoyo" force = true } resource "alicloudramsecurity_preference" "example2" { enablesavemfa_ticket = false allowusertochangepassword = true enforcemfafor_login = false } ``` ```tf title="Negative test num. 1 - tf file" resource "alicloudramuser" "user0" { name = "user_test" displayname = "userdisplay_name" mobile = "86-18688888888" email = "hello.uuu@aaa.com" comments = "yoyoyo" force = true } resource "alicloudramsecurity_preference" "example0" { enablesavemfa_ticket = false allowusertochangepassword = true enforcemfafor_login = true } ```
Project: Numaflow (App Definition and Development / Streaming & Messaging)
File: max-message-size.md

The default maximum message size is `1MB`. There's a way to increase this limit in case you want to, but please think it through before doing so. The max message size is determined by: Max messages size supported by gRPC (default value is `64MB` in Numaflow). Max messages size supported by the Inter-Step Buffer implementation. If `JetStream` is used as the Inter-Step Buffer implementation, the default max message size for it is configured as `1MB`. You can change it by setting the `spec.jetstream.settings` in the `InterStepBufferService` specification. ```yaml apiVersion: numaflow.numaproj.io/v1alpha1 kind: InterStepBufferService metadata: name: default spec: jetstream: settings: | max_payload: 8388608 # 8MB ``` It's not recommended to use values over `8388608` (8MB) but `max_payload` can be set up to `67108864` (64MB). Please be aware that if you increase the max message size of the `InterStepBufferService`, you probably will also need to change some other limits. For example, if the size of each messages is as large as 8MB, then 100 messages flowing in the pipeline will make each of the Inter-Step Buffer need at least 800MB of disk space to store the messages, and the memory consumption will also be high, that will probably cause the Inter-Step Buffer Service to crash. In that case, you might need to update the retention policy in the Inter-Step Buffer Service to make sure the messages are not stored for too long. Check out the for more details.
Project: Shifu (Provisioning / Automation & Configuration)
File: pull-request-template.md

<!-- Thanks for sending a pull request! Here are some tips for you: If you want faster PR reviews, read how: https://github.com/kubernetes/community/blob/master/contributors/devel/pull-requests.md#best-practices-for-faster-reviews --> What this PR does / why we need it: Will this PR make the community happier? Which issue this PR fixes (optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged): fixes # How is this PR tested [ ] unit test [ ] e2e test [ ] other (please specify) Special notes for your reviewer: Release note: <!-- Steps to write your release note: Use the release-note-* labels to set the release note state (if you have access) Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. --> ```release-note ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.12.4.md

RabbitMQ `3.12.4` is a maintenance release in the `3.12.x` . Please refer to the upgrade section from the if upgrading from a version prior to 3.12.0. This release requires Erlang 25 and supports Erlang versions up to `26.0.x`. has more details on Erlang version requirements for RabbitMQ. As of 3.12.0, RabbitMQ requires Erlang 25. Nodes will fail to start on older Erlang releases. Users upgrading from 3.11.x (or older releases) on Erlang 25 to 3.12.x on Erlang 26 (both RabbitMQ and Erlang are upgraded at the same time) must consult the first. Release notes can be found on GitHub at . Consumer churn on quorum queues could result in some messages not being delivered to consumers in certain cases. This mostly affected queue federation links. GitHub issue: Quorum queue replica management operations over the HTTP API now can be disabled. This can be useful in environments where replica management is done by the platform team and tooling, and should not be exposed to cluster users. Contributed by @SimonUnge (AWS). GitHub issue: Queue federation links that connected quorum queues could get stuck (stop transferring messages even when there were no other consumers on the upstream). GitHub issue: LDAP plugin did not interpolate values with non-ASCII characters correctly. GitHub issue: None in this release. To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.12.4.tar.xz` instead of the source tarball produced by GitHub.
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: envoy-authorization.md

title: Container Network Authorization with Envoy subtitle: Official OPA Envoy Integration labels: category: servicemesh layer: network software: envoy tutorials: https://github.com/tsandall/minimal-opa-envoy-example/blob/master/README.md https://www.openpolicyagent.org/docs/latest/envoy-introduction/ code: https://github.com/open-policy-agent/opa-envoy-plugin https://github.com/tsandall/minimal-opa-envoy-example inventors: styra blogs: https://blog.openpolicyagent.org/envoy-external-authorization-with-opa-578213ed567c videos: title: 'OPA at Scale: How Pinterest Manages Policy Distribution' speakers: name: Will Fu organization: pinterest name: Jeremy Krach organization: pinterest venue: OPA Summit at Kubecon San Diego 2019 link: https://www.youtube.com/watch?v=LhgxFICWsA8 title: Deploying Open Policy Agent at Atlassian speakers: name: Chris Stivers organization: atlassian name: Nicholas Higgins organization: atlassian venue: OPA Summit at Kubecon San Diego 2019 link: https://www.youtube.com/watch?v=nvRTO8xjmrg title: How Yelp Moved Security From the App to the Mesh with Envoy and OPA speakers: name: Daniel Popescu organization: yelp name: Ben Plotnick organization: yelp venue: Kubecon San Diego 2019 link: https://www.youtube.com/watch?v=Z6aN3Smt-9M docs_features: envoy: note: | The project is the official integration for OPA and Envoy. rest-api-integration: note: | The project uses the REST API to allow and deny requests routed via an Envoy proxy. Read about this integration in the . Envoy is a networking abstraction for cloud-native applications. OPA hooks into Envoys external authorization filter to provide fine-grained, context-aware authorization for network or HTTP requests.
Project: StarRocks (App Definition and Development / Database)
File: cardinality.md

displayed_sidebar: "English" Returns the number of elements in a MAP value. MAP is an unordered collection of key-value pairs, for example, `{"a":1, "b":2}`. One key-value pair constitutes one element. `{"a":1, "b":2}` contains two elements. This function is supported from v3.0 onwards. It is the alias of . ```Haskell INT cardinality(any_map) ``` `any_map`: the MAP value from which you want to retrieve the number of elements. Returns a value of the INT value. If the input is NULL, NULL is returned. If a key or value in the MAP value is NULL, NULL is processed as a normal value. From v3.1 onwards, StarRocks supports defining MAP columns when you create a table. This example uses table `test_map`, which contains the following data: ```Plain CREATE TABLE test_map( col_int INT, col_map MAP<VARCHAR(50),INT> ) DUPLICATE KEY(col_int); INSERT INTO test_map VALUES (1,map{"a":1,"b":2}), (2,map{"c":3}), (3,map{"d":4,"e":5}); SELECT * FROM testmap ORDER BY colint; +++ | colint | colmap | +++ | 1 | {"a":1,"b":2} | | 2 | {"c":3} | | 3 | {"d":4,"e":5} | +++ 3 rows in set (0.05 sec) ``` Obtain the number of elements in each row of the `col_map` column. ```Plaintext select cardinality(colmap) from testmap order by col_int; +-+ | cardinality(col_map) | +-+ | 2 | | 1 | | 2 | +-+ 3 rows in set (0.05 sec) ``` This example uses Hive table `hive_map`, which contains the following data: ```Plaintext SELECT * FROM hivemap ORDER BY colint; +++ | colint | colmap | +++ | 1 | {"a":1,"b":2} | | 2 | {"c":3} | | 3 | {"d":4,"e":5} | +++ ``` After a is created in your cluster, you can use this catalog and the cardinality() function to obtain the number of elements in each row of the `col_map` column. ```Plaintext SELECT cardinality(colmap) FROM hivemap ORDER BY col_int; +-+ | cardinality(col_map) | +-+ | 2 | | 1 | | 2 | +-+ 3 rows in set (0.05 sec) ```
Project: Cloud Custodian (Provisioning / Automation & Configuration)
File: OWNERS.md

Kapil Thangavelu (@kapilt) project lead (bdfl) Darren Dao (@darrendao) Pratyush Mishra (@PratMis) Todd Stansell (@tjstansell) John Hillegass (@JohnHillegass) Sonny Shi (@thisisshi) David Filiatrault (@FireballDWF) Jamison Roberts (@jtroberts83) Karol Lassak (@ingwarsw) Stefan Gordon (@stefangordon) Andy Luong (@aluong) Kiril Logachev (@logachev) Administrative duties on behalf of the maintainers, used for governance/CNCF contact, no code rights. Jorge Castro (@castrojo) Since the opensource inception of Cloud Custodian in April 2016, we have had numerous maintainers who over the course of years are no longer current contributors, but we still celebrate their contributions and they are listed here. Kit Ewbank (@ewbankkit) Mandeep Bal (@mandeepbal) Erin Welch (@erwelch) Darcy Laylock (@Sutto)
Project: KICS (Provisioning / Security & Compliance)
File: 7cc6c791-5f68-4816-a564-b9b699f9d26e.md

title: ElastiCache Using Default Port hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 7cc6c791-5f68-4816-a564-b9b699f9d26e Query name: ElastiCache Using Default Port Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: ElastiCache should not use the default port (an attacker can easily guess the port). For engine set to Redis, the default port is 6379. The Memcached default port is 11211<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="9" name: Basic example community.aws.elasticache: name: "test-please-delete" state: present engine: memcached cacheengineversion: 1.4.14 node_type: cache.m1.small num_nodes: 1 cache_port: 11211 cachesubnetgroup: default zone: us-east-1d ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="9" name: Basic example2 community.aws.elasticache: name: "test-please-delete" state: present engine: redis cacheengineversion: 1.4.14 node_type: cache.m1.small num_nodes: 1 cache_port: 6379 cachesubnetgroup: default zone: us-east-1d ``` ```yaml title="Negative test num. 1 - yaml file" name: Basic example2 community.aws.elasticache: name: "test-please-delete" state: present engine: memcached cacheengineversion: 1.4.14 node_type: cache.m1.small num_nodes: 1 cache_port: 11212 cachesubnetgroup: default zone: us-east-1d ``` ```yaml title="Negative test num. 2 - yaml file" name: Basic example2 community.aws.elasticache: name: "test-please-delete" state: present engine: redis cacheengineversion: 1.4.14 node_type: cache.m1.small num_nodes: 1 cache_port: 6380 cachesubnetgroup: default zone: us-east-1d ```
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: devspace_logs.md

title: "Command - devspace logs" sidebar_label: devspace logs Prints the logs of a pod and attaches to it ``` devspace logs [flags] ``` ``` Logs prints the last log of a pod container and attachs to it Example: devspace logs devspace logs --namespace=mynamespace ``` ``` -c, --container string Container name within pod where to execute command -f, --follow Attach to logs afterwards -h, --help help for logs --image string Image is the config name of an image to select in the devspace config (e.g. 'default'), it is NOT a docker image like myuser/myimage --image-selector string The image to search a pod for (e.g. nginx, nginx:latest, ${runtime.images.app}, nginx:${runtime.images.app.tag}) -l, --label-selector string Comma separated key=value selector list (e.g. release=test) --lines int Max amount of lines to print from the last log (default 200) --pick Select a pod (default true) --pod string Pod to print the logs of --wait Wait for the pod(s) to start if they are not running ``` ``` --config string The devspace config file to use --debug Prints the stack trace if an error occurs --disable-profile-activation If true will ignore all profile activations --inactivity-timeout int Minutes the current user is inactive (no mouse or keyboard interaction) until DevSpace will exit automatically. 0 to disable. Only supported on windows and mac operating systems (default 180) --kube-context string The kubernetes context to use -n, --namespace string The kubernetes namespace to use --no-warn If true does not show any warning when deploying into a different namespace or kube-context than before -p, --profile strings The DevSpace profiles to apply. Multiple profiles are applied in the order they are specified --profile-parent strings One or more profiles that should be applied before the specified profile (e.g. devspace dev --profile-parent=base1 --profile-parent=base2 --profile=my-profile) --profile-refresh If true will pull and re-download profile parent sources --restore-vars If true will restore the variables from kubernetes before loading the config --save-vars If true will save the variables to kubernetes after loading the config --silent Run in silent mode and prevents any devspace log output except panics & fatals -s, --switch-context DEPRECATED: Switches and uses the last kube context and namespace that was used to deploy the DevSpace project --var strings Variables to override during execution (e.g. --var=MYVAR=MYVALUE) --vars-secret string The secret to restore/save the variables from/to, if --restore-vars or --save-vars is enabled (default "devspace-vars") ```
Project: KICS (Provisioning / Security & Compliance)
File: ce60cc6b-6831-4bd7-84a2-cc7f8ee71433.md

title: SSM Session Transit Encryption Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ce60cc6b-6831-4bd7-84a2-cc7f8ee71433 Query name: SSM Session Transit Encryption Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: SSM Session should be encrypted in transit<br> ```tf title="Positive test num. 1 - tf file" hl_lines="5" resource "awsssmdocument" "positive1" { name = "test_document" document_type = "Session" content = <<DOC { "schemaVersion": "1.2", "description": "Check ip configuration of a Linux instance." } DOC } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="5" resource "awsssmdocument" "positive2" { name = "test_document" document_type = "Session" content = <<DOC { "schemaVersion": "1.2", "description": "Check ip configuration of a Linux instance.", "inputs": { "s3EncryptionEnabled": true, "cloudWatchEncryptionEnabled": true, "cloudWatchStreamingEnabled": true, "runAsEnabled": false } } DOC } ``` ```tf title="Negative test num. 1 - tf file" resource "awsssmdocument" "negative" { name = "test_document" document_type = "Session" content = <<DOC { "schemaVersion": "1.2", "description": "Check ip configuration of a Linux instance.", "inputs": { "s3EncryptionEnabled": true, "cloudWatchEncryptionEnabled": true, "cloudWatchStreamingEnabled": true, "runAsEnabled": false, "kmsKeyId": "${var.kmskeyid}" } } DOC } ```
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: fix-12492.en.md

Return `Receive-Maximum` in `CONNACK` for MQTT v5 clients. EMQX takes the min value of client's `Receive-Maximum` and server's `max_inflight` config as the max number of inflight (unacknowledged) messages allowed. Prior to this fix, the value was not sent back to the client in `CONNACK` message.
Project: Redis (App Definition and Development / Database)
File: README.md

This directory contains JSON files, one for each of Redis commands. Each JSON contains all the information about the command itself, but these JSON files are not to be used directly! Any third party who needs access to command information must get it from `COMMAND INFO` and `COMMAND DOCS`. The output can be extracted in a JSON format by using `redis-cli --json`, in the same manner as in `utils/generate-commands-json.py`. The JSON files are used to generate commands.def (and https://github.com/redis/redis-doc/blob/master/commands.json) in Redis, and despite looking similar to the output of `COMMAND` there are some fields and flags that are implicitly populated, and that's the reason one shouldn't rely on the raw files. The structure of each JSON is somewhat documented in https://redis.io/commands/command-docs/ and https://redis.io/commands/command/ The `reply_schema` section is a standard JSON Schema (see https://json-schema.org/) that describes the reply of each command. It is designed to someday be used to auto-generate code in client libraries, but is not yet mature and is not exposed externally.
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.8.23.md

RabbitMQ `3.8.23` is a maintenance release. All users are recommended to upgrade to this release. RabbitMQ releases are distributed via , , and . This release and . explains what package repositories and tools can be used to provision modern Erlang versions. See the for general documentation on upgrades and for release notes of other releases. If upgrading from a`3.7.x` release, see upgrade and compatibility notes first. If upgrading from a `3.6.x` or older , first upgrade to and then to this version. Any questions about this release, upgrades or RabbitMQ in general are welcome on the and . Release notes are kept under . Contributors are encouraged to update them together with their changes. This helps with release automation and more consistent release schedule. TLS information delivered in header is now attached to connection metrics as if it was provided by a non-proxying client. GitHub issue: contributed by @prefiks, sponsored by CloudAMQP Classic queue shutdown now uses a much higher timeout (up to 10 minutes instead of 30 seconds). In environments with many queues (especially mirrored queues) and many consumers this means that the chance of queue indices rebuilding after node restart is now substantially lower. GitHub issue: Quorum queues no longer leak memory and disk space when a consumer is repeatedly added and cancelled on an empty queue. GitHub issue: observer_cli has been upgraded from `1.6.2` to `1.7.1` To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.8.23.tar.xz` instead of the source tarball produced by GitHub.
Project: Checkov (Provisioning / Security & Compliance)
File: Installing Checkov.md

layout: default published: true title: Installing Checkov nav_order: 1 Installing Checkov is quick and straightforwardjust install, configure input, and scan. ```shell pip install checkov ``` or ```shell pip3 install checkov ``` In general, it is not recommended to use Alpine with larger Python projects, like Checkov, because of incompatible C extensions. Currently, Checkov can only be installed on Alpine with Python 3.11+, but it is not officially tested or supported. ```shell pip3 install --upgrade pip && pip3 install --upgrade setuptools pip3 install checkov ``` ```shell brew install checkov ``` If you installed Checkov with pip3, use the following command to upgrade: ```shell pip3 install -U checkov ``` or with Homebrew ```sh brew upgrade checkov ``` ```shell checkov --directory /user/path/to/iac/code ``` ```shell checkov --file /user/tf/example.tf ``` ```shell checkov -f /user/cloudformation/example1.yml -f /user/cloudformation/example2.yml ``` ```json terraform init terraform plan -out tf.plan terraform show -json tf.plan > tf.json checkov -f tf.json ``` Note: The Terraform show output file `tf.json` will be a single line. For that reason Checkov will report all findings as line number 0. ```json check: CKVAWS21: "Ensure all data stored in the S3 bucket have versioning enabled" FAILED for resource: awss3bucket.customer File: /tf/tf.json:0-0 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning ``` If you have installed jq, you can convert a JSON file into multiple lines with the command `terraform show -json tf.plan | jq '.' > tf.json`, making it easier to read the scan result. ```json checkov -f tf.json Check: CKVAWS21: "Ensure all data stored in the S3 bucket have versioning enabled" FAILED for resource: awss3bucket.customer File: /tf/tf1.json:224-268 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning 225 | "values": { 226 | "acceleration_status": "", 227 | "acl": "private", 228 | "arn": "arn:aws:s3:::mybucket", ```