cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: fa750c81-93c2-4fab-9c6d-d3fd3ce3b89f.md

title: TSL Connection Certificate Not Setup hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: fa750c81-93c2-4fab-9c6d-d3fd3ce3b89f Query name: TSL Connection Certificate Not Setup Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: TSL Connection Certificate files should be Setup<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="2" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false evictionHard: memory.available: "200Mi" ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--tls-cert-file=someFile.txt","--tls-private-key-file=someFile.txt"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false tlsCertFile: "someFile.txt" tlsPrivateKeyFile: "someFile.txt" evictionHard: memory.available: "200Mi" ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: [] restartPolicy: OnFailure ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "port": 10250, "readOnlyPort": 10255, "cgroupDriver": "cgroupfs", "hairpinMode": "promiscuous-bridge", "serializeImagePulls": false, "tlsCertFile": "someFile.txt", "tlsPrivateKeyFile": "someFile.txt", "featureGates": { "RotateKubeletClientCertificate": true, "RotateKubeletServerCertificate": true } } ``` </details>
Project: Open Policy Administration Layer (OPAL) (Provisioning / Security & Compliance)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: '' assignees: '' Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] Describe the solution you'd like A clear and concise description of what you want to happen. Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered. Additional context Add any other context or screenshots about the feature request here.
Project: KICS (Provisioning / Security & Compliance)
File: 2c4fe4a9-f44b-4c70-b09b-5b75cd251805.md

title: Unrestricted Databricks ACL hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2c4fe4a9-f44b-4c70-b09b-5b75cd251805 Query name: Unrestricted Databricks ACL Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: ACL allow ingress from 0.0.0.0/0 and/or ::/0<br> ```tf title="Positive test num. 1 - tf file" hl_lines="10" resource "databricksworkspaceconf" "positive1" { custom_config = { "enableIpAccessLists" : true } } resource "databricksipaccess_list" "positive1" { label = "allow_in" list_type = "ALLOW" ip_addresses = [ "0.0.0.0/0", "1.2.5.0/24" ] dependson = [databricksworkspace_conf.positive1] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="10" resource "databricksworkspaceconf" "positive2" { custom_config = { "enableIpAccessLists" : true } } resource "databricksipaccess_list" "positive2" { label = "allow_in" list_type = "ALLOW" ip_addresses = [ "::/0", "1.2.5.0/24" ] dependson = [databricksworkspace_conf.positive2] } ``` ```tf title="Negative test num. 1 - tf file" resource "databricksworkspaceconf" "negative" { custom_config = { "enableIpAccessLists" : true } } resource "databricksipaccess_list" "negative" { label = "allow_in" list_type = "ALLOW" ip_addresses = [ "1.2.3.0/24", "1.2.5.0/24" ] dependson = [databricksworkspace_conf.negative] } ```
Project: Cassandra (App Definition and Development / Database)
File: CONTRIBUTING.md

<!-- --> Apache Cassandra doesn't use GitHub pull requests as part of the development process. In fact, this repository is a GitHub mirror of . Use to create an issue, then either attach a patch or post a link to a GitHub branch with your changes. How you can contribute to Apache Cassandra by Yuki Morishita Code style Running Cassandra in IDEA Running Cassandra in Eclipse Cassandra Cluster Manager - and a guide Cassandra Distributed Tests aka Cassandra Testing Guidelines - see TESTING.md
Project: ArangoDB (App Definition and Development / Database)
File: is_nothrow_swappable.md

+++ title = "`BOOSTOUTCOMEUSESTDISNOTHROWSWAPPABLE`" description = "How to implement `isnothrowswappable<T>`." +++ Whether to implement `isnothrowswappable<T>` as `std::isnothrowswappable<T>`, or else use a local emulation. Overridable: Define before inclusion. Default: If the current compiler implements C++ 17 or later, if unset this macro is defaulted to `1`, otherwise it is defaulted to `0`. Header: `<boost/outcome/config.hpp>`
Project: YugabyteDB (App Definition and Development / Database)
File: smembers.md

title: SMEMBERS linkTitle: SMEMBERS description: SMEMBERS menu: preview: parent: api-yedis weight: 2300 aliases: /preview/api/redis/smembers /preview/api/yedis/smembers type: docs `SMEMBERS key` This command selects all members of the set that is associated with the given `key`. If `key` is associated with a value that is not a set, an error is raised. If `key` does not exist, no value is returned. Returns all members of the given set. ```sh $ SADD yuga_world "Africa" ``` ``` 1 ``` ```sh $ SADD yuga_world "America" ``` ``` 1 ``` ```sh $ SMEMBERS yuga_world ``` ``` 1) "Africa" 2) "America" ``` , , ,
Project: ArangoDB (App Definition and Development / Database)
File: implicit_failure_error_exception_copy_constructor.md

+++ title = "`basicoutcome(const failuretype<EC, EP> &)`" description = "Implicit error-and-exception-from-failure-type-sugar copy constructor. Available if `predicate::enablecompatibleconversion<void, EC, EP, void>` is true. Constexpr, triviality and noexcept propagating." categories = ["constructors", "implicit-constructors", "tagged-constructors"] weight = 536 +++ Implicit error-and-exception-from-failure-type-sugar copy constructor used to disambiguate the construction of the error + exception types. Calls {{% api "void onoutcomecopyconstruction(T *, U &&, V &&) noexcept" %}} with `this`, `const failuretype<EC> &` and `const failure_type<EP> &`. Requires: `predicate::enablecompatibleconversion<void, EC, EP, void>` is true. Complexity: Same as for the `errortype` and `exceptiontype` constructors which accept `EC` and `EP`. Constexpr, triviality and noexcept of underlying operations is propagated.
Project: KICS (Provisioning / Security & Compliance)
File: d39761d7-94ab-45b0-ab5e-27c44e381d58.md

title: Stack Notifications Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d39761d7-94ab-45b0-ab5e-27c44e381d58 Query name: Stack Notifications Disabled Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: AWS CloudFormation should have stack notifications enabled to be notified when an event occurs<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="2" name: create a stack, pass in the template via an URL amazon.aws.cloudformation: stack_name: "ansible-cloudformation" state: present region: us-east-1 disable_rollback: true template_url: https://s3.amazonaws.com/my-bucket/cloudformation.template template_parameters: KeyName: jmartin DiskType: ephemeral InstanceType: m1.small ClusterSize: 3 tags: Stack: ansible-cloudformation ``` ```yaml title="Negative test num. 1 - yaml file" name: create a stack, pass in the template via an URL amazon.aws.cloudformation: stack_name: ansible-cloudformation stack_policy: wowowowoowow notification_arns: a, b state: present region: us-east-1 disable_rollback: true template_url: https://s3.amazonaws.com/my-bucket/cloudformation.template template_parameters: KeyName: jmartin DiskType: ephemeral InstanceType: m1.small ClusterSize: 3 tags: Stack: ansible-cloudformation ```
Project: Apache Hadoop (App Definition and Development / Database)
File: RELEASENOTES.2.7.3.md

<! --> These release notes cover new developer and user-facing incompatibilities, important issues, features, and major improvements. | Critical | Allow repeating job commit by extending OutputCommitter API* Previously, the MR job will get failed if AM get restarted for some reason (like node failure, etc.) during its doing commit job no matter if AM attempts reach to the maximum attempts. In this improvement, we add a new API isCommitJobRepeatable() to OutputCommitter interface which to indicate if job's committer can do commitJob again if previous commit work is interrupted by NM/AM failures, etc. The instance of OutputCommitter, which support repeatable job commit (like FileOutputCommitter in algorithm 2), can allow AM to continue the commitJob() after AM restart as a new attempt. | Critical | RPC client does not time out by default* This fix includes public method interface change. A follow-up JIRA issue for this incompatibility for branch-2.7 is HADOOP-13579. | Major | Annotate CanUnbuffer with @InterfaceAudience.Public* Made CanBuffer interface public for use in client applications. | Major | Support additional compression levels for GzipCodec* Added New compression levels for GzipCodec that can be set in zlib.compress.level | Critical | Add capability to set JHS job cache to a task-based limit* Two recommendations for the mapreduce.jobhistory.loadedtasks.cache.size property: 1) For every 100k of cache size, set the heap size of the Job History Server to 1.2GB. For example, mapreduce.jobhistory.loadedtasks.cache.size=500000, heap size=6GB. 2) Make sure that the cache size is larger than the number of tasks required for the largest job run on the cluster. It might be a good idea to set the value slightly higher (say, 20%) in order to allow for job size growth. | Major | inconsistent value type of the "type" field for LeafQueueInfo in response of RM REST API - cluster/scheduler* Fix inconsistent value type ( String and Array ) of the "type" field for LeafQueueInfo in response of RM REST API | Minor | TestJobListCache#testEviction sometimes fails on Windows with timeout* Backport the fix to 2.7 and 2.8
Project: Scylla (App Definition and Development / Database)
File: parallel_aggregations.md

This document describes the design of a mechanism that parallelizes execution of aggregation queries. New level of coordination was added. Node called super-coordinator splits aggregation query into sub-queries and distributes them across some group of coordinators. Super-coordinator is also responsible for merging results. To develop a mechanism for speeding up `count()` queries, there was a need to detect which queries have a `count()` selector. Due to this pull request being a proof of concept, detection was realized rather poorly. It is only allows catching the simplest cases of `count(*)` queries (with only one selector and no column name specified). After detecting that a query is a `count(*)` it should be split into sub-queries and sent to another coordinators. Splitting part wasn't that difficult, it has been achieved by limiting original query's partition ranges. Sending modified query to another node was much harder. The easiest scenario would be to send whole `cql3::statements::selectstatement`. Unfortunately `cql3::statements::selectstatement` can't be [de]serialized, so sending it was out of the question. Even more unfortunately, some non-[de]serializable members of `cql3::statements::selectstatement` are required to start the execution process of this statement. Finally, I have decided to send a `query::readcommand` paired with required [de]serializable members. Objects, that cannot be [de]serialized (such as query's selector) are mocked on the receiving end. When a super-coordinator receives a `count(*)` query, it splits it into sub-queries. It does so, by splitting original query's partition ranges into list of vnodes, grouping them by their owner and creating sub-queries with partition ranges set to successive results of such grouping. After creation, each sub-query is sent to the owner of its partition ranges. Owner dispatches received sub-query to all of its shards. Shards slice partition ranges of the received sub-query, so that they will only query data that is owned by them. Each shard becomes a coordinator and executes so prepared sub-query.
Project: KICS (Provisioning / Security & Compliance)
File: 071a71ff-f868-47a4-ac0b-3c59e4ab5443.md

title: Shared Host Network Namespace hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 071a71ff-f868-47a4-ac0b-3c59e4ab5443 Query name: Shared Host Network Namespace Platform: DockerCompose Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: Container should not share the host network namespace<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" version: '2' volumes: dhcp-leases: external: false services: mongo: # 27017 image: mongo:latest network_mode: "host" privileged: true ``` ```yaml title="Negative test num. 1 - yaml file" version: '2' volumes: dhcp-leases: external: false services: mongo: # 27017 image: mongo:latest network_mode: "none" privileged: true ```
Project: MongoDB (App Definition and Development / Database)
File: gwp-asan.md

GWP-ASan is a low-overhead sampling-based utility for finding heap-use-after-frees and heap-buffer-overflows in production. GWP-ASan is a recursive acronym: "GWP-ASan Will Provide Allocation Sanity". For many cases you should use (e.g., on your tests). However, ASan comes with average execution slowdown of 2x (compared to `-O2`), binary size increase of 2x, and significant memory overhead. For these reasons, ASan is generally impractical for use in production (other than in dedicated canaries). GWP-ASan is a minimal-overhead alternative designed for widespread use in production. You can enable GWP-ASan by calling `tcmalloc::MallocExtension::ActivateGuardedSampling()`. To adjust GWP-ASan's sampling rate, see . When GWP-ASan detects a heap memory error, it prints stack traces for the point of the memory error, as well as the points where the memory was allocated and (if applicable) freed. These stack traces can then be symbolized offline to get file names and line numbers. GWP-ASan will crash after printing stack traces. For guarded sampling rates above 100M (the default), CPU overhead is negligible. For sampling rates as low as 8M, CPU overhead is under 0.5%. RAM overhead is up to 512 KB on x86\_64, or 4 MB on PowerPC. `tcmalloc::MallocExtension::SetGuardedSamplingRate` sets the sampling rate for GWP-ASan. GWP-ASan will guard allocations approximately every `GuardedSamplingRate` bytes allocated. Thus, lower values will generally increase the the chance of finding bugs but will also have higher CPU overhead. For applications that cannot tolerate any CPU overhead, we recommend using TCMalloc's default sampling rate. If your application can tolerate some CPU overhead, we recommend a sampling rate of 8MB. The current version of GWP-ASan will only find bugs in allocations of 8 KB or less. This restriction was made to limit the CPU/RAM overhead required by GWP-ASan. GWP-ASan has limited diagnostic information for buffer overflows within alignment padding, since overflows of this type will not touch a guard page. For write-overflows, GWP-ASan will still be able to detect the overflow during deallocation by checking whether magic bytes have been overwritten, but the stack trace of the overflow itself will not be available. No. GWP-ASan crashes because your program accessed unmapped memory, which is always a true bug, or a sign of hardware failure (see below). The vast majority of GWP-ASan reports we see are true bugs, but occasionally faulty hardware will be the actual cause of the crash. In general, if you see the same GWP-ASan crash on multiple machines, it is very likely there's a true software bug. Since GWP-ASan finds bugs with very low probability, QoD is generally not a concern. Even if there is a reliable way to trigger a bug, GWP-ASan will only detect it and crash on a tiny fraction of actual occurrences, allowing the other 99.9% to continue without crashing. Separate implementations of GWP-ASan exist for Chromium and Android. For GWP-ASan for Chromium see . For Android, see .
Project: YDB (App Definition and Development / Database)
File: node_restarting.md

To make sure that the process is stoppable, follow these steps. Access the node via SSH. Execute the command ```bash ydbd cms request restart host {node_id} --user {user} --duration 60 --dry --reason 'some-reason' ``` If the process is stoppable, you'll see `ALLOW`. Stop the process ```bash sudo service ydbd stop ``` Restart the process if needed ```bash sudo service ydbd start ``` Before replacing equipment, make sure that the {{ ydb-short-name }} process is . If the replacement is going to take a long time, first move all the VDisks from this node and wait until replication is complete. After replication is complete, you can safely shut down the node. To make sure that disabling the dynamic node doesn't affect query handling, drain the tablets from this node first. Go to the page. Click "View Nodes" to see a list of all nodes. Before disabling the node, first disable the transfer of tablets through the Active button, then click Drain, and wait for all the tablets to be moved away.
Project: Chef InSpec (Provisioning / Security & Compliance)
File: inetd_conf.md

+++ title = "inetd_conf resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "inetd_conf" identifier = "inspec/resources/os/inetdconf.md inetdconf resource" parent = "inspec/resources/os" +++ Use the `inetd_conf` Chef InSpec audit resource to test if a service is listed in the `inetd.conf` file on Linux and Unix platforms. inetdthe Internet service daemonlistens on dedicated ports, and then loads the appropriate program based on a request. The `inetd.conf` file is typically located at `/etc/inetd.conf` and contains a list of Internet services associated to the ports on which that service will listen. Only enabled services may handle a request; only services that are required by the system should be enabled. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. An `inetd_conf` resource block declares the list of services that are enabled in the `inetd.conf` file: describe inetd_conf('path') do its('service_name') { should eq 'value' } end where `'service_name'` is a service listed in the `inetd.conf` file `('path')` is the non-default path to the `inetd.conf` file `should eq 'value'` is the value that is expected This resource supports any of the properties listed as services in the `inetd.conf` file. You may want to ensure that specific services do not listen via `inetd.conf`. The following examples show how to use this Chef InSpec audit resource. its('shell') { should eq nil } or: its('netstat') { should eq nil } or: its('systat') { should eq nil } For example: describe inetd_conf do its('shell') { should eq nil } its('login') { should eq nil } its('exec') { should eq nil } end The contents if the `inetd.conf` file contain the following: and the following test is defined: describe inetd_conf do its('ftp') { should eq nil } its('telnet') { should eq nil } end Because both the `ftp` and `telnet` Internet services are commented out (`#`), both services are disabled. Consequently, both tests will return `true`. However, if the `inetd.conf` file is set as follows: ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a then the same test will return `false` for `ftp` and the entire test will fail. describe package('telnetd') do it { shouldnot beinstalled } end describe inetd_conf do its('telnet') { should eq nil } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}}
Project: KICS (Provisioning / Security & Compliance)
File: baa3890f-bed7-46f5-ab8f-1da8fc91c729.md

title: Shared Host IPC Namespace hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: baa3890f-bed7-46f5-ab8f-1da8fc91c729 Query name: Shared Host IPC Namespace Platform: DockerCompose Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: Container should not share the host IPC namespace<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10" version: "3.9" services: webapp: build: context: ./dir dockerfile: Dockerfile-alternate args: buildno: 1 ipc: "host" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="13" version: "3.9" services: webapp: build: context: ./dir dockerfile: Dockerfile-alternate args: buildno: 1 ports: "8080:8080" "3000:3000" ipc: "host" cap_drop: all ``` ```yaml title="Negative test num. 1 - yaml file" version: "3.9" services: webapp: build: context: ./dir dockerfile: Dockerfile-alternate args: buildno: 1 ``` ```yaml title="Negative test num. 2 - yaml file" version: "2.4" services: service: image: busybox command: top ipc: "service:shareable" container: image: busybox command: top ipc: "container:composetestipcmode_container" shareable: image: busybox command: top ipc: shareable ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: expose.md

Expose a port or a range of ports (e.g. --expose=3300-3310). The protocol can be `tcp`, `udp` or `sctp` and if not given `tcp` is assumed. This option matches the EXPOSE instruction for image builds and has no effect on the actual networking rules unless -P/--publish-all is used to forward to all exposed ports from random host ports. To forward specific ports from the host into the container use the -p/--publish option instead.