cwielenb/CNCF-Dataset huggingface dataset:
Project: Chef InSpec (Provisioning / Security & Compliance)
File: yum.md

+++ title = "yum resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "yum" identifier = "inspec/resources/os/yum.md yum resource" parent = "inspec/resources/os" +++ Use the `yum` Chef InSpec audit resource to test packages in the Yum repository. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. A `yum` resource block declares a package repo, tests if the package repository is present, and if it that package repository is a valid package source (i.e. "is enabled"): describe yum.repo('name') do it { should exist } it { should be_enabled } end where `repo('name')` is the (optional) name of a package repo, using either a full identifier (`'updates/7/x86_64'`) or a short identifier (`'updates'`) The following examples show how to use this Chef InSpec audit resource. describe yum do its('repos') { should exist } end describe yum do its('repos') { should include 'base/7/x86_64' } its('epel') { should exist } its('epel') { should be_enabled } end describe yum.repo('epel') do it { should exist } it { should be_enabled } end describe yum.repo('mycompany-artifacts') do it { should exist } it { should be_enabled } its('baseurl') { should include 'mycompany.biz' } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `be_enabled` matcher tests if the package repository is a valid package source: it { should be_enabled } The `exist` matcher tests if the package repository exists: it { should exist } The `repo('name')` matcher names a specific package repository: describe yum.repo('epel') do ... end The `repos` matcher tests if a named repo, using either a full identifier (`'updates/7/x86_64'`) or a short identifier (`'updates'`), is included in the Yum repo: its('repos') { should include 'some_repo' } The `shortname` matcher names a specific package repository's group identifier. For example, if a repository's group name is "Directory Server", the corresponding group identifier is typically "directory-server": describe yum.repo('Directory Server') do its('shortname') { should eq 'directory-server' } end
Project: Chef InSpec (Provisioning / Security & Compliance)
File: interfaces.md

+++ title = "interfaces resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "interfaces" identifier = "inspec/resources/os/interfaces.md interfaces resource" parent = "inspec/resources/os" +++ Use the `interfaces` Chef InSpec audit resource to test the properties of multiple network interfaces on the system. An `interfaces` resource block may take no arguments, in which case it will list all interfaces: describe interfaces do its('names') { should include 'eth0' } end An `interfaces` resource block may take a where clause, filtering on a Filter Criterion: describe interfaces.where(name: /^eth\d+/) its('names') { should include 'eth0' } end Like any Chef InSpec resource, you may also use it for data lookup instead of testing: interfaces.where(name: /^eth/).names do |name| describe interface(name) do it { should haveipv6address } end end myip = interfaces.ipv4address String. The name of an interface. The `count` property returns an Integer describing how many interfaces matched. its("count") { should eq 6 } Attempts to guess the "first" "real" IPv4 address on any interface. Looks for interfaces that are up and have IPv4 addresses assigned, then tries to filter out loopback, management (10/8) and local (192.168/16) IP addresses, returning the best of of those that it can; you may still get nil, or a loopback address. Note that if the machine is behind NAT this will not be the external IP address; use the `http` resource to query an IP lookup service for that. its('ipv4address') { shouldnot eq '127.0.0.1' } The `names` property returns an Array of Strings representing the names of the interfaces. its("names") { should include "eth0" } For a full list of available universal matchers, please visit our . The `exist` matcher tests true if at least one interface exists on the system. This is almost always the case. it { should exist }
Project: Kubewarden (Provisioning / Security & Compliance)
File: SECURITY.md

The Kubewarden team greatly appreciates investigative work into security vulnerabilities carried out by well-intentioned, ethical security researchers. We follow the practice of responsible disclosure in order to best protect Kubewarden's user-base from the impact of security issues. On our side, this means: We will respond to security incidents on priority. We will release fixes for issues as soon as is practical, keeping in mind that not all risks are created equal. We will always transparently let the community know about any incident that affects them. If you have found a security vulnerability in Kubewarden, we kindly ask that you disclose it responsibly by emailing . Please do not discuss potential vulnerabilities in public without validating with us first. On receipt the security team will: Review the report, verify the vulnerability and respond with confirmation and/or further information requests. Once the reported security bug has been addressed we will notify the Researcher, who is then welcome to optionally disclose publicly.
Project: StarRocks (App Definition and Development / Database)
File: uuid_numeric.md

displayed_sidebar: "English" Returns a random UUID of the LARGEINT type. This function has an execution performance 2 orders of magnitude better than the `uuid` function. ```Haskell uuid_numeric(); ``` None Returns a value of the LARGEINT type. ```Plain Text MySQL > select uuid_numeric(); +--+ | uuid_numeric() | +--+ | 558712445286367898661205 | +--+ 1 row in set (0.00 sec) ```
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.12.md

layout: release date: 2022-10-05 tag: v0.6.12 language: en Implement websocket signalling for collaboration @nishantwrp (#6237) [Server] Backend for catalog for local provider @gr455 (#6258) [refactor] ioutil package to io/os @acald-creator (#6315) Bump eslint-plugin-react from 7.31.1 to 7.31.8 in /provider-ui @dependabot (#6336) Bump eslint-config-next from 12.2.5 to 12.3.1 in /provider-ui @dependabot (#6293) Bump cypress from 10.7.0 to 10.9.0 in /provider-ui @dependabot (#6294) Bump nodemon from 2.0.19 to 2.0.20 in /ui @dependabot (#6319) Bump next from 12.2.5 to 12.3.1 in /provider-ui @dependabot (#6302) Bump d3-color from 3.0.1 to 3.1.0 in /ui @dependabot (#6290) Bump @babel/types from 7.18.13 to 7.19.3 in /ui @dependabot (#6295) Bump nodemon from 2.0.19 to 2.0.20 in /provider-ui @dependabot (#6296) Bug fix [UI] Make button responsive for Designs card @siddheshJungade (#6289) [eslint]: fix eslint errrors that was stopping the dev server @Abhishek-kumar09 (#6329) Namespace Node SVG update. @Abhishek-kumar09 (#6321) Bump @fortawesome/fontawesome-svg-core from 1.2.36 to 6.2.0 in /ui @dependabot (#6298) Bump eslint-plugin-react from 7.29.3 to 7.31.8 in /ui @dependabot (#6301) [UI] remove tilted quotes from the design-configurator html @Abhishek-kumar09 (#6312) Bump eslint-plugin-react from 7.31.1 to 7.31.8 in /provider-ui @dependabot (#6336) Bump eslint-config-next from 12.2.5 to 12.3.1 in /provider-ui @dependabot (#6293) Bump cypress from 10.7.0 to 10.9.0 in /provider-ui @dependabot (#6294) Bump github.com/layer5io/meshsync from 0.5.10 to 0.6.1 @dependabot (#6311) Bump nodemon from 2.0.19 to 2.0.20 in /ui @dependabot (#6319) Bump next from 12.2.5 to 12.3.1 in /provider-ui @dependabot (#6302) Bump d3-color from 3.0.1 to 3.1.0 in /ui @dependabot (#6290) Bump @babel/types from 7.18.13 to 7.19.3 in /ui @dependabot (#6295) Bump nodemon from 2.0.19 to 2.0.20 in /provider-ui @dependabot (#6296) Update github tag retrieval @CyrineG (#6256) Bump @fortawesome/fontawesome-svg-core from 1.2.36 to 6.2.0 in /ui @dependabot (#6298) Bump eslint-plugin-react from 7.29.3 to 7.31.8 in /ui @dependabot (#6301) Text Updated @UtkarshMishra12 (#6322) Updating the go version in Contributing docs @legendarykamal (#6326) Updating the docs for authentication via CLI @legendarykamal (#6320) Updated Text @UtkarshMishra12 (#6313) Thank you to our contributors for making this release possible: @Abhishek-kumar09, @Chadha93, @CyrineG, @Revolyssup, @UtkarshMishra12, @acald-creator, @dependabot, @dependabot[bot], @gr455, @l5io, @leecalcote, @legendarykamal, @nishantwrp and @siddheshJungade
Project: Chef InSpec (Provisioning / Security & Compliance)
File: zfs.md

+++ title = "zfs resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "zfs" identifier = "inspec/resources/os/zfs.md zfs resource" parent = "inspec/resources/os" +++ Use the `zfs` Chef InSpec audit resource to test the named ZFS Pool file system and its respective properties. Chef Inspec distributes this resource. A `zfs` Chef InSpec audit resource allows you to test if the ZFS Pool is present and has specific properties. ```ruby describe zfs(zfspoolname) do it { should exist } it { should have_property({ "key1" => "VALUE1", "key2" => "VALUE2" }) } end ``` where `'zfspoolname'` is the name of a ZFS Pool, `exist` and `have_property` are matchers of this resource, `{ "key1" => "value1", "key2" => "value2" }` are properties of the ZFS Pool to test. For a full list of available matchers, please visit our . The specific matchers of this resource are: `exist` and `have_property`. The `exist` matcher tests if the ZFS Pool exists on the system. ```ruby it { should exist } ``` The `have_property` matcher accepts properties in hash format and tests if the specified properties are valid ZFS Pool properties. ```ruby it { should have_property({ "key1" => "VALUE1", "key2" => "VALUE2" }) } ``` The following examples show how to use this Chef InSpec audit resource. `exist` matcher allows to test if the ZFS Pool exists on the system. ```ruby describe zfs("POOL") do it { should exist } end ``` `have_property` matcher allows you to test if the specified properties are valid ZFS Pool properties. ```ruby describe zfs("POOL") do it { should have_property({ "failmode" => "WAIT", "capacity" => "0" }) } end ```
Project: KICS (Provisioning / Security & Compliance)
File: c1573577-e494-4417-8854-7e119368dc8b.md

title: Network Interfaces With Public IP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c1573577-e494-4417-8854-7e119368dc8b Query name: Network Interfaces With Public IP Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Network Interfaces should not be exposed with a public IP address. If configured, additional security baselines should be followed (https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/virtual-network-security-baseline, https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/public-ip-security-baseline)<br> ```tf title="Positive test num. 1 - tf file" hl_lines="10" resource "azurermnetworkinterface" "positive" { name = "example-nic" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name ip_configuration { name = "internal" subnetid = azurermsubnet.example.id privateipaddress_allocation = "Dynamic" publicipaddress_id = "IP" } } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermnetworkinterface" "negative" { name = "example-nic" location = azurermresourcegroup.example.location resourcegroupname = azurermresourcegroup.example.name ip_configuration { name = "internal" subnetid = azurermsubnet.example.id privateipaddress_allocation = "Dynamic" } } ```
Project: TDengine (App Definition and Development / Database)
File: 03-high-availability.md

title: High Availability sidebar_label: High Availability description: This document describes how TDengine implements high availability. High availability of vnode can be achieved through replicas in TDengine. A TDengine cluster can have multiple databases. Each database has a number of vnodes associated with it. A different number of replicas can be configured for each DB. When creating a database, the parameter `replica` is used to specify the number of replicas. The default value for `replica` is 1. Naturally, a single replica cannot guarantee high availability since if one node is down, the data service is unavailable. Note that the number of dnodes in the cluster must NOT be lower than the number of replicas set for any DB, otherwise the `create table` operation will fail with error "more dnodes are needed". The SQL statement below is used to create a database named "demo" with 3 replicas. ```sql CREATE DATABASE demo replica 3; ``` The data in a DB is divided into multiple shards and stored in multiple vgroups. The number of vnodes in each vgroup is determined by the number of replicas set for the DB. The vnodes in each vgroup store exactly the same data. For the purpose of high availability, the vnodes in a vgroup must be located in different dnodes on different hosts. As long as over half of the vnodes in a vgroup are in an online state, the vgroup is able to provide data access. Otherwise the vgroup can't provide data access for reading or inserting data. There may be data for multiple DBs in a dnode. When a dnode is down, multiple DBs may be affected. While in theory, the cluster will provide data access for reading or inserting data if over half the vnodes in vgroups are online, because of the possibly complex mapping between vnodes and dnodes, it is difficult to guarantee that the cluster will work properly if over half of the dnodes are online. Each TDengine cluster is managed by `mnode`, which is a module of `taosd`. For the high availability of mnode, multiple mnodes can be configured in the system. When a TDengine cluster is started from scratch, there is only one `mnode`, then you can use command `create mnode` to and start corresponding dnode to add more mnodes. ```sql SHOW MNODES; ``` The end point and role/status (leader, follower, candidate, offline) of all mnodes can be shown by the above command. When the first dnode is started in a cluster, there must be one mnode in this dnode. Without at least one mnode, the cluster cannot work. From TDengine 3.0.0, RAFT protocol is used to guarantee the high availability, so the number of mnodes is should be 1 or 3.
Project: KICS (Provisioning / Security & Compliance)
File: 3609d27c-3698-483a-9402-13af6ae80583.md

title: S3 Bucket With Unsecured CORS Rule hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3609d27c-3698-483a-9402-13af6ae80583 Query name: S3 Bucket With Unsecured CORS Rule Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: If the CORS (Cross-Origin Resource Sharing) rule is defined in an S3 bucket, it should be secure<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" AWSTemplateFormatVersion: 2010-09-09 Resources: S3Bucket: Type: 'AWS::S3::Bucket' Properties: AccessControl: PublicRead CorsConfiguration: CorsRules: AllowedHeaders: '*' AllowedMethods: GET AllowedOrigins: '*' ExposedHeaders: Date Id: myCORSRuleId1 MaxAge: 3600 AllowedMethods: DELETE AllowedOrigins: 'http://www.example.com' 'http://www.example.net' ExposedHeaders: Connection Server Date Id: myCORSRuleId2 MaxAge: 1800 ``` ```json title="Positive test num. 2 - json file" hl_lines="9" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "S3Bucket": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "PublicRead", "CorsConfiguration": { "CorsRules": [ { "AllowedHeaders": [ "*" ], "AllowedMethods": [ "GET" ], "AllowedOrigins": [ "*" ], "ExposedHeaders": [ "Date" ], "Id": "myCORSRuleId1", "MaxAge": 3600 }, { "AllowedMethods": [ "DELETE" ], "AllowedOrigins": [ "http://www.example.com", "http://www.example.net" ], "ExposedHeaders": [ "Connection", "Server", "Date" ], "Id": "myCORSRuleId2", "MaxAge": 1800 } ] } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: S3Bucket: Type: 'AWS::S3::Bucket' Properties: AccessControl: PublicRead CorsConfiguration: CorsRules: AllowedMethods: GET AllowedOrigins: 'https://s3-website-test.hashicorp.com' ExposedHeaders: Date Id: myCORSRuleId1 MaxAge: 3600 AllowedMethods: DELETE AllowedOrigins: 'http://www.example.com' 'http://www.example.net' ExposedHeaders: Connection Server Date Id: myCORSRuleId2 MaxAge: 1800 ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "S3Bucket": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "PublicRead", "CorsConfiguration": { "CorsRules": [ { "AllowedMethods": [ "GET" ], "AllowedOrigins": [ "https://s3-website-test.hashicorp.com" ], "ExposedHeaders": [ "Date" ], "Id": "myCORSRuleId1", "MaxAge": 3600 }, { "AllowedMethods": [ "DELETE" ], "AllowedOrigins": [ "http://www.example.com", "http://www.example.net" ], "ExposedHeaders": [ "Connection", "Server", "Date" ], "Id": "myCORSRuleId2", "MaxAge": 1800 } ] } } } } } ```
Project: KICS (Provisioning / Security & Compliance)
File: b139213e-7d24-49c2-8025-c18faa21ecaa.md

title: Node Auto Upgrade Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b139213e-7d24-49c2-8025-c18faa21ecaa Query name: Node Auto Upgrade Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Resource Management URL: Kubernetes nodes must have auto upgrades set to true, which means Node 'auto_upgrade' should be enabled for Kubernetes Clusters<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 19 36" resource "googlecontainernode_pool" "positive1" { name = "my-node-pool" location = "us-central1-a" cluster = googlecontainercluster.primary.name node_count = 3 timeouts { create = "30m" update = "20m" } } resource "googlecontainernode_pool" "positive2" { name = "my-node-pool" location = "us-central1-a" cluster = googlecontainercluster.primary.name node_count = 3 management { auto_repair = true } timeouts { create = "30m" update = "20m" } } resource "googlecontainernode_pool" "positive3" { name = "my-node-pool" location = "us-central1-a" cluster = googlecontainercluster.primary.name node_count = 3 management { auto_upgrade = false } timeouts { create = "30m" update = "20m" } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecontainernode_pool" "negative1" { name = "my-node-pool" location = "us-central1-a" cluster = googlecontainercluster.primary.name node_count = 3 management { auto_upgrade = true } timeouts { create = "30m" update = "20m" } } ```
Project: Shifu (Provisioning / Automation & Configuration)
File: development-design-shifud.md

- - - - - - - - - - - This is a development design document for *shifud component of the Shifu* system for edge devices. The goal of *shifud* is to achieve the following: *deviceDiscoverer*: Automatically detect ONVIF devices in the network subnet. Given the connection type and address, detect if the device is live. Given the server url, discover devices registered in the OPC UA server. *deviceVerifier*: Verify USB connected devices' metadata through udev. Verify network connected devices' metadata using SNMP/ONVIF/OPC UA. *deviceUpdater*: Update the status field of *edgeDevice* resource to Kubernetes API server. Input: *edgeDevice resource from Kubernetes' edgeDevice* resource. Output: List of discovered devices in the following JSON format: ``` [ { "deviceName": "", "connection": "", "address": "", "type": "", "vendor": "", "protocol": "" }, ... ] ``` Output: List of discovered ONVIF cameras in JSON format (same as above). Input: *edgeDevice resource from Kubernetes cluster, deviceList from deviceDiscoverer*. Output: List of discovered devices that are verified matching *edgeDevice* resource. Input: List of devices from *deviceVerifier*. A continuous loop that scans for ONVIF (per cluster/subnet). discoverONVIF() On demand loop that scans udev event (per *edgeNode*). discoverUDEV() On demand loop that scans OPC UA servers (per cluster/subnet). discoverOPCUA(str url) On demand TCP pinger for TCP/IP based alive detection (per cluster/subnet). discoverTCP(str address, int port) Listens for the device list sent from *deviceDiscoverer*. Upon receiving, query for metadata of the device. queryMetadata(device discoveredDevice) Compare the metadata of the device to *edgeDevice* resource. verifyDeviceMetadata(device edgeDevice, device discoveredDevice) If matches, output to *deviceUpdater*. Listens for the device list sent from *deviceVerifier* Upon receiving, update Kubernetes resources. updateEdgeDeviceResource(device discoveredDevice) ``` { str deviceName, str connection_type, str address, deviceType deviceType, str deviceVendor, protocol deviceProtocol } ``` ](/img/shifud-overall-call-stack.svg) ](/img/shifud-deviceDiscoverer-cluster-call-stack.svg) ](/img/shifud-deviceDiscoverer-edgeNode-call-stack.svg) ](/img/shifud-deviceVerifier-cluster-call-stack.svg) ](/img/shifud-deviceVerifier-edgeNode-call-stack.svg) ](/img/shifud-deviceUpdater-call-stack.svg)
Project: KICS (Provisioning / Security & Compliance)
File: 344bf8ab-9308-462b-a6b2-697432e40ba1.md

title: GKE Basic Authentication Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 344bf8ab-9308-462b-a6b2-697432e40ba1 Query name: GKE Basic Authentication Enabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: GCP - Google Kubernetes Engine (GKE) Basic Authentication must be disabled, which means the username and password provided in the master_auth block must be empty<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="32 3 47 18 63" name: create a cluster1 google.cloud.gcpcontainercluster: name: my-cluster1 initialnodecount: 2 node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a cluster2 google.cloud.gcpcontainercluster: name: my-cluster2 initialnodecount: 2 master_auth: password: "" node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a cluster3 google.cloud.gcpcontainercluster: name: my-cluster3 initialnodecount: 2 master_auth: username: "" node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a cluster4 google.cloud.gcpcontainercluster: name: my-cluster4 initialnodecount: 2 master_auth: username: cluster_admin password: "" node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a cluster5 google.cloud.gcpcontainercluster: name: my-cluster5 initialnodecount: 2 master_auth: username: "" password: my-secret-password node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: create a cluster google.cloud.gcpcontainercluster: name: my-cluster initialnodecount: 2 master_auth: username: '' password: '' node_config: machine_type: n1-standard-4 disksizegb: 500 location: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present ```