cwielenb/CNCF-Dataset huggingface dataset:
Project: Terrascan (Provisioning / Security & Compliance)
File: github.md

| Category | Resource | Severity | Description | Reference ID | | -- | -- | -- | -- | | | Identity & Access Management | github | MEDIUM | Repository is Not Private or Internal. | accurics.github.IAM.1 | ACGITHUB0002 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Encryption and Key Management | github | MEDIUM | Insecure SSL is used for repository webhook. | accurics.github.EKM.2 | ACGITHUB0003 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Encryption and Key Management | github | MEDIUM | Insecure SSL is used for organization webhook. | accurics.github.EKM.1 | ACGITHUB0001 |
Project: StarRocks (App Definition and Development / Database)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to make participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity, and expression, level of experience, education, socioeconomic status, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies within all project spaces, and it also applies when an individual is representing the project or its community in public spaces. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at opensource@starrocks.com. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality about the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4. For answers to common questions about this code of conduct, see .
Project: StarRocks (App Definition and Development / Database)
File: bitmap_min.md

displayed_sidebar: "English" Obtains the minimum value of a bitmap. If the bitmap is `NULL`, this function returns `NULL`. If the bitmap is empty, this function returns `NULL` by default. ```Haskell bitmap_min(bitmap) ``` `bitmap`: the bitmap whose minimum value you want to obtain. Only the BITMAP data type is supported. You can specify a bitmap that you construct by using functions such as . Returns a value of the LARGEINT data type. ```Plain MySQL > select bitmapmin(bitmapfrom_string("0, 1, 2, 3")); +-+ | bitmapmin(bitmapfrom_string('0, 1, 2, 3')) | +-+ | 0 | +-+ MySQL > select bitmapmin(bitmapfrom_string("-1, 0, 1, 2")); +-+ | bitmapmin(bitmapfrom_string('-1, 0, 1, 2')) | +-+ | NULL | +-+ MySQL > select bitmapmin(bitmapempty()); +-+ | bitmapmin(bitmapempty()) | +-+ | NULL | +-+ mysql> select bitmapmin(bitmapfrom_string("16501189037412846863")); +--+ | bitmapmin(bitmapfrom_string('16501189037412846863')) | +--+ | 16501189037412846863 | +--+ 1 row in set (0.03 sec) ```
Project: KICS (Provisioning / Security & Compliance)
File: 404908b6-4954-4611-98f0-e8ceacdabcb1.md

title: Privilege Escalation Using Become Plugin hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 404908b6-4954-4611-98f0-e8ceacdabcb1 Query name: Privilege Escalation Using Become Plugin Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: In order to perform an action as a different user with the become_user, 'become' must be defined and set to 'true'<br> ```cfg title="Positive test num. 1 - cfg file" hl_lines="10" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False fact_caching=memory become=False becomeaskpass=False become_method=sudo become_user=root ``` ```cfg title="Positive test num. 2 - cfg file" hl_lines="12" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False fact_caching=memory becomeaskpass=False become_method=sudo become_user=root ``` ```cfg title="Negative test num. 1 - cfg file" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False become_plugins=~/.ansible/plugins/become:/usr/share/ansible/plugins/become fact_caching=memory ``` ```cfg title="Negative test num. 2 - cfg file" [defaults] action_warnings=True cowsayenabledstencils=bud-frogs, bunny, cheese, daemon, default, dragon, elephant-in-snake, elephant, eyes, hellokitty, kitty, luke-koala, meow, milk, moofasa, moose, ren, sheep, small, stegosaurus, stimpy, supermilker, three-eyes, turkey, turtle, tux, udder, vader-koala, vader, www cow_selection=default force_color=False nocolor=False nocows=False anyerrorsfatal=False fact_caching=memory becomeaskpass=False become_method=sudo become=True become_user=root ```
Project: OAuth2 Proxy (Provisioning / Key Management)
File: google.md

id: google title: Google (default) For Google, the registration steps are: Create a new project: https://console.developers.google.com/project Choose the new project from the top right project dropdown (only if another project is selected) In the project Dashboard center pane, choose "APIs & Services" In the left Nav pane, choose "Credentials" In the center pane, choose "OAuth consent screen" tab. Fill in "Product name shown to users" and hit save. In the center pane, choose "Credentials" tab. Open the "New credentials" drop down Choose "OAuth client ID" Choose "Web application" Application name is freeform, choose something appropriate Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com` Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback` Choose "Create" Take note of the Client ID and Client Secret It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the account is still authorized. Create a and configure it to use or, alternatively download the JSON. Make note of the Client ID for a future step. Under "APIs & Auth", choose APIs. Click on Admin SDK and then Enable API. Follow the steps on https://developers.google.com/workspace/guides/create-credentials#optionalsetupdomain-widedelegationforaserviceaccount and give the client id from step 2 the following oauth scopes: ``` https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/admin.directory.user.readonly ``` Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances of this flag with different groups and the user will be checked against all the provided groups. (Only if using a JSON file (see step 1)) Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the `google-service-account-json` flag. Restart oauth2-proxy. Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ). oauth2-proxy can make use of . When deployed within GCP, this means that it can automatically use the service account attached to the resource. When deployed to GKE, ADC can be leveraged through a feature called Workload Identity. Follow Google's to set up Workload Identity. When deployed outside of GCP, might be an option.
Project: Meshery (Provisioning / Automation & Configuration)
File: spiffe.md

layout: integration title: SPIFFE subtitle: Collaborative and visual infrastructure as code for SPIFFE image: /assets/img/integrations/spiffe/icons/color/spiffe-color.svg permalink: extensibility/integrations/spiffe docURL: https://docs.meshery.io/extensibility/integrations/spiffe description: integrations-category: Security & Compliance integrations-subcategory: Key Management registrant: Artifact Hub components: featureList: [ "Design and apply policy for node and workload attestation.", "Configure your signing framework for securely issuing and renewing SVIDs.", "Simplify access from identified services to secret stores, databases, services meshes and cloud provider services." ] howItWorks: "Wrangle the Workload API" howItWorksDetails: "Expertly use the Workload API specification to issue and retrieve SVIDs." language: en list: include type: extensibility category: integrations
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: roles.md

Roles determine a user's access to projects. Users are given roles in groups and organizations. Members of groups can be given the following roles: Guest Reporter Developer Maintainer Owner These roles and their permissions are described in more depth here: . Members of organizations can be given the following roles: Org Owner Org Viewer !!! info inline end "Changing Quotas" If you need to change quotas, please contact your Lagoon administrator. An organization owner can do everything to do with administering an organization aside from changing quotas. They can add and delete users, groups, projects, deploy targets, and notifcations An organization viewer is a read-only role that can only view the organization, but cannot make any changes or additions. They can view the projects, groups, users, and notifications within an organization but cannot modify them. A user who has not been assigned as an owner or viewer cannot see the organization.
Project: ClickHouse (App Definition and Development / Database)
File: enabled-roles.md

slug: /en/operations/system-tables/enabled-roles Contains all active roles at the moment, including current role of the current user and granted roles for current role. Columns: `role_name` ()) Role name. `withadminoption` () Flag that shows whether `enabled_role` is a role with `ADMIN OPTION` privilege. `iscurrent` () Flag that shows whether `enabledrole` is a current role of a current user. `isdefault` () Flag that shows whether `enabledrole` is a default role.
Project: YugabyteDB (App Definition and Development / Database)
File: supported-os-and-arch.md

title: Supported operating systems and architectures for YugabyteDB nodes headerTitle: Node prerequisites linkTitle: Node prerequisites description: Operating systems and architectures supported by YugabyteDB Anywhere for deploying YugabyteDB headcontent: Prerequisites for YugabyteDB universe nodes menu: v2.18_yugabyte-platform: identifier: supported-os-and-arch parent: configure-yugabyte-platform weight: 6 type: docs Using YugabyteDB Anywhere (YBA), you can deploy YugabyteDB universes on nodes with the following architectures and operating systems. YBA supports deploying YugabyteDB on both x86 and ARM (aarch64) architecture-based hardware. Note that support for ARM architectures is unavailable for airgapped setups, because YBA ARM support for requires Internet connectivity. YBA supports deploying YugabyteDB on the following operating systems: AlmaLinux OS 8 (default) CentOS Oracle Linux 7 Oracle Linux 8 Ubuntu 18 Ubuntu 20 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Python 3 is required. If you're using YugabyteDB Anywhere to provision nodes in public clouds, be sure the custom AMI you plan to use has Python 3 installed. The host AMI must have `gtar` and `zipinfo` installed. YBA support for Oracle Linux 8 and AlmaLinux OS 8 has the following limitations: Oracle Linux 8 uses the `firewall-cmd` client to set default target `ACCEPT`. On Oracle Linux 8, only the Red Hat Linux-compatible kernel is supported, to allow port changing. The Unbreakable Enterprise Kernel (UEK) is not supported. Systemd services are only supported in YugabyteDB Anywhere 2.15.1 and later versions.
Project: external-secrets (Provisioning / Security & Compliance)
File: index.md

External Secrets Operator is a Kubernetes operator that integrates external secret management systems like [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/), [HashiCorp Vault](https://www.vaultproject.io/), [Google Secrets Manager](https://cloud.google.com/secret-manager), [Azure Key Vault](https://azure.microsoft.com/en-us/services/key-vault/), , and many more. The operator reads information from external APIs and automatically injects the values into a [Kubernetes Secret](https://kubernetes.io/docs/concepts/configuration/secret/). The goal of External Secrets Operator is to synchronize secrets from external APIs into Kubernetes. ESO is a collection of custom API resources - `ExternalSecret`, `SecretStore` and `ClusterSecretStore` that provide a user-friendly abstraction for the external API that stores and manages the lifecycle of the secrets for you. To get started, please read through this should give you a high-level overview to understand the API and use-cases. After that please follow one of our to get a jump start using the operator. See our for installation instructions. For a complete reference of the API types please refer to our [API Reference](api/spec.md). This project is driven by its users and contributors, and we welcome everybody to get involved. Join our meetings, open issues or ask questions in Slack. The success of this project depends on your input: No contribution is too small - even opinions matter! How to get involved: Bi-weekly Development Meeting every odd week at on Wednesday (, ) [Kubernetes Slack
Project: KICS (Provisioning / Security & Compliance)
File: e39bee8c-fe54-4a3f-824d-e5e2d1cca40a.md

title: IAM Role Policy passRole Allows All hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e39bee8c-fe54-4a3f-824d-e5e2d1cca40a Query name: IAM Role Policy passRole Allows All Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Using the iam:passrole action with wildcards (*) in the resource can be overly permissive because it allows iam:passrole permissions on multiple resources<br> ```tf title="Positive test num. 1 - tf file" hl_lines="5" resource "awsiamrolepolicy" "testpolicy" { name = "test_policy" role = awsiamrole.test_role.id policy = <<-EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "iam:passrole" ], "Effect": "Allow", "Resource": "*" } ] } EOF } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamrolepolicy" "testpolicy" { name = "test_policy" role = awsiamrole.test_role.id policy = <<-EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "iam:passrole" ], "Effect": "Allow", "Resource": "arn:aws:sqs:us-east-2:account-ID-without-hyphens:queue1" } ] } EOF } ```
Project: YugabyteDB (App Definition and Development / Database)
File: yba_storage-config_gcs_create.md

Create a GCS YugabyteDB Anywhere storage configuration Create a GCS storage configuration in YugabyteDB Anywhere ``` yba storage-config gcs create [flags] ``` ``` --backup-location string [Required] The complete backup location including "gs://". --credentials-file-path string GCS Credentials File Path. Required for non IAM role based storage configurations. Can also be set using environment variable GOOGLEAPPLICATIONCREDENTIALS. --use-gcp-iam [Optional] Use IAM Role from the YugabyteDB Anywhere Host. Supported for Kubernetes GKE clusters with workload identity. Configuration creation will fail on insufficient permissions on the host. (default false) -h, --help help for create ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -n, --name string [Optional] The name of the storage configuration for the operation. Required for create, delete, describe, update. -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Manage a YugabyteDB Anywhere GCS storage configuration
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.3.15.md

layout: release date: 2020-5-4 tag: v0.3.15 language: en Released on 1 May 2020 Mesheryctl Feature: Addition of `mesheryctl perf --file <smp.yaml>' support for performance test profiles. Feature: Behavior change `mesheryctl perf` for using tokens and supporting JWT.
Project: KICS (Provisioning / Security & Compliance)
File: 1afbb3fa-cf6c-4a3d-b730-95e9f4df343e.md

title: ElastiCache Replication Group Not Encrypted At Transit hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1afbb3fa-cf6c-4a3d-b730-95e9f4df343e Query name: ElastiCache Replication Group Not Encrypted At Transit Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: ElastiCache Replication Group encryption should be enabled at Transit<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awselasticachereplication_group" "example" { automaticfailoverenabled = true availability_zones = ["us-west-2a", "us-west-2b"] replicationgroupid = "tf-rep-group-1" replicationgroupdescription = "test description" node_type = "cache.m4.large" numbercacheclusters = 2 port = 6379 } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="9" resource "awselasticachereplication_group" "example" { automaticfailoverenabled = true availability_zones = ["us-west-2a", "us-west-2b"] replicationgroupid = "tf-rep-group-1" replicationgroupdescription = "test description" node_type = "cache.m4.large" numbercacheclusters = 2 port = 6379 transitencryptionenabled = false } ``` ```tf title="Negative test num. 1 - tf file" resource "awselasticachereplication_group" "example3" { automaticfailoverenabled = true availability_zones = ["us-west-2a", "us-west-2b"] replicationgroupid = "tf-rep-group-1" replicationgroupdescription = "test description" node_type = "cache.m4.large" numbercacheclusters = 2 port = 6379 atrestencryption_enabled = true transitencryptionenabled = true } ```
Project: KICS (Provisioning / Security & Compliance)
File: a71ecabe-03b6-456a-b3bc-d1a39aa20c98.md

title: Serverless Function Without Tags hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a71ecabe-03b6-456a-b3bc-d1a39aa20c98 Query name: Serverless Function Without Tags Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: AWS Serverless Function should have associated tags<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: Function: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Description: AWS SAM template with a simple API definition Resources: Function1: Type: AWS::Serverless::Function Properties: PackageType: Image ImageUri: account-id.dkr.ecr.region.amazonaws.com/ecr-repo-name:image-name ImageConfig: Command: "app.lambda_handler" EntryPoint: "entrypoint1" WorkingDirectory: "workDir" Tags: Key: Type Value: AWS Serverless Function ```