cwielenb/CNCF-Dataset huggingface dataset:
Project: RBAC Lookup (Provisioning / Security & Compliance)
File: CODE_OF_CONDUCT.md

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. Examples of behavior that contributes to creating a positive environment include: Using welcoming and inclusive language Being respectful of differing viewpoints and experiences Gracefully accepting constructive criticism Focusing on what is best for the community Showing empathy towards other community members Examples of unacceptable behavior by participants include: The use of sexualized language or imagery and unwelcome sexual attention or advances Trolling, insulting/derogatory comments, and personal or political attacks Public or private harassment Publishing others' private information, such as a physical or electronic address, without explicit permission Other conduct which could reasonably be considered inappropriate in a professional setting Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at opensource@fairwinds.com. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. This Code of Conduct is adapted from the , version 1.4, available at
Project: KICS (Provisioning / Security & Compliance)
File: c589f42c-7924-4871-aee2-1cede9bc7cbc.md

title: RBAC Roles with Exec Permission hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c589f42c-7924-4871-aee2-1cede9bc7cbc Query name: RBAC Roles with Exec Permission Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Roles or ClusterRoles with RBAC permissions to run commands in containers via 'kubectl exec' could be abused by attackers to execute malicious code in case of compromise. To prevent this, the 'pods/exec' verb should not be used in production environments<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: my-namespace name: allow-exec rules: apiGroups: [""] resources: ["pods", "pods/exec"] verbs: ["get", "list", "create"] apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: allow-exec namespace: my-namespace subjects: kind: User name: bob apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: allow-exec apiGroup: "" ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: my-namespace name: allow-exec-neg rules: apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "create"] apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: allow-exec-neg namespace: my-namespace subjects: kind: User name: bob apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: allow-exec-neg apiGroup: "" ```
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubedb-webhook-server_version.md

title: Kubedb-Webhook-Server Version menu: docs_{{ .version }}: identifier: kubedb-webhook-server-version name: Kubedb-Webhook-Server Version parent: reference-webhook-server menuname: docs{{ .version }} sectionmenuid: reference Prints binary version number. ``` kubedb-webhook-server version [flags] ``` ``` --check string Check version constraint -h, --help help for version --short Print just the version number. ``` ``` --bypass-validating-webhook-xray if true, bypasses validating webhook xray checks --default-seccomp-profile-type string Default seccomp profile --use-kubeapiserver-fqdn-for-aks if true, uses kube-apiserver FQDN for AKS cluster to workaround https://github.com/Azure/AKS/issues/522 (default true) ``` -
Project: EMQ Technologies (App Definition and Development / Streaming & Messaging)
File: fix-11697.en.md

Disable outdated TLS versions and ciphersuites in the EMQX backplane network (`gen_rpc`). Allow using tlsv1.3 on the backplane. Add new configuration parameters: `EMQXRPCTLSVERSIONS` and `EMQXRPC_CIPHERS`. The corresponding `genrpc` PR: https://github.com/emqx/genrpc/pull/36
Project: Harbor (Provisioning / Container Registry)
File: 1-11-admin-update-password.md

Test 1-11 - Admin User update password (DB Mode) ======= To verify that the admin user can update password. User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against a local database. ( auth_mode is set to db_auth* .) The user data is stored in a local database. A linux host with Docker CLI installed (Docker client). The admin user logs in to the UI by username. The admin user changes his/her own password. The admin user logs out. The admin user logs in to the UI by email using the new password. The admin user can log in using `docker login` command using the new password. Password can be changed in Step 2. User can log in using new password in Step 4. None
Project: kpt (Provisioning / Automation & Configuration)
File: prototype-controller.md

Create some example repositories / packages: ```sh make apply-dev-config make -C config/samples/apps/hello-server push-image ./scripts/create-deployment-package.sh ``` To test out remoterootsync self-applying: ```sh kubectl apply -f controllers/remoterootsync/config/samples/hack-self-apply-rbac.yaml cat controllers/remoterootsync/config/samples/hack-self-apply.yaml \ | sed -e s/example-google-project-id/${GCPPROJECTID}/g | kubectl apply -f - ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: memory.md

Memory limit. A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes). Allows the memory available to a container to be constrained. If the host supports swap memory, then the -m memory setting can be larger than physical RAM. If a limit of 0 is specified (not using -m), the container's memory is not limited. The actual limit may be rounded up to a multiple of the operating system's page size (the value is very large, that's millions of trillions). This option is not supported on cgroups V1 rootless systems.
Project: Carvel (App Definition and Development / Application Definition & Image Build)
File: CONDUCT.md

Cobra will follow a steady release cadence. Non breaking changes will be released as minor versions quarterly. Patch bug releases are at the discretion of the maintainers. Users can expect security patch fixes to be released within relatively short order of a CVE becoming known. For more information on security patch fixes see the CVE section below. Releases will follow . Users tracking the Master branch should expect unpredictable breaking changes as the project continues to move forward. For stability, it is highly recommended to use a release. We will maintain two major releases in a moving window. The N-1 release will only receive bug fixes and security updates and will be dropped once N+1 is released. Deprecation of Go versions or dependent packages will only occur in major releases. To reduce the change of this taking users by surprise, any large deprecation will be preceded by an announcement in the and an Issue on Github. Maintainers will make every effort to release security patches in the case of a medium to high severity CVE directly impacting the library. The speed in which these patches reach a release is up to the discretion of the maintainers. A low severity CVE may be a lower priority than a high severity one. Cobra maintainers will use GitHub issues and the as the primary means of communication with the community. This is to foster open communication with all users and contributors. Breaking changes are generally allowed in the master branch, as this is the branch used to develop the next release of Cobra. There may be times, however, when master is closed for breaking changes. This is likely to happen as we near the release of a new version. Breaking changes are not allowed in release branches, as these represent minor versions that have already been released. These version have consumers who expect the APIs, behaviors, etc, to remain stable during the lifetime of the patch stream for the minor release. Examples of breaking changes include: Removing or renaming exported constant, variable, type, or function. Updating the version of critical libraries such as `spf13/pflag`, `spf13/viper` etc... Some version updates may be acceptable for picking up bug fixes, but maintainers must exercise caution when reviewing. There may, at times, need to be exceptions where breaking changes are allowed in release branches. These are at the discretion of the project's maintainers, and must be carefully considered before merging. Maintainers will ensure the Cobra test suite utilizes the current supported versions of Golang. Changes to this document and the contents therein are at the discretion of the maintainers. None of the contents of this document are legally binding in any way to the maintainers or the users.
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: php-cli.md

The . Based on , it has all the needed command line tools for daily operations. Containers \(or pods\) started from `cli` images are responsible for building code for Composer or Node.js based projects. The image also contains database `cli`s for both MariaDB and PostgreSQL. !!! Info This Dockerfile is intended to be used as a base for any `cli` needs within Lagoon. 7.3 \(available for compatibility only, no longer officially supported\) - `uselagoon/php-7.3-cli` 7.4 \(available for compatibility only, no longer officially supported\) - `uselagoon/php-7.4-cli` 8.0 \(available for compatibility only, no longer officially supported\) - `uselagoon/php-8.0-cli` 8.1 (Security Support until November 2024) - `uselagoon/php-8.1-cli` 8.2 (Security Support until December 2025) - `uselagoon/php-8.2-cli` 8.3 (Security Support until December 2026) - `uselagoon/php-8.3-cli` All PHP versions use their own Dockerfiles. This image is prepared to be used on Lagoon. There are therefore some things already done: Folder permissions are automatically adapted with , so this image will work with a random user. `COMPOSERALLOWSUPERUSER=1` removes warning about use of Composer as root. `80-shell-timeout.sh` script checks if containers are running in a Kubernetes environment and then set a 10 minutes timeout to idle `cli` pods. `cli` containers use an SSH key injected by Lagoon or defined into `SSHPRIVATEKEY`environment variable. The included CLI tools are: \(changeable via `COMPOSERVERSION` and `COMPOSERHASH_SHA256`\) \(as of Mar 2022\) `mariadb-client` `postgresql-client` By default this image ships with the `nodejs-current` package \(v17 as of Mar 2022\). If you need another version you can remove the current version and install the one of your choice. For example, to install Node.js 16, modify your dockerfile to include: ```bash title="Update Node.js version" RUN apk del nodejs-current \ && apk add --no-cache nodejs=~16 ``` Some options are configurable via [environment variables](../concepts-advanced/environment-variables.md). The [php-fpm environment variables](php-fpm.md#environment-variables) also apply. | Name | Default | Description | | :- | : | :- | | MARIADBMAXALLOWED_PACKET | 64M | Controls the max allowed packet for the MySql client. |
Project: LinuxKit (Provisioning / Automation & Configuration)
File: 2017-04-02.md

The fourth weekly development report. Feel free to send PRs if you want to add to these reports (or correct them). Amir Chaudhry @amirmc and Avi Deitcher @deitch have helped out with documentation this week, which is very helpful. We continued to invite people to participate; if you have any suggestions for additional people who are interested please let us know. Welcome everyone, looking forward to your contributions and working with you. Please open issues on github if you need help, or ask on #moby in the . We moved some of our earlier work-in-progress things to while they are not completed, in particular the eBPF iovisor tools build that we had working previously, and the AWS build which should be completed soon. This helps clean up the things that are currently in use and working to help new users; hopefully they will be fixed shortly. Support was added for `moby run` to support multiple backends on a platform eg `moby run hyperkit` . Each platform retains a default. This will allow adding simple `moby run` support for other platforms, such as VMWare , and cloud platforms. Each backend can have its own options for platform specific flags. Lots of documentation improvements this week: an , the start of a document, and an in progress . Lots of progress in the this week, getting to a point where it can be usefully tested, and more design and API discussion. Lots of discussion in Slack and on the about arm64 support, looks like several people are making good progress. Having multiarch base images for Alpine sounds like it would be useful. Sounds like we should have some working boots next week, hopefully PRs following. Small changes: `.yaml` files were renamed to `.yml` for consistency with common usage elsewhere fixes for console handling kernel updates, additional driver support `moby build` now logs what it is doing by default, to help debugging. There is a quiet option to disable. support for disk formatting `containerd` and `runc` updates, fix the version incompatibilities arm64 prototypes documentation preparation for Dockercon there will be a talk by @justincormack on Moby (currently billed as containerd...) there will be a Docker Security talk with @riyazdf (`Secure Substrate: Least Privilege Container Deployment`) that will highlight Moby there will be a session and lots of time to talk at the Thursday summit - get in touch if you need an invite. Please add topics you could like to talk about to via PR.
Project: KICS (Provisioning / Security & Compliance)
File: b2e8752c-3497-4255-98d2-e4ae5b46bbf5.md

title: S3 Bucket Without Server-side-encryption hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b2e8752c-3497-4255-98d2-e4ae5b46bbf5 Query name: S3 Bucket Without Server-side-encryption Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: S3 Buckets should have server-side encryption at rest enabled to protect sensitive data<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: '2010-09-09' Description: S3 bucket without default encryption Resources: S3Bucket: Type: 'AWS::S3::Bucket' Properties: BucketName: 'Fn::Sub': 'bucket-${AWS::Region}-${AWS::AccountId}' DeletionPolicy: Delete ``` ```json title="Positive test num. 2 - json file" hl_lines="5" { "Resources": { "S3Bucket": { "Type": "AWS::S3::Bucket", "Properties": { "BucketName": { "Fn::Sub": "bucket-${AWS::Region}-${AWS::AccountId}" } }, "DeletionPolicy": "Delete" } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "S3 bucket without default encryption" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Description: S3 bucket with default encryption Resources: EncryptedS3Bucket: Type: 'AWS::S3::Bucket' Properties: BucketName: 'Fn::Sub': 'encryptedbucket-${AWS::Region}-${AWS::AccountId}' BucketEncryption: ServerSideEncryptionConfiguration: ServerSideEncryptionByDefault: SSEAlgorithm: 'aws:kms' KMSMasterKeyID: KMS-KEY-ARN DeletionPolicy: Delete ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "S3 bucket with default encryption", "Resources": { "EncryptedS3Bucket": { "Type": "AWS::S3::Bucket", "Properties": { "BucketName": { "Fn::Sub": "encryptedbucket-${AWS::Region}-${AWS::AccountId}" }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "KMS-KEY-ARN" } } ] } }, "DeletionPolicy": "Delete" } } } ```
Project: KCL (Provisioning / Automation & Configuration)
File: 3.coding_conventions.md

The core code of KCL is fully built by Rust, so we recommend that you follow the . Thanks to Rust's rich and powerful language toolchains, we recommend that you use tools such as `cargo fmt`, `cargo clippy`, and `cargo fix` to check or refactor every commit of code change before submission. Lines should be at most 100 characters. It's even better if you can keep things to 80. Prefer 4-space indent.
Project: KICS (Provisioning / Security & Compliance)
File: 83c5fa4c-e098-48fc-84ee-0a537287ddd2.md

title: Unrestricted Security Group Ingress hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 83c5fa4c-e098-48fc-84ee-0a537287ddd2 Query name: Unrestricted Security Group Ingress Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: Security groups allow ingress from 0.0.0.0/0<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="41 28 14 55" name: example1 amazon.aws.ec2_group: name: example1 description: an example EC2 group vpc_id: 12345 region: eu-west-1 rules: proto: tcp ports: 80 443 8080-8099 cidr_ip: 0.0.0.0/0 name: example2 amazon.aws.ec2_group: name: example2 description: an example EC2 group vpc_id: 12345 region: eu-west-1 rules: proto: tcp ports: 80 443 8080-8099 cidr_ip: 0.0.0.0/0 name: example3 amazon.aws.ec2_group: name: example3 description: an example EC2 group vpc_id: 12345 region: eu-west-1 rules: proto: tcp ports: 80 443 8080-8099 cidr_ipv6: ::/0 name: example4 amazon.aws.ec2_group: name: example4 description: an example EC2 group vpc_id: 12345 region: eu-west-1 rules: proto: tcp ports: 80 443 8080-8099 cidr_ipv6: ::/0 ``` ```yaml title="Negative test num. 1 - yaml file" name: example1 amazon.aws.ec2_group: name: example1 description: an example EC2 group vpc_id: 12345 region: eu-west-1 rules: proto: tcp ports: 80 443 8080-8099 cidr_ip: 172.16.17.0/24 name: example2 amazon.aws.ec2_group: name: example2 description: an example EC2 group vpc_id: 12345 region: eu-west-1 rules: proto: tcp ports: 80 443 8080-8099 cidr_ip: 172.16.1.0/24 name: example3 amazon.aws.ec2_group: name: example3 description: an example EC2 group vpc_id: 12345 region: eu-west-1 rules: proto: tcp ports: 80 443 8080-8099 cidr_ipv6: 2607:F8B0::/32 name: example4 amazon.aws.ec2_group: name: example4 description: an example EC2 group vpc_id: 12345 region: eu-west-1 rules: proto: tcp ports: 80 443 8080-8099 cidr_ipv6: 64:ff9b::/96 2607:F8B0::/32 ```
Project: KICS (Provisioning / Security & Compliance)
File: f2f903fb-b977-461e-98d7-b3e2185c6118.md

title: Pip install Keeping Cached Packages hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f2f903fb-b977-461e-98d7-b3e2185c6118 Query name: Pip install Keeping Cached Packages Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: When installing packages with pip, the '--no-cache-dir' flag should be set to make Docker images smaller<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="2 8 9 10 11" FROM python:3 RUN pip install --upgrade pip && \ pip install nibabel pydicom matplotlib pillow && \ pip install med2image CMD ["cat", "/etc/os-release"] FROM python:3.1 RUN pip install --upgrade pip RUN python -m pip install nibabel pydicom matplotlib pillow RUN pip3 install requests=2.7.0 RUN ["pip3", "install", "requests=2.7.0"] CMD ["cat", "/etc/os-release"] ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM python:3 RUN pip install --no-cache-dir --upgrade pip && \ pip install --no-cache-dir nibabel pydicom matplotlib pillow && \ pip install --no-cache-dir med2image RUN pip3 install --no-cache-dir requests=2.7.0 RUN ["pip3", "install", "requests=2.7.0", "--no-cache-dir"] CMD ["cat", "/etc/os-release"] ```
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.UsageModel.md

/ / UsageModel .UsageModel `CapabilityRequirements` `UsageModel` `Optional` available: [] `Optional` breadcrumb: `string` `Optional` children: `Record`<`string`, { `route`: `string` ; `usage?`: }\> `Optional` command: `string` `Optional` commandPrefix: `string` `Optional` commandPrefixNotNeeded: `boolean` `Optional` commandSuffix: `string` `Optional` configuration: `YargsParserConfiguration` `Optional` detailedExample: `DetailedExample` \| `DetailedExample`[] `Optional` docs: `string` `Optional` example: `string` `Optional` fullscreen: `boolean` CapabilityRequirements.fullscreen `Optional` header: `string` `Optional` hide: `boolean` `Optional` intro: `TitledContent` `Optional` nRowsInViewport: `number` \| `boolean` `Optional` needsUI: `boolean` CapabilityRequirements.needsUI `Optional` noAuthOk: `boolean` \| `string`[] CapabilityRequirements.noAuthOk `Optional` noHelp: `boolean` `Optional` noHelpAlias: `boolean` `Optional` oneof: [] `Optional` onlyEnforceOptions: `boolean` \| `string`[] `Optional` optional: [] `Optional` parents: `BreadcrumbLabel`[] `Optional` preserveCase: `boolean` `Optional` related: `string`[] `Optional` required: [] `Optional` requiresLocal: `boolean` CapabilityRequirements.requiresLocal `Optional` sampleInputs: [] `Optional` sections: `UsageSection`[] `Optional` strict: `string` `Optional` synonymFor: `string` `Optional` synonyms: `string`[] `Optional` title: `string` `Optional` fn(`command`): | Name | Type | | :-- | :- | | `command` | `string` |