cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: dbbc6705-d541-43b0-b166-dd4be8208b54.md

title: NET_RAW Capabilities Not Being Dropped hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: dbbc6705-d541-43b0-b166-dd4be8208b54 Query name: NET_RAW Capabilities Not Being Dropped Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Containers should drop 'ALL' or at least 'NET_RAW' capabilities<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="13 18 11 21" apiVersion: v1 kind: Pod metadata: name: example spec: containers: name: payment image: nginx securityContext: capabilities: drop: SYS_ADMIN name: payment2 image: nginx name: payment4 image: nginx securityContext: capabilities: add: NETBINDSERVICE name: payment3 image: nginx securityContext: allowPrivilegeEscalation: false ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="31" apiVersion: apps/v1 kind: Deployment metadata: name: redis-unhealthy-deployment labels: app: redis spec: replicas: 3 selector: matchLabels: app: redis template: metadata: labels: app: redis spec: hostNetwork: true hostPID: true hostIPC: true containers: name: redis image: redis:latest ports: containerPort: 9001 hostPort: 9001 securityContext: privileged: true readOnlyRootFilesystem: false allowPrivilegeEscalation: true runAsUser: 0 capabilities: add: NET_ADMIN ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: example spec: containers: name: payment image: nginx securityContext: capabilities: drop: ALL add: NETBINDSERVICE privileged: false seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny runAsUser: rule: RunAsAny fsGroup: rule: RunAsAny volumes: '*' ```
Project: YugabyteDB (App Definition and Development / Database)
File: azure-cosmos.md

title: Compare Azure Cosmos DB with YugabyteDB headerTitle: Azure Cosmos DB linkTitle: Azure Cosmos DB description: Compare Azure Cosmos database with YugabyteDB. aliases: /comparisons/azure-cosmos/ menu: preview_faq: identifier: azure-cosmos identifier: comparisons-cosmos parent: comparisons weight: 1110 type: docs YugabyteDB's multi-API and tunable read latency approaches are similar to that of . However, it's underlying storage and replication architecture is much more resilient than that of Cosmos DB. Support for fully distributed SQL and global consistency across multi-region and multi-cloud deployments makes it much more suitable for enterprises building scale-out RDBMS as well as internet-scale OLTP apps but do not want to get locked into a proprietary database such as Cosmos DB. A post on our blog titled goes through some of above topics in more detail.
Project: YugabyteDB (App Definition and Development / Database)
File: 01-select.md

title: "SELECT" SELECT data from one column In this exercise we will select all the data in the company\names column from the customers_ table. ``` select company_name from customers; ``` The query should return 91 rows. SELECT data from multiple columns In this exercise we will select all the data in three columns from the employees table. ``` select employeeid,firstname,lastname,birthdate from employees; ``` The query should return 9 rows. SELECT data from all the columns and rows in a table In this exercise we will select all the data, from all columns in the orderdetails_ table. ``` select * from order_details; ``` The query should return 2155 rows. SELECT with an expression In this exercise we will combine the first\name and last\name columns to give us full names, along with their titles from the employees table. ``` select firstname || '' || lastname as full_name,title from employees; ``` The query should return 9 rows. SELECT with an expression, but without a FROM clause In this exercise we will use an expression, but omit specifying a table because it doesn't require one. ``` SELECT 5 * 3 AS result; ``` The query should return 1 row with a result of 15. SELECT with a column alias In this exercise we will use the alias title for the contacttitle_ column and output all the rows. ``` SELECT contact_title AS title FROM customers; ``` The query should return 91 rows. SELECT with a table alias In this exercise we will use the alias details for the order\details_ table and output all the rows. ``` SELECT productid, discount FROM orderdetails AS details; ``` The query should return 2155 rows.
Project: Meshery (Provisioning / Automation & Configuration)
File: archive.md

layout: page title: Articles permalink: /archive/ excludedinsearch: true language: en list: exclude published: false {% for post in site.posts %}{% capture thisyear %}{{ post.date | date: "%Y" }}{% endcapture %}{% capture nextyear %}{{ post.previous.date | date: "%Y" }}{% endcapture %} {% if forloop.first %}<h2 class="c-archivesyear" id="{{ thisyear }}-ref">{{thisyear}}</h2> <ul class="c-archiveslist">{% endif %} <li class="c-archivesitem"> {{ post.date | date: "%b %-d, %Y" }}: <a href="{{ post.url | prepend: site.baseurl }}">{{ post.title }}</a> </li>{% if forloop.last %}</ul>{% else %}{% if thisyear != nextyear %} </ul> <h2 class="c-archivesyear" id="{{ nextyear }}-ref">{{nextyear}}</h2> <ul class="c-archiveslist">{% endif %}{% endif %}{% endfor %}
Project: Daytona (App Definition and Development / Application Definition & Image Build)
File: CONTRIBUTORS.md

We contributors to Daytona: License all our contributions to the project under the Apache License, Version 2.0 Have the legal rights to license our contributions ourselves, or get permission to license them from our employers, clients, or others who may have them Signoff on our commits with the Developer Certificate of Origin (DCO) Version 1.1 (https://developercertificate.org/) Previously we added our names and GitHub handles to this CONTRIBUTORS.md file. We leave these names here to record the commits that came before. -- Vedran Jukic (@vedranjukic) Ivan Burazin (@ivan-burazin) Chad Metcalf (@metcalfc) Toma Puljak (@tpuljak) Nikola Balic (@nkkko) Goran Draganic (@gdraganic) Ivan Dageli (@idagelic) Fabjan Vuina (@fabjanvucina) Neo (@neo773) Ezhil Shanmugham (@ezhil56x) Tarun Chauhan (@tarunrajput) Deepak gupta (@guptadeepak8) Vineeth Kumar (@vineeth-vk11) Jay Kumar (@35C4n0r) Twac (@Twacqwq)
Project: GraphScope (App Definition and Development / Database)
File: how_to_instrument.md

GraphScope leverage for instrument. Download thelatest agent file Configure the following environment variables to set the service and protocol details. ```bash export JAVATOOLOPTIONS="-javaagent:/PATH/TO/opentelemetry-javaagent.jar" export OTELSERVICENAME="frontend-service" ``` Start the application as usual ```bash java -jar application.jar ```
Project: ShardingSphere (App Definition and Development / Database)
File: enable-disable-compute-node.en.md

+++ title = "ENABLE/DISABLE COMPUTE NODE" weight = 4 +++ The `ENABLE/DISABLE COMPUTE NODE` syntax is used enable/disable a specified proxy instance {{< tabs >}} {{% tab name="Grammar" %}} ```sql EnableDisableComputeNode ::= ('ENABLE' | 'DISABLE') 'COMPUTE' 'NODE' instanceId instanceId ::= string ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} `instanceId` needs to be obtained through syntax query The currently in-use proxy instance cannot be disabled Disable a specified proxy instance ```sql DISABLE COMPUTE NODE '734bb086-b15d-4af0-be87-2372d8b6a0cd'; ``` Enable a specified proxy instance ```sql ENABLE COMPUTE NODE '734bb086-b15d-4af0-be87-2372d8b6a0cd'; ``` `ENABLE`, `DISABLE`, `COMPUTE`, `NODE`
Project: Chef Infra (Provisioning / Automation & Configuration)
File: branching_and_backporting.md

We develop and ship the current release of Chef off the `main` branch of this repository. Our goal is that `main` should always be in a shippable state. Previous stable releases of Chef are developed on their own branches named by the major version (ex: chef-16 or chef-15). We do not perform direct development on these stable branches, except to resolve build failures. Instead, we backport fixes from our main branch to these stable branches. Stable branches receive critical bugfixes and security releases, and stable Chef releases are made as necessary for security purposes. If there is a critical fix that you believe should be backported from main to a stable branch, please follow these steps to backport your change: Ask in the #chef-dev channel on if this is an appropriate change to backport. Inspect the Git history and find the `SHA`(s) associated with the fix. Backport the fix to a branch via cherry-pick: Check out the stable release branch: `git checkout chef-16` Create a branch for your backport: `git checkout -b mygreatbug_backport` Cherry Pick the SHA with the fix: `git cherry-pick SHA` Address any conflicts (if necessary) Push the new branch to your origin: `git push origin` Open a PR for your backport The PR title should be `Backport: ORIGINALPRTEXT` The description should link to the original PR and include a description of why it needs to be backported
Project: KICS (Provisioning / Security & Compliance)
File: c2a3efb6-8a58-481c-82f2-bfddf34bb4b7.md

title: CosmosDB Account IP Range Filter Not Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c2a3efb6-8a58-481c-82f2-bfddf34bb4b7 Query name: CosmosDB Account IP Range Filter Not Set Platform: Terraform Severity: <span style="color:#ff0000">Critical</span> Category: Networking and Firewall URL: The IP range filter should be defined to secure the data stored<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "azurermcosmosdbaccount" "positive1" { name = "example" isvirtualnetworkfilterenabled = true } ``` ```tf title="Negative test num. 1 - tf file" resource "azurermcosmosdbaccount" "negative1" { name = "example" iprangefilter = "104.42.195.92" isvirtualnetworkfilterenabled = true } ```
Project: Paralus (Provisioning / Security & Compliance)
File: README.md

We use filebeat inorder to push logs from application to elasticsearch server. In actual deployment, the idea is that we will have a sidecar container that will be responsible for tailing the log files so that we can read it using a filebeat instance running in a daemonset. For local testing, you can run filebeat as as a binary and push the logs generated into ES. You can use the following config to do so. ``` yaml filebeat.inputs: type: log fields: type: "auditlogs" paths: audit.log # audit file path json.keysunderroot: true json.overwrite_keys: true json.adderrorkey: true json.expand_keys: true output.elasticsearch: hosts: ["http://127.0.0.1:9200"] index: "index-%{[fields.type]:other}-%{+yyyy.MM.dd}" ssl: verification_mode: "none" enabled: false catrustedfingerprint: "ignore-this" setup.template.name: "index" setup.template.pattern: "index-*" setup.template.overwrite: true setup.template.append_fields: name: timestamp type: date ``` This will push the audit logs generated in `audit.log` file into elasticsearch index with the name `index-auditlogs-<date>` which you should be able to see in ES. Now if you were to use this as the audit index key, you should be able to use this in the application.
Project: StarRocks (App Definition and Development / Database)
File: ADMIN_SHOW_CONFIG.md

displayed_sidebar: "English" Displays the configuration of the current cluster (Currently, only FE configuration items can be displayed). For detailed description of these configuration items, see . If you want to set or modify a configuration item, use . :::tip This operation requires the SYSTEM-level OPERATE privilege. You can follow the instructions in to grant this privilege. ::: ```sql ADMIN SHOW FRONTEND CONFIG [LIKE "pattern"] ``` Note: Description of the return parameters: ```plain text Key: Configuration item name Value: Configuration item value Type: Configuration item type IsMutable: Whether it can be set through the ADMIN SET CONFIG command MasterOnly: Whether it only applies to leader FE Comment: Configuration item description ``` View the configuration of the current FE node. ```sql ADMIN SHOW FRONTEND CONFIG; ``` Search for the configuration of the current FE node by using the `like` predicate. ```plain text mysql> ADMIN SHOW FRONTEND CONFIG LIKE '%checkjavaversion%'; +--+-++--+++ | Key | Value | Type | IsMutable | MasterOnly | Comment | +--+-++--+++ | checkjavaversion | true | boolean | false | false | | +--+-++--+++ 1 row in set (0.00 sec) ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: routing_table.md

+++ title = "routing_table resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "routing_table" identifier = "inspec/resources/os/routingtable.md routingtable resource" parent = "inspec/resources/os" +++ Use the `routing_table` Chef InSpec audit resource to test the routing information parameters, destination, gateway, and interface present in the routing table. The rule matches with the output information of `netstat -rn`. This resource is distributed with Chef InSpec. A `routing_table` Chef InSpec audit resource tests if an entry of destination, gateway, and interface is present as part of the routing table information. All three keys and their values must be passed when testing. ```ruby describe routing_table do it { should have_entry(destination: '0.0.0.0', interface: 'eth0', gateway: '172.31.80.1') } end ``` where `destination`, `interface`, and `gateway` are parameters of the routing table. `have_entry` is a matcher of this resource. For a full list of available matchers, please visit our . The `have_entry` matcher tests the if the given destination, interface, and gateway exist as an entry in the routing table. ```ruby it { should have_entry(destination: '0.0.0.0', interface: 'eth0', gateway: '172.31.80.1') } ``` The following examples show how to use this Chef InSpec audit resource. `have_entry` returns true if the given combination of destination, gateway, and interface is a valid entry in the routing table. ```ruby describe routing_table do it { should have_entry(destination: '10.123.137.0', interface: 'eth0', gateway: '0.0.0.0') } end ``` ```ruby describe routing_table do it do should have_entry( :destination => '192.168.43.1/32', :interface => 'lxdbr0', :gateway => '172.31.80.1', ) end end ```
Project: YugabyteDB (App Definition and Development / Database)
File: strings-and-text-ycql.md

title: Strings and text in YCQL headerTitle: String and text data types linkTitle: 8. Strings and text description: Learn how to work with string and text data types in YCQL. menu: v2.18: identifier: strings-and-text-2-ycql parent: learn weight: 570 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li > <a href="{{< relref "./strings-and-text-ysql.md" >}}" class="nav-link"> <i class="icon-postgres" aria-hidden="true"></i> YSQL </a> </li> <li > <a href="{{< relref "./strings-and-text-ycql.md" >}}" class="nav-link active"> <i class="icon-cassandra" aria-hidden="true"></i> YCQL </a> </li> </ul> YCQL content coming soon.
Project: YugabyteDB (App Definition and Development / Database)
File: ddl_alter_role.md

title: ALTER ROLE statement [YCQL] headerTitle: ALTER ROLE linkTitle: ALTER ROLE description: Use the ALTER ROLE statement to change the properties of an existing role. menu: v2.18: parent: api-cassandra weight: 1210 type: docs Use the `ALTER ROLE` statement to change the properties of an existing role. It allows modifying properties `SUPERUSER`, `PASSWORD`, and `LOGIN`. This statement is enabled by setting the YB-TServer flag to `true`. <svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="437" height="65" viewbox="0 0 437 65"><path class="connector" d="M0 52h5m58 0h10m52 0h10m84 0h10m53 0h30m-5 0q-5 0-5-5v-20q0-5 5-5h32m46 0h32q5 0 5 5v20q0 5-5 5m-5 0h25"/><rect class="literal" x="5" y="35" width="58" height="25" rx="7"/><text class="text" x="15" y="52">ALTER</text><rect class="literal" x="73" y="35" width="52" height="25" rx="7"/><text class="text" x="83" y="52">ROLE</text><a xlink:href="../grammardiagrams#role-name"><rect class="rule" x="135" y="35" width="84" height="25"/><text class="text" x="145" y="52">rolename</text></a><rect class="literal" x="229" y="35" width="53" height="25" rx="7"/><text class="text" x="239" y="52">WITH</text><rect class="literal" x="339" y="5" width="46" height="25" rx="7"/><text class="text" x="349" y="22">AND</text><a xlink:href="../grammardiagrams#role-property"><rect class="rule" x="312" y="35" width="100" height="25"/><text class="text" x="322" y="52">roleproperty</text></a></svg> ```ebnf altertable ::= ALTER ROLE rolename WITH roleproperty [ AND roleproperty ...]; role_property ::= PASSWORD = '<Text Literal>' | LOGIN = <Boolean Literal>' | SUPERUSER = '<Boolean Literal>' ``` Where `role_name` is a text identifier. An error is raised if `role_name` does not exist. You can do this as shown below. ```sql ycqlsh:example> CREATE ROLE finance; ``` ```sql ycqlsh:example> ALTER ROLE finance with LOGIN = true; ``` ```sql ycqlsh:example> ALTER ROLE finance with SUPERUSER = true; ``` ```sql ycqlsh:example> ALTER ROLE finance with PASSWORD = 'jsfp9ajhufans2' AND SUPERUSER = false; ```
Project: KICS (Provisioning / Security & Compliance)
File: 8bfbf7ab-d5e8-4100-8618-798956e101e0.md

title: User With Privilege Escalation By Actions 'iam:PutGroupPolicy' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8bfbf7ab-d5e8-4100-8618-798956e101e0 Query name: User With Privilege Escalation By Actions 'iam:PutGroupPolicy' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: User with privilege escalation by actions 'iam:PutGroupPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamuser" "cosmic" { name = "cosmic" } resource "awsiamuserpolicy" "testinline_policy" { name = "testinlinepolicy" user = awsiamuser.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:PutGroupPolicy", ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" users = [awsiamuser.cosmic.name] roles = [awsiamrole.role.name] groups = [awsiamgroup.group.name] } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: kpt (Provisioning / Automation & Configuration)
File: empty-repository.md

For easier orientation, an overview of the contents of the `empty-repository.tar`. The repository in `empty-repository.tar` is truly empty. It has no commits, no refs. Because `HEAD` is required for a valid git repository, `HEAD` is a symbolic ref to (non-existent) `refs/heads/main`. There are no commits in this repository.
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: management-introduction.md

title: "Overview & Architecture" kind: management weight: 1 OPA exposes a set of APIs that enable unified, logically centralized policy management. Read this page if you are interested in how to build a control plane around OPA that enables policy distribution and collection of important telemetry data like decision logs. OPA enables low-latency, highly-available policy enforcement by providing a lightweight engine for distributed architectures. By default, all of the policy and data that OPA uses to make decisions is kept in-memory: <! source: https://docs.google.com/drawings/d/1-dwGFRjv_nFydo-8tOK-C-PbWyjvRObYhePC7XaLUFw/edit?usp=sharing > {{< figure src="integration.svg" width="55" caption="Host-local Architecture" >}} OPA is designed to enable distributed policy enforcement. You can run OPA next to each and every service that needs to offload policy decision-making. By colocating OPA with the services that require decision-making, you ensure that policy decisions are rendered as fast as possible and in a highly-available manner. <! source: https://docs.google.com/drawings/d/1wFef9_Smy0gNvJj4l8n05WCTqhmzdadiyspyRGFvHuw/edit?usp=sharing > {{< figure src="distributed.svg" width="55" caption="Distributed Enforcement" >}} To control and observe a set of OPAs, each OPA can be configured to connect to management APIs that enable: Policy distribution () Decision telemetry () Agent telemetry () Dynamic agent configuration () By configuring and implementing these management APIs you can unify control and visibility over OPAs in your environments. OPA does not provide a control plane service out-of-the-box today. <! source: https://docs.google.com/drawings/d/1-08mHgUN5oy2phLJ6MOr7j3e0iguxgX_3VH321iLc/edit?usp=sharing > {{< figure src="control-plane.svg" width="55" caption="Control Plane" >}}
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.0-rc-5j.md

layout: release date: 2022-04-04 tag: v0.6.0-rc-5j language: en fix: image tag of meshery-cilium @gkarthiks (#5338) Add if block in `perf result` to avoid panic error @alphaX86 (#5340) Bump eslint-plugin-react from 7.29.2 to 7.29.4 in /provider-ui @dependabot (#5325) Bump next from 12.1.0 to 12.1.4 in /provider-ui @dependabot (#5322) Bump eslint-config-next from 12.1.0 to 12.1.4 in /provider-ui @dependabot (#5328) Bump @fortawesome/free-regular-svg-icons from 6.0.0 to 6.1.1 in /ui @dependabot (#5336) Bump eslint-plugin-react from 7.29.2 to 7.29.4 in /provider-ui @dependabot (#5325) Bump google.golang.org/grpc from 1.44.0 to 1.45.0 @dependabot (#5326) Bump to later Alpine image @leecalcote (#5341) Bump next from 12.1.0 to 12.1.4 in /provider-ui @dependabot (#5322) Bump gorm.io/gorm from 1.23.2 to 1.23.3 @dependabot (#5327) Bump github.com/vektah/gqlparser/v2 from 2.4.0 to 2.4.1 @dependabot (#5335) Bump eslint-config-next from 12.1.0 to 12.1.4 in /provider-ui @dependabot (#5328) Bump @fortawesome/free-regular-svg-icons from 6.0.0 to 6.1.1 in /ui @dependabot (#5336) Thank you to our contributors for making this release possible: @alphaX86, @dependabot, @dependabot[bot], @gkarthiks and @leecalcote
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: solr.md

The . Based on the official . This Dockerfile is intended to be used to set up a standalone Solr server with an initial core `mycore`. 5.5 \(available for compatibility only, no longer officially supported\) 6.6 \(available for compatibility only, no longer officially supported\) 7.7 \(available for compatibility only, no longer officially supported\) 7 - `uselagoon/solr-7` 8 - `uselagoon/solr-8` This image is prepared to be used on Lagoon. There are therefore some things already done: Folder permissions are automatically adapted with , so this image will work with a random user. `10-solr-port.sh` script to fix and check `Solr` port. `20-solr-datadir.sh` script to check if `Solr` config is compliant for Lagoon. This sets directory paths, and configures the correct lock type. Some options are configurable via [environment variables](../concepts-advanced/environment-variables.md). | Environment Variable | Default | Description | | : | :-- | : | | SOLRJAVAMEM | 512M | Default Java HEAP size (ie. `SOLRJAVAMEM="-Xms10g -Xmx10g"`). | | SOLRDATADIR | /var/solr | Path of the solr data dir. Be careful, changing this can cause data loss! | | SOLRCOPYDATADIRSOURCE | (not set) | Path which the entrypoint script of solr will use to copy into the defined `SOLRDATADIR`, this can be used for prepopulating the Solr with a core. The scripts expects actual Solr data files! Plus it only copies data if the destination does not already have a solr core in it. |