cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: e77c89f6-9c85-49ea-b95b-5f960fe5be92.md

title: Group With Privilege Escalation By Actions 'iam:PutGroupPolicy' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e77c89f6-9c85-49ea-b95b-5f960fe5be92 Query name: Group With Privilege Escalation By Actions 'iam:PutGroupPolicy' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Group with privilege escalation by actions 'iam:PutGroupPolicy' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamgroup" "cosmic" { name = "cosmic" } resource "awsiamgrouppolicy" "testinline_policy" { name = "testinlinepolicy" group = awsiamgroup.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:PutGroupPolicy", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: ShardingSphere (App Definition and Development / Database)
File: audit.en.md

+++ title = "Sharding Audit Algorithm" weight = 8 +++ The sharding audit is to audit the SQL statements in the sharding database. Sharding audit not only intercept illegal SQL statements, but also gather the SQL statistics. Type: DMLSHARDINGCONDITIONS when configuring data sharding rules, create sharding audit configurations. DMLSHARDINGCONDITIONS ```yaml auditors: shardingkeyrequired_auditor: type: DMLSHARDINGCONDITIONS ```
Project: Meshery (Provisioning / Automation & Configuration)
File: katib.md

layout: integration title: Kubeflow Katib subtitle: Collaborative and visual infrastructure as code for Kubeflow Katib image: /assets/img/integrations/katib/icons/color/katib-color.svg permalink: extensibility/integrations/katib docURL: https://docs.meshery.io/extensibility/integrations/katib description: integrations-category: Machine Learning integrations-subcategory: Machine Learning registrant: Artifact Hub components: name: experiment colorIcon: assets/img/integrations/katib/components/experiment/icons/color/experiment-color.svg whiteIcon: assets/img/integrations/katib/components/experiment/icons/white/experiment-white.svg description: name: suggestion colorIcon: assets/img/integrations/katib/components/suggestion/icons/color/suggestion-color.svg whiteIcon: assets/img/integrations/katib/components/suggestion/icons/white/suggestion-white.svg description: name: trial colorIcon: assets/img/integrations/katib/components/trial/icons/color/trial-color.svg whiteIcon: assets/img/integrations/katib/components/trial/icons/white/trial-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: Meshery (Provisioning / Automation & Configuration)
File: mesheryctl-system-config.md

layout: default title: mesheryctl-system-config permalink: reference/mesheryctl/system/config redirect_from: reference/mesheryctl/system/config/ type: reference display-title: "false" language: en command: system subcommand: config Configure Meshery Configure the Kubernetes cluster used by Meshery. <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system config [flags] </div> </pre> Set configuration according to k8s cluster <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system config [aks|eks|gke|minikube] </div> </pre> Path to token for authenticating to Meshery API (optional, can be done alternatively using "login") <pre class='codeblock-pre'> <div class='codeblock'> mesheryctl system config --token "~/Downloads/auth.json" </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> -h, --help help for config </div> </pre> <pre class='codeblock-pre'> <div class='codeblock'> --config string path to config file (default "/home/runner/.meshery/config.yaml") -c, --context string (optional) temporarily change the current context. -v, --verbose verbose output -y, --yes (optional) assume yes for user interactive prompts. </div> </pre> Go back to , if you want to add content manually to the CLI documentation, please refer to the for guidance.
Project: secureCodeBox (Provisioning / Security & Compliance)
File: 11-telemetry.md

sidebar_label: Telemetry title: "secureCodeBox Telemetry Data" The secureCodeBox Operator collects and submits anonymized data to give the development team a vague overview on how much the secureCodeBox is actually used. The total number of datapoints collected is extremely small, and they are individually evaluated to ensure that the submitted data is as anonymous as possible. Installed version of the secureCodeBox Operator (e.g. `v2.0.0`) List of installed ScanTypes across all kubernetes Namespaces: (e.g. `['nmap', 'zap-baseline']`). Unofficial ScanTypes are reported as `other`, to avoid submission of confidential data. The data is submitted every 24 hours. When the Operator starts, the first data-point is submitted one hour after the start, to give users the opportunity to disable the telemetry data submission before the first datapoints are send. The collection of telemetry data can be completely disabled by setting the `telemetryEnabled` to `false`, e.g: ```bash helm install securecodebox-operator secureCodeBox/operator --set="telemetryEnabled=false" ``` The entire code for both the telemetry backend and frontend is open-source and linked below. Telemetry Client used in secureCodeBox Operator: Telemetry Backend:
Project: YugabyteDB (App Definition and Development / Database)
File: follower-reads.md

title: Follower Reads for global applications headerTitle: Follower reads linkTitle: Follower reads description: Reducing Read Latency for global applications headcontent: Reduce read latency for global applications menu: v2.18: identifier: global-apps-follower-reads parent: build-global-apps weight: 800 rightNav: hideH3: true hideH4: true type: docs When applications run in multiple regions, they incur cross-region latency to read the latest data from the leader, even though there could be a follower present locally. This is because all followers may not have the latest data at the read time. In some scenarios, however, reading from the leader is not necessary. For example: The data does not change often (for example, movie database). The application does not need the latest data (for example, yesterday's report). If a little staleness for reads is acceptable for the application running in other regions, then Follower Reads is the pattern to adopt. {{<tip>}} Multiple application instances are active and some instances read stale data. {{</tip>}} {{<cluster-setup-tabs>}} Suppose you have a set up across 3 regions `us-east`, `us-central`, and `us-west`, with leader preference set to `us-east`. Suppose further that you want to run applications in all 3 regions. Read latencies would be similar to the following illustration. Enable follower reads for your application using the following statements: ```plpgsql SET session characteristics as transaction read only; SET ybreadfrom_followers = true; ``` This allows the application to read data from the closest follower (or leader). In this scenario, the read latency for the application in `us-west` drops drastically to 2 ms from the initial 60 ms, and the read latency of the application in `us-central` also drops to 2 ms. As replicas may not be up-to-date (by design), this might return slightly stale data (the default staleness is 30 seconds). This is the case even if the read goes to a leader. You can change the staleness value using the following setting: ```plpgsql SET ybfollowerreadstalenessms = 10000; -- 10s ``` {{<note>}} This is only for reads. All writes still go to the leader. {{</note>}} When the follower in a region fails, the application redirects its reads to the next closest follower/leader. Notice how the application in `us-west` reads from the follower in `us-central` when the follower in `us-west` has failed. The read latency is 40 ms, still much less than the original 60 ms.
Project: ClickHouse (App Definition and Development / Database)
File: offset.md

slug: /en/sql-reference/statements/select/offset sidebar_label: OFFSET title: "OFFSET FETCH Clause" `OFFSET` and `FETCH` allow you to retrieve data by portions. They specify a row block which you want to get by a single query. ``` sql OFFSET offsetrowcount {ROW | ROWS}] [FETCH {FIRST | NEXT} fetchrowcount {ROW | ROWS} {ONLY | WITH TIES}] ``` The `offsetrowcount` or `fetchrowcount` value can be a number or a literal constant. You can omit `fetchrowcount`; by default, it equals to 1. `OFFSET` specifies the number of rows to skip before starting to return rows from the query result set. The `FETCH` specifies the maximum number of rows that can be in the result of a query. The `ONLY` option is used to return rows that immediately follow the rows omitted by the `OFFSET`. In this case the `FETCH` is an alternative to the clause. For example, the following query ``` sql SELECT * FROM test_fetch ORDER BY a OFFSET 1 ROW FETCH FIRST 3 ROWS ONLY; ``` is identical to the query ``` sql SELECT * FROM test_fetch ORDER BY a LIMIT 3 OFFSET 1; ``` The `WITH TIES` option is used to return any additional rows that tie for the last place in the result set according to the `ORDER BY` clause. For example, if `fetchrowcount` is set to 5 but two additional rows match the values of the `ORDER BY` columns in the fifth row, the result set will contain seven rows. :::note According to the standard, the `OFFSET` clause must come before the `FETCH` clause if both are present. ::: :::note The real offset can also depend on the setting. ::: Input table: ``` text ab 1 1 2 1 3 4 1 3 5 4 0 6 5 7 ``` Usage of the `ONLY` option: ``` sql SELECT * FROM test_fetch ORDER BY a OFFSET 3 ROW FETCH FIRST 3 ROWS ONLY; ``` Result: ``` text ab 2 1 3 4 5 4 ``` Usage of the `WITH TIES` option: ``` sql SELECT * FROM test_fetch ORDER BY a OFFSET 3 ROW FETCH FIRST 3 ROWS WITH TIES; ``` Result: ``` text ab 2 1 3 4 5 4 5 7 ```
Project: Meshery (Provisioning / Automation & Configuration)
File: index.md

layout: default title: Tasks permalink: tasks language: en list: exclude published: false abstract: Common tasks for using Meshery's various features and components. These sections provide user guides to the functionality Meshery offers. {% assign sorted = site.pages | sort: "functionality" %} <ul> {% for item in sorted %} {% if item.type=="tasks" and item.list!="exclude" and item.language !="es" -%} <li><a href="{{ site.baseurl }}{{ item.url }}">{{ item.title }}</a> {% if item.abstract != " " %} {{ item.abstract }} {% endif %} </li> {% endif %} {% endfor %} </ul>
Project: ClickHouse (App Definition and Development / Database)
File: v23.7.2.25-stable.md

sidebar_position: 1 sidebar_label: 2023 Backported in : If a dynamic disk contains a name, it should be specified as `disk = disk(name = 'diskname'`, ...) in disk function arguments. In previous version it could be specified as `disk = disk<disk_name>(...)`, which is no longer supported. (). Backported in : Add `clickhouse-keeper-client` symlink to the clickhouse-server package. (). Fix binary arithmetic for Nullable(IPv4) (). Support IPv4 and IPv6 as dictionary attributes (). init and destroy ares channel on demand.. (). Fix crash in function `tuple` with one sparse column argument (). Fix data race in Keeper reconfiguration (). clickhouse-keeper: fix implementation of server with poll() (). Rename setting disableurlencoding to enableurlencoding and add a test (). Fix bugs and better test for SYSTEM STOP LISTEN (). Increase min protocol version for sparse serialization (). Docker improvements ().
Project: Docker Compose (App Definition and Development / Application Definition & Image Build)
File: compose_watch.md

<!MARKERGENSTART--> Watch build context for service and rebuild/refresh containers when files are updated | Name | Type | Default | Description | |:|:--|:--|:-| | `--dry-run` | | | Execute command in dry run mode | | `--no-up` | | | Do not build & start services before watching | | `--quiet` | | | hide build output | <!MARKERGENEND-->
Project: StarRocks (App Definition and Development / Database)
File: st_linefromtext.md

displayed_sidebar: "English" Converts a WKT (Well Known Text) to a memory representation in the form of Line. ```Haskell GEOMETRY ST_LineFromText(VARCHAR wkt) ``` ```Plain Text MySQL > SELECT STAsText(STLineFromText("LINESTRING (1 1, 2 2)")); ++ | stastext(stlinefromtext('LINESTRING (1 1, 2 2)')) | ++ | LINESTRING (1 1, 2 2) | ++ ``` STLINEFROMTEXT,STLINESTRINGFROMTEXT,ST,LINEFROMTEXT,LINESTRINGFROMTEXT
Project: KubeDL (Provisioning / Automation & Configuration)
File: debug_guide.md

Credentials To run KubeDL locally, you must have the access to the kubernetes cluster, the credential is a distributed kube-config cert file. Install CRDs and run KubeDL operator ```bash export KUBECONFIG=${PATHTOCONFIG} // or specify the path by --kubeconfig {PATHTOCONFIG} make install make run ``` KubeDL supports running workloads selectively. You can enable a specific workload by parsing the parameter `--workloads {workload-to-debug}` while starting KubeDL. Check the printed logs to see if the job controller is started as expected. The followings are the steps to debug KubeDL operator using Pod. Install docker Following the . Install minikube Follow the . Develop customized KubeDL operator Make your own code changes and validate the build by running `make manager` in KubeDL directory. Deploy customized operator Your customized operator will be deployed as a replicaset to replace the original KubeDL operator. The deployment can be done via the following steps assuming a clean environment: Prerequisites: create new/use existing account ($DOCKERID), and create a `kubedl` repository in it. Also, ; step 1: `docker login` with the $DOCKERID account; step 2: `export IMG=<image_name>` to specify the target image name. e.g., `export IMG=$DOCKERID/kubedl:test`; step 3: `make docker-build` to build the image locally; step 4: `make docker-push` to push the image to dock hub under the `kubedl` repository; step 5: change the `config/manager/allinone.yaml` and replace the image of the kubedl deployment to `$DOCKERID/kubedl:test` ```yaml spec: containers: command: /manager args: "--workloads {workload-to-debug}" image: $DOCKERID/kubedl:test imagePullPolicy: Always name: kubedl ``` step 6: `kubectl delete deployment kubedl-controller-manager -n kubedl` to remove the old deployment if any; step 7: `kubectl apply -f config/manager/allinone.yaml` to install the new deployment with the customized operator image; You can now perform manual tests and use `kubectl logs kubedl-controller-manager-0 -n kubedl-system` to check controller logs for debugging.
Project: Tetragon (Provisioning / Security & Compliance)
File: TODO.md

The following are high-level tasks that will be considered for upcoming release cycles. [ ] Support and test on Windows platform (#27) [ ] Ability to map and access program flags (#20) [ ] Provide a simple API to submit HTTP requests and retrieve HTTP documents (think of wget/curl) [x] Support for scatter/gather exec commands [x] Support for concurrent exec of os commands [x] Piping/chaining OS exec commands (#29) [x] Apply code quality changes
Project: KICS (Provisioning / Security & Compliance)
File: ba4e0031-3e9d-4d7d-b0d6-bd8f003f8698.md

title: AMI Shared With Multiple Accounts hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ba4e0031-3e9d-4d7d-b0d6-bd8f003f8698 Query name: AMI Shared With Multiple Accounts Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Limits access to AWS AMIs by checking if more than one account is using the same image<br> ```tf title="Positive test num. 1 - tf file" hl_lines="11 3" resource "awsamilaunch_permission" "positive1" { image_id = "ami-1235678" account_id = "12345600012" } resource "awsamilaunch_permission" "positive2" { image_id = "ami-1235678" account_id = "123456789012" } ``` ```tf title="Negative test num. 1 - tf file" resource "awsamilaunch_permission" "negative1" { image_id = "ami-12345678" account_id = "123456789012" } resource "awsamilaunch_permission" "example" { image_id = "ami-12345680" account_id = "12345672" } ```
Project: YugabyteDB (App Definition and Development / Database)
File: slice-operator.md

title: The array slice operator linkTitle: Array slice operator headerTitle: The array slice operator description: The array slice operator menu: preview: identifier: array-slice-operator parent: array-functions-operators weight: 30 type: docs Purpose: Return a new array whose length is defined by specifying the slice's lower and upper bound along each dimension. Signature: ``` input value: [lb1:ub1] ... [lbN:ubN]anyarray return value: anyarray ``` Note: You must specify the lower and upper slicing bounds, as `int` values for each of the input array's N dimensions. The specified slicing bounds must not exceed the source array's bounds. The new array has the same dimensionality as the source array and its lower bound is `1` on each axis. Example: ```plpgsql create table t(k int primary key, arr text[]); insert into t(k, arr) values (1, ' [4:5]= { { {a,b}, {c,d}, {e,f}, {g,h} }, { {i,j}, {k,l}, {m,n}, {o,p} }, { {q,r}, {s,t}, {u,v}, {w,x} } } '::text[]); select arr as "old value of arr" from t where k = 1; select array_lower(arr, 1) as "lb-1", array_upper(arr, 1) as "ub-1", array_lower(arr, 2) as "lb-2", array_upper(arr, 2) as "ub-2", array_lower(arr, 3) as "lb-3", array_upper(arr, 3) as "ub-3" from t where k = 1; ``` It produces these results: ``` old value of arr [4:5]={{{a,b},{c,d},{e,f},{g,h}},{{i,j},{k,l},{m,n},{o,p}},{{q,r},{s,t},{u,v},{w,x}}} ``` and: ``` lb-1 | ub-1 | lb-2 | ub-2 | lb-3 | ub-3 +++++ 2 | 4 | 3 | 6 | 4 | 5 ``` Now do the slicing: ```plpgsql update t set arr = arr[3:4] where k = 1; select arr as "new value of arr" from t where k = 1; select array_lower(arr, 1) as "lb-1", array_upper(arr, 1) as "ub-1", array_lower(arr, 2) as "lb-2", array_upper(arr, 2) as "ub-2", array_lower(arr, 3) as "lb-3", array_upper(arr, 3) as "ub-3" from t where k = 1; ``` It produces these results: ``` new value of arr -- {{{c},{e}},{{k},{m}}} ``` and: ``` lb-1 | ub-1 | lb-2 | ub-2 | lb-3 | ub-3 +++++ 1 | 2 | 1 | 2 | 1 | 1 ``` Notice, that as promised, all the lower bounds are equal to `1`.
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_builder.md

title: kbcli builder builder command. ``` -h, --help help for builder ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - migrate - a developer tool. - tpl - a developer tool integrated with KubeBlocks that can help developers quickly generate rendered configurations or scripts based on Helm templates, and discover errors in the template before creating the database cluster.