cwielenb/CNCF-Dataset huggingface dataset:
Project: Checkov (Provisioning / Security & Compliance)
File: secrets.md

layout: default title: secrets resource scans nav_order: 1 | | Id | Type | Entity | Policy | IaC | Resource Link | |-||-|-|-||-| | 0 | CKVSECRET1 | Artifactory Credentials | secrets | Artifactory Credentials | secrets | | | 1 | CKVSECRET2 | AWS Access Key | secrets | AWS Access Key | secrets | | | 2 | CKVSECRET3 | Azure Storage Account access key | secrets | Azure Storage Account access key | secrets | | | 3 | CKVSECRET4 | Basic Auth Credentials | secrets | Basic Auth Credentials | secrets | | | 4 | CKVSECRET5 | Cloudant Credentials | secrets | Cloudant Credentials | secrets | | | 5 | CKVSECRET6 | Base64 High Entropy String | secrets | Base64 High Entropy String | secrets | | | 6 | CKVSECRET7 | IBM Cloud IAM Key | secrets | IBM Cloud IAM Key | secrets | | | 7 | CKVSECRET8 | IBM COS HMAC Credentials | secrets | IBM COS HMAC Credentials | secrets | | | 8 | CKVSECRET9 | JSON Web Token | secrets | JSON Web Token | secrets | | | 9 | CKVSECRET11 | Mailchimp Access Key | secrets | Mailchimp Access Key | secrets | | | 10 | CKVSECRET12 | NPM tokens | secrets | NPM tokens | secrets | | | 11 | CKVSECRET13 | Private Key | secrets | Private Key | secrets | | | 12 | CKVSECRET14 | Slack Token | secrets | Slack Token | secrets | | | 13 | CKVSECRET15 | SoftLayer Credentials | secrets | SoftLayer Credentials | secrets | | | 14 | CKVSECRET16 | Square OAuth Secret | secrets | Square OAuth Secret | secrets | | | 15 | CKVSECRET17 | Stripe Access Key | secrets | Stripe Access Key | secrets | | | 16 | CKVSECRET18 | Twilio API Key | secrets | Twilio API Key | secrets | | | 17 | CKVSECRET19 | Hex High Entropy String | secrets | Hex High Entropy String | secrets | |
Project: KICS (Provisioning / Security & Compliance)
File: 647de8aa-5a42-41b5-9faf-22136f117380.md

title: RDS DB Instance Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 647de8aa-5a42-41b5-9faf-22136f117380 Query name: RDS DB Instance Publicly Accessible Platform: Pulumi Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17" name: aws-rds runtime: yaml description: An RDS Instance resources: default: type: aws:rds:Instance properties: allocatedStorage: 10 dbName: mydb engine: mysql engineVersion: '5.7' instanceClass: db.t3.micro parameterGroupName: default.mysql5.7 password: foobarbaz skipFinalSnapshot: true username: foo publiclyAccessible: true ``` ```yaml title="Negative test num. 1 - yaml file" name: aws-rds runtime: yaml description: An RDS cluster resources: default: type: aws:rds:Instance properties: allocatedStorage: 10 dbName: mydb engine: mysql engineVersion: '5.7' instanceClass: db.t3.micro parameterGroupName: default.mysql5.7 password: foobarbaz skipFinalSnapshot: true username: foo ``` ```yaml title="Negative test num. 2 - yaml file" name: aws-rds runtime: yaml description: An RDS Instance resources: default: type: aws:rds:Instance properties: allocatedStorage: 10 dbName: mydb engine: mysql engineVersion: '5.7' instanceClass: db.t3.micro parameterGroupName: default.mysql5.7 password: foobarbaz skipFinalSnapshot: true username: foo publiclyAccessible: false ```
Project: ClickHouse (App Definition and Development / Database)
File: part_log.md

slug: /en/operations/system-tables/part_log The `system.part_log` table is created only if the server setting is specified. This table contains information about events that occurred with in the family tables, such as adding or merging data. The `system.part_log` table contains the following columns: `hostname` () Hostname of the server executing the query. `query_id` () Identifier of the `INSERT` query that created this data part. `event_type` () Type of the event that occurred with the data part. Can have one of the following values: `NewPart` Inserting of a new data part. `MergeParts` Merging of data parts. `DownloadPart` Downloading a data part. `RemovePart` Removing or detaching a data part using . `MutatePart` Mutating of a data part. `MovePart` Moving the data part from the one disk to another one. `mergereason` () The reason for the event with type `MERGEPARTS`. Can have one of the following values: `NotAMerge` The current event has the type other than `MERGE_PARTS`. `RegularMerge` Some regular merge. `TTLDeleteMerge` Cleaning up expired data. `TTLRecompressMerge` Recompressing data part with the. `mergealgorithm` () Merge algorithm for the event with type `MERGEPARTS`. Can have one of the following values: `Undecided` `Horizontal` `Vertical` `event_date` () Event date. `event_time` () Event time. `eventtimemicroseconds` () Event time with microseconds precision. `duration_ms` () Duration. `database` () Name of the database the data part is in. `table` () Name of the table the data part is in. `part_name` () Name of the data part. `partition_id` () ID of the partition that the data part was inserted to. The column takes the `all` value if the partitioning is by `tuple()`. `pathondisk` () Absolute path to the folder with data part files. `rows` () The number of rows in the data part. `sizeinbytes` () Size of the data part in bytes. `merged_from` () An array of names of the parts which the current part was made up from (after the merge). `bytes_uncompressed` () Size of uncompressed bytes. `read_rows` () The number of rows was read during the merge. `read_bytes` () The number of bytes was read during the merge. `peakmemoryusage` () The maximum difference between the amount of allocated and freed memory in context of this thread. `error` () The code number of the occurred error. `exception` () Text message of the occurred error. The `system.part_log` table is created after the first inserting data to the `MergeTree` table. Example ``` sql SELECT * FROM system.part_log LIMIT 1 FORMAT Vertical; ``` ``` text Row 1: hostname: clickhouse.eu-central1.internal query_id: 983ad9c7-28d5-4ae1-844e-603116b7de31 event_type: NewPart merge_reason: NotAMerge merge_algorithm: Undecided event_date: 2021-02-02 event_time: 2021-02-02 11:14:28 eventtimemicroseconds: 2021-02-02 11:14:28.861919 duration_ms: 35 database: default table: logmt2 partname: all110 partition_id: all pathondisk: db/data/default/logmt2/all11_0/ rows: 115418 sizeinbytes: 1074311 merged_from: [] bytes_uncompressed: 0 read_rows: 0 read_bytes: 0 peakmemoryusage: 0 error: 0 exception: ```
Project: Clair (Provisioning / Security & Compliance)
File: authentication.md

Previous versions of Clair used [jwtproxy] to gate authentication. For ease of building and deployment, v4 handles authentication itself. Authentication is configured by specifying configuration objects underneath the `auth` key of the configuration. Multiple authentication configurations may be present, but they will be used preferentially in the order laid out below. Clair implements JWT-based authentication using a pre-shared key. The `auth` stanza of the configuration file requires two parameters: `iss`, which is the issuer to validate on all incoming requests; and `key`, which is a base64 encoded symmetric key for validating the requests. ```yaml auth: psk: key: >- MDQ4ODBlNDAtNDc0ZC00MWUxLThhMzAtOTk0MzEwMGQwYTMxCg== iss: 'issuer' ```
Project: Chef InSpec (Provisioning / Security & Compliance)
File: apt.md

+++ title = "apt resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "apt" identifier = "inspec/resources/os/apt.md apt resource" parent = "inspec/resources/os" +++ Use the `apt` Chef InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. An `apt` resource block tests the contents of Apt and PPA repositories: describe apt('path') do it { should exist } it { should be_enabled } end where `apt('path')` must specify an Apt or PPA repository `('path')` may be an `http://` address, a `ppa:` address, or a short `repo-name/ppa` address `exist` and `be_enabled` are a valid matchers for this resource The following examples show how to use this Chef InSpec audit resource. describe apt('http://ppa.launchpad.net/juju/stable/ubuntu') do it { should exist } it { should be_enabled } end describe apt('ppa:nginx/stable') do it { should exist } it { should be_enabled } end describe apt('ubuntu-wine/ppa') do it { should_not exist } it { shouldnot beenabled } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `be_enabled` matcher tests if a repository is enabled on the system: it { should be_enabled } The `exist` matcher tests if a repository exists on the system: it { should exist }
Project: StarRocks (App Definition and Development / Database)
File: DECIMAL.md

displayed_sidebar: "English" DECIMAL(P[,S]) High-precision fixed-point value. `P` stands for the total number of significant numbers (precision). `S` stands for the maximum number of decimal points (scale). If `P` is omitted, the default is 10. If `S` is omitted, the default is 0. Decimal V2 The range of `P` is [1,27] and the range of `S` is [0,9]. `P` must be greater than or equal to the value of `S`. The default value of `S` is 0. Fast Decimal (Decimal V3) The range of `P` is [1,38] and the range of `S` is [0, P]. The default value of `S` is 0. Fast Decimal provides a higher precision. Major optimizations: Fast Decimal uses variable-width integers to express decimals. For example, it uses 64-bit integers to express decimals whose precision is less than or equal to 18. Whereas, Decimal V2 uses 128-bit integers uniformly for all decimals. Arithmetic operations and conversion operations on 64-bit processors use fewer instructions, which greatly improves performance. Compared with Decimal V2, Fast Decimal made significant optimizations in some algorithms, especially in multiplication, which improves performance by about 4 times. Fast Decimal is controlled by the FE dynamic parameter `enabledecimalv3`, which is `true` by default. From v3.1 onwards, StarRocks supports Fast Decimal entries in , , and . StarRocks does not support querying DECIMAL data in ORC and Parquet files from Hive. Define DECIMAL columns when creating a table. ```sql CREATE TABLE decimalDemo ( pk BIGINT(20) NOT NULL COMMENT "", account DECIMAL(20,10) COMMENT "" ) ENGINE=OLAP DUPLICATE KEY(pk) COMMENT "OLAP" DISTRIBUTED BY HASH(pk); INSERT INTO decimalDemo VALUES (1,3.141592656), (2,21.638378), (3,4873.6293048479); SELECT * FROM decimalDemo; ++--+ | pk | account | ++--+ | 1 | 3.1415926560 | | 3 | 4873.6293048479 | | 2 | 21.6383780000 | ++--+ ``` decimal, decimalv2, decimalv3, fast decimal
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.149.md

layout: release date: 2023-09-27 tag: v0.6.149 fix: Remove useTheme from emotion react, and call theme as props @nebula-aac (#8948) Thank you to our contributors for making this release possible: @leecalcote, @nebula-aac and @theBeginner86
Project: Copa (Provisioning / Security & Compliance)
File: custom-address.md

title: Custom buildkit addresses If you need to specify a custom address using the `--addr` flag. Here are the supported formats: `unix:///path/to/buildkit.sock` - Connect to buildkit over unix socket. `tcp://$BUILDKIT_ADDR:$PORT` - Connect to buildkit over TCP. (not recommended for security reasons) `docker://<docker connection spec>` - Connect to docker, currently only unix sockets are supported, e.g. `docker://unix:///var/run/docker.sock` (or just `docker://`). `docker-container://my-buildkit-container` - Connect to a buildkitd running in a docker container. `buildx://my-builder` - Connect to a buildx builder (or `buildx://` for the currently selected builder). Note: only container-backed buildx instances are currently supported `nerdctl-container://my-container-name` - Similar to `docker-container` but uses `nerdctl`. `podman-container://my-container-name` - Similar to `docker-container` but uses `podman`. `ssh://myhost` - Connect to a buildkit instance over SSH. Format of the host spec should mimic the SSH command. `kubepod://mypod` - Connect to buildkit running in a Kubernetes pod. Can also specify kubectl context and pod namespace (`kubepod://mypod?context=foo&namespace=notdefault`). ```bash copa patch -i docker.io/library/nginx:1.21.6 -r nginx.1.21.6.json -t 1.21.6-patched ``` ```bash docker buildx create --name demo copa patch -i docker.io/library/nginx:1.21.6 -r nginx.1.21.6.json -t 1.21.6-patched --addr buildx://demo ``` ```bash export BUILDKIT_VERSION=v0.12.4 docker run \ --detach \ --rm \ --privileged \ --name buildkitd \ --entrypoint buildkitd \ "moby/buildkit:$BUILDKIT_VERSION" copa patch -i docker.io/library/nginx:1.21.6 -r nginx.1.21.6.json -t 1.21.6-patched --addr docker-container://buildkitd ``` ```bash export BUILDKIT_VERSION=v0.12.4 export BUILDKIT_PORT=8888 docker run \ --detach \ --rm \ --privileged \ -p 127.0.0.1:$BUILDKITPORT:$BUILDKITPORT/tcp \ --name buildkitd \ --entrypoint buildkitd \ "moby/buildkit:$BUILDKIT_VERSION" \ --addr tcp://0.0.0.0:$BUILDKIT_PORT copa patch \ -i docker.io/library/nginx:1.21.6 \ -r nginx.1.21.6.json \ -t 1.21.6-patched \ -a tcp://0.0.0.0:$BUILDKIT_PORT ```
Project: YugabyteDB (App Definition and Development / Database)
File: ddl_drop_foreign_table.md

title: DROP FOREIGN TABLE statement [YSQL] headerTitle: DROP FOREIGN TABLE linkTitle: DROP FOREIGN TABLE description: Use the DROP FOREIGN TABLE statement to drop a foreign table. menu: v2.18: identifier: ddldropforeign_table parent: statements type: docs Use the `DROP FOREIGN TABLE` command to remove a foreign table. The user who executes the command must be the owner of the foreign table. {{%ebnf%}} dropforeigntable {{%/ebnf%}} Drop a foreign table named table_name. If it doesnt exist in the database, an error will be thrown unless the `IF EXISTS` clause is used. `RESTRICT` is the default and it will not drop the foreign table if any objects depend on it. `CASCADE` will drop the foreign table and any objects that transitively depend on it. Drop the foreign-data table `mytable`, along with any objects that depend on it. ```plpgsql yugabyte=# DROP FOREIGN TABLE mytable CASCADE; ```
Project: Meshery (Provisioning / Automation & Configuration)
File: github-actions-runner-operator.md

layout: integration title: Github Actions Runner Operator subtitle: Collaborative and visual infrastructure as code for Github Actions Runner Operator image: /assets/img/integrations/github-actions-runner-operator/icons/color/github-actions-runner-operator-color.svg permalink: extensibility/integrations/github-actions-runner-operator docURL: https://docs.meshery.io/extensibility/integrations/github-actions-runner-operator description: integrations-category: App Definition and Development integrations-subcategory: Source Version Control registrant: Artifact Hub components: name: github-action-runner colorIcon: assets/img/integrations/github-actions-runner-operator/components/github-action-runner/icons/color/github-action-runner-color.svg whiteIcon: assets/img/integrations/github-actions-runner-operator/components/github-action-runner/icons/white/github-action-runner-white.svg description: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations
Project: YDB (App Definition and Development / Database)
File: bool_bit.md

Apply the relevant logical operation (`AND`/`OR`/`XOR`) to all values in a Boolean column or expression. These functions don't skip `NULL` during aggregation, with even one `NULL` turning the result into `NULL`. To skip `NULLs` during aggregation, you can use the functions `MIN`/`MAX` or `BITAND`/`BITOR`/`BIT_XOR`. Examples ```yql SELECT BOOLAND(boolcolumn), BOOLOR(boolcolumn), BOOLXOR(boolcolumn) FROM my_table; ``` Apply the relevant bitwise operation to all values of a numeric column or expression. Examples ```yql SELECT BITXOR(unsignednumeric_value) FROM my_table; ```
Project: KubeVela (App Definition and Development / Application Definition & Image Build)
File: export2secret.eg.md

```yaml apiVersion: core.oam.dev/v1beta1 kind: Application metadata: name: export-secret namespace: default spec: components: name: express-server-sec type: webservice properties: image: oamdev/hello-world port: 8000 workflow: steps: name: apply-server type: apply-component outputs: name: status valueFrom: output.status.conditions[0].message properties: component: express-server-sec name: export-secret type: export2secret inputs: from: status parameterKey: data.serverstatus properties: secretName: my-secret data: testkey: | testvalue value-line-2 ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: systemd.md

Run container in systemd mode. The default is true. true enables systemd mode only when the command executed inside the container is systemd, /usr/sbin/init, /sbin/init or /usr/local/sbin/init. false disables systemd mode. always enforces the systemd mode to be enabled. Running the container in systemd mode causes the following changes: Podman mounts tmpfs file systems on the following directories /run /run/lock /tmp /sys/fs/cgroup/systemd (on a cgroup v1 system) /var/lib/journal Podman sets the default stop signal to SIGRTMIN+3*. Podman sets container_uuid* environment variable in the container to the first 32 characters of the container ID. Podman does not mount virtual consoles (_/dev/tty\d+_) when running with --privileged*. On cgroup v2, /sys/fs/cgroup* is mounted writeable. This allows systemd to run in a confined container without any modifications. Note that on SELinux systems, systemd attempts to write to the cgroup file system. Containers writing to the cgroup file system are denied by default. The container_manage_cgroup boolean must be enabled for this to be allowed on an SELinux separated system. ``` setsebool -P containermanagecgroup true ```
Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: operator-sdk_alpha_generate.md

title: "operator-sdk alpha generate" Re-scaffold an existing Kuberbuilder project It's an experimental feature that has the purpose of re-scaffolding the whole project from the scratch using the current version of KubeBuilder binary available. $ kubebuilder alpha generate --input-dir="./test" --output-dir="./my-output" Then we will re-scaffold the project by Kubebuilder in the directory specified by 'output-dir'. ``` operator-sdk alpha generate [flags] ``` ``` -h, --help help for generate --input-dir string path to a Kubebuilder project file if not in the current working directory --output-dir string path to output the scaffolding. defaults a directory in the current working directory ``` ``` --plugins strings plugin keys to be used for this subcommand execution --verbose Enable verbose logging ``` - Alpha-stage subcommands
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.0-rc.5l.md

layout: release date: 2022-04-11 tag: v0.6.0-rc.5l language: en [Docker Extension] Proxy: remove unnecessary caps @leecalcote (#5369) [CI] Made changes to Makefile to enforce usage of go v1.17.8 @asubedy (#5367) [DDE] Setup Golang proxy for the UI to be able to communicate with Meshery Server @sudo-NithishKarthik (#5365) [Bug] - Fixed Upstream URL Issue @adithyaakrishna (#5359) potential fix for dde icon @warunicorn19 (#5358) dde_css @warunicorn19 (#5356) Update ADOPTERS.md @samirparhi-dev (#5353) [CI] Workflow DDE @leecalcote (#5351) Changed Description @hershd23 (#5350) small changes in dde @warunicorn19 (#5347) added browse in dde @warunicorn19 (#5343) [RJSF] Support Lazy loading of components tooltip in Exntension @Abhishek-kumar09 (#5363) Bump moment from 2.29.1 to 2.29.2 in /ui @dependabot (#5362) Bump @types/react-relay from 11.0.2 to 13.0.2 in /ui @dependabot (#5332) Bump babel-plugin-relay from 11.0.2 to 13.2.0 in /ui @dependabot (#5333) [CI] Use mesheryctl to start adapters in CI @gr455 (#5361) Bump moment from 2.29.1 to 2.29.2 in /ui @dependabot (#5362) Bump @types/react-relay from 11.0.2 to 13.0.2 in /ui @dependabot (#5332) Bump babel-plugin-relay from 11.0.2 to 13.2.0 in /ui @dependabot (#5333) Bump github.com/99designs/gqlgen from 0.17.1 to 0.17.2 @dependabot (#5324) [CI] Upgrade setup-go version @alphaX86 (#5354) [CI] Docker Extension for Meshery workflow @leecalcote (#5352) [CI] DDE: Fix release channel logic @leecalcote (#5349) Updated Contributing-gitflow(Readme) @Nandani-Paliwal (#5313) Thank you to our contributors for making this release possible: @Abhishek-kumar09, @Nandani-Paliwal, @adithyaakrishna, @alphaX86, @asubedy, @dependabot, @dependabot[bot], @gr455, @hershd23, @l5io, @leecalcote, @samirparhi-dev, @sudo-NithishKarthik and @warunicorn19
Project: Teleport (Provisioning / Security & Compliance)
File: postrelease.md

This checklist is to be run after cutting a release. Our GitHub Actions workflows will create two PRs when a release is published: A PR against the release branch that updates the default version in our docs. A PR that updates the AWS AMI IDs for the new release. (This job only runs for releases on the latest release branch) The AWS AMI ID PR can be merged right away. The docs version PR should be merged after the `gravitational/teleport-plugins` release is published, since the PR will include an update to the plugins version as well. [ ] Update support matrix in docs FAQ page Example: https://github.com/gravitational/teleport/pull/4602 [ ] Update the list of OCI images to monitor and rebuild nightly in and [ ] Update `e/.github/workflows/build-buildboxes-cron.yaml` to bump the branches on each job (two per job) and to comment out the final job that only exists for the pre-release, and bump the versions for the next release.