vania-janet/multiturn-rag-retrieval-data huggingface dataset:
}
],
"issues": [
"https://github.ibm.com/cocoa-test/e2e-compliance-incident-issues-20220331113709516/issues/6",
"https://github.ibm.com/cocoa-test/e2e-compliance-incident-issues-20220331113709516/issues/7",
"https://github.ibm.com/cocoa-test/e2e-compliance-incident-issues-20220331113709516/issues/8"
],
"tool": "owasp-zap-ui"
}
Show more

Where evidence_collection_subject is the repository_url for a repo scan and the artifactory_url for an image scan.







 v1 evidence summary 

The DevSecOps pipeline creates an evidence summary document. This document is based on evidence that is created during each of the continuous integration builds that deploy an image, and the evidence that is created during the deployment itself. The summary is created for the change request that is required to deploy any stage; it is also used by the Security and Compliance Center integration.

The format and fields of the evidence summary document are specified by using the typescript syntax:

interface Summary {
version: '1.0'; // schema version
date: string; // ISO-8601, UTC, ie. YYYY-MM-DDThh:mm:ssZ
toolchain_crn: string; // CRN of the toolchain that generated the summary
pipeline_id: string; // ID of the pipeline that generated the summary
pipeline_run_id: string; // ID of the pipeline run that generated the summary
evidences: Evidence[];
}



 Example 

{
"date": "23-43-2020 UTC",
"version": "1.0",
"pipeline_run_id": 12345, // this is the id of the CD pipeline that deploys in prod, not all data below may come from this pipeline
rm -rfv $2/
3. Push your app with the null buildpack that was modified to delete the cache by using the following command. After you complete this step, all contents in the cache directory of your app are deleted.

ibmcloud cf push appname -p app_path -b <modified_null_buildpack>
4. Push your app with the latest buildpack that you want to use by using the following command:

ibmcloud cf push appname -p app_path -b <latest_buildpack>







 The app continues to restart 

 What’s happening 

The app continues to crash and restart.

 Why it’s happening 

The app container lifecycle, such as evacuation and shut down, can impact your app functions.

 How to fix it 

Identify which step of the app container lifecycle is causing errors in app deployment. Learn more about the [Cloud Foundry app lifecycle](https://docs.cloudfoundry.org/devguide/deploy-apps/app-lifecycle.htmlevacuation).





 The Actions button on the Instance Details page is disabled (Deprecated) 

 What’s happening 

The Actions button on the Instance Details page is unavailable.

 Why it’s happening 

This problem occurs for the following reasons:



* The app isn't deployed with the embedded Liberty buildpack.
* The app was deployed with an early version of Liberty buildpack.



 How to fix it 

If the problem is caused by an early version of Liberty buildpack, redeploy the app in IBM Cloud. Otherwise, you can provide the following client app log files to the support team:



* logs/messages.log
* logs/stdout.log
* logs/stderr.log







 Credentials are required to open a trace or memory dump window (Deprecated) 

 What’s happening 

A user name and password are required to open the trace or memory dump window.

 Why it’s happening 

This problem occurs because of the login session timeout.

 How to fix it 

Enter the user name and password again.





 Error occurs when trace or memory dump operations are running (Deprecated)
Redeploy your app and reference the debug-pvc. Alternatively, you can use the following sample pod.

apiVersion: v1
kind: Pod
metadata:
name: debug-pod
spec:
volumes:
- name: nginx
persistentVolumeClaim:
claimName: cos-debug
containers:
- name: nginx
image: nginx
volumeMounts:
- mountPath: /debug
name: nginx
4. Save the following DaemonSet configuration file as inspectnode-ds.yaml. After you deploy an app that references the PVC that you created earlier, deploy the DaemonSet when the Transport endpoint is not connected. error occurs to gather the logs.

apiVersion: apps/v1
kind: DaemonSet
metadata:
namespace: default
name: ibm-inspectnode
labels:
app: ibm-inspectnode
spec:
selector:
matchLabels:
app: ibm-inspectnode
updateStrategy:
type: RollingUpdate
template:
metadata:
labels:
app: ibm-inspectnode
spec:
tolerations:
- operator: "Exists"
hostNetwork: true
containers:
- name: inspectnode
image: alpine:latest
command: ["/bin/sh"]
args: ["-c", "while true; do msg=$(date); echo $msg; sleep 30; done"]
securityContext:
runAsUser: 0
volumeMounts:
- mountPath: /host/var/log
name: host-log
volumes:
- name: host-log
hostPath:
path: /var/log
Show more
5. Create the DaemonSet in your cluster when the Transport endpoint is not connected. error occurs.

kubectl create -f ./inspectnode-ds.yaml
6.
Dallas qsc.us-south.kms.cloud.ibm.com 
 London qsc.eu-gb.kms.cloud.ibm.com 
 Frankfurt qsc.eu-de.kms.cloud.ibm.com 



The classic Key Protect service endpoints are not quantum safe enabled.







 Configure Quantum Safe TLS with Key Protect via the SDK 



 Prerequisites 

Before setting up your application to work with the SDK, follow these steps:



1. Download the [Open Quantum Safe Software Stack (OQSSA) script](https://github.com/IBM/oqssa/blob/master/build-oqssa.sh). This script will build and install all necessary dependencies ( liboqs, openssl, and libcurl) into your HOME directory folder ( $HOME/opt/oqssa/).
2. Make sure dependent packages required for building OQSSA are installed. You will need sudo permissions in order to install the dependency packages.



* Debian (Ubuntu) dependencies: libtool automake autoconf cmake (3.5 or above) make openssl libssl-dev build-essential git wget golang (1.14 or above) patch perl diffutils



If you are using a Debian distribution, copy the following code snippet to a file and execute it to verify that all necessary packages have been installed:

echo "Starting prerequisites verification"
CMAKE_VER_REQUIRED="3."
packages="libtool automake autoconf cmake make openssl libssl-dev git wget build-essential golang patch perl diffutils"
for REQUIRED_PKG in $packages
do
PKG_STATUS=$(dpkg-query -W --showformat='${Version},${Status}n' $REQUIRED_PKG|grep "install ok installed")
if [ "" = "$PKG_STATUS" ]
then
echo "$REQUIRED_PKG is NOT installed"
When you set up IBM Cloud Monitoring alerts, take the following scenarios into consideration.



* A NetworkUnavailable alert might become a problem when a calico-node pod fails to achieve a Running state, and its container restart count continues to increase.
* A worker node remains in NetworkUnavailable state for a long amount of time.



After a worker update or replace, sometimes the calico-node pod still does not start on Red Hat OpenShift VPC Cluster. The calico_node pod might get stuck in a state where it is unable to start on a Red Hat OpenShift VPC cluster. This is not an issue on IKS or Classic clusters. This can occur when you have the sysdig-admission-controller-webhook installed and try to do a worker update or replace. This happens because:



1. The VPN client pod gets moved to the new worker as it is starting.
2. calico-node on the new worker starts up, but gets stuck because it makes an apiserver call and times out after 2 seconds.
3. The apiserver call then tries to call the webhook which fails because the VPN client pod was trying to start on the new node. The VPN node cannot successfully do so because calico-node hasn't started up yet.



In summary, the calico-node pod startup depends on the webhook working; the webhook depends on the VPN client pod; and the VPN client pod depends on calico-node starting up. The system is stuck in a circular dependency. If you are able to gather logs from a successfully deployed calico-node pod, you might see an error like this:

2022-09-08 07:13:19.719 [WARNING] startup/utils.go 228: Failed to set NetworkUnavailable; will retry error=Patch "https://172.21.0.1:443/api/v1/nodes/10.242.64.17/status?timeout=2s": net/http: request canceled (Client.Timeout exceeded while awaiting headers)



 Workarounds for calico-node
cocoa change-request close 

Closes a Change Request through the ServiceNow API. You can attach 'close notes' by using the --close-notes option and specify the 'close category' using the --close-category option.

Options:

--close-category Choices: "successful" (default), "successful_issues", "unsuccessful", "cancelled"
--close-notes String, defaults to "Deployment done."
--provider (Optional) Change Management service provider (choices: 'servicenow', 'servicenow-v3', default: 'servicenow')

Required Environment Variables regardless of the provider:

CHANGE_REQUEST_ID= ID of the Change Request

Required Environment Variables, if you are using ServiceNow v1 or v2 provider:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables, if you are using ServiceNow v3 provider:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

cocoa change-request close





 cocoa change-request check-approval 

Queries the approval status of a change request. If the Change Request is an emergency, the command does not fail but prompts for a retroactive approval.

Options:

--provider (Optional) Change Management service provider (choices: 'servicenow', 'servicenow-v3', default: 'servicenow')

Required Environment Variables regardless of the provider:

CHANGE_REQUEST_ID= ID of the Change Request

Required Environment Variables, if you are using ServiceNow v1 or v2 provider:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables, if you are using ServiceNow v3 provider:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

cocoa change-request check-approval





 cocoa change-request prepare
oc get pods -n openshift-storage

Example output

NAME READY STATUS RESTARTS AGE
csi-cephfsplugin-9g2d5 3/3 Running 0 8m11s
csi-cephfsplugin-g42wv 3/3 Running 0 8m11s
csi-cephfsplugin-provisioner-7b89766c86-l68sr 5/5 Running 0 8m10s
csi-cephfsplugin-provisioner-7b89766c86-nkmkf 5/5 Running 0 8m10s
csi-cephfsplugin-rlhzv 3/3 Running 0 8m11s
csi-rbdplugin-8dmxc 3/3 Running 0 8m12s
csi-rbdplugin-f8c4c 3/3 Running 0 8m12s
csi-rbdplugin-nkzcd 3/3 Running 0 8m12s
csi-rbdplugin-provisioner-75596f49bd-7mk5g 5/5 Running 0 8m12s
csi-rbdplugin-provisioner-75596f49bd-r2p6g 5/5 Running 0 8m12s
noobaa-core-0 1/1 Running 0 4m37s
noobaa-db-0 1/1 Running 0 4m37s
noobaa-endpoint-7d959fd6fb-dr5x4 1/1 Running 0 2m27s
noobaa-operator-6cbf8c484c-fpwtt 1/1 Running 0 9m41s
ocs-operator-9d6457dff-c4xhh 1/1 Running 0 9m42s
rook-ceph-crashcollector-169.48.170.83-89f6d7dfb-gsglz 1/1 Running 0 5m38s
rook-ceph-crashcollector-169.48.170.88-6f58d6489-b9j49 1/1 Running 0 5m29s
If restarting your pod does not resolve the issue, [reload your worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload).
3. Verify that you use the latest IBM Cloud and IBM Cloud Kubernetes Service plug-in version.

ibmcloud update

ibmcloud plugin repo-plugins

ibmcloud plugin update







 Verifying that the storage driver and plug-in pods show a status of Running 

Follow the steps to check the status of your storage driver and plug-in pods and review any error messages.



1. List the pods in the kube-system namespace.

kubectl get pods -n kube-system
2. If the storage driver and plug-in pods don't show a Running status, get more details of the pod to find the root cause. Depending on the status of your pod, the following commands might fail.



1. Get the names of the containers that run in the driver pod.

kubectl describe pod <pod_name> -n kube-system
2. Export the logs from the driver pod to a logs.txt file on your local machine.

kubectl logs <pod_name> -n kube-system > logs.txt
3. Review the log file.

cat logs.txt



3. Check the latest logs for any error messages. [Review the File Storage for Classic troubleshooting documentation for steps to resolve common errors](https://cloud.ibm.com/docs/containers?topic=containers-cs_sitemapsitemap_file_storage).







 Checking whether your PVC is successfully provisioned. 

Follow the steps to check the status of your PVC and review any error messages.



1. Check the status of your PVC. A PVC is successfully provisioned if the PVC shows a status of Bound.

kubectl get pvc



* If the PVC shows a status of Bound, the PVC is successfully provisioned.

Example output
OS name: "linux", version: "5.15.49-linuxkit", arch: "amd64", family: "unix"

 gradle -version

Welcome to Gradle 7.5.1!

Here are the highlights of this release:
- Support for Java 18
- Support for building with Groovy 4
- Much more responsive continuous builds
- Improved diagnostics for dependency resolution

For more details see https://docs.gradle.org/7.5.1/release-notes.html

------------------------------------------------------------
Gradle 7.5.1
------------------------------------------------------------

Build time: 2022-08-05 21:17:56 UTC
Revision: d1daa0cbf1a0103000b71484e1dbfe096e095918

Kotlin: 1.6.21
Groovy: 3.0.10
Ant: Apache Ant(TM) version 1.10.11 compiled on July 10 2021
JVM: 17.0.5 (Eclipse OpenJ9 openj9-0.35.0)
OS: Linux 5.15.49-linuxkit amd64

 oc version
Client Version: 4.11.12
Kustomize Version: v4.5.4

 zip
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.

 unzip
UnZip 6.00 of 20 April 2009, by Info-ZIP. Maintained by C. Spieler. Send
* Review the [1.25 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_125).
* Review the [Migrating from PSPs to Pod Security Admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migration) guide.



If you are not ready to migrate to Pod Security Admission, you can clear the status message by performing a cluster master refresh.

 How to fix it 

If you already performed the Pod Security Admission upgrade prerequisite actions, the error message indicates an action that you might have missed or an unexpected change to IBM Cloud Kubernetes Service defined resources that you need to address. Complete the following steps based on the message you are seeing.



 Could not get PodSecurityPolicies 



1. Run the following to command to get your PSPs.

kubectl get podsecuritypolicies
2. If there is no error, try again to upgrade the cluster master.







 Found non-IBM PodSecurityPolicy 

There are additional PSPs that need to be removed.

Before you upgrade your cluster to version 1.25, verify that only the following PSPs exist.



* ibm-privileged-psp
* ibm-anyuid-psp
* ibm-anyuid-hostpath-psp
* ibm-anyuid-hostaccess-psp
* ibm-restricted-psp





1. List your PSPs.

kubectl get podsecuritypolicies
2. If the additional PodSecurityPolicy is no longer in use, delete it. If there are additional pod security policies, [review the migration guide](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migration).

kubectl delete podsecuritypolicies PSP
3. Retry the cluster upgrade.







 Could not get ClusterRoleBinding privileged-psp-user
For 1.25 and later pod-security.admission.config.k8s.io/v1 is preferred, but the v1beta API version can still be used.



1. Create a YAML file containing a PodSecurityConfiguration resource. You can use the default configuration to start.

apiVersion: pod-security.admission.config.k8s.io/v1
kind: PodSecurityConfiguration
defaults:
enforce: "privileged"
enforce-version: "latest"
audit: "privileged"
audit-version: "latest"
warn: "privileged"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces: []
2. Make the customizations that you want to use. Review the following the information about each section of the configuration. defaults : The defaults section of the configuration defines cluster-wide defaults for namespaces that do not have pod security labels. The fields can have the same values as the corresponding namespace labels.

exemptions
: The exemptions section of the configuration allows you to create pods that are otherwise prohibited because of the policy associated with a specific namespace. Exemption dimensions include the following cases.



* Usernames: Requests from users with an exempt authenticated (or impersonated) username are ignored. Usernames are typically IAM users or service accounts. For example usernames: [ "IAMuser@example.com" ]. You can also exempt the username associated with an admin kubeconfig client certificate. If you want to specify an admin kubeconfig certificate, the username is the CN component of the current client-certificate.

kubectl config view --minify -o jsonpath='{.users[0].user.client-certificate}'
/home/user/.bluemix/plugins/container-service/clusters/mycluster-cheku1620qbs90gq6mdg-admin/admin.pem
Because the Calico IPAM detects no available IP addresses, it does not assign IP addresses to new pods in the cluster, and pods can't start.

 How to fix it 



 Fixing registry quota issues 

Virtual Private Cloud

Classic infrastructure

To fix registry quota issues, [free up storage in IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_quotaregistry_quota_freeup).





 Fixing IP address issues 

Virtual Private Cloud

Classic infrastructure

To fix IP address issues, release individual and blocks of IP addresses that were not cleanly removed from the Calico IPAM records so that they can be reused by pods in your cluster.

Your cluster must run a [supported version](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionscs_versions_available). If your cluster runs a deprecated or unsupported version, first [update your cluster](https://cloud.ibm.com/docs/containers?topic=containers-update).



 Step 1: Releasing individual IP addresses 

First, check for and release individual IP addresses that were not cleanly removed from the Calico IPAM records so that they can be reused by pods in your cluster.



1. Follow the steps in [Installing and configuring the Calico CLI](https://cloud.ibm.com/docs/containers?topic=containers-network_policiescli_install) to download version 3.18 or later of the calicoctl client, use the correct Calico configuration for your cluster, and verify that the Calico configuration is working correctly for your targeted cluster. Note that even if your cluster runs an older version of Calico, you can still use calicoctl version 3.18 to run the commands in the following steps.

If you recently updated your classic cluster from Kubernetes version 1.18 to 1.19, the cluster uses the KDD datastore for Calico. Ensure that you follow the steps for 1.19 clusters to set the DATASTORE_TYPE environment variable to kubernetes and the KUBECONFIG environment variable to the kube-config file for your cluster.
! ! ! . * You cannot upload CSV files that include a space in the file name (for example: file 1.csv) to a Content Mining project. Rename the file to work around the issue. * When performing Project level relevancy training, if you have multiple collections, and two or more of those collections contains a duplicate document_id, then project level relevancy training will fail. Example of duplicate document_ids: Collection A contains a document with the id of 1234, and Collection B also contains a document with the id of 1234. * Only the first facet using a field with the prefix extracted_metadata is saved correctly after creation. Others with that prefix will appear but after a screen refresh will be gone. This only happens once per project, so the workaround is to refresh and add the facet again. IBM Cloud Pak for Data

During installation on IBM Cloud Pak® for Data 2.5.0.0, some Kubernetes Jobs may incorrectly report their status as OOMKilled, causing the install to timeout. To resolve this, once a Job returns OOMKilled verify the logs of the Pod associated with that Job. There should be no obvious error messages in the logs and the resources are reported in the logs as created. Manually verify these resources exist in the namespace and then delete the Job. This will cause the install to continue.
* Some documents may show two html fields when applying an enrichment. Both html fields shown are the same and operate as such. * When creating a data source in Firefox, you may not see the entire list of options, including the More processing settings settings. To work around the issue, zoom out, increase the browser height, or use another supported browser. * When customizing the display of search results, the changes made sometimes do not save after clicking the Apply button. To work around this issue, refresh the browser and try to make the changes again. * When setting up a data source or web crawler for your collection, if you enter an incorrect configuration, then try to update it on the Processing settings page, the data source update or crawl may not start when you click the Apply changes and reprocess button.
OS name: "linux", version: "6.3.6-200.fc38.aarch64", arch: "amd64", family: "unix"

 gradle

Welcome to Gradle 8.1.1!

Here are the highlights of this release:
- Stable configuration cache
- Experimental Kotlin DSL assignment syntax
- Building with Java 20

For more details see https://docs.gradle.org/8.1.1/release-notes.html

------------------------------------------------------------
Gradle 8.1.1
------------------------------------------------------------

Build time: 2023-04-21 12:31:26 UTC
Revision: 1cf537a851c635c364a4214885f8b9798051175b

Kotlin: 1.8.10
Groovy: 3.0.15
Ant: Apache Ant(TM) version 1.10.11 compiled on July 10 2021
JVM: 11.0.19 (Eclipse OpenJ9 openj9-0.38.0)
OS: Linux 6.3.6-200.fc38.aarch64 amd64

 oc
4.13.2

 zip
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.

 unzip
UnZip 6.00 of 20 April 2009, by Debian. Original by Info-ZIP.

 git
git version 2.41.0

 curl
OS name: "linux", version: "5.10.104-linuxkit", arch: "amd64", family: "unix"

 gradle -version

Welcome to Gradle 7.5.1!

Here are the highlights of this release:
- Support for Java 18
- Support for building with Groovy 4
- Much more responsive continuous builds
- Improved diagnostics for dependency resolution

For more details see https://docs.gradle.org/7.5.1/release-notes.html

------------------------------------------------------------
Gradle 7.5.1
------------------------------------------------------------

Build time: 2022-08-05 21:17:56 UTC
Revision: d1daa0cbf1a0103000b71484e1dbfe096e095918

Kotlin: 1.6.21
Groovy: 3.0.10
Ant: Apache Ant(TM) version 1.10.11 compiled on July 10 2021
JVM: 17.0.3 (Eclipse OpenJ9 openj9-0.32.0)
OS: Linux 5.10.104-linuxkit amd64

 oc version
Client Version: 4.11.0
Kustomize Version: v4.5.4

 zip
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.

 unzip
UnZip 6.00 of 20 April 2009, by Info-ZIP. Maintained by C. Spieler. Send
container-registry 0.1.391
container-service/kubernetes-service 0.3.47
doi 0.1.2

 java -version
openjdk version "1.8.0_212"
OpenJDK Runtime Environment (build 1.8.0_212-8u212-b03-0ubuntu1.16.04.1-b03)
OpenJDK 64-Bit Server VM (build 25.212-b03, mixed mode)

 ant -version
Apache Ant(TM) version 1.10.6 compiled on May 2 2019

 mvn -version
Apache Maven 3.6.1 (d66c9c0b3152b2e69ee9bac180bb8fcc8e6af555; 2019-04-04T19:00:29Z)
Maven home: /opt/IBM/maven
Java version: 1.8.0_212, vendor: Oracle Corporation, runtime: /usr/lib/jvm/java-8-openjdk-amd64/jre
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "4.4.0-141-generic", arch: "amd64", family: "unix"

 gradle -version

Welcome to Gradle 5.4.1!

Here are the highlights of this release:
- Run builds with JDK12
- New API for Incremental Tasks
- Updates to native projects, including Swift 5 support

For more details see https://docs.gradle.org/5.4.1/release-notes.html

------------------------------------------------------------
Gradle 5.4.1