vania-janet/multiturn-rag-retrieval-data huggingface dataset:
rule-c4d50b06-9331-4f5c-a3f8-9fe8060efc9b - Check whether Security Groups for VPC doesn't allow PING for the default security group
rule-936158a6-40ff-48ca-91a1-f184aa9b0dff - Check whether Virtual Private Cloud (VPC) classic access is disabled
rule-64c0bea0-8760-4a6b-a56c-ee375a48961e - Check whether Virtual Private Cloud (VPC) has no public gateways attached
rule-64e628f7-4f3a-4c0e-85a4-40300bafe856 - Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port
rule-f9137be8-2490-4afb-8cd5-a201cb167eb2 - Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to SSH port
rule-f1e80ee7-88d5-4bf2-b42f-c863bb24601c - Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to RDP port
rule-faacfd1f-454f-4e60-95d7-8fe01158840d - Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port
rule-c0314fad-f377-465e-9f16-fa5aa3d5ebbe - Check whether Virtual Servers for VPC instance has the minimum interfaces
rule-17b54156-373a-48f9-b340-a7e47acd87b6 - Check whether Virtual Servers for VPC instance doesn't have a floating IP
After you create rules, you can [update](https://cloud.ibm.com/apidocs/context-based-restrictionsreplace-rule) and [delete](https://cloud.ibm.com/apidocs/context-based-restrictionsdelete-rule) them.





 Creating network rules by using the CBR UI 

After you complete the prerequisites, you can create zones in the UI. For more information about the steps to follow, see [Creating context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uinetwork-zones-create).

You can use the CBR UI to [add resources and contexts](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uicontext-restrictions-create-rules) to your network rules.

Unlike IAM policies, context-based restrictions do not assign access. Context-based restrictions check that an access request comes from an allowed context that you configure. Also, the rules might not take effect immediately due to synchronization and resource availability.

After you create rules, you can [update](https://cloud.ibm.com/apidocs/context-based-restrictionsreplace-rule) and [delete](https://cloud.ibm.com/apidocs/context-based-restrictionsdelete-rule) them.







 Next steps 

You must follow the creation or modification of zones or rules with adequate testing to ensure access and Schematics service availability.
Create one rule for each [control plane CIDR for the region where your cluster is located](https://github.com/IBM-Cloud/kube-samples/tree/master/control-plane-ips) Allow TCP Each [control plane CIDR for the region where your cluster is located](https://github.com/IBM-Cloud/kube-samples/tree/master/control-plane-ips) <br><br> * <br><br><br> Any 80 After 5 
 Deny all other traffic that does not match the previous rules. Deny ALL Any <br><br> * <br><br><br> Any <br><br> * <br><br><br> Set to bottom 



* Alternatively, to allow the inbound traffic for ALB health checks, you can create a single inbound rule and outbound rule to allow all incoming and outgoing traffic on port 80.
6. In the Outbound rules section, create the following rules by clicking Create.

ACL rules are applied to traffic in a specific order. If you must create custom rules to allow other traffic to or from your worker nodes on this subnet, be sure to set the custom rules' Priority before the final rule that denies all traffic. If you add a rule after the deny rule, your rule is ignored, because the packet matches the deny rule and is blocked and removed before it can reach your rule. Note that these steps outline the minimum ACL rules that are required for basic cluster functionality. You might need to create additional ACL rules based on your use case.



Table 6. Required outbound rules

 Rule purpose Allow/Deny Protocol Source IP or CIDR Source Port Destination IP or CIDR Destination Port Priority 

 Allow worker nodes to be created in your cluster. Allow ALL Any <br><br> * <br><br><br> 161.26.0.0/16 <br><br> * <br><br><br> Set to top 
 Allow worker nodes to communicate with other IBM Cloud services that support private cloud service endpoints, and in clusters that run Kubernetes version 1.19 or earlier, with the cluster master through the private cloud service endpoint.
"priority": 100,
"paused": false,
"description": "do not challenge login from office"
}
-s, --json-str: Deprecated. The JSON data describing a firewall-rule.-j, --json-file: Deprecated. A file contains input JSON data.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-create-a-firewall-rule-options" "> --><-- <section "id="section-create-a-firewall-rule-examples" "> --> Examples Create a firewall-rule in domain 372e67954025e0ba6aaa6d586b9e0b60. ibmcloud cis firewall-rule-create 31984fea73a15b45779fa0df4ef62f9b --expression "ip.src eq 93.184.216.1 and http.request.uri.path "^./wp-login.php$"" --action allow --priority 200 --paused off --description "do not challenge login from office" -i "cis-demo"

ibmcloud cis firewall-rule-create 31984fea73a15b45779fa0df4ef62f9b --json '{"expression": "ip.src eq 93.184.216.1 and http.request.uri.path "^./wp-login.php$"", "action": "allow", "priority": 100, "paused": false, "description": "do not challenge login from office"}' -i "cis-demo"
You can create zones and rules by using a RESTful [API](https://cloud.ibm.com/apidocs/context-based-restrictionsintroduction) or with [context-based restrictions](https://cloud.ibm.com/context-based-restrictions/overview). After you create or update a zone or a rule, it might take a few minutes for the change to take effect.

CBR rules do not apply to provisioning or deprovision processes.





 Limitations 

When a user has instance level IAM access, CBR rules that are applied to specific secret groups do not take effect. To work around this limitation, set the user's IAM access policies to only secret groups.

Context-based restrictions protect only the actions that are associated with the [Secrets Manager API](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2). Actions that are associated with the following platform APIs are not protected by context-based restrictions. Refer to the API docs for the specific action IDs.



* [Resource Instance APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-instances)
* [Resource Keys APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-keys)
* [Resource Bindings APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-bindings)
* [Resource Aliases APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-aliases)
* [IAM Policy APIs](https://cloud.ibm.com/apidocs/iam-policy-managementlist-policies)
* [Global Search APIs](https://cloud.ibm.com/apidocs/search)
* The Administration functions for the service instance itself (for example the IBM Cloud CLI service-instance-create, service-instance-delete or service-instance-update commands, or equivalent) are not under the scope of the context-based restrictions rules that are created against an Event Streams instance.





 Managing context-based restrictions settings 

Creating context-based restrictions rules is a two-step process:



1. Create a network zone with list of allowed IP addresses, allowed VPCs, or reference a service. For more information, see [Creating network zones](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-createnetwork-zones-create).
2. Create rules that specify one or more network zones against the Event Streams resource. For more information about rule creation, see [Creating rules](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uicontext-restrictions-create-rules).



Next, note the following considerations:



* You must be the account owner or have an access policy with the administrator role on all account management services to restrict access.
* After creating or updating a zone or a rule, it can take a few minutes for the change to take effect.







 Supporting connections between services (service-to-service) with context-based restrictions 

If an Event Streams service instance is configured to use [customer-managed encryption](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryption), the service must also be granted the ability to connect to the selected IBM Key Management Services.

The administrator of the account can set this up as follows:



1. Add a service reference for the Event Streams service to the required network zone.
2. Ensure that access from this zone is permitted by way of the context-based restrictions rules applicable to other Cloud services.



For more information about service reference creation, see [Service references](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatisservice-attribute).





 Coexistence of context-based restrictions rules and private IP allowlists
You must configure the required VLAN interfaces and IP addresses to the devices as well as firewall zones, rules, and policies.
3. If you route your management VLAN through the firewall, you can also secure your management workloads, such as vCenter and NSX-T managers. Ensure that you allow the traffic for your management.
4. Your workload T0 is attached to IBM Cloud private network. If you route this VLAN through the firewall, add the required rules on both the firewall and T0.
5. Your workload T0 is attached to IBM Cloud public network. If you route this VLAN through the firewall, add the required rules on both the firewall and T0.
6. Alter the automation deployed routes if you need to customize the routing behavior, or establish dynamic routing between your T0 and the third-party device.







 Deploying third-party router or firewall in converged or management clusters 

When you deploy a vCenter Server instance in your IBM Cloud classic infrastructure, you might optionally deploy a Juniper vSRX or host a third-party router or firewall on the converged or management clusters. You can integrate the firewall with your overlay topology in multiple ways, by using the VLAN or NSX-T overlay, if your firewall supports this.

In this pattern, you are not able to control which VLANs are routed through the router or firewall running on the firewall.

Zoom

![Deploying third-party router or firewall in converged or management clusters](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/arch-pattern-nsx-t-3rd-party.svg)

Figure 2. Deploying third-party router or firewall in converged or management clusters

This architecture pattern deployment is summarized as follows:



1. Depending on the network preference selection, your vCenter Server instance is deployed with both public and private connectivity or private connectivity only.
2.
Implementation 'com.ibm.mobilefirstplatform.clientsdk.android:core:3.+'
.......
}

// with this

dependencies {
........
implementation platform('com.google.firebase:firebase-bom:29.0.0')
implementation 'com.google.firebase:firebase-messaging'
implementation 'com.ibm.cloud:sdk-core:9.15.0'
implementation 'com.ibm.cloud:eventnotifications-destination-android:0.0.1'
.......
}
Show more



1. Open AndroidManifest.xml and change the following elements:



* Change the <service> section to refer to the new service

// Replace the below section

<service android:name="com.ibm.mobilefirstplatform.clientsdk.android.push.api.MFPPushIntentService" android:exported="true" >
<intent-filter>
<action android:name="com.google.firebase.MESSAGING_EVENT" />
</intent-filter>
</service>

<service
android:name="com.ibm.mobilefirstplatform.clientsdk.android.push.api.MFPPush" android:exported="true" >
<intent-filter>
<action android:name="com.google.firebase.INSTANCE_ID_EVENT" />
</intent-filter>
</service>

// with this

<service android:name="com.ibm.cloud.eventnotifications.destination.android.ENPushIntentService" android:exported="true">
<intent-filter>
<action android:name="com.google.firebase.MESSAGING_EVENT" />
</intent-filter>
</service>

<service android:name="com.ibm.cloud.eventnotifications.destination.android.ENPush" android:exported="true" >
[Project setting](https://cloud.ibm.com/docs-content/v1/content/4c9a07fe500838e5e55e71e73131ef20b44a6c66/event-notifications/images/en-migration-firebase-setting.png)

Figure 5. Project setting
4. Find an app with package name com.ibm.mobilefirstplatform.clientsdk.android.push and click Remove this app.
5. Click Add app > Choose Android
6. Enter com.ibm.cloud.eventnotifications.destination.android as the package name and click Register App.

Zoom

![Register app](https://cloud.ibm.com/docs-content/v1/content/4c9a07fe500838e5e55e71e73131ef20b44a6c66/event-notifications/images/en-migration-firebase-addapp.png)

Figure 6. Register app
7. Download google-services.json. You use this file later when you modify the app.







 Edit the Android app 



1. Add the Firebase google-services.json in the app module.
2. Change the Module’s build.gradlefileto include the new SDKs.



// Replace the below section

dependencies {
........
implementation 'com.google.firebase:firebase-messaging:20.0.0'
Implementation 'com.ibm.mobilefirstplatform.clientsdk.android:core:3.+'
.......
}

// with this

dependencies {
........
implementation platform('com.google.firebase:firebase-bom:29.0.0')
implementation 'com.google.firebase:firebase-messaging'
implementation 'com.ibm.cloud:sdk-core:9.15.0'
Java 

As a standard bearer for enterprise application development and the native application language for Android, Java is a key language to support for your IBM Cloud service.



  Content 



  Methods 

Method parameters MUST be encapsulated into an “options” object that can be constructed with a "Builder".





  Streaming 

The SDK SHOULD accept parameters with potentially large memory requirements as InputStream values, to allow the value to be streamed to the service.







  Style guidelines 

For services that support both a traditional Java SDK and an Android SDK, the Java SDK SHOULD be designed to be Android compatible, to minimize duplication of code.

You should follow a coding style based on the [Google Java Style Guide](https://google.github.io/styleguide/javaguide.html).

You should use the standard [development tools](https://cloud.ibm.com/docs/sdk-handbook?topic=sdk-handbook-devtools) for Java to check style and code coverage.





  Documentation 

Your SDK is not useful if your audience cannot understand how to consume it in order to do the basic operations for your service. Your SDK needs to contain the following resources to help your users:



*  README.md
*  [Contributor guidelines](https://cloud.ibm.com/docs/sdk-handbook?topic=sdk-handbook-documentationsdk-contributor-docs)
*  Code Samples
*  [Service documentation](https://cloud.ibm.com/docs/sdk-handbook?topic=sdk-handbook-documentation)







  Distribution 



  Package management 

Official SDK releases MUST be published in [Maven Central](https://search.maven.org/).
Combined with robust automation, they allow engineers to make high-impact changes frequently and predictably, with minimal toil.”



So a "cloud-native" app isn't just an "app". It's a set of processes and best practices that also go along with it. The transformation of the development processes is critical. The "development ecosystem" is quickly learning the best ways to deliver software, and that is an important part of the latest app creation process.

So let's overview the important points about cloud-native apps:



* Apps are highly connected with various technologies and architectures, such as containers, container orchestration, microservices, and declarative APIs.
* Apps are built to run on modern infrastructures, typically "clouds". The cloud can be an external cloud vendor, or your own internal cloud environment.
* Building cloud-native apps is critically a practice and philosophy, not just a technology choice - it's about changing the way software is delivered in a DevOps and automation culture.
* They represent the dynamic and distributed nature of computing today, and the need for increased deployment speed, flexibility, agility, scalability, reliability, and security.







 12 Factor App 

As explained by the original concept creator:

Twelve Factor apps are built for agility and rapid deployment, enabling continuous delivery and reducing the time and cost for new developers to join a project. They are designed to use the principles of modern cloud platforms while permitting maximum portability between projects. Finally, they can scale up without significant changes to tooling, architecture, or development practices

The 12 factor apps check-list is a set of guidelines that dictate how an app is built to properly support the concept of independently-managed and iterated services.

The [12 factors website](https://12factor.net) describes the 12 factors as:



1. One codebase tracked in revision control, many deployments.
2. Explicitly declare and isolate dependencies.
3. Store configuration in the environment.
4. Treat backing services as attached resources.
5. Strictly separate build and run stages.
6. Run the app as one or more stateless processes.
7.
[Android SDK](https://github.com/IBM/appconfiguration-android-client-sdk) <br>[Documentation](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-integrate-sdks-android) <br>[JavaScript SDK](https://github.com/IBM/appconfiguration-js-client-sdk) <br>[Documentation](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-javascript) <br>[React SDK](https://github.com/IBM/appconfiguration-react-client-sdk) <br>[Documentation](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-react) 
 Admin SDK Admin SDK is designed to perform App Configuration service instance management. Use this SDK to create and manage App Configuration resources like Collections, Environments, Feature flags, and Properties. [App Configuration Admin SDK for Go](https://cloud.ibm.com/apidocs/app-configuration?code=go) 



For more information about installation and technical concepts, see the 'readme file' document in the SDK.

You can also access these documents and download the SDKs from the App Configuration console under SDKs on the navigation menu.
In the defaultConfig section, configure the redirect scheme.

defaultConfig {
...
manifestPlaceholders = ['appIdRedirectScheme': android.defaultConfig.applicationId]
}



4. Synchronize your project with Gradle. Click Tools > Android > Sync Project with Gradle Files.







 Initializing the SDK 



1. Pass the context, tenant ID, and region parameters to the initialize method to configure the SDK.

A common, though not mandatory, place to put the initialization code is in the onCreate method of the main activity in your Android application.

AppID.getInstance().initialize(getApplicationContext(), <tenantID>, <region>);









 Authenticating with the iOS Swift SDK 

Protect your mobile applications by using the App ID client SDK.



 Before you begin 

You must have the following prerequisites before you get started:



* Xcode 9.0 or higher
* CocoaPods 1.1.0 or higher
* iOS 10.0 or higher







 Installing the SDK 

The App ID client SDK is distributed with CocoaPods, a dependency manager for Swift and Objective-C Cocoa projects. CocoaPods downloads artifacts, and makes them available to your project.



1. Create an Xcode project or open an existing one.
2. Create a new or open your existing Podfile in the project's directory.
3. Add the IBMCloudAppID pod and use_frameworks! command to your target's dependencies

target '<yourTarget>' do
use_frameworks!
pod 'IBMCloudAppID'
end
4. Install your dependencies from the command line within your project directory.

pod install --repo-update
5. After installation, open the {your app}.xcworkspace file that contains your Xcode project and your linked dependencies
6. Enable keychain sharing in your Xcode project.
buttonTitle: "Reject",
isAuthenticationRequired: false,
defineActivationMode: .destructive)
Show more
* Change the Notification category

// Replace this

let category = BMSPushNotificationActionCategory(
identifierName: "category",
buttonActions: [acceptButton, rejectButton])

// with this

let category = ENPushNotificationActionCategory(
identifierName: "category",
buttonActions: [actionOne, actionTwo])





Your iOS mobile app is ready to work with your new instance of IBM Cloud® Event Notifications.







 Step 4: Modify a Web application 

Modify the Web app source code to use the new Event Notifications SDKs. You will replace the existing Push Notifications service WebPush SDK with the Event Notifications WebPush SDK.



 Create a Web destination 



 Chrome Destination 

Create a destination of type Chrome Push Notification for the Web app. Provide the Website URL and FCM Server key.

Zoom

![Create Chrome destination](https://cloud.ibm.com/docs-content/v1/content/4c9a07fe500838e5e55e71e73131ef20b44a6c66/event-notifications/images/en-migration-chrome.png)

Figure 8. Create Chrome destination





 Firefox Destination 

Create a destination of type Firefox Push Notification for the Web app. Provide the Website URL.

Zoom

![Create Firefox destination](https://cloud.ibm.com/docs-content/v1/content/4c9a07fe500838e5e55e71e73131ef20b44a6c66/event-notifications/images/en-migration-firefox.png)

Figure 9. Create Firefox destination





 Safari Destination 

Create a destination of type Safari Push Notification for the Web app.
// Replace the below section

push.registerDeviceWithUserId("userId", new MFPPushResponseListener<String>() {

@Override
public void onSuccess(String response) {
//handle successful device registration here
}

@Override
public void onFailure(MFPPushException ex) {
//handle failure in device registration here
}
});

// with this

push.registerDeviceWithUserId("userId",new ENPushResponseListener<String>() {

@Override
public void onSuccess(String deviceId) {
//handle successful device registration here
}

@Override
public void onFailure(ENPushException ex) {
//handle failure in device registration here
}
});
Show more



6. Make changes to the unregister API call.

// Replace the below section

push.unregister(new MFPPushResponseListener<String>() {

@Override
public void onSuccess(String s) {
// Handle success
}

@Override
public void onFailure(MFPPushException e) {
// Handle Failure
}
});

// with this

push.unregister(new ENPushResponseListener<String>() {

@Override
public void onSuccess(String s) {
// Handle success
}

@Override
public void onFailure(ENPushException e) {
// Handle Failure
}
});
Show more
7. Optionally, if you are using tags



* Change the tag subscriptions as follows:

// Replace the below section

push.subscribe("tagName", new MFPPushResponseListener<String>() {

@Override