vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Agents can be deployed and configured to use dedicated infrastructure to run your automation that can be scaled up or down depending on the capacity needs. In addition, Agent images can be extended to include or use your own automation software and versions in conjunction with automation engine provided by the Schematics runtime.
* The multi-tenanted Schematics service uses network access policies: that cater to all its tenants, hence cannot be tuned to a single tenant requirements. Agents enables you to implement fine gained control over your network access policies to access your private network resources. You can configure the [ingress or egress](https://cloud.ibm.com/docs/containers?topic=containers-vpc-kube-policies) rules and [VPC security policies](https://cloud.ibm.com/docs/vpc?topic=vpc-security-in-your-vpc&interface=ui) that are used by Agents to connect to your hybrid cloud infrastructure.







 Next steps 

Now that you learned about the Schematics Agent architecture and its usage. The next steps to explore Schematics Agents:



* You can explore the steps to [prepare Schematics Agent](https://cloud.ibm.com/docs/schematics?topic=schematics-plan-agent-overview&interface=cli) setup in your IBM Cloud account.
* Infrastructure management operators, which include Policies and Profiles (ibm-management-infra-grc), Provisioning virtual machines and Instances (ibm-management-infra-vm), Managed services (ibm-management-cam-install), and Creating and managing services (ibm-management-service-library).
* Operations operator, which is ChatOps (ibm-management-sre-chatops).
* Monitoring operator, which is Monitoring (ibm-management-monitoring).
* Security services operators, which include Notary service for image signing (ibm-management-notary), Image signing support for image policies (ibm-management-image-security-enforcement), Mutation Advisor (ibm-management-mutation-advisor), and Vulnerability Advisor (ibm-management-vulnerability-advisor).
* Runtime (ibm-management-manage-runtime) operator, which is a technology preview code.







 Self-service capabilities 

Additional self-service capabilities enable developers to provision infrastructure and application components from a predefined service flow. This means providing a full-service library feature for developers to access on-demand.





 SRE tools for hybrid applications 

The IBM Cloud Pak for Multicloud Management supports the implementation of an SRE operating model. Some of these tools are:



* Bastion control - A new single point of access terminal supports secure remote access to managed systems. This centralized bastion host simplifies the troubleshooting process across regions and deployment models with increased visualization and remediation tools, such as audit and replay.
* Session replay - Replay sessions for auditing, compliance, and SRE postmortem reviews, which allows SRE teams to have a consistent source of review and feedback for future incident response and resolution.
* ChatOps - A ChatOps interface that connects with your preferred tools, including PagerDuty and Slack. This further accelerates the SRE’s ability to receive and react to incidents immediately by using the tools they use every day.







 Hybrid Policy Model 

The updates to Governance, Risk, and Compliance policies allow for a faster, more flexible solution for both VMs and containers. This hybrid approach to policy applications allows operators to apply a policy that is enforced, even as applications are edited and moved by development teams.
Setting up Terraform for CIS 

Terraform on IBM Cloud® enables predictable and consistent provisioning of IBM Cloud services so that you can rapidly build complex, multi-tier cloud environments following Infrastructure as Code (IaC) principles. Similar to using the IBM Cloud CLI or API and SDKs, you can automate the provisioning, update, and deletion of your IBM Cloud Internet Services instances by using HashiCorp Configuration Language (HCL).

Looking for a managed Terraform on IBM Cloud® solution? Try out [IBM Cloud® Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-getting-started). With Schematics, you can use the Terraform scripting language that you are familiar with, but you don't have to worry about setting up and maintaining the Terraform command line and the IBM Cloud® Provider plug-in. Schematics also provides pre-defined Terraform templates that you can easily install from the IBM Cloud® catalog.



 Installing Terraform and configuring resources for IBM Cloud Internet Services 

Before you begin, make sure that you have the [required access](https://cloud.ibm.com/docs/cis?topic=cis-at_iam_CIS) to create and work with IBM Cloud Internet Services resources.



* Follow the [Terraform on IBM Cloud® getting started tutorial](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started) to install the Terraform CLI and configure the IBM Cloud® Provider plug-in for Terraform. The plug-in abstracts the IBM Cloud® APIs that are used to provision, update, or delete IBM Cloud Internet Services service instances and resources.
* Create a Terraform configuration file that is named main.tf. In this file, you add the configuration to create a CIS service instance and to assign a user an access policy in Identity and Access Management (IAM) for that instance by using HashiCorp Configuration Language (HCL).
* End-to-end flexible: TLS encrypts all traffic; however, you can use a self-signed certificate to secure traffic between CIS and your origin server(s).
* End-to-end CA signed: TLS encrypts all traffic; you must use a CA-signed certificate.



Refer to [TLS options](https://cloud.ibm.com/docs/cis?topic=cis-cis-tls-options) for details.

IBM CIS allows you to use custom certificates, or you can use a wildcard certificate provisioned for you by CIS.



 Upload custom certificates 

You can upload your custom certificate by clicking Add Certificate button and entering your certificate, private key, and bundle method. If you upload your own certificate, you gain immediate compatibility with encrypted traffic, and you maintain control over your certificate (for example, an Extended Validation (EV) certificate).

Remember that you are responsible for managing your certificate if you upload a custom certificate. For example, CIS won't track the certificate expiration date.





 Order dedicated certificates 

CIS makes managing your certificates easy by offering dedicated certificates. You no longer need to generate private keys, create certificate signing requests (CSR), or remember to renew certificates. You can order a dedicated certificate by clicking Add Certificate button and ordering a wildcard certificate or entering hostnames to order a dedicated custom certificate. The type of certificates are:



* SHA-2/ECDSA signed certificate using P-256 key,
* SHA-2/RSA signed certificate using RSA 2048-bit key, and
* SHA-1/RSA signed certificate using RSA 2048-bit key.



CIS can issue for all TLDs except for .cu, .iq, .ir, .kp, .sd, .ss, and .ye. CIS manages the expiration date. To edit the hostnames on your dedicated custom certificate, you must reorder then delete. For example, you order a dedicated custom certificate with the hostname alpha.yourdomain.com.
[CIS Proxy Toggle ON](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/includes/solution-tutorials/includes/solution-tutorials/images/solution32-multi-region-k8s-cis/cis-proxy.png)

CIS Proxy Toggle ON



Your GLB is now protected. An immediate benefit is that the origin IP addresses of your clusters will be hidden from the clients. If CIS detects a threat for an upcoming request, the user may see a screen like this one before being redirected to your application:

Zoom

![Verifying - DDoS protection](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/includes/solution-tutorials/includes/solution-tutorials/images/solution32-multi-region-k8s-cis/cis-DDoS.png)

Verifying - DDoS protection

In addition, you can now control what content gets cached by CIS and how long it stays cached. Go to Performance > Caching to define the global caching level and the browser expiration. You can customize the global security and caching rules with Page Rules. Page Rules enable fine-grained configuration using specific domain paths. As example with Page Rules, you could decide to cache all contents under /assets for 3 days:

Zoom

![Page Rules](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/includes/solution-tutorials/includes/solution-tutorials/images/solution32-multi-region-k8s-cis/cis-pagerules.png)

Page Rules







 Step 5: Remove resources 



 Remove Kubernetes Cluster resources 



1. Remove the Ingress, you can do so by running the following command:
Automating change management 

Change management automation is an important part of the DevSecOps pipeline reference implementation. Developers, approvers, and auditors can monitor the compliance aspects of deployments. Every deployment must follow an organization's change management policy.

To automate change management, take the following steps:



 Step 1: Creating change requests for deployments 

Use the pull request template that is provided in the inventory for promotion pull requests to populate the change request fields. Because you cannot automatically populate these fields, you must manually populate them to promote changes. By manually populating these fields, you trigger the deployment and continue automatic data collection for the rest of the change request.

Zoom

![Promotion pull request](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/promotion-pr.png)

Figure 1. Promotion pull request

The promotion pull request template contains the following fields:



* Priority Required. The priority of the change. Valid values are: critical, high, moderate, low, and planning.
* Change Request assignee Required. The email address of the person that the change request is assigned to.
* Additional Description Describes the change process. Extra content from the automation process is appended here.
* Purpose/Goal Describes the purpose of the change.
* Explanation of Impact Describes the possible impact of the change.
* Customer Impact Required. Describes the impact of the change for the customer. Valid values are: critical, high, moderate, low, no_impact
* Backout Plan Describes the rollback or backout plan.



Along with these fields, you must set two additional fields from the environment properties:



* target-environment-purpose (Required) Valid values are: production, pre_prod. Any non-production deployment would qualify as pre_prod.
* target-environment-detail (Required) A string which describes the target-environment where the change is deployed.
(https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/secrets-manager/images/create-service-auth.svg)

Figure 1. Creating a service authorization between Secrets Manager and CIS



1. In the console, click Manage > Access (IAM), and select Authorizations.
2. Click Create.
3. Select a source account for the authorization.
4. Select a source and target service for the authorization.



1. From the Source service list, select Secrets Manager.
2. From the Target service list, select Internet Services.



5. Specify a service instance for both the source and the target.
6. Select the Manager role. With these permissions, your Secrets Manager instance can manage the CIS instance and its domains.
7. Optional: To grant access to a specific domain, select Resources based on selected attributes and provide the Domain ID for the CIS instance.

For production environments, it is recommended that you assign access only to the specific domains.
8. Click Authorize
9. Complete the steps to [add a certificate authority configuration](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-certificate-authority) to your Secrets Manager instance.







 Granting service access for another account 

If the CIS instance that you'd like to access is located in another account, you can create an authorization between the services by providing an API key. You need the Cloud Resource Name (CRN) of the CIS instance that contains your domains, and an API key with the correct level of access to your instance. The API key must grant Secrets Manager the ability to view the CIS instance, access its domains, and manage TXT records.

If the CIS instance is located in an account that allows access to only specific IP addresses, you must also update the IP address restrictions in the account to allow incoming requests from Secrets Manager.
If you disable or delete the root key, your worker nodes enter a critical state until you restore the root key and [reboot](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_reboot) the worker nodes.



The encryption for the disks of the worker nodes in your worker pool are now managed by the root key in your KMS provider. If you created a cluster, the worker pool is the default worker pool.





 Satellite worker nodes 

Satellite: The encryption of the OS disk and secondary disk is managed at the IAAS layer of the platform Satellite is deployed on. The encryption of persistent storage volumes utilized within the cluster is managed at the persistent storage plug-in level and backing storage device level. For more information about encryption for storage devices or plug-ins, see the device provider documentation or the storage plug-in documentation.
Managing user access 

IBM Cloud Hyper Protect Crypto Services supports a centralized access control system, which is governed by IBM Cloud® Identity and Access Management, to help you manage users and access for your encryption keys.



 Roles and permissions 

The following table shows the roles that Hyper Protect Crypto Services supports.



Table 1. Roles and permissions

 Roles Permissions 

 Service administrator Manages [platform access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessplatform-mgmt-roles) and [service access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles), [grants access to keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-keys), creates and deletes service instances, and manages keys. An IBM Cloud account owner is automatically assigned the service administrator permission. 
 Crypto unit administrator Provides signature keys, and signs Trusted Key Entry (TKE) administrative commands such as for adding another crypto unit administrator. In some cases, a crypto unit administrator can also be a master key custodian. 
 Master key custodian Provides master key parts for initializing a service instance. In some cases, a master key custodian can also be a crypto unit administrator. 
 Certificate administrator Sets up and manages administrator signature keys and client certificates to enable the second layer of TLS authentication in GREP11 or PKCS #11 API connections. The administrator needs to be assigned the Certificate Manager IAM [service access role](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles) to perform the corresponding actions. 
 Service user Manages root keys and standard keys through user interface and the API, and performs cryptographic operations through the PKCS #11 API or the Enterprise PKCS #11 over gRPC (GREP11) API.
* e.g.- fteStartAgent -p QM_COORD DEST_AGENT



4. Now both of your newly created agents should be in Active/Ready state. To check there status execute.



* fteListAgents -p <configurationOptions>



* configurationOptions - by convention this is the name of a coordination queue manager



* e.g.- fteListAgents -p QM_COORD



![Image showing 'fteListAgents' command that lists all the agents running against the coordination queue manager.](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_fte_List_Agents.png)



You have now configured the IBM MQ Managed File transfer queue managers to transfer a file.

--------------------





 What to do next 

Go to Step 2 to [Initiate a File Transfer](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_mft_create_transfer)
CIS allowlisted IP addresses 

The following API lists all IP addresses used by the CIS proxy. The CIS proxy uses only addresses from this list, for both client-to-proxy and proxy-to-origin communication.

[https://api.cis.cloud.ibm.com/v1/ips](https://api.cis.cloud.ibm.com/v1/ips)

Polling this API one time a week is sufficient to get the information you need to update your allowlists.

The IP addresses the CIS proxy uses for communication with the origins are not necessarily the same as the ones used for client-to-proxy communication, although all addresses are derived from the same list.
If your domain was added when the default SSL mode was End-to-end Flexible, that setting is not overwritten. You can change the mode to a less strict mode, but that is not recommended for production environments.





 What is DDoS? 

A distributed denial-of-service (DDoS) attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. In a DDoS attack, multiple compromised computer systems attack a target such as a server, website, or other network resource, affecting users of the targeted resource.

The flood of incoming messages, connection requests, or malformed packets to the target system forces it to slow down or even crash and shut down, thereby denying service to legitimate users or systems. DDoS attacks have been carried out by diverse threat actors, ranging from individual criminal hackers to organized crime rings and government agencies.





 What do I do if I’m under a DDoS attack? 

Step 1: Turn on “Defense mode" in the Overview screen.

Zoom

![Defense Mode](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/defense-mode.png)

Figure 1. Defense mode

Step 2: Set your DNS records for maximum security.

Step 3: Do not rate-limit or throttle requests from IBM CIS, we need the bandwidth to assist you with your situation.

Step 4: Block specific countries and visitors, if necessary.





 I got a 522 error, what do I do now? 

A 522 error indicates we weren't able to establish a connection with your origin server (that is, your host). After about 15 seconds of connection failure, we close the connection and display a 522 error page.

This issue usually is caused by firewall or security software that accidentally blocks our IP addresses. Because CIS acts as a reverse proxy, connections to your site appear to come from a range of CIS IPs. This behavior can cause certain firewalls to block these connections, which prevents us from serving content to your site visitors properly.
* Provide fixes and guidance on how to remediate security findings.
* Map misconfigurations in production to infrastructure as code (IaC) manifests.
* Provide control over cloud infrastructure configurations and ensure consistent implementation of policies across multiple cloud providers.

Use out-of-the-box compliance controls.

Create customized security policies that align with your security mandates.

Duplicate an existing security policy and turn on/off controls, or create a new ones from scratch.
* Monitor for suspicious activity and threats.

Perform risk assessments of your infrastructure and workloads by checking policies and controls that are included in standard frameworks such as CIS, PCI, NIST.

Enforce compliance with controls using policy as code based on OPA.
* Monitor all suspicious activity performed by privileged users.
* Integrate with DevOps tools to streamline the incident response process.
* Show proof of your compliance through audit logs and container forensics data.







 Kubernetes Security Posture Management (KSPM) 

Kubernetes security posture management, or KSPM, is the use of security automation tools to discover and fix security and compliance issues within a Kubernetes component.



* KSPM provides processes and technologies to help secure a Kubernetes cluster or a Red Hat OpenShift cluster, and the workloads running within it.
* KSPM continuously analyzes and evaluates the security of cluster components and their configurations, identifies potential vulnerabilities, and monitors for and responds to security incidents.



KSPM is one part in a Kubernetes security strategy, but it isn't the only one. KSPM is not a substitute for runtime security, which helps detect active threats within your environment. Nor does KSPM address risks such as malware inside containers, which is a threat that a container image scanning can handle.

You must deploy a broad set of security tools for Kubernetes, such as IBM Cloud Security and Compliance Center Workload Protection. As part of a broader Kubernetes security strategy, KSPM allows teams to validate the security of Kubernetes configurations to find and remediate mistakes that can trigger a breach. By running continuous, automatic scans of Kubernetes configurations, admins can mitigate one of the most common areas of attack, human error.
Enter the name of your Schematics workspace, select a resource group, select a Schematics region, and click Next.

In the Tags field, you can enter a name of a specific tag to attach to your Operator. Tags provide a way to organize, track usage costs, and manage access to the resources in your account.
6. Click Validate.







 Step 7: Manage compliance 

Controls are safeguards that are used to meet security and compliance requirements. Only controls that are supported by Security and Compliance Center, formatted correctly, and validated by Code Risk Analysis and Security and Compliance Center scans appear in the catalog. For more information, see [Adding compliance details](https://cloud.ibm.com/docs/account?topic=account-catalog-format-controls).



 Manage compliance controls 

You can review the controls that were added from your readme file and add additional controls.



1. Click Add controls.
2. Choose a profile.
3. Select the controls that you want to add to your version.
4. Click Add.







 Run Code Risk Analyzer scan 

Scan your source code with Code Risk Analyzer to identify any security vulnerabilities that you need to assess.



1. Click Run scan.
2. Wait for the scan to finish.







 Add Security and Compliance Center scan 

Add the scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).



1. Select the profile that you scanned.
2. Select the Security and Compliance Center scan.
3. Click Add scan.
4. Click Next.









 Review requirements 

You must complete validation and any other requirements to publish to your account.





 Next steps 

After you onboard and validate your Operator bundle, you're ready to publish it to your account. From the Actions menu, select Publish to account.