vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Security Assessment and Authorization (CA) [CA-3 System Interconnections](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ca-3) 
 System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 7. Ensure all operator actions are executed through a bastion host
A host system, which is protected by the IBM Secure Service Container technology is installed on each partition. IBM Secure Service Container technology provides protection against insider threats, for example, IBM Cloud administrators. Protection achieved by the following features:



* The host system supports interactions for administrators by way of well-defined encrypted REST APIs with only a limited set of secure configuration options. No other connection is available. For example, SSH is not available.
* The IBM Secure Service Container implements a secure boot procedure to detect potential attacks against the installation image, which ensures that only untampered images are started.
* All disks, which are attached to the IBM Secure Service Container host system are automatically encrypted according to AES256. The encryption keys are stored in the protected host.
* IBM LinuxONE Hardware Management Console functions, which examine the processor or memory state are not available for partitions that are protected by the IBM Secure Service Container technology.



Zoom

![Hyper Protect Virtual Servers architecture](https://cloud.ibm.com/docs-content/v1/content/29e0ddc9fd7149f916889ba6a4d131cc3528c9bc/hp-virtual-servers/image/hpvs_architecture-isolation.svg)

Figure 2. Hyper Protect Virtual Servers architecture compute isolation

Figure 2. shows that every host system is shared between multiple Hyper Protect Virtual Servers that are owned by multiple tenants. The KVM hypervisor isolates the virtual servers, and each virtual server has its own virtualized network connection.





 Dependencies on other IBM Cloud services 



Table 1. Dependencies to other IBM Cloud services

 Service name Description 

 Business Support Services for IBM Cloud (BSS) BSS is used to access information about the IBM Cloud account, service subscription, service usage, and billing. 
 IBM Cloud® Certificate Manager This service manages the TLS certificates that are used for the service broker. 
 IBM Cloud® Log Analysis with LogDNA The Hyper Protect Virtual Servers service broker sends service logs to IBM Cloud Log Analysis with LogDNA. These logs are monitored and analyzed by the service team to detect service issues and malicious activities.
cc_kp_name Name of the Key Protect instance where the secrets are stored. string "" 
 cc_kp_location IBM Cloud® location or region that contains the Key Protect instance. string "" 
 cc_kp_resource_group The resource group that contains the Key Protect instance for your secrets. string "" 







 Switching between secrets providers 

Secrets Manager is the default provider for the toolchains. Use the following variables to switch between Key Protect and Secrets Manager for each toolchain.

Secrets providers can be switched across all the toolchains.



Table 10. Secrets providers

 Name Description Type Default 

 enable_key_protect Enable Key Protect integrations. bool false 
 enable_secrets_manager Enable the Secrets Manager integrations. bool true 



Alternatively, you can switch secrets providers seperately for the different toolchains. The toolchain-specific variable defaults for the secrets providers, as outlined in the Table 10, are set to false by default. The variables are grouped under Key Protect and Secrets Manager. All the variables in a group take precendence if any variable in that group is changed from the default value.



Table 11. Switch secrets provider

 Name Description Type Default 

 ci_enable_key_protect Enables Key Protect integration. bool false 
 cd_enable_key_protect Uses the Key Protect integration. bool false 
 cc_enable_key_protect Enables Key Protect integration. bool false 
 ci_enable_secrets_manager Enables Secrets Manager integration. bool false 
 cd_enable_secrets_manager Uses the Secrets Manager integration. bool false 
 cc_enable_secrets_manager Enables Secrets Manager integration. bool false 



Set these variables to true to use a Key Protect integration instead of Secrets Manager. Also, set the Secrets Manager values to false in this case so that an unnecessary integration is not created in the toolchain.







 Optional CI, CD, and CC variables 

API key, secrets, and toolchain

Continuous integration

Continuous deployment



Table 12. API key, secrets, and toolchain

 Name Description Type Default
(https://nvd.nist.gov/vuln/detail/CVE-2020-36226), [CVE-2020-36227](https://nvd.nist.gov/vuln/detail/CVE-2020-36227), [CVE-2020-36228](https://nvd.nist.gov/vuln/detail/CVE-2020-36228), [CVE-2020-36229](https://nvd.nist.gov/vuln/detail/CVE-2020-36229), [CVE-2020-36230](https://nvd.nist.gov/vuln/detail/CVE-2020-36230), [CVE-2021-25682](https://nvd.nist.gov/vuln/detail/CVE-2021-25682), [CVE-2021-25683](https://nvd.nist.gov/vuln/detail/CVE-2021-25683), and [CVE-2021-25684](https://nvd.nist.gov/vuln/detail/CVE-2021-25684).
Haproxy 468c09 04f862 [CVE-2022-1271](https://nvd.nist.gov/vuln/detail/CVE-2022-1271). 
 containerd v1.5.11 v1.5.13 See the [change log](https://github.com/containerd/containerd/releases/tag/v1.5.13), the [security bulletin](https://www.ibm.com/support/pages/node/6597989) for [CVE-2022-31030](https://nvd.nist.gov/vuln/detail/CVE-2022-31030), and the [security bulletin](https://www.ibm.com/support/pages/node/6598049) for [CVE-2022-29162](https://nvd.nist.gov/vuln/detail/CVE-2022-29162). 
 Kubernetes 1.22.10 1.22.11 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.22.11). 







 Change log for worker node fix pack 1.22.10_1554, released 7 June 2022 

The following table shows the changes that are in the worker node fix pack 1.22.10_1554. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.22.9_1552

 Component Previous Current Description
2 Has an encrypted seed Has kms details (one entry) LUKS encrypted The instance calls Hyper Protect Crypto Services to unwrap the encrypted seed and opens the LUKS layer on the data partition. 
 2 Has an encrypted seed Has kms details (multiple entries) The instance calls Hyper Protect Crypto Services to unwrap the encrypted seed with the first kms entry. If it fails, it uses the next entry. When it succeeds, it uses the first configuration to rewrap the seed. If all the entries don't work, the instance shuts down. 
 2 Has an encrypted seed No kms details The instance shuts down. You need to provide kms details in the contract. 



Check logs in Log Analysis if your instance shuts down.



 Steps 



1. Provision a Hyper Protect Crypto Services instance and create a root key. For more information, see [Creating root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys&interface=ui).

To enhance security, it's recommended to use [virtual private endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-virtual-private-endpoints-for-vpc&interface=cli) with Hyper Protect Crypto Services.
2. When you prepare the [contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_se), add kms details in the env - volumes section, and then use the contract to [create](https://cloud.ibm.com/docs/vpc?topic=vpc-about-se&interface=uicreate-hyper-protect-virtual-servers-for-vpc-instance) a Hyper Protect Virtual Server for VPC instance. For example:

env: 
logging:
logDNA:
hostname: syslog-a.eu-gb.logging.cloud.ibm.com
CVE-2019-13295](https://nvd.nist.gov/vuln/detail/CVE-2019-13295), [CVE-2019-13297](https://nvd.nist.gov/vuln/detail/CVE-2019-13297), [CVE-2019-13300](https://nvd.nist.gov/vuln/detail/CVE-2019-13300), [CVE-2019-13301](https://nvd.nist.gov/vuln/detail/CVE-2019-13301), [CVE-2019-13304](https://nvd.nist.gov/vuln/detail/CVE-2019-13304), [CVE-2019-13305](https://nvd.nist.gov/vuln/detail/CVE-2019-13305), [CVE-2019-13306](https://nvd.nist.gov/vuln/detail/CVE-2019-13306), [CVE-2019-13307](
When a cluster has a Kubernetes key management service (KMS) provider enabled and a disabled [Key Protect](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) key, cluster health state is now set to critical. Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 CoreDNS 1.7.1 1.8.0 See the [CoreDNS release notes](https://coredns.io/2020/10/22/coredns-1.8.0-release/). 
 GPU device plug-in and installer 0c07674 b966c41 Updated image for [CVE-2019-20386](https://nvd.nist.gov/vuln/detail/CVE-2019-20386), [CVE-2019-13050](https://nvd.nist.gov/vuln/detail/CVE-2019-13050), [CVE-2020-8177](https://nvd.nist.gov/vuln/detail/CVE-2020-8177), [CVE-2019-14889](https://nvd.nist.gov/vuln/detail/CVE-2019-14889), [CVE-2020-1730](https://nvd.nist.gov/vuln/detail/CVE-2020-1730), [CVE-2020-10029](https://nvd.nist.gov/vuln/detail/CVE-2020-10029), [CVE-2020-1751
RHEL Packages N/A N/A Updated image with fixes for: [CVE-2020-0543](https://nvd.nist.gov/vuln/detail/CVE-2020-0543), [CVE-2020-0548](https://nvd.nist.gov/vuln/detail/CVE-2020-0548), [CVE-2020-0549](https://nvd.nist.gov/vuln/detail/CVE-2020-0549), [CVE-2020-8695](https://nvd.nist.gov/vuln/detail/CVE-2020-8695), [CVE-2020-8696](https://nvd.nist.gov/vuln/detail/CVE-2020-8696), [CVE-2020-8698](https://nvd.nist.gov/vuln/detail/CVE-2020-8698), [CVE-2020-24489](https://nvd.nist.gov/vuln/detail/CVE-2020-24489), [CVE-2020-24511](https://nvd.nist.gov/vuln/detail/CVE-2020-24511), and [CVE-2020-24512](https://nvd.nist.gov/vuln/detail/CVE-2020-24512). 







 Change log for worker node fix pack 4.5.41_1547_openshift, released 02 August 2021 

The following table shows the changes that are in the worker node fix pack patch update 4.5.41_1547_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.5.41_1545_openshift

 Component Previous Current Description
"payload": "<key_material>",
"extractable": <key_type>
}
]
}'

Replace the variables in the example request according to the following table.





Table 1. Describes the variables that are needed to add a root key with the Key Protect API

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. <br> <br>For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 correlation_ID The unique identifier that is used to track and correlate transactions. 
 return_preference A header that alters server behavior for POST and DELETE operations. <br> <br>When you set the return_preference variable to return=minimal, the service returns only the key metadata, such as the key name and ID value, in the response entity-body. When you set the variable to return=representation, the service returns both the key material and the key metadata. 
 key_name Required. A unique, human-readable name for easy identification of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 alias_list Optional. One or more unique, human-readable aliases assigned to your key.
Instead, reflecting the different use cases and infrastructure maintenance requirements for Satellite-based deployments, users are charged a flat rate for each location where they want Key Protect installed and then an additional rate depending on the quota of keys they select at deployment time.

For more information about IBM® Key Protect for IBM Cloud® on Satellite, check out [About IBM® Key Protect for IBM Cloud® on Satellite](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-about).







 March 2023 



 24 March 2023 

The price per key version in IBM Cloud has risen 4.5% in staging, an increase from USD1 to USD1.045. This price increases in production on April 1, 2023 and applies to all new and existing key versions. For more information, check out [Pricing](https://cloud.ibm.com/docs/key-protect?topic=key-protect-pricing-plan).







 February 2023 



 3 February 2023 

IBM® Key Protect for IBM Cloud® announces ability to view number of key versions for keys in all states
: Previously, the [List key versions API endpoint](https://cloud.ibm.com/apidocs/key-protectgetkeyversions) would return an HTTP 409 if a key was not in an Active (1) state. When a new parameter, allKeyStates, is passed as true, it returns the number of versions of a key even if the key is no longer active. Similarly, an HTTP 410 used to be returned for keys in a Destroyed (5) state. Now, if allKeyStates is passed as true, the number of versions of the destroyed key is returned.

For more information, check out [Viewing key versions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-key-versions).







 December 2022 



 2 December 2022 

IBM® Key Protect for IBM Cloud® announces new features for the Terraform plugin as part of v1.48.0
2023-1170](https://nvd.nist.gov/vuln/detail/CVE-2023-1170), [CVE-2023-1175](https://nvd.nist.gov/vuln/detail/CVE-2023-1175), [CVE-2023-1264](https://nvd.nist.gov/vuln/detail/CVE-2023-1264), [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329), [CVE-2023-27533](https://nvd.nist.gov/vuln/detail/CVE-2023-27533), [CVE-2023-27534](https://nvd.nist.gov/vuln/detail/CVE-2023-27534), [CVE-2023-27535](https://nvd.nist.gov/vuln/detail/CVE-2023-27535), [CVE-2023-27536](https://nvd.nist.gov/vuln/detail/CVE-2023-27536), [CVE-2023-27538](https://nvd.nist.gov/vuln/detail/CVE-2023-27538). 
 Kubernetes 1.26.1 1.26.3 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.26.3). 
 Containerd 1.7.0-rc.3 1.7.0 For more information, see the [change log](https://github.com/containerd/containerd/releases/tag/v1.7.0). 
 Haproxy af5031 8398d1 [CVE-2023-23916](https://nvd.nist.gov/vuln/detail/CVE-2023-23916).
* [CVE-2022-43552](https://nvd.nist.gov/vuln/detail/CVE-2022-43552), [CVE-2022-3204](https://nvd.nist.gov/vuln/detail/CVE-2022-3204), [CVE-2023-27535](https://nvd.nist.gov/vuln/detail/CVE-2023-27535),[CVE-2022-36227], [CVE-2022-35252](https://nvd.nist.gov/vuln/detail/CVE-2022-35252), [CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403), [CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404), [CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405), [CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402), [CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400), [CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540), [CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539).



* Introduced two new configurable flags in addon-vpc-block-csi-driver-configmap configMap to enable/disable and edit the retry interval for Snapshot Creation.



* IsSnapshotEnabled allows users to disable or enable snapshot functionality.
Describes the variables that are needed to list key versions with the Key Protect API.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 keyID_or_alias Required. The unique identifier or alias for the key that you want to inspect. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key is a part of. The header itself is optional, but if unspecified, Key Protect will search for the key in every key ring associated with the specified instance. It is recommended to specify the key ring ID for a more optimized request. Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. For more information, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 
 show_total Optional. If set to true, returns totalCount in the response metadata for use with pagination for all keys in an active state, unless allKeyStates is also set to true. The totalCount value returned specifies the total number of key versions that match the request, disregarding limit and offset. The default is set to false.
2020-12402](https://nvd.nist.gov/vuln/detail/CVE-2020-12402), [CVE-2020-12403](https://nvd.nist.gov/vuln/detail/CVE-2020-12403), [CVE-2018-20843](https://nvd.nist.gov/vuln/detail/CVE-2018-20843), [CVE-2019-15903](https://nvd.nist.gov/vuln/detail/CVE-2019-15903), [CVE-2019-14834](https://nvd.nist.gov/vuln/detail/CVE-2019-14834), [CVE-2019-11068](https://nvd.nist.gov/vuln/detail/CVE-2019-11068), [CVE-2019-18197](https://nvd.nist.gov/vuln/detail/CVE-2019-18197), [CVE-2019-16935](https://nvd.nist.gov/vuln/detail/CVE-2019-16935), [CVE-2019-20386](https://nvd.nist.gov/vuln/detail/CVE-2019-20386), [CVE-2019-17498](https://nvd.nist.gov/vuln/detail/CVE-2019-17498), and [CVE-2020-14365](https://nvd.nist.gov/vuln/detail/CVE-2020-14365). 







 Change log for worker node fix pack 4.4.23_1520_openshift, released 30 September 2020 

The following table shows the changes that are in the worker node fix pack update 4.4.23_1520_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.4.23_1519_openshift
https://nvd.nist.gov/vuln/detail/CVE-2021-3733), [CVE-2021-3737](https://nvd.nist.gov/vuln/detail/CVE-2021-3737), [CVE-2021-3759](https://nvd.nist.gov/vuln/detail/CVE-2021-3759), [CVE-2021-3778](https://nvd.nist.gov/vuln/detail/CVE-2021-3778), [CVE-2021-3796](https://nvd.nist.gov/vuln/detail/CVE-2021-3796), [CVE-2021-3800](https://nvd.nist.gov/vuln/detail/CVE-2021-3800), [CVE-2021-38199](https://nvd.nist.gov/vuln/detail/CVE-2021-38199), [CVE-2021-3903](https://nvd.nist.gov/vuln/detail/CVE-2021-3903), [
2019-12975](https://nvd.nist.gov/vuln/detail/CVE-2019-12975), [CVE-2019-12976](https://nvd.nist.gov/vuln/detail/CVE-2019-12976), [CVE-2019-12978](https://nvd.nist.gov/vuln/detail/CVE-2019-12978), [CVE-2019-12979](https://nvd.nist.gov/vuln/detail/CVE-2019-12979), [CVE-2019-13133](https://nvd.nist.gov/vuln/detail/CVE-2019-13133), [CVE-2019-13134](https://nvd.nist.gov/vuln/detail/CVE-2019-13134), [CVE-2019-13135](https://nvd.nist.gov/vuln/detail/CVE-2019-13135), [CVE-2019-13233](https://nvd.nist.gov/vuln/detail/CVE-2019-13233), [
Prerequisites 

You need the [Writer service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to rotate secrets.





 Command options 

payload
: The new data to store for an arbitrary secret. Only text-based payloads are supported. If you need to store a binary file, be sure to base64 encode it before you save it to Secrets Manager. For more information, see [Examples](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-clivault-cli-create-static-secret-examples).

password
: The new password to assign to a username_password secret.

certificate
: The new certificate data to store for an imported_cert secret. Supported file type is .pem.

private_key
: The new private key data to store for an imported_cert secret. Supported file type is .pem.

intermediate
: The new intermediate certificate data to store for an imported_cert secret. Supported file type is .pem.

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.

-force
: Replaces the password that is stored for a username_password secret with a randomly generated, 32-character password that contains uppercase letters, lowercase letters, digits, and symbols.





 Examples 

Manually rotate the secret data that is stored for an arbitrary secret.

vault write -format=json ibmcloud/arbitrary/secrets/fe874c2b-e8fd-bbb6-9f19-e91bbe744735/rotate payload="Updated secret data."

Manually rotate the password that is stored for a username_password secret.