vania-janet/multiturn-rag-retrieval-data huggingface dataset:
1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode option includes Node. Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) IBM 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Scored 1 Pass IBM 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) IBM 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is set if PodSecurityPolicy is not used. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) IBM 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Scored 1 Pass IBM 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Scored 1 Pass IBM 
 1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Scored 1 Pass IBM
1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode option includes Node. Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48) IBM 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Scored 1 Pass IBM 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48) IBM 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is set if PodSecurityPolicy is not used. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48) IBM 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Scored 1 Pass IBM 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Scored 1 Pass IBM 
 1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48) IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Scored 1 Pass IBM
Scored 1 Pass IBM 
 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600. Scored 1 Pass IBM 







 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.2.1 Ensure that the --anonymous-auth option is set to false. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) IBM 
 1.2.2 Ensure that the --basic-auth-file option is not set. Scored 1 Pass IBM 
 1.2.3 Ensure that the --token-auth-file parameter is not set. Scored 1 Pass IBM 
 1.2.4 Ensure that the --kubelet-https option is set to true. Scored 1 Pass IBM 
 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key options are set as appropriate. Scored 1 Pass IBM 
 1.2.6 Ensure that the --kubelet-certificate-authority option is set as appropriate. Scored 1 Pass IBM 
 1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode option includes Node. Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set.
If no annotation sets are available, click Create Annotation Sets.



1. For the base set, select the document set or annotation set that you want to divide into annotation sets.
2. For the overlap value, specify the percentage of documents that you want to include in each annotation set. Inter-annotator agreement scores cannot be calculated unless two or more human annotators annotate the same documents. For example, if you specify a 20% overlap value for a corpus that contains 30 documents, and you divide the corpus into 3 document sets, 6 documents (20%) will be annotated by all human annotators. The remaining 24 documents will be divided among the 3 human annotators (8 each). Thus, each annotator receives 14 documents to annotate (6+8).



An annotation set that you plan to use to train a machine learning model must contain at least 10 annotated documents.



1. Select a user name from the list of human annotators.
2. Name the annotation set.

As a good practice for evaluating a human annotator's work as the workspace progresses, you might want to create annotation set names that identify the human annotator assigned to the set. You cannot change the annotation set name after the set is created.

The maximum size of the annotation set name is 256 characters.
3. Click Generate.



6. A list of available annotation sets is displayed under Available Sets, along with the names of the human annotators assigned to them. To add available sets to your annotation task, click Add to task.
7. Make sure that all of the annotation sets that you want to include in the task appear under Selected Sets, then click Save to create the task.







 What to do next 

After the task is created, you can return to the Annotation Tasks tab on the Machine Learning Model > Annotations page to view the progress of each human annotator. Also, you can complete the following tasks:



* Check approved documents that overlap between annotation sets to resolve annotation conflicts.
"https://acme.org/foo/125",
],
"required": "yes" | "no" ] // yes: this is an auditable step; no: this is a non auditable step
}, {
// Partial: CM-3(2) CONFIGURATION CHANGE CONTROL | TEST / VALIDATE / DOCUMENT CHANGES
// The organization tests, validates, and documents changes to the information system
// before implementing the changes on the operational system.
// Partial: SA-11(b). Perform Selection (one or more): unit; integration; system; regression]
// testing/evaluation at Assignment: organization-defined depth and coverage];
// SI-7(9) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | VERIFY BOOT PROCESS
// The information system verifies the integrity of the boot process of Assignment: organization-defined devices].
// Control passed if:
// 1- the script is one of the blessed ones AND
// 2- the status is passed OR
// 3- the status is failed AND issues have been opened AND prod CR approved manually
"evidence_type_id": "com.ibm.unit_test",
"version": "1.0.0",
"date": "2020-05-06T12:00:00Z", // date of task run
"origin": {
"url":"https://us-south.git.cloud.ibm.com/open-toolchain/compliance-pipelines/-/blob/master/definitions/mytask.yaml", // where the task is taken from
"version": "423792" // commit id representing the task version used to produce the evidence
}
4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root. Scored 1 Pass IBM 







 4.2 Kubelet 



Section 4.2 Kubelet benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.2.1 Ensure that the --anonymous-auth option is set to false. Scored 1 Pass IBM 
 4.2.2 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 4.2.3 Ensure that the --client-ca-file option is set as appropriate. Scored 1 Pass IBM 
 4.2.4 Ensure that the --read-only-port option is set to 0. Scored 1 Pass IBM 
 4.2.5 Ensure that the --streaming-connection-idle-timeout option is not set to 0. Scored 1 Pass IBM 
 4.2.6 Ensure that the --protect-kernel-defaults option is set to true. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) IBM 
 4.2.7 Ensure that the --make-iptables-util-chains option is set to true. Scored 1 Pass IBM 
 4.2.8 Ensure that the --hostname-override option is not set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) IBM 
 4.2.9 Ensure that the --event-qps option is set to 0 or a level that ensures appropriate event capture. Not Scored 2 Pass IBM 
 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Scored 1 Pass IBM
"hash": "abc123", // the hash of the log file
},
"expired_issues": 134,132,342], // link(s) to the issues for which the grace period expired
"issues": 234,343,342], // link(s) to the issue(s) created to track the bugs found during the test run. Should be populated only if the scan failed
"required": "yes" | "no" ] // yes: this is an auditable step; no: this is a non auditable step
}, {
// Partial: RA-5(a) Scans for vulnerabilities in the information system and hosted applications Assignment: organization-defined
// frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting
// the system/applications are identified and reported;
// Partial: RA-5(b). Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts
// of the vulnerability management process by using standards for:..
// Control passed if:
// 1- the script is one of the blessed ones AND
// 2- the status is passed OR
// 3- the status is failed AND issues have been opened AND there are no expired issues AND prod CR approved manually
"evidence_type_id": "com.ibm.vulnerability_scan",
"version": "1.0.0",
"date": "2020-05-06T12:00:00Z", // date of task run
"origin": {
"url":"https://us-south.git.cloud.ibm.com/open-toolchain/compliance-pipelines/-/blob/master/definitions/mytask.yaml", // where the task is taken from
"version": "423792" // commit id representing the task version used to produce the evidence
}
Scored 1 Pass IBM 
 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root. Scored 1 Pass IBM 







 4.2 Kubelet 



Section 4.2 Kubelet benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.2.1 Ensure that the --anonymous-auth option is set to false. Scored 1 Pass IBM 
 4.2.2 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 4.2.3 Ensure that the --client-ca-file option is set as appropriate. Scored 1 Pass IBM 
 4.2.4 Ensure that the --read-only-port option is set to 0. Scored 1 Pass IBM 
 4.2.5 Ensure that the --streaming-connection-idle-timeout option is not set to 0. Scored 1 Pass IBM 
 4.2.6 Ensure that the --protect-kernel-defaults option is set to true. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) IBM 
 4.2.7 Ensure that the --make-iptables-util-chains option is set to true. Scored 1 Pass IBM
Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.2 Minimize the admission of containers wanting to share the host process ID namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.3 Minimize the admission of containers wanting to share the host IPC namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.4 Minimize the admission of containers wanting to share the host network namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.6 Minimize the admission of root containers. Not Scored 2 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.7 Minimize the admission of containers with the NET_RAW capability. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 5.2.8 Minimize the admission of containers with added capabilities.
The multi-label classifier will not output normalized confidence scores, in order to account for the added flexibility of associating multiple labels with examples.









 Training a custom classifications model 

When your training data is ready, use the Create classifications model method to create your custom classifications model. Make sure to substitute your credentials for {apikey} and {url}, and use the path to your training data file in the training_data parameter. Optionally, you can also specify characteristics of your classifier using training_parameters.

curl -X POST -u "apikey:{apikey}" -H "Content-Type: multipart/form-data" -F "name=MyClassificationsModel" -F "language=en" -F "model_version=1.0.1" -F 'training_parameters={"model_type": "multi_label"}' -F "training_data=@classifications_data.json;type=application/json" "{url}/v1/models/classifications?version=2021-03-23"

Use the model_id in the response to check the status of your model.





 Checking the status of a classifications model 

The following sample request for the Get classifications model method checks the status for the classifications model with ID cb3755ad-d226-4587-b956-43a4a7202202.

curl -X GET -u "apikey:{apikey}" "{url}/v1/models/classifications/cb3755ad-d226-4587-b956-43a4a7202202?version=2021-03-23"

To get information for all classifications models deployed to your instance, use the List classifications models method.

curl -X GET -u "apikey:{apikey}" "{url}/v1/models/classifications?version=2021-03-23"

When the status is available, the classification is ready to use.





 Analyzing text with a custom classifications model
Scored 1 Pass IBM 
 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root. Scored 1 Pass IBM 







 4.2 Kubelet 



Section 4.2 Kubelet benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.2.1 Ensure that the --anonymous-auth option is set to false. Scored 1 Pass IBM 
 4.2.2 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 4.2.3 Ensure that the --client-ca-file option is set as appropriate. Scored 1 Pass IBM 
 4.2.4 Ensure that the --read-only-port option is set to 0. Scored 1 Pass IBM 
 4.2.5 Ensure that the --streaming-connection-idle-timeout option is not set to 0. Scored 1 Pass IBM 
 4.2.6 Ensure that the --protect-kernel-defaults option is set to true. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48) IBM 
 4.2.7 Ensure that the --make-iptables-util-chains option is set to true. Scored 1 Pass IBM
Scored 1 Pass IBM 
 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root. Scored 1 Pass IBM 







 4.2 Kubelet 



Section 4.2 Kubelet benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.2.1 Ensure that the --anonymous-auth argument is set to false. Scored 1 Pass IBM 
 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow. Scored 1 Pass IBM 
 4.2.3 Ensure that the --client-ca-file argument is set as appropriate. Scored 1 Pass IBM 
 4.2.4 Ensure that the --read-only-port argument is set to 0. Scored 1 Pass IBM 
 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0. Scored 1 Pass IBM 
 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) IBM 
 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true. Scored 1 Pass IBM
1.2.9 Ensure that the --authorization-mode argument includes RBAC Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plugin EventRateLimit is set Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) IBM 
 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set Scored 1 Pass IBM 
 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) IBM 
 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used Not Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) IBM 
 1.2.14 Ensure that the admission control plugin ServiceAccount is set Scored 1 Pass IBM 
 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set Scored 1 Pass IBM 
 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) IBM 
 1.2.17 Ensure that the admission control plugin NodeRestriction is set Scored 1 Pass IBM 
 1.2.18 Ensure that the --insecure-bind-address argument is not set Scored 1 Pass IBM 
 1.2.19 Ensure that the --insecure-port argument is set to 0 Scored 1 Pass IBM 
 1.2.20 Ensure that the --secure-port argument is not set to 0 Scored 1 Pass IBM 
 1.2.21 Ensure that the --profiling argument is set to false Scored 1 Pass IBM
1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode option includes Node. Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) IBM 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set, Scored 1 Pass IBM 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) IBM 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is set, if PodSecurityPolicy is not used Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) IBM 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Scored 1 Pass IBM 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Scored 1 Pass IBM 
 1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Scored 1 Pass IBM
1.2.24 Ensure that the --audit-log-maxbackup option is set to 10 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 1.2.25 Ensure that the --audit-log-maxsize option is set to 100 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Scored 1 Pass IBM 
 1.2.27 Ensure that the --service-account-lookup option is set to true. Scored 1 Pass IBM 
 1.2.28 Ensure that the --service-account-key-file option is set as appropriate. Scored 1 Pass IBM 
 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile options are set as appropriate. Scored 1 Pass IBM 
 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Scored 1 Pass IBM 
 1.2.31 Ensure that the --client-ca-file option is set as appropriate. Scored 1 Pass IBM 
 1.2.32 Ensure that the --etcd-cafile option is set as appropriate. Scored 1 Pass IBM 
 1.2.33 Ensure that the --encryption-provider-config option is set as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 1.2.34 Ensure that encryption providers are appropriately configured.