vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"disabled": false,
"description": "Prevent multiple login failures to mitigate brute force attacks",
"bypass":
{
"name": "url",
"value": "api.example.com/"
}
],
"threshold": 60,
"period": 900,
"correlate": {
"by": "nat"
},
"action":
{
"mode": "simulate",
"timeout": 86400,
"response": {
"content_type": "text/plain",
"body": "<error>This request has been rate-limited.</error>"
}
}
],
"match": {
"request": {
"methods":
"GET"
],
"schemes":
"HTTP",
"HTTPS"
],
"url": ".example.org/path"
},
"response": {
"status":
403, 401
],
"headers":
{
"name": "Cf-Cache-Status",
"op": "eq",
"value": "HIT"
}
] ! !
}
}
}
Show more
-s, --json-st: Deprecated. The JSON data describing a rate limiting rule.-j, --json-file: Deprecated. A file contains input JSON data.-i, --instance: Instance name or ID.
const IP='REMOTE_IP'

function getRemote(req, res) {
path = '/info'
remote_url = 'http://' + IP + ':3000' + path
http.get(remote_url, (resp) => {
let rawData = '';
resp.on('data', (chunk) => { rawData += chunk; });
resp.on('end', () => {
try {
console.log(rawData)
rawObj = JSON.parse(rawData)
res.statusCode = 200;
res.end(JSON.stringify({remote_url: remote_url, remote_ip: resp.connection.remoteAddress, remote_info: rawObj}, null, 3))

In our case the REMOTE_IP will be shared.widgets.example.com because of the following in common/user_data_app/main.tf:

output user_data_centos {
value = replace(local.shared_app_user_data_centos, "REMOTE_IP", var.remote_ip)
}

And back in application1/main.tf:

module user_data_app {
source = "../common/user_data_app"
remote_ip = "shared.widgets.example.com"
}
4. Create the resources:

terraform init
terraform apply

Results look something like this:

$ terraform apply
...
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

ibm1_private_ip = "10.1.0.4"
ibm1_public_ip = "52.116.140.202"
test_info = "curl 52.116.140.202:3000/info"
test_remote = "curl 52.116.140.202:3000/remote"

Try the two curl commands (test_info, test_remote) that were suggested above.
url: https://apikey-v2-58B528DF5397465BB6673E1B79482A8C:5811381f6daff7255b288695c3544be63f550e975bcde46799473e69c7d48d61@f6cf0c55-48ea-4908-b441-a962b27d3bb6-bluemix.cloudant.com
username: apikey-v2-58B528DF5397465BB6673E1B79482A8C
port: 443
apikey: XXXXX-XXXXXX_XXXXXXXXXXXXX-XXXXXXXXXXX
host: f6cf0c55-48ea-4908-b441-a962b27d3bb6-bluemix.cloudant.com
iam_apikey_description: Auto generated apikey during resource-key operation for Instance - crn:v1:bluemix:public:cloudantnosqldb:us-south:a/b42116849bb7e2abb0841ca25d28ee4c:ee78351d-82bf-4e80-bc22-825c937fafa3::
iam_serviceid_crn: crn:v1:bluemix:public:iam-identity::a/b42116849bb7e2abb0841ca25d28ee4c::serviceid:ServiceId-53f9e2a2-cdfb-4f90-b072-bfffafb68b3e
password: 581138...7d48d61
Show more



Now, the tutorial is complete. Optionally, you can delete the service credentials or service instance as shown in the steps in the next two sections.
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:f1bc94a6-64aa-4c55-b00f-f6cd70e4b2ce:secret:cb7a2502-8ede-47d6-b5b6-1b7af6b6f563",
"custom_metadata": {
"metadata_custom_key": "metadata_custom_value"
},
"description": "Extended description for this secret.",
"downloaded": true,
"expiration_date": "2023-03-02T15:08:37Z",
"id": "cb7a2502-8ede-47d6-b5b6-1b7af6b6f563",
"issuer": "example.com",
"key_algorithm": "RSA2048",
"labels": [
"dev",
"us-south"
],
"locks_total": 0,
"name": "example-private-certificate",
"next_rotation_date": "2022-03-02T14:08:07Z",
"rotation": {
"auto_rotate": false,
"interval": 1,
"unit": "month"
},
"secret_data": {
"certificate": "-----BEGIN CERTIFICATE-----nMIIE3jCCBGSgAwIBAgIUZfTbf3adn87l5J2Q2Aw+6Vk/qhowCgYIKoZIzj0EAwIwn-----END CERTIFICATE-----",
In either case, the NLB sees your system's source IP address as the client IP address.
6. Copy your system's source IP address (client_address=1.1.1.1 in the previous step output) into your cheat sheet to use in later lessons.



Great! At this point, your app is exposed to the public internet from the public NLB port only. Traffic to the public node ports is blocked. Your cluster is partially locked down from unwanted traffic.

Next, you can create and apply Calico policies to allow traffic from only certain source IPs.





 Step 3: Allow incoming traffic from a specific IP to the NLB 

You now decide to completely lock down traffic to the PR firm's cluster and test access by allowing only your own computer's IP address.

First, in addition to the node ports, you must block all incoming traffic to the NLB exposing the app. Then, you can create a policy that allows your system's IP address. At the end of Lesson 3, all traffic to the public node ports and NLB is blocked and only traffic from your allowed system IP is allowed.

Zoom

![The web server app is exposed by public NLB to your system IP only.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs_tutorial_policies_L3.png)

Figure 3. The webserver app is exposed by public NLB to your system IP only.



1. In a text editor, create a high-order Pre-DNAT policy called deny-lb-port-80.yaml to deny all incoming TCP and UDP traffic from any source IP to the NLB IP address and port. Replace <loadbalancer_IP> with the NLB public IP address from your cheat sheet.

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
name: deny-lb-port-80
spec:
applyOnForward: true
"vpc": { "id": "a0819609-0997-4f92-9409-86c95ddf59d3" }
}'

The following response shows after you initiate the request:



Table 2. Initiate response create example

 Response Body Details 

 available_ipv4_address_count <br>Always included <br>int64 The number of IPv4 addresses in this subnet that are not in-use, and have not been reserved by the user or the provider. <br>Example:15 
 created_at <br>Always included <br>date-time The date and time that the subnet was created 
 crn <br>Always included <br>string The CRN for this subnet <br>Possible values: 9 ≤ length ≤ 512 <br>Example:crn:v1:bluemix:public:is:us-south-1:a/123456::subnet:7ec86020-1c6e-4889-b3f0-a15f2e50f87e 
 <br><br> * href <br> Always included* <br> string<br><br><br> The URL for this subnet <br>Possible values: 10 ≤ length ≤ 8000, Value must match regular expression ^http(s)?://([^/?])([^?])(?([^]))?((.))?$ <br>Example:https://us-south.iaas.cloud.ibm.com/v1/subnets/7ec86020-1c6e-4889-b3f0-a15f2e50f87e 
 <br><br> * id <br> Always included <br> string<br><br><br> The unique identifier for this subnet <br>Possible values: 1 ≤ length ≤ 64, Value must match regular expression ^[-0-9a-z_]+$ <br>Example:7ec86020-1c6e-4889-b3f0-a15f2e50f87e
If the user list visibility is set to be restricted, this can limit a user's ability to view, search, and manage support cases in an account that they didn't open themselves.





 User management 

You can give users access to view users in an account, invite and remove users, and view and update user profile settings.



Table 21. Roles and example actions for the User Management service

 Roles Actions 

 Viewer View users in the account<br><br>View user profile settings 
 Operator View users in the account<br><br>View user profile settings 
 Editor View, invite, remove, and update users from the account<br><br>View and update user profile settings 
 Administrator View, invite, remove, and update users from the account<br><br>View and update user profile settings 



The viewer role on the user management service is a role that is commonly assigned for users assigned a role to view or manage support cases. If an account owner restricts the visibility of the user list in the IAM settings, users can't see support cases that are opened by other users in the account. However, if they are assigned the viewer role for the user management service, the user list visibility setting doesn't affect the ability to view cases in the account.





 Activity Tracker Event Routing 

You can give users access to run platform actions.



Table 22. Roles and example actions for the Activity Tracker Event Routing service

 Roles Actions 

 Viewer View Activity Tracker Event Routing configuration resources such as routes and targets. 
 Operator View Activity Tracker Event Routing configuration resources such as routes and targets. 
 Editor View, create, update, and delete Activity Tracker Event Routing resources. 
 Administrator View, create, update, and delete Activity Tracker Event Routing resources.<br><br>Assign access policies to manage Activity Tracker Event Routing resources to other users in the account. 









 Assigning access by using Terraform 

Before you can assign access by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform.
When you log in, any of the following types of accounts might be associated with your user credentials:



* Personal account
* Corporate account
* Corporate individual account





 Personal accounts 

Typically, each user has their own account that is their personal account. You can easily identify your personal account because it usually contains your name, for example, John Smith's Account.

You have full rights over all objects that are created in your personal account. You can invite other users to join your account, assign them rights over objects that you create, and assign them rights to create objects in your account. Because of these rights, the personal data of other users might be in your account, and your personal data might be in other user's accounts.

If you have permission to create an object in an account, you also have the right to modify and delete it, regardless of which account the object is stored in. When two users collaborate, they often share a personal account.





 Corporate accounts 

A corporate account is set up by your company. Typically, you are added automatically to the account, rather than being invited. Although corporate accounts provide users with a place to work, communicate, and share resources and charging, this set up is just a convention. A corporate account is really no different than a personal account. Objects that are created in a corporate account are associated with the account and users can be invited to the account.

Teams of people who work for a corporation often collaborate by using a corporate account.





 Corporate individual accounts 

When you work for a corporation, the work in your account might be legally owned by the corporation. Many users who work for a corporation have a corporate individual account. If you log in to your account by using credentials that contain your corporation's name and also have what appears to be a personal account, the work within your personal account might belong to the corporation.

A corporate individual account is no different from any other account. You can invite users to a corporate individual account and objects that are created in a corporate individual account are owned by the account.

If you work for a corporation that owns your work, a personal account that usually contains your name is considered a corporate individual account.







 Modifying, exporting, and deleting personal data
Created At: Tue Sep 18 19:58:38 UTC 2018
State: active
Credentials:
iam_apikey_name: auto-generated-apikey-621ffde2-ea10-4318-b297-d6d849cec48a
iam_role_crn: crn:v1:bluemix:public:iam::::serviceRole:Manager
url: https://apikey-v2-58B528DF5397465BB6673E1B79482A8C:5811381f6daff7255b288695c3544be63f550e975bcde46799473e69c7d48d61@f6cf0c55-48ea-4908-b441-a962b27d3bb6-bluemix.cloudant.com
username: apikey-v2-58B528DF5397465BB6673E1B79482A8C
port: 443
apikey: XXXXX-XXXXXX_XXXXXXXXXXXXX-XXXXXXXXXXX
host: f6cf0c55-48ea-4908-b441-a962b27d3bb6-bluemix.cloudant.com
iam_apikey_description: Auto generated apikey during resource-key operation for Instance - crn:v1:bluemix:public:cloudantnosqldb:us-south:a/b42116849bb7e2abb0841ca25d28ee4c:ee78351d-82bf-4e80-bc22-825c937fafa3::
Once the account is VRF and service endpoint enabled, the logging agent can be configured to use the private network by using the [Private Endpoint](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api) as the ingestion URL.



* Private endpoints are not accessible from the public internet.
* All traffic is routed to the IBM Cloud private network.









 How your data is stored in IBM Log Analysis 

IBM Log Analysis collects and aggregates logs.



 Data location 

IBM Log Analysis collects and aggregates logs in one centralized logging system.



* Log data is hosted on the IBM Cloud.
* Data is collocated in the location where the IBM Log Analysis instance is provisioned. For example, log data for an instance that is provisioned in US South is hosted in the US South region.
* Data from IBM Cloud services is collected and aggregated in each IBM Cloud location where the service is available.
* Data forwarded by a logging agent is collected and aggregated in the location where the logging instance configured for an agent is available.







 Data encryption 

All the data that is hosted in a logging instance is encrypted at rest using AES 256.

When a logging agent sends data to a logging instance, data is encrypted in transit over HTTPS.

When a user requests an export, the data is encrypted during transit, and is also encrypted at rest in IBM Cloud Object Storage (COS).





 Data retention 

The service plan that you choose for an IBM Log Analysis instance defines the number of days that data is stored and retained.

For example, if you choose the Lite plan, data is not stored at all. However, if you choose the 7-day plan, data is stored for 7 days and you have access to it through the logging Web UI.







 Data archives 

You can archive logs from an IBM Log Analysis instance into a bucket in an IBM Cloud Object Storage (COS) instance. [Learn more](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-archiving).
An example ACCOUNT is de810d0e-763f-46a6-ae88-50823dc85581-bluemix, and resulting example public endpoint would be de810d0e-763f-46a6-ae88-50823dc85581-bluemix.cloudantnosqldb.appdomain.cloud.





 Private Endpoints 

Private (internal) endpoints are added to all instances deployed on Dedicated Hardware plan environments. The IBM Cloud internal network endpoint is shown in the following example:

https://$ACCOUNT.private.cloudantnosqldb.appdomain.cloud

In this example, ACCOUNT is the service name of the service instance user in the URL. An example ACCOUNT is de810d0e-763f-46a6-ae88-50823dc85581-bluemix, and resulting example private endpoint would be de810d0e-763f-46a6-ae88-50823dc85581-bluemix.private.cloudantnosqldb.appdomain.cloud.

For more information on Private endpoints, see the [Service Endpoints](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-service-endpoints) documentation.

For more information about how to block public network connectivity by using IP allowlisting, see [Secure access control](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-securitysecure-access-control).







 Service credentials 

To generate service credentials for IBM Cloudant by using the IBM Cloud Dashboard, see [Creating an IBM Cloudant instance on IBM Cloud](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-getting-started-with-cloudant).
"fingerprint": "SHA256:RJ+YWs3rupwGFiJuLqY43tvmdeLOUjcIc9cA6IR8n8E",
"id": "dadae729-1d81-4a13-966e-f5d92699f103",
"name": "my-key1",
"resource_type": "key"
}
],
"user_data": "Content-Type: multipart/form-data; boundary=3efa30189c9e0e8ebc24a4decbbf4c2be7b26120c1cdd7cb7bc2ecb0c07cnMIME-Version: 1.0nn--3efa30189c9e0e8ebc24a4decbbf4c2be7b26120c1cdd7cb7bc2ecb0c07cnContent-Type: text/cloud-confignncloud-configndisable_root: falsenchpasswd:n list: |n root:genes1sn expire: falsenusers:n- defaultn- name: rootn lock-passwd: falsen ssh_pwauth: truenn--3efa30189c9e0e8ebc24a4decbbf4c2be7b26120c1cdd7cb7bc2ecb0c07c--"
}
Show more





 Retrieve instance information 

Make a GET "http://169.254.169.254/metadata/v1/instance" call to retrieve detailed information about the instance. To tailor information for specific instance details, such as network interfaces, see [Extra instance metadata endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-get-metadata&interface=apiimd-additional-inst-metadata).
VRVDR-49326 Major At system login user level operator "show queuing" command does not work 
 VRVDR-49231 Critical PPPoE Client - Not re-establishing dropped connection automatically 
 VRVDR-48466 Critical DNS nslookup query within a routing instance vrf is broken 
 VRVDR-48337 Critical NCS fails to load vyatta-system-image YANG 
 VRVDR-48203 Minor Split IDT servo into separate shared libraries 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1908h

 Issue Number CVSS score Advisory Summary 

 VRVDR-51236 8.6 DSA-4689-1 CVE-2019-6477, CVE-2020-8616, CVE-2020-8617: Debian DSA-4689-1 : bind9 - security update 
 VRVDR-51142 5.5 DSA-4685-1 CVE-2020-3810: Debian DSA-4685-1 : apt - security update 
 VRVDR-51054 6.7 DSA-4688-1 CVE-2020-10722, CVE-2020-10723, CVE-2020- 10724: Debian DSA-4688-1 : dpdk - security update 
 VRVDR-50530 7.1 DSA-4647-1 CVE-2020-0556: Debian DSA-4647-1 : bluez - security update 









 1908g 



 Issues Resolved 



Issues resolved for 1908g

 Issue Number Priority Summary 

 VRVDR-50563 Critical Transport-link / port peering no longer works on xsm, sm and md 









 1908f 



 Issues Resolved 



Issues resolved for 1908f

 Issue Number Priority Summary 

 VRVDR-50467 Critical Marvell : Sometimes after dataplane crash front panel ports do not come up 
 VRVDR-50387 Major qemu-wrap.py script confusing libvirt/virsh 
 VRVDR-50376 Major Increase max number of clients of dp_events 
 VRVDR-50293 Critical Forwarded cross VRF traffic blackholed when SNAT is applied
Custom Event Fields Type Description 

 requestData.RequestParameters.repository String The name of the repository that you want to see image vulnerability assessments for. For example, us.icr.io/namespace/image. 
 requestData.RequestParameters.includeIBM String When set to true, the returned list contains IBM public images and the account images. If not set, or set to false, the list contains only the account images. 
 requestData.RequestParameters.includePrivate String When set to false, the returned list does not contain the private account images. If not set, or set to true, the list contains the private account images. 



For more information about the action container-registry.account-vulnerability-report.list, see [Get the vulnerability assessment for all images](https://cloud.ibm.com/apidocs/container-registry/vaaccountreportquerypath) in the API documentation.





 Request data for the account vulnerability status 

Get the vulnerability assessment status (container-registry.account-vulnerability-status.list) for the list of registry images that belong to a specific account.

The following table lists the fields that are available through the requestData field in events with the action container-registry.account-vulnerability-status.list.



Table 19. Custom event fields for Container Registry account vulnerability status list

 Custom Event Fields Type Description 

 requestData.RequestParameters.repository String The name of the repository that you want to see image vulnerability assessments for. For example, us.icr.io/namespace/image. 
 requestData.RequestParameters.includeIBM String When set to true, the returned list contains IBM public images and the account images. If not set, or set to false, the list contains only the account images. 
 requestData.RequestParameters.includePrivate String When set to false, the returned list does not contain the private account images. If not set, or set to true, the list contains the private account images.
["payload"]'

LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo=





 Required parameters 

-i, --instance-id
: The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command.

$ export KP_INSTANCE_ID=INSTANCE_ID







 kp instance policies 

Retrieve details about instance policies, such as allowed networks (public-and-private or private-only) and dual authorization delete (deleting a key requires an authorization from two users).

ibmcloud kp instance policies
-i, --instance-id INSTANCE_ID
[-a, --allowed-network]
[-d, --dual-auth-delete]
[-o, --output OUTPUT]



 Example 

Description

 update the instance policy and set the allowed network to public-and-private
$ ibmcloud kp instance policy-update allowed-network --enable --network-type public-and-private

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies

Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Created By user id ...<redacted>...
Creation Date 2020-06-22T16:17:52Z
Last Updated 2020-06-22T16:17:52Z
Updated By user id ...<redacted>...
Policy Type allowedNetwork
Enabled true
Network Allowed public-and-private

 disable the instance allowed-network policy
$ ibmcloud kp instance policy-update allowed-network --disable

Updating instance policy...
OK

 list the instance policies - the policy exists and it's disabled
$ ibmcloud kp instance policies
If the instance was provisioned by using a shared catalog image in another account, this output is the output that you always see even if the image exists in the owning account.

Additionally, it is possible that the referenced image might have the same name as a custom image in your account. But these image names are for two different images in two different accounts. While the CLI uses both ID and Name to identify an image, only the ID uniquely identifies an image across IBM Cloud®.

Verify that your CLI-based automation handles image reference lookup failures gracefully and do not assume that inaccessible images were deleted, even if it runs with full access to your images. To avoid possible retrieval or use of the wrong image by Name, specify the image ID instead.





 Using cross-account image references in a private catalog in the API 

Instances that you provision belong to your account. Images that are shared to your account through a private catalog might belong to other accounts. When you provision an instance from an image that belongs to another account or from an instance template that specifies such an image, the image still belongs to the other account even though the instance belongs to your account. A reference to such an image might exist in details of the instance and related resources. For example, details about its boot volume and any snapshot that are created from that boot volume might reference that image. Regardless of your authorizations, you can't access such an image by its id, crn, or href and attempts fail as if the image does not exist.

In the API, an image reference appears in places such as the image properties of the Instance and BareMetalServerInitialization response schemas and in the source_image properties of the Volume and Snapshot response schemas. The following example uses retrieving instance data to illustrate how this error might occur.

curl -X GET "$vpc_api_endpoint/v1/instances/r006-44905aa4-119d-5622-00ce-face32b78999?version=2022-09-06&generation=2" -H "Authorization: Bearer $iam_token" | jq -r '(.image)'

When you run this command, you see the following output.

{
Why do I see xxxhiddenxxx in the deployment output log instead of a variable name that I provided? 

The solution provides useful information in the Terraform output log regarding the cluster and how to access cluster nodes (for example, SSH command, region, trusted profile ID, and so on).

The solution is integrated with the IBM Cloud catalog tile, and input that's provided there triggers Schematics to deploy the VPC resources that form the cluster. When passing sensitive information such as username and password, if that value matches with data in the deployment logs, Schematics outputs the value as xxxhiddenxxx according to a security policy that has been implemented.