vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) Shared 
 1.2.35 Ensure that the API server makes use of only Strong Cryptographic Ciphers. Not Scored 1 Pass IBM 







 1.3 Controller manager 



Section 1.3 Controller manager benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 1.3.1 Ensure that the --terminated-pod-gc-threshold option is set as appropriate. Scored 1 Pass IBM 
 1.3.2 Ensure that the --profiling option is set to false. Scored 1 Pass IBM 
 1.3.3 Ensure that the --use-service-account-credentials option is set to true. Scored 1 Pass IBM 
 1.3.4 Ensure that the --service-account-private-key-file option is set as appropriate. Scored 1 Pass IBM 
 1.3.5 Ensure that the --root-ca-file option is set as appropriate. Scored 1 Pass IBM 
 1.3.6 Ensure that the RotateKubeletServerCertificate option is set to true. Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) IBM 
 1.3.7 Ensure that the --bind-address option is set to 127.0.0.1. Scored 1 Pass IBM 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 1.4.1 Ensure that the --profiling option is set to false. Scored 1 Pass IBM 
 1.4.2 Ensure that the --bind-address option is set to 127.0.0.1. Scored 1 Pass IBM 









 2 Etcd node configuration 

Review the Etcd Node Configuration results of the version 1.5 CIS Kubernetes benchmark.



Section 2 Etcd Node Configuration benchmark results

 Section Recommendation Scored? Level Result Responsibility
1.2.32 Ensure that the --etcd-cafile argument is set as appropriate. Scored 1 Pass IBM 
 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 1.2.34 Ensure that encryption providers are appropriately configured. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Not Scored 1 Pass IBM 







 1.3 Controller manager 



Section 1.3 Controller manager benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate. Scored 1 Pass IBM 
 1.3.2 Ensure that the --profiling argument is set to false. Scored 1 Pass IBM 
 1.3.3 Ensure that the --use-service-account-credentials argument is set to true. Scored 1 Pass IBM 
 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate. Scored 1 Pass IBM 
 1.3.5 Ensure that the --root-ca-file argument is set as appropriate. Scored 1 Pass IBM 
 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true. Scored 2 Pass IBM 
 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1. Scored 1 Pass IBM 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.4.1 Ensure that the --profiling argument is set to false. Scored 1 Pass IBM
Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.4.2 Consider external secret storage. Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller. Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces. Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.6.3 Apply security context to your pods and containers. Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.6.4 The default namespace should not be used. Scored 2 Pass Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation
Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) IBM 
 4.2.7 Ensure that the --make-iptables-util-chains option is set to true. Scored 1 Pass IBM 
 4.2.8 Ensure that the --hostname-override option is not set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) IBM 
 4.2.9 Ensure that the --event-qps option is set to 0 or a level which ensures appropriate event capture. Not Scored 2 Pass IBM 
 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Scored 1 Pass IBM 
 4.2.11 Ensure that the --rotate-certificates option is not set to false. Scored 1 Pass IBM 
 4.2.12 Ensure that the RotateKubeletServerCertificateoption is set to true. Scored 1 Pass IBM 
 4.2.13 Ensure that the kubelet makes use of only Strong Cryptographic Ciphers Not Scored 1 Pass IBM 









 5 Kubernetes policies 

Review the Kubernetes Policies results of the version 1.5 CIS Kubernetes benchmark.



 5.1 RBAC and service accounts 



Section 5.1 RBAC and Service Accounts benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.1.1 Ensure that the cluster-admin role is only used where required. Not Scored 1 Pass Shared 
 5.1.2 Minimize access to secrets. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared 
 5.1.3 Minimize wildcard use in Roles and ClusterRoles.
1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 Scored 1 Pass IBM 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.4.1 Ensure that the --profiling argument is set to false Scored 1 Pass IBM 
 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 Scored 1 Pass IBM 









 2 Etcd node configuration 



Section 2 Etcd Node Configuration benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate Scored 1 Pass IBM 
 2.2 Ensure that the --client-cert-auth argument is set to true Scored 1 Pass IBM 
 2.3 Ensure that the --auto-tls argument is not set to true Scored 1 Pass IBM 
 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate Scored 1 Pass IBM 
 2.5 Ensure that the --peer-client-cert-auth argument is set to true Scored 1 Pass IBM 
 2.6 Ensure that the --peer-auto-tls argument is not set to true Scored 1 Pass IBM 
 2.7 Ensure that a unique Certificate Authority is used for etcd Not Scored 2 Pass IBM 







 3 Control plane configuration 



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.1.1 Client certificate authentication should not be used for users Not Scored 2 Pass Shared 







 3.2 Logging 



Section 3.2 Logging benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.2.1 Ensure that a minimal audit policy is created Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared
Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) IBM 
 4.2.9 Ensure that the --event-qps option is set to 0 or a level that ensures appropriate event capture. Not Scored 2 Pass IBM 
 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Scored 1 Pass IBM 
 4.2.11 Ensure that the --rotate-certificates option is not set to false. Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) IBM 
 4.2.12 Ensure that the RotateKubeletServerCertificate option is set to true. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) IBM 
 4.2.13 Ensure that the kubelet makes use of only Strong Cryptographic Ciphers. Not Scored 1 Pass IBM 









 5 Kubernetes policies 

Review the Kubernetes Policies results of the version 1.5 CIS Kubernetes benchmark.



 5.1 RBAC and service accounts 



Section 5.1 RBAC and Service Accounts benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.1.1 Ensure that the cluster-admin role is only used where required. Not Scored 1 Pass Shared 
 5.1.2 Minimize access to secrets. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) Shared 
 5.1.3 Minimize wildcard use in Roles and ClusterRoles. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) Shared
A change made for the March 4 service update caused a value of 0 to return an error. (The service returns an error if you specify a negative value.)

Change to passing value of 0 for word_alternatives_threshold parameter
: For the word_alternatives_threshold parameter, the service again accepts a value of 0 . A change made for the March 4 service update caused a value of 0 to return an error. (The service returns an error if you specify a negative value.)

New limit on maximum precision for confidence scores
: The service now returns all confidence scores with a maximum precision of two decimal places. This change includes confidence scores for transcripts, word confidence, word alternatives, keyword results, and speaker labels.





 4 March 2019 

Updates to Brazilian Portuguese, French, and Spanish narrowband models for improved speech recognition
: The following narrowband language models have been updated for improved speech recognition:



* Brazilian Portuguese narrowband model (pt-BR_NarrowbandModel)
* French French model (fr-FR_NarrowbandModel)
* Spanish narrowband model (es-ES_NarrowbandModel)



By default, the service automatically uses the updated models for all speech recognition requests. If you have custom language or custom acoustic models that are based on the models, you must upgrade your existing custom models to take advantage of the updates by using the following methods:



* POST /v1/customizations/{customization_id}/upgrade_model
* POST /v1/acoustic_customizations/{customization_id}/upgrade_model



For more information, see [Upgrading custom models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-custom-upgrade).





 28 January 2019 

New support for IBM Cloud IAM by WebSocket interface
: The WebSocket interface now supports token-based Identity and Access Management (IAM) authentication from browser-based JavaScript code. The limitation to the contrary has been removed. To establish an authenticated connection with the WebSocket /v1/recognize method:



* If you use IAM authentication, include the access_token query parameter.
An unsigned number followed by st is interpreted as a positive increase. For example, +5st or 5st.
* A keyword: One of the following six keywords, which modify the pitch to the corresponding predefined values:



* default uses the service's default baseline pitch.
* x-low shifts the pitch baseline down by 12 semitones.
* low shifts the pitch baseline down by six semitones.
* medium produces the same behavior as default.
* high shifts the pitch baseline up by six semitones.
* x-high shifts the pitch baseline up by 12 semitones.





Expressive neural voices support only percentage values for the pitch attribute. They do not support the use of Hertz, semitones, or keywords.

The best way to determine what works for your application is to make adjustments based on percentages and experiment with different values. Try incremental changes of five or ten percent before making more significant modifications.

<prosody pitch="150Hz">Transpose pitch to 150 Hz</prosody>
<prosody pitch="-20Hz">Lower pitch by 20 Hz from baseline</prosody>
<prosody pitch="+20Hz">Increase pitch by 20 Hz from baseline</prosody>
<prosody pitch="-10%">Decrease pitch by 10 percent</prosody>
<prosody pitch="+10%">Increase pitch by 10 percent</prosody>
<prosody pitch="-12st">Lower pitch by 12 semitones from baseline</prosody>
<prosody pitch="+12st">Increase pitch by 12 semitones from baseline</prosody>
<prosody pitch="x-low">Lower pitch by 12 semitones from baseline</prosody>





 The rate attribute 

The rate attribute indicates a change in the speaking rate for the text within the element. Accepted values are



* A number with no unit designation: The rate is changed to the specified number of words per minute. For example, a value of 50 indicates a speaking rate of 50 words per minute.
1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 Scored 1 Pass IBM 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.4.1 Ensure that the --profiling argument is set to false Scored 1 Pass IBM 
 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 Scored 1 Pass IBM 









 2 Etcd node configuration 



Section 2 Etcd Node Configuration benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate Scored 1 Pass IBM 
 2.2 Ensure that the --client-cert-auth argument is set to true Scored 1 Pass IBM 
 2.3 Ensure that the --auto-tls argument is not set to true Scored 1 Pass IBM 
 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate Scored 1 Pass IBM 
 2.5 Ensure that the --peer-client-cert-auth argument is set to true Scored 1 Pass IBM 
 2.6 Ensure that the --peer-auto-tls argument is not set to true Scored 1 Pass IBM 
 2.7 Ensure that a unique Certificate Authority is used for etcd Not Scored 2 Pass IBM 







 3 Control plane configuration 



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.1.1 Client certificate authentication should not be used for users Not Scored 2 Pass Shared 







 3.2 Logging 



Section 3.2 Logging benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 3.2.1 Ensure that a minimal audit policy is created Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared
[Modifying a type system without losing human annotations](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-improve-mlwks_projtypesysmod)









 Setting the IAA threshold 

To help you decide whether to accept or reject an annotated document set, you can specify an inter-annotator agreement threshold. The threshold helps you compare how well or poorly inter-annotator agreement compares to the IAA score calculated by the system.



 About this task 

To compare how different human annotators annotated the same documents, specify an evaluation threshold. If the annotations made by one human annotator differ from the annotations made by another human annotator to the point where the difference results in a low score, it means that the annotators do not agree. The disagreement needs to be investigated and resolved.





 Procedure 

To set the inter-annotator agreement threshold:



1. Log in as a Knowledge Studio administrator, and select your workspace.
2. Select the Settings > IAA Settings tab.
3. Specify a value between 0 and 1, such as .5 or .8, and then click Save.









 Connecting to annotation guidelines 

After you create annotation guidelines for your project, you can configure Knowledge Studio to connect to them. For help with choosing the correct annotation to apply, human annotators can review the guidelines while annotating documents. Administrators can also review the guidelines if they need assistance while resolving annotation conflicts in overlapping documents.



 Procedure 

To connect the ground truth editor and adjudication tool to your annotation guidelines:



1. Log in as a Knowledge Studio administrator, and select your workspace.
2. select the Settings > Annotation Guidelines tab.
3. Specify the URL to where your guidelines are hosted.
4. Click Save. The system connects the ground truth editor and adjudication tool to your annotation guidelines.
For example, you might change the split ratio to 60%-33%-7%.
IBM Cloud Pak for Data

Increase the capacity of your deployed service instance by scaling up service pods.









 Evaluating the extractor 

To review metrics from the test run of the entity extractor model that you created, click the Evalute extractor tab.

The following table describes the available evaluation metrics.



Metrics details

 Metric Description 

 Confusion matrix A table that provides a detailed numeric breakdown of annotated document sets. Use it to compare entity type mentions that are labeled by the machine learning model to entity type mentions that are labeled in the training data. 
 F1 Score Measures whether the optimal balance between precision and recall is reached. The F1 score can be interpreted as a weighted average of the precision and recall values. An F1 score reaches its best value at 1 and worst value at 0. Overall scores are lower if the model doesn't have enough training data to learn from. 
 Precision Measures how many of the overall extracted mentions are classified as the correct entity type. A false positive is when an entity label is incorrect, but was predicted to be correct (Predicted = Positive, Actual = Negative). False positives typically mean low precision. 
 Recall Measures how often entity type mentions that should be extracted are extracted. A false negative is when an entity type label is correct, but was predicted to be incorrect (Predicted = Negative, Actual = Positive). False negatives typically mean low recall. 





1. Review the metrics that are provided about the extractor model test run to determine whether more training is needed.
2. Explore the test results in more detail by clicking Review training results in test set.

Documents from the test set are displayed with the predicted labels shown in one panel and the ground truth shown in the other.



* Predicted labels are the examples that the entity extractor identified and labeled as entity types.
* The ground truth has examples that a person labeled or that were bulk labeled and reviewed by a person. Labels in the ground truth are considered the correct labels.



The performance of the model is rated based on how closely the predicted labels match the ground truth.





 Improving the extractor 

The following table shows suggested fixes for common problems.



Improvement actions
1.2.19 Ensure that the --insecure-port option is set to 0. Scored 1 Pass IBM 
 1.2.20 Ensure that the --secure-port option is not set to 0. Scored 1 Pass IBM 
 1.2.21 Ensure that the --profiling option is set to false. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) IBM 
 1.2.22 Ensure that the --audit-log-path option is set. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 1.2.23 Ensure that the --audit-log-maxage option is set to 30 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 1.2.24 Ensure that the --audit-log-maxbackup option is set to 10 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 1.2.25 Ensure that the --audit-log-maxsize option is set to 100 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Scored 1 Pass IBM 
 1.2.27 Ensure that the --service-account-lookup option is set to true. Scored 1 Pass IBM 
 1.2.28 Ensure that the --service-account-key-file option is set as appropriate. Scored 1 Pass IBM
Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Scored 1 Pass IBM 
 1.2.27 Ensure that the --service-account-lookup option is set to true. Scored 1 Pass IBM 
 1.2.28 Ensure that the --service-account-key-file option is set as appropriate. Scored 1 Pass IBM 
 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile options are set as appropriate. Scored 1 Pass IBM 
 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Scored 1 Pass IBM 
 1.2.31 Ensure that the --client-ca-file option is set as appropriate. Scored 1 Pass IBM 
 1.2.32 Ensure that the --etcd-cafile option is set as appropriate. Scored 1 Pass IBM 
 1.2.33 Ensure that the --encryption-provider-config option is set as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 
 1.2.34 Ensure that encryption providers are appropriately configured. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 
 1.2.35 Ensure that the API server makes use of only Strong Cryptographic Ciphers. Not Scored 1 Pass IBM 







 1.3 Controller manager 



Section 1.3 Controller manager benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.3.1 Ensure that the --terminated-pod-gc-threshold option is set as appropriate. Scored 1 Pass IBM