vania-janet/multiturn-rag-retrieval-data huggingface dataset:
5.1.3 Minimize wildcard use in Roles and ClusterRoles Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 5.1.4 Minimize access to create pods Not Scored 1 Pass Shared 
 5.1.5 Ensure that default service accounts are not actively used. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 5.1.6 Ensure that Service Account Tokens are only mounted where necessary Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 







 5.2 Pod Security Policies 



Section 5.2 Pod Security Policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.2.1 Minimize the admission of privileged containers Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared 
 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-412ibm-remediations-and-explanations-412) Shared
The VPN tunnel endpoint (router) forwards the request to the on-premises server or mainframe, depending on the destination IP address that was specified in step 2. The necessary data is sent back over the VPN connection to myapp2 through the same process.



To set up a Virtual Router Appliance,



1. [Order a VRA](https://cloud.ibm.com/docs/virtual-router-appliance).
2. [Configure the private VLAN on the VRA](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-managing-vlans-and-gateway-appliances).
3. To enable a VPN connection by using the VRA, [configure VRRP on the VRA](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-working-with-high-availability-and-vrrphigh-availability-vpn-with-vrrp).



If you have an existing router appliance and then add a cluster, the new portable subnets that are ordered for the cluster are not configured on the router appliance. To use networking services, you must enable routing between the subnets on the same VLAN by [enabling VLAN spanning or VRF](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworker-worker).
Applying DevSecOps and shift-left to the delivery lifecycle reduces the risk of naively releasing known vulnerabilities into production.

Organizations can take advantage of the significant benefits of using a standard set of processes for continuous integration and continuous delivery by multiple disparate teams that develop heterogeneous offerings and components. These benefits include consistency and economies of scales. When a single set of prescriptive reference pipelines that are instrumented for compliance are used for all of the components across an organization, developers spend less time to develop automation solutions and can focus on feature development. The development leaders and security officers can be confident that the necessary controls are in place to ensure secure, compliant software and provide evidence that can be used in an audit. Security audits within an organization can be streamlined when a standard implementation is used, as opposed to each component or offering team that uses their own compliance implementation.

Learn more about [DevSecOps](https://www.ibm.com/cloud/learn/devsecops).

For more information about the DevSecOps reference architecture, see [DevSecOps architecture](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-arch).

Get started and [deploy a secure app with DevSecOps best practices](https://cloud.ibm.com/docs/devsecops?topic=devsecops-tutorial-cd-devsecops).
* There are no deployment connectors or built-in integrations available. You must build a custom client application that can host the assistant. As a result, the Integrations page is not included in the product user interface.
* The @sys-person and @sys-location system entities are not supported and the new version of the numeric system entities is not available.
* There is no search function in the pages of the product.
* You cannot use the Activity Tracker service to track user actions.
* Intent recommendations and the new irrelevance detection model are not supported.
* The product tour that is available to some first-time users of the cloud-based product is not available.
* You cannot manage user access at the individual skill and assistant level. You can control only who can access the entire service instance, which includes all of its skills and assistants. For more information about granting access to services in IBM Cloud Pak for Data, see [3.0.1 Managing users](https://www.ibm.com/support/knowledgecenter/SSQNUZ_3.0.1/cpd/admin/users.html).







 14 April 2020 

IBM Cloud Private End Of Support
: Effective 30 September 2020, IBM will withdraw support for IBM Watson® Assistant on IBM Cloud Private. For more information, see the [announcement](https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?infotype=an&subtype=ca&appname=gpateam&supplier=897<=tternum=ENUS920-075).





 28 February 2020 

IBM Watson® Assistant for IBM Cloud Pak® for Data version 1.4.1 is available
: Watson Assistant for IBM Cloud Pak® for Data version 1.4.1 is compatible with IBM Cloud Pak® for Data version 2.5.

New backup and restore
: A new backup and restore script is available. See [Backing up and restoring data](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-backup).

Webhooks now generally available
: The Webhooks feature is now generally available.
: If you set up [VPC security groups](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-group) or [VPC access control lists (ACLs)](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-acls) to secure your cluster network, you can now create the rules to allow the necessary traffic from the control plane IP addresses and Akamai IPv4 IP addresses to health check your ALBs. Previously, a quota on the number of rules per security group or ACL prevented the ability to create all necessary rules for health checks.





 10 May 2021 

New! PX-Backup is now available
: For more information, see [Backing up and restoring apps and data with PX-Backup](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_backup).

Calico KDD update in 1.19
: Added a step to check for Calico NetworkPolicy resources that are scoped to non-existent namespaces before [updating your cluster to Kubernetes version 1.19](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_119119_before).

Cluster autoscaler add-on
: [Patch update 1.0.2_267](https://cloud.ibm.com/docs/containers?topic=containers-ca_changelog) of the cluster autoscaler add-on is available.

IBM Cloud Object Storage plug-in
: [Version 2.0.9](https://cloud.ibm.com/docs/containers?topic=containers-cos_plugin_changelog) of the IBM Cloud Object Storage plug-in is available.

Worker node versions
Then, specify the Resource Group and ibm_resource_group variable, which outputs the resource_group_name.





 variables.tf 

[variables.tf](https://github.com/IBM/elasticsearch-cos-snapshot-restore/blob/main/terraform/variables.tf) contains the variable definitions ibmcloud_api_key, region, and elastic_password. Update these variables with your API key, preferred region, and your Elasticsearch password.

After setting up your resources, configurations, and variables, go ahead and run your Terraform script. Navigate to your terraform folder and install the infrastructure with the following command:

terraform init
terraform apply --auto-approve

The Terraform script outputs configuration data that is needed to run the application, so copy it into the root folder:

terraform output -json >../config.json







 Step 3: Run the shell snapshot script 

Run the [migrate.sh](https://github.com/IBM/elasticsearch-cos-snapshot-restore/blob/main/migrate.sh) file in the main project folder. This shell script uses the information that is provided by the config.json file to perform the necessary migration steps.



* Create different snapshot names by adding a timestamp.
* Get database and S3/COS parameters.
* Mount S3/COS bucket on source deployment.
* Mount S3/COS bucket on target deployment.
* Close all indexes on the target so the restore can be run without touching the icd-auth index, which is protected by Cloud Databases.



Run migrate.sh as many times as necessary to fully back up your data.

Snapshots are incremental, so the first snapshot takes longer than the rest.

Once your COS bucket has all the necessary snapshots, stop any writes to the source. Then, run migrate.sh one more time to take a final snapshot and restore it to the target. All of your data is now in the target. Point your applications to the target database and your upgrade is complete.
Configuring access for connecting an application to a queue manager 

To connect an application to a queue manager, it must have been granted permissions to access queue managers within your IBM MQ service instance. The application must connect to the queue manager using its Application username and the password must be the application's API key.



* Note: applications have access to connect to all queues and topics starting with DEV.*. They have permission to put / get messages and publish / subscribe to topics.



If you want to know more about IBM MQ users and applications before proceeding, you can find [information here](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_users_and_apps)



 Granting an application permissions to access queue managers within your IBM MQ service instance 

If you are the administrator of your IBM Cloud Account, then you should have the necessary administrator privileges for your IBM MQ service instance.

If you do not have the necessary privileges, someone with the required privileges should follow these instructions to grant you access to queue managers within your IBM MQ service instance.

The required privileges to add new application credentials are configured in IAM and include:



* Administrator for the MQ service in the required resource group
* Administrator for the User Management service in account management services
* The account owner will need to set [unrestricted visibility of the user list in the account](https://cloud.ibm.com/docs/account?topic=account-iam-user-settinguserlistview)





1. Log in to the IBM Cloud console to view the dashboard.
2. In the Resource summary panel click Services.
3. In the Offering filter box type MQ.
4. Locate and click on your IBM MQ service instance, found under the 'Services' heading.
5. Once in the MQ on Cloud service, click the Application credentials tab.

!
Example credential unset command 

ibmcloud oc credential unset --region us-south









 infra-permissions commands 

Check classic IBM Cloud infrastructure permissions that are used in Red Hat OpenShift on IBM Cloud.

The ibmcloud oc infra-permissions commands check only classic IBM Cloud infrastructure, not VPC permissions.



 ibmcloud oc infra-permissions get 

Classic infrastructure

Check whether the credentials that allow [access to the IBM Cloud infrastructure portfolio](https://cloud.ibm.com/docs/openshift?topic=openshift-access-creds) for the targeted resource group and region are missing suggested or required infrastructure permissions.

If the infrastructure credentials for the region and resource group are missing any permissions, the output of this command returns a list of required and suggested permissions.



* Required: These permissions are needed to successfully order and manage infrastructure resources such as worker nodes. If the infrastructure credentials are missing one of these permissions, common actions such as worker reload can fail for all clusters in the region and resource group.
* Suggested: These permissions are helpful to include in your infrastructure permissions, and might be necessary in certain use cases. For example, the Add Compute with Public Network Port infrastructure permission is suggested because if you want public networking, you need this permission. However, if your use case is a cluster on the private VLAN only, the permission is not needed so it is not considered required.



For a list of common use cases by permission, see [Infrastructure roles](https://cloud.ibm.com/docs/openshift?topic=openshift-classic-roles).

What if I see an infrastructure permission that I can't find in the console or [Infrastructure roles](https://cloud.ibm.com/docs/openshift?topic=openshift-classic-roles) table?
: Support Case permissions are managed in a different part of the console than infrastructure permissions. See step 8 of [Customizing infrastructure permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsinfra_access).
[112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/depmodels/cloud/)[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>![190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture)[IBM Training<br><br>Build your skills with IBM Cloud training.<br><br>![83-Elements-of-the-cloud.svg](https://cloud.ibm.com/media/docs/images/homepage/83-Elements-of-the-cloud.svg)](https://www.ibm.com/training/cloud)[Community<br><br>Join the IBM Cloud community and collaborate with others.<br><br>![35-Connectivity.svg](https://cloud.ibm.com/media/docs/images/homepage/35-Connectivity.svg)](https://community.ibm.com/community/user/publiccloud/home)

 Latest updates 

[View more](https://cloud.ibm.com/docs/overview?topic=overview-whatsnew)10 April 2023 | View email notification history

You can use the Communication history page in the console to check the status of all email notifications that are sent you to verify if the emails are being delivered successfully. You can also view the last 90 days of IBM Cloud email history, which can help save you time troubleshooting any delivery issues without needing to contact IBM support.

22 September 2022 | Getting help in the console

You can now find the documentation and Support Center help options from a single menu item in the IBM Cloud console menu bar. Check out the new Help option from the menu bar that now includes your links for Docs, the Support Center, a form to give us feedback, and available guided tours.
AC-6 (5) - Privileged Accounts 



  Control requirements 

AC-6 (5) - 0
:   The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].





  NIST supplemental guidance 

Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from having access to privileged information/functions. Organizations may differentiate in the application of this control enhancement between allowed privileges for local accounts and for domain accounts provided organizations retain the ability to control information system configurations for key security parameters and as otherwise necessary to sufficiently mitigate risk.
Bare metal hosts 

The IBM Cloud® for VMware® Regulated Workloads is built upon multiple clusters of bare metal hosts with VMware ESXi™ as the hypervisor.

Zoom

![IBM Cloud for VMware Regulated Workloads infrastructure overview](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vrw-v2-overview.svg)

Figure 1. IBM Cloud for VMware Regulated Workloads infrastructure overview



 Management cluster 

The management cluster is formed of four bare metal hosts. Configuring the cluster with four hosts is the mandatory, minimum requirement where vSAN™ is the storage platform. These hosts are sized to meet the requirements of the management applications. No nonmanagement workloads are run in the management cluster.





 Gateway cluster 

The gateway cluster requires only two bare metal hosts. vSAN is not an available storage option. Shared storage is not required since use of the local datastore is preferred. The hosts are sized to support the requirements of the virtual router or gateway appliance that is deployed to the individual hosts.





 Workload cluster 

The workload cluster uses vSAN for storage and thus a minimum of four bare metal hosts with ESXi as the hypervisor are required. More hosts are added as necessary to scale horizontally to deliver the required compute, memory, and storage required by the hosted applications.

The deployment of more workload clusters is supported to supply dedicated resources for an application or business unit.





 Physical host connections 

Each physical host in this design has two redundant pairs of 10 Gbps Ethernet connections into each IBM Cloud top of rack (ToR) switch (public and private). The adapters are set up as individual connections (unbonded) for a total of 4 x 10 Gbps connections. This design allows networking interface card (NIC) connections to work independently from each other.

Removing physical network connectivity to the public or private network for the bare metal servers that are used within the vCenter Server offering is not possible.
[190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture)[IBM Training<br><br>Build your skills with IBM Cloud training.<br><br>![83-Elements-of-the-cloud.svg](https://cloud.ibm.com/media/docs/images/homepage/83-Elements-of-the-cloud.svg)](https://www.ibm.com/training/cloud)[Community<br><br>Join the IBM Cloud community and collaborate with others.<br><br>![35-Connectivity.svg](https://cloud.ibm.com/media/docs/images/homepage/35-Connectivity.svg)](https://community.ibm.com/community/user/publiccloud/home)

 Latest updates 

[View more](https://cloud.ibm.com/docs/devsecops?topic=devsecops-release-notes)07 December 2022 | Integration for Infrastructure as Code now available as a Toolchain template

DevSecOps Continuous Integration for Infrastructure as Code is available as a Toolchain template in the Toolchain catalog.

30 November 2022 | CRA scans and Cocoa Tekton improvements

CRA scans are now part of the `app-preview-pr-listener` in the CI pipeline. Also, Cocoa Tekton `get-pipeline-logs` now supports pulling logs for specific stages.

25 October 2022 | CRA issue parser improvements

CRA issue parser now contains an `Introduced by` field when creating a new issue found during a scan.
From the Configurations tab in your project, click the name of your deployable architecture configuration > Edit.
2. Review the input values and make any necessary changes.
3. Click Deploy. This action includes preparing your resources to deploy, which can take a few minutes. You are notified when the deployment is successful.
4. Review the outputs from the deployable architecture.



If any additional changes are needed, or if a new version of the deployable architecture is available, you must deploy your architecture again. You must also deploy your architecture again [if there is any drift detected](https://cloud.ibm.com/docs/schematics?topic=schematics-drift-note&interface=uidrift-ui) in your Schematics workspace.





 Viewing resources 

View your resources that are tied to the deployable architecture configuration by completing the following steps:



1. From the projects list, select a project.
2. Go to the Configurations tab, and select a deployable architecture configuration.
3. From the Resources tab, you can view the full list of deployed resources. For additional information, click View in Schematics.







 Reviewing output values 

Output values populate after the architecture is deployed, and they provide important information about your created resources. After the deployment is successful, you can go to the Output tab to view the outputs.
Using software that is already Financial Services Validated will make it easier for you to provide this evidence.





 4. Implement a system of account, identity, and access management to enable a zero-trust environment 

Requirement: Implement a system of zero-trust where account, identity, and access management are based on the principles of separation of duties and least privilege. This system must include IBM Cloud accounts and resources under the control of IBM Cloud Identity and Access Management (IAM) as well as supporting accounts and resources outside of IBM Cloud.

Purpose & value: The design of the IBM Cloud for Financial Services is intended to enable a zero-trust model for deployments of the reference architectures. The scope of any one individual operator or administrator is strictly limited to those actions necessary and appropriate to perform their assigned roles. Overlap of duties is minimized or eliminated to prevent the need for privilege escalation that may result in undesired flows of information into or out of your deployment. It is guided by two major principles:



* [Separation of duties](https://csrc.nist.gov/glossary/term/separation_of_duty) - No user should be given enough privileges to misuse the system on their own. For example, no one user should have the authority/ability to develop, compile, and/or move object code from non-production environments into production environments.
* [Least privilege](https://csrc.nist.gov/glossary/term/least_privilege) - Restrict the access privileges of authorized personnel (e.g., program execution privileges, file modification privileges) to the minimum necessary to perform their jobs. Access must be granted based only on a need to know. Access that has not been explicitly permitted is denied by default. Role-based access controls (RBAC) are used to allocate logical access to a specific job function or area of responsibility, rather than to an individual. Administrative access is only granted to individuals whose job roles have been approved for administration responsibilities.



Not only do these principles apply to IBM Cloud accounts and resources, but they also apply to accounts and resources that are not managed by IBM Cloud. For example, your operators will need credentials and proper authorizations to resources such as (but not limited to):



* Virtual servers in your VPCs