vania-janet/multiturn-rag-retrieval-data huggingface dataset:
1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Pass 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass 
 2.2 Ensure that the --client-cert-auth option is set to true. Automated 1 Pass 
 2.3 Ensure that the --auto-tls option is not set to true. Automated 1 Pass 
 2.4 Ensure that the --peer-cert-file and --peer-key-file options are set as appropriate. Automated 1 Pass 
 2.5 Ensure that the --peer-client-cert-auth option is set to true. Automated 1 Pass 
 2.6 Ensure that the --peer-auto-tls option is not set to true. Automated 1 Pass 
 2.7 Ensure that a unique Certificate Authority is used for etcd. Manual 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 







 3 Control plane configuration 



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.1.1 Do not use client certificate authentication for users. Manual 2 Pass 







 3.2 Logging 



Section 3.3 Logging benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.2.1 Ensure that a minimal audit policy is created. Automated 1 Pass 
 3.2.2 Ensure that the audit policy covers key security concerns. Manual 2 Pass 









 4 Worker Nodes 

Follow the instruction in [Using the compliance operator](https://cloud.ibm.com/docs/openshift?topic=openshift-compliance-operator) to perform automated check for worker node configuration.





 5 Policies
No headers are set by default. 
 statusCode A valid HTTP status code. If body content is present, the default is 200 OK. If no body content is present, the default is 204 No Content. 
 body A string that is either plain text, a JSON object or array, or a base64 encoded string for binary data. The body is considered empty if it is null, the empty string "", or undefined. The default is an empty body. 



The [controller](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-aboutabout_controller) passes any action-specified headers, status code, or body to the HTTP client that terminates the request or response. If the Content-Type header is not declared in the action result's headers, the body is interpreted as application/json for non-string values and text/html otherwise. If the Content-Type header is defined, the controller determines whether the response is binary data or plain text and decodes the string by using a base64 decoder as needed. If the body isn't decoded correctly, an error is returned to the client.

The owner of the web action owns all the activations records, and incurs the cost of running the action in the system regardless of how the action was invoked.



 Protected parameters 

Action parameters are protected and can be changed only by updating your action. Parameters are automatically finalized to enable web actions.

ibmcloud fn action create /<namespace_ID>/demo/hello hello.js --parameter name Jane --web true

The result of these changes is that the name is bound to Jane and cannot be overridden by query or body parameters because of the final annotation. This design secures the action against query or body parameters that try to change this value whether by accident or intentionally.







 Performing an HTTP redirect by using a web action 

You might use this feature in a web application to redirect a user to the new version of your site.

Before you begin
3. Make a request to the protected endpoint. An error is returned.
4. [Obtain an access token](https://cloud.ibm.com/docs/appid?topic=appid-obtain-tokens).
5. With the access token that you obtained in the previous step, make a request to the endpoint. You are now be able to access the protected endpoint. Verify that the response contains what you expect.







 Next steps 

Ready to start perfecting your authentication experience? Try walking through [this blog](https://www.ibm.com/cloud/blog/perfecting-the-login-experience-with-liberty-oauth2-and-appid) or learning more about [app-to-app communication](https://cloud.ibm.com/docs/appid?topic=appid-app).
If you have a specific resource that you are protecting with a context-based restriction, you can see whether access to the resource is blocked by searching for action:context-based-restrictions.policy.eval responseData.decision:Deny responseData.isEnforced:==true <CRN OR UNIQUE ID OF THE RESOURCE>.







 Examples 

A context-based restriction rule that protects Example service has the following identifying attributes in Activity Tracker:



Table 1. Sample context-based restriction attributes and values in Activity Tracker

 Attribute Value Description 

 action context-based-restrictions.policy.eval 
 initiator ID iam-ServiceId-21271d73-adae-410d-820b-7a582b0066fc The unique ID of the protected service. 
 initiator name Example service The name of the protected service. 
 target ID crn:v1:staging:public:context-based-restrictions:global:a/9bb3ea01633c4d828080de16ce34ea70::rule:b9fadacd4fbe034d7aafcd1659063aaa The unique ID of the rule that rendered the allow or deny decision. 
 requestData ipAddress, resource, subject Contains the details of the resource that the requester is trying to access, the identity of the requester and from what IP address they are requesting access. 
 responseData decision, isEnforced The decision and enforcement mode. When isEnforced=false, the rule is in report-only mode. 
 correlationId 4a03eafdefed4f059dc9cad29d28513cxacml Used for debug interactions and tracing the request with support.
Compliance information for vCenter Server with Hybridity Bundle instances 

Review the following information for details about compliance for VMware® vCenter Server® with Hybridity Bundle instances.



 Customer versus IBM responsibility for vCenter Server with Hybridity Bundle 

The following diagram provides details about the customer (you) and IBM® responsibilities for compliance activities.

Zoom

![Customer versus IBM responsibility matrix](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/customer_ibm_responsibility_matrix.svg)

Figure 1. Customer versus IBM responsibility matrix for vCenter Server with Hybridity Bundle





 Health data restrictions 

The following terms apply only to the vCenter Server offering.



 HIPAA 

Notwithstanding information in the data sheet for this Cloud Service regarding the Health Information Portability and Accountability Act of 1996 ("HIPAA") and the permitted use of Health Information and Health data as Types of Personal Data and/or Special Categories of Personal Data (collectively, "Health Data") with this Cloud Service, use of Health Data with this Cloud Service is subject to the following limitations and conditions:

vCenter Server

Only the offerings that are previously listed can be provisioned to implement the HIPAA Privacy and Security Rule controls for use with Health Data if Client notifies IBM in advance that Client will use Health Data with the Cloud Service and IBM confirms in writing that the Cloud Service will be provisioned for Health Data usage. The Cloud Service cannot be used for the transmission, storage, or other usage of any Health Data protected under HIPAA unless (i) Client provides IBM such notification; (ii) IBM and Client have entered into an applicable Business Associate Agreement; and (iii) IBM provides Client with express written confirmation that the Cloud Service can be used with Health Data. In no event shall the Cloud Service be used for processing PHI as a healthcare clearinghouse within the meaning of HIPAA.

If a system failure occurs, a third-party service provider might request debugging artifacts from the client (logs, core memory dumps). It is the client’s sole responsibility to gather and transmit these artifacts to the third-party provider.
export MQSERVER="CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)"
export MQS_KEYSTORE_CONF="/bob/.mqs/keystore.conf"

On Linux:
export MQSAMP_USER_ID=bob
export MQSERVER="CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)"
export MQS_KEYSTORE_CONF="/home/bob/.mqs/keystore.conf"

On Windows:
set MQSAMP_USER_ID=bob
set MQSERVER=CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)
set MQS_KEYSTORE_CONF=C:Usersbob.mqskeystore.conf



* <HOSTNAME> - this is 'hostname' in the file connection_info.txt
* <PORT> - this is 'listenerPort' in the file connection_info.txt



3. From alice's command shell, run the sample program to send messages to the protected queue.

amqsputc DEV.QUEUE.1 <your Queue manager name>

3.1 Enter the application API key of alice when prompted for a password(This is your 'apiKey' vaule in the file "applicationApiKeyalice.json).
3.2 Type the text of the message, then press Enter key twice to send only a single message.
Note: Pressing the Enter key twice will exit the sample application.
![Image showing alice sending message to protected queue](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_app_ams_st_putpq.png)
4. From bob's command shell, run the sample program to receive the messages.

amqsgetc DEV.QUEUE.1 <your Queue manager name>
Security and compliance 

IBM® Event Streams for IBM Cloud® is a secure and highly available message bus that is built with Apache Kafka. The service is built on the following best industry standards.



 IBM Cloud for Financial Services 

Event Streams is IBM Cloud® for [Financial Services](https://www.ibm.com/cloud/financial-services) certified. For information about requesting an IBM Cloud for Financial Services report, see [IBM Cloud industry compliance programs](https://www.ibm.com/cloud/compliance).

The Enterprise plan is IBM Cloud® Financial Services certified.





 General Data Protection Regulation (GDPR) 

The GDPR seeks to create a harmonized data protection law framework across the EU. It aims to give citizens back the control of their personal data, while it imposes strict rules on the ones who host and "process" this data, anywhere in the world. The Regulation also introduces rules that relate to the free movement of personal data within and outside the EU.

With the [General Data Protection Regulation](https://gdpr.eu/), Event Streams customers can rely on the Event Streams team's understanding and compliance with emerging data privacy standards and legislation. Customers can also rely on IBM's wider ability to provide a comprehensive suite of solutions to assist businesses of all sizes with their own internal data governance requirements.

The Enterprise, Standard, and Satellite plans are GDPR certified.





 Health Insurance Portability and Accountability Act (HIPAA) 

Event Streams meets the required IBM controls that are commensurate with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security and Privacy Rule requirements. These requirements include the appropriate administrative, physical, and technical safeguards required of Business Associates in 45 CFR Part 160 and Subparts A and C of Part 164. HIPAA must be requested at the time of provisioning and requires a representative to sign a Business Associate Addendum (BAA) agreement with IBM.

The Enterprise plan meets HIPAA requirements.





 ISO 27001/27017/27018 and ISO 27701 

Event Streams is ISO 27001, 27017, 27018, and ISO 27701 certified. ISO 27001 (International Organisation for Standardisation) is an international standard for information security.
Figure 8. IBMid Activated



After verification/creation of your IBMid is complete, proceed to the next section [How to Register for MAS SaaS Support Services](https://cloud.ibm.com/docs/mas-saashow-to-register-for-mas-support)





 How to Register for Maximo Application Suite Support 

Maximo Application Suite Support covers support for both the application and your MAS SaaS environments.



1. Visit the following link:

[https://www.ibm.com/mysupport/s/supportaccess](https://www.ibm.com/mysupport/s/supportaccess)
2. Log in using your IBMid:

Note: if you don't have an IBMid, please reference the following link: [How to Create an IBMid](https://cloud.ibm.com/docs/mas-saashow-to-create-an-ibmid)

Zoom

![MAS-MS-Register-IBMid-Login](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-MS-Register-IBMid-Login.png)

Figure 9. Register IBMid Login
3. A privacy statement may appear. If it does, click I consent

Zoom

![MAS-MS-Register-Privacy](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-MS-Register-Privacy.png)

Figure 10. Register Privacy
4. After entering your IBMid & password, the following page will be displayed. Click on the Request access button:

Zoom

!
IBM offers a suite of approved ciphers for you to choose from so that you secure the communication between your load balancer and your clients.

To choose a preferred cipher suite for an existing load balancer:



1. Access the Cipher table from the Protocols tab.

There must be at least one existing HTTPS protocol.
2. Click Edit to enable editing, and select (or clear) the required ciphers.
3. When you're done, click Save to save your changes.

If you defined an HTTPS protocol when you create your load balancer, it has all ciphers in the suite enabled. The selection of a particular set of ciphers can be done only after the load balancer is provisioned.

For a list of supported ciphers, refer to [SSL offload](https://cloud.ibm.com/docs/loadbalancer-service?topic=loadbalancer-service-ssl-offload-with-ibm-cloud-load-balancer).



Contribute in GitHub

Open doc issue

Edit topic







Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

!
Compliance information for vCenter Server instances 

Review the following information for details about compliance for VMware vCenter Server® instances.



 Customer versus IBM responsibility for vCenter Server 

The following diagram provides details about the customer (you) and IBM® responsibilities for compliance activities.

Zoom

![Customer versus IBM responsibility matrix](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/customer_ibm_responsibility_matrix.svg)

Figure 1. Customer versus IBM responsibility matrix for vCenter Server





 Health data restrictions 

The following terms apply only to the vCenter Server offering.



 HIPAA 

Notwithstanding information in the data sheet for this Cloud Service regarding the Health Information Portability and Accountability Act of 1996 ("HIPAA") and the permitted use of Health Information and Health data as Types of Personal Data and Special Categories of Personal Data (collectively, "Health Data") with this Cloud Service, use of Health Data with this Cloud Service is subject to the following limitations and conditions:

vCenter Server

Only the offerings that are previously listed can be provisioned to implement the HIPAA Privacy and Security Rule controls for use with Health Data if Client notifies IBM in advance that Client will use Health Data with the Cloud Service and IBM confirms in writing that the Cloud Service will be provisioned for Health Data usage. The Cloud Service cannot be used for the transmission, storage, or other usage of any Health Data protected under HIPAA unless (i) Client provides IBM such notification; (ii) IBM and Client have entered into an applicable Business Associate Agreement; and (iii) IBM provides Client with express- written confirmation that the Cloud Service can be used with Health Data. In no event, shall the Cloud Service be used for processing PHI as a healthcare clearinghouse within the meaning of HIPAA.

If a system failure occurs, a third-party service provider might request debugging artifacts from the client (logs, core memory dumps). It is the client’s sole responsibility to gather and transmit these artifacts to the third-party provider. The IBM support team might assist by providing links to documentation or providing direction through screen sharing sessions.
Using mutual TLS 

Mutual Transport Layer Security (mTLS) authentication ensures that traffic is both secure and trusted in both directions between a client and server. It is only available for customers at the Enterprise or Security plan level.

When mTLS is configured, access is granted only to requests with a corresponding client certificate. When a request reaches the application, CIS responds with a request for the client certificate. If the client fails to present the certificate, the request is not allowed to proceed. Otherwise, the key exchange proceeds.

Zoom

![Diagram of mTLS handshake](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/mtls-handshake.png)

Figure 1. Diagram of an mTLS handshake



 Configuring mutual TLS 

Mutual TLS is not enabled by default. It is an additional service that requires prior authorization and enablement.

To obtain authorization, you must submit an IBM Support case.

After mTLS is turned on for your account, take the following steps to enable it.



1. Navigate to the Security page in the CIS UI.
2. Select the Mutual TLS tab.
3. Click Enable to enable the feature.



After mTLS is enabled, it cannot be disabled.

To set up mTLS authentication in the IBM Cloud Internet Services UI for a particular endpoint:



1. In the Root certificates table, click Add to define a new root certificate.
2. Paste the certificate content into the content field, provide a name for the Root CA, and add one or more fully qualified domain names (FQDN) of the endpoints that you want to use this certificate. These FQDNs are the hostnames that are used for the resources being protected by the application policy. You must associate the Root CA with the FQDN that the application being protected uses.
3. Click Save.

If your zone is using an intermediate certificate in addition to the root certificate, upload the entire chain.
4.
* RiskForesight - An "all-in-on" VM hosted in the recovery region that has Asset Repositories and scheduled jobs that are configured for both the protected and recovery regions.
* VMware Aria Operations™ for Logs - One cluster per region and the use log forwarding/filtering between regions.
* VMware Aria Operations Manager - An analytic cluster on a cross-region network in the protected region and remote collectors in both regions. Recovery of the analytics cluster is done through replicas.
* VMware Aria Operations™ for Networks – An optional manual installation in each region.
* AD/DNS/NTP - HA VMs in both regions. Each region is a separate forest.
* Veeam - A single Veeam Backup & Replication instance with a bare metal server in each region. The management components are located in the recovery region. Backup and file copies are used to provide off-site copies. Veeam replication is used to provide replicas of the VMware Aria Operations analytic cluster.
* Key Management Interoperability Protocol for VMware Service (KMIP) - An HA KMIP instance in each region.
* Hyper Protect Crypto Services (HPCS) - An HA HPCS instance in each region.







 Related links 



* [Veeam on IBM Cloud overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview)
The VMware Regulated Workloads dual region design incorporates a number of design decisions that are justified by design simplicity, maximizing the VMware Regulated Workloads instance deployment automation, and minimizing the restrictions upon DR of the workloads. The recovery of management workloads and customer workloads is considered to be independent and this design focuses on the recovery of these management components. Customer workloads can be recovered by similar methods or by using different tools.

Zoom

![IBM Cloud for VMware Regulated Workloads dual region overview diagram](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vrw-v2-dualregion.svg)

Figure 2. IBM Cloud for VMware Regulated Workloads dual region overview diagram

The VMware Regulated Workloads dual region design uses the following specifications:



* An IBM Cloud for VMware Regulated Workloads instance in each region, two regions are required. Available regions are; Dallas, Washington DC, Sydney, London, Frankfurt, and Tokyo.



* In the protected region, deploy a single or multizone IBM Cloud for VMware Regulated Workloads instance as required to support the normal operations of the workload.
* In the recovery region, deploy a single IBM Cloud for VMware Regulated Workloads instance as required to support the restoration of the workload when DR is started or tested.



* vCenter - One appliance per region.
* NSX Manager - One cluster per region.
* RiskForesight - An "all-in-on" VM hosted in the recovery region that has Asset Repositories and scheduled jobs that are configured for both the protected and recovery regions.
* VMware Aria Operations™ for Logs - One cluster per region and the use log forwarding/filtering between regions.
* VMware Aria Operations Manager - An analytic cluster on a cross-region network in the protected region and remote collectors in both regions. Recovery of the analytics cluster is done through replicas.
The IBM Cloud for VMware® Regulated Workloads dual region design focuses on use case 1. However, guidelines are provided so that use cases 2 and 3 can be solved for the individual needs of workload backup and replication.

Configure Veeam encryption for data at rest and data in transit so that VM data is not stored or transmitted unencrypted (which is the default setting). Veeam encryption requires the use of a password or passphrase and does not use the HPCS instance for the management of keys. When the VM is restored, select the encrypted storage policy to ensure that the VM is encrypted in the vSphere datastore.

The use of Veeam Backup & Replication in the regulated Workloads dual region design means that protected region encryption keys are not required in the recovery region. Therefore, separate HPCS, and KMIP for VMware services can be used.

The following post deployment activities are required to create the deployment scenario used in the dual region pattern:



* Remove the Veeam VMs at each region.
* Order a Windows bare metal server in each region. The specification of this server is documented in [Veeam on bare metal server introduction](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeam-bms-archi-intro). The small server is adequate for use case 1.



For use cases 2 and 3, the number and sizing of the bare metal servers needs to be calculated. For more information, see [Repository storage](https://bp.veeam.com/vbr/VBP/2_Design_Structures/D_Veeam_Components/D_backup_repositories/repositories%20storage.html).

The protected region bare metal Windows server hosts the following components:



* Proxy - A proxy is a “data mover” component that is used to retrieve VM data from the source datastore, process it and deliver to the target. As a rule, have the proxy as close as possible to the source data.