vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [VMware Aria Operations Manager design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-opsmgmt-vrops).

The dual region design uses this deployed architecture and requires some post-provisioning tasks to create the required design:



* Protected region



* The four-node analytics cluster is reused and two extra remote collectors are deployed on an extra private portable subnet.
* The analytics cluster is protected with Veeam Replication and fails over to the recovery region. IP addresses are not changed.
* The remote collectors do not fail over and are region-specific.



* Recovery region



* The four-node analytic cluster is deleted and two remote collectors are deployed on the existing private portable subnet.
* The vSRX is configured so that the same subnet that hosts the analytics cluster is available in the recovery region. In normal operations, no VMs are hosted on this network and this network is isolated. On DR invocation, this network, and the recovered analytics cluster, becomes reachable from the remote collectors. This network is not reachable directly from the IBM Cloud underlay network outside of the vSRX, but it is reachable through the VPN connections.





Review the following design decisions:



* The reuse of the automated deployment of VMware Aria Operations at the protected region reduces post deployment tasks.
* By using the VMware multiregion design for VMware Aria Operations that has the concept of region specific and cross-region components, you can recover the VMware Aria Operations analytic appliances to an identical network configuration. Re-IPing the appliances is possible but adds complexity.
* By deploying two remote collector nodes per region, the load is removed from the analytics cluster from collecting metrics from applications that do not fail over between regions.
* The use of Veeam Replication provides a replica of the VMware Aria Operations analytics cluster to allow recovery at the recovery region.
* Only the Analytics cluster needs to be backed up with Veeam, as remote collectors do not store data, however, for ease of redeployment a backup is taken.







 AD, DNS, and NTP
The traffic from the source to the proxy is not yet optimized, meaning that 100% of the backup data is transferred over this link. A good connection is required between proxy and repository as optimized data (normally 50% of the source data size) is transferred across this link. Therefore, place proxies in both the protected and recovery regions.
* Proxies can be hosted on Windows Server or Linux OS with almost no performance differences. For the all-in-one deployment scenario, a Windows OS is used.
* For the repository server, a bare metal server is recommended to maximize performance and to separate the production environment that needs to be protected from the backup storage. It is also recommended to combine this practice with the proxy role to keep overheads on the virtual environment and on the network to a minimum. Best practice is to avoid the usage of the same storage for backups and for the virtualized infrastructure because the loss of this single system might lead to the loss of both copies of the data, the production and the backups.
* Repository servers can be either Windows or Linux. For the all-in-one deployment scenario, a Windows OS is used. Additionally, for Microsoft Windows-based repositories, Veeam uses the Windows Crypto API complying with the Federal Information Processing Standards (FIPS 140). For Linux-based repositories, Veeam uses a statically linked OpenSSL encryption library, without the FIPS 140 support.
* For bare metal servers, the block storage device can be a local disk or a LUN provided through a SAN by using iSCSI. For the VMware Regulated Workloads design, SAN that uses iSCSI is not supported. Therefore, local disk is used.
* Configure a scheduled, encrypted backup of the Veeam Backup & Replication configuration and use a Veeam file copy job to copy the file to the protected region. This way, if a failure occurs, the Veeam Backup server can be rebuilt and the configuration can be restored from an off-site copy.
* A capacity tier that uses IBM Cloud Object Storage is not configured as the storage requirements for use case 1 are low.



The following guidance applies to use cases 2 and 3:
1.3.5 Ensure that the --root-ca-file option is set as appropriate. Automated 1 Missing 
 1.3.6 Ensure that the RotateKubeletServerCertificate option is set to true. Automated 2 Pass 
 1.3.7 Ensure that the --bind-address option is set to 127.0.0.1. Automated 1 Pass 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Missing 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass 
 2.2 Ensure that the --client-cert-auth option is set to true. Automated 1 Pass 
 2.3 Ensure that the --auto-tls option is not set to true. Automated 1 Pass 
 2.4 Ensure that the --peer-cert-file and --peer-key-file options are set as appropriate. Automated 1 Pass 
 2.5 Ensure that the --peer-client-cert-auth option is set to true. Automated 1 Pass 
 2.6 Ensure that the --peer-auto-tls option is not set to true. Automated 1 Pass 
 2.7 Ensure that a unique Certificate Authority is used for etcd. Manual 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 







 3 Control plane configuration 



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.1.1 Do not use client certificate authentication for users. Manual 2 Pass 







 3.2 Logging
Working with token authentication 

Token authentication can stop unauthorized clients from accessing your sensitive content, and protects your content from hotlinking. By enabling token authentication on CDN, requests are authenticated by CDN Edge servers before the CDN delivers the content.



 How it works 

The following diagram shows how the CDN token authentication works with your web application to validate the client's requests.

Zoom

![Token authentication flow](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN/images/token-authentication-flow.svg)

Figure 1: Token authentication flow

In this diagram, before a client requests the protected contents, they must get a token from your web application. Your web application logic (for instance, username and password) validates the request. If the validation passes, it generates a one-time token and returns it to the client.

When the client requests the CDN contents, they must pass the token in a cookie, query string parameter, or request header. The request goes to the CDN Edge server, and the Edge server attempts to match it with the local token-auth setting. If the token is a verified match, the content is returned to the client. If the token doesn't match, the Edge server returns a 403 response.

With token authentication, request verification occurs only in the CDN Edge servers, your back end application server isn't needed. This can reduce the network latency and offload to your server.



 Generating the access token 

Generate an access token and apply it to content you want to protect. The token is a delimited list of string fields, with an HMAC to prevent tampering with the strings. Each field consists of a value that is verified by CDN Edge servers when a request is made.

It is recommended that you set up your origin server to dynamically generate these tokens for each client request for the protected content. This way, you can include the IP address (IP) as a parameter and restrict access to protected content to that specific authorized user.
Backend apps 

You can use the IBM Cloud® App ID SDKs and APIs to protect your backend application endpoints and APIs.



 Understanding the flow 

Part of developing backend apps is verifying that your APIs are protected from unauthorized access. The App ID SDKs help you protect your API endpoints and ensure the security of your app.



 What is the flow's technical basis? 

App ID implements the [OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc6749) and the OIDC spec, which uses bearer tokens for authentication and authorization. These tokens are formatted as [JSON Web Tokens](https://datatracker.ietf.org/doc/html/rfc7519), which are digitally signed and contain claims that describe the subject that is being authenticated and the identity provider. The APIs of your application are protected by access and identity tokens. Clients that need access to your APIs can authenticate with the identity provider through App ID in exchange for these tokens. The claims in the tokens must be validated to grant access to the protected APIs.

For more information about how tokens are used in App ID, see [Understanding tokens](https://cloud.ibm.com/docs/appid?topic=appid-tokens).





 What does the flow look like? 

Zoom

![App ID backend flow](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/backend-flow.svg)

Figure 1. Backend application flow



1. A client makes a POST request to the App ID authorization server to obtain an access token. A POST request generally takes the following form:

POST /oauth/v4/<tenantID>/token HTTP/1.1
Content_type: application/x-www-form-urlencoded
IBMid Activated



After verification/creation of your IBMid is complete, proceed to the next section [How to Register for MAS SaaS Support Services](https://cloud.ibm.com/docs/mas-saas?topic=mas-saas-getting-started-with-ibm-maximo-application-suite-saashow-to-register-for-mas-support)





 How to Register for Maximo Application Suite Support 

Maximo Application Suite Support covers support for both the application and your MAS SaaS environments.



1. Visit the following link:

[https://www.ibm.com/mysupport/s/supportaccess](https://www.ibm.com/mysupport/s/supportaccess)
2. Log in using your IBMid:

Note: if you don't have an IBMid, please reference the following link: [How to Create an IBMid](https://cloud.ibm.com/docs/mas-saas?topic=mas-saas-getting-started-with-ibm-maximo-application-suite-saashow-to-create-an-ibmid)

Zoom

![MAS-MS-Register-IBMid-Login](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-MS-Register-IBMid-Login.png)

Figure 9. Register IBMid Login
3. A privacy statement may appear. If it does, click I consent

Zoom

![MAS-MS-Register-Privacy](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-MS-Register-Privacy.png)

Figure 10. Register Privacy
4.
Only one VLAN firewall or Network Gateway can be associated with a VLAN, but a server can be protected on the public VLAN by a VLAN firewall and associated on the private network with a Network Gateway.

GatewayName indicates the VLAN is associated with that Network Gateway.





 Individually protected servers view 

On the VLANs screen, identify a row with Individually Protected Servers in the Gateway/Firewall column and click on the associated VLAN number link. This will display the details for the VLAN including the associated devices.

From here, you can click on each device and review whether a firewall is in place for that particular Server.

Once you have clicked on a device, scroll to the bottom of the Configuration tab. You will see Firewall in the Addons section with Installed or Not installed for the status. Not Installed indicates that no firewall is in place for this device. Installed indicates that a firewall is in place and you will have a Firewall details button. It will redirect you to the "Firewall Details" page where you can manage the firewall configuration.





 Dedicated firewall view 

On the VLANs screen, identify a row with Firewall-vlanXXXX.networklayer.com in the Gateway/Firewall column and click on that firewall. You are presented with a FortiGate Security Appliance. The device details include the associated Router, VLAN, and IPv4/IPv6 Subnets, the devices associated with that VLAN, and the controls for routing traffic through or around the firewall.

FortiGate Security Appliance devices will have the management IP, username, and password. Management is completed through the management GUI or SSH-based console.





 Network gateway view 

On the VLANs screen, identify a row with the Gateway/Firewall column populated by a Network Gateway device name and click on that network gateway. You are then taken to the interface displaying associated frontend (FCR) and backend (BCR) VLANs and Network Gateway management options.
* One NSX-T Edge cluster that connects the workloads in the domain for logical switching, logical dynamic routing, and load balancing.



The customer workload domain is reserved for use by customer workload except for NSX-T Edge clusters used for North-South networking traffic.





 VMware as a Service workload isolation and data protection 

VMware as a Service uses trust zones. Trust zones are logical grouping of components that we know, control, and trust. Protection boundaries are established between trust zones as described in the following table.



Table 1. Description and boundaries for the management and workload planes

 Name Description Boundary 

 Management plane VMware as a Service operational management components These resources exist in IBM Cloud classic IaaS. Management interfaces are protected by networking appliance firewalls and the use of bastion hosts by the operations team. Management component connectivity to the workload plane takes place through networking appliances. Public connectivity to all public service interfaces is protected through Akami security. Customers access VMware Cloud Director and associated service portals by using the web UI from the public network. These interfaces are restricted and do not enable customers to transit further through the management plane network. 
 Workload plane Virtual Data Center from VMware Cloud Director consisting of vApps, virtual machine (VM), and virtual networks Management interfaces are protected by networking appliances firewalls. Customer workloads are allowed by VMware Cloud Director to attach only to restricted, separate NSX-T virtualized networks that are running as overlays on the classic IaaS network. Therefore, customer VMs do not have broad access to the Workload Plane management and storage networks. Their access is restricted by using NSX-T edge appliances. Customer workload connectivity to public takes place through NSX-T edge routers that are managed by the customer through a restricted VMware Cloud Director interface. Customer workload connectivity to private takes place through IBM-managed NSX-T edge routers that are configured to limit connectivity to well-known IBM Cloud private services. 





 Data protection 

Client metadata is associated with the VMware as a Service instances that the client creates. When the instance is deleted by the client, the metadata is maintained in the database where the instance state is set to Deleted.
For more information, see the [deprecation details](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-deprecationdep_details).

When an HTTP or HTTPS request is sent to an application running on IBM® Cloud Foundry, HTTP headers are added to the request.

Scroll for more

Scroll for more



Table 1. HTTP/HTTPS headers

 Header Contains 

 x-client-ip IP address of the client 
 x-forwarded-for IP address of the client and the IBM® Cloud Foundry server routing the request 
 x-forwarded-host Host specified in the client request 
 x-forwarded-port Port specified in the client request 
 x-forwarded-proto Protocol specified in the client request 
 x-forwarded-scheme Protocol specified in the client request 
 x-real-ip IP address of the client 



See [HTTP headers](https://docs.cloudfoundry.org/concepts/http-routing.htmlhttp-headers) for more information.

Contribute in GitHub

Open doc issue

Edit topic







Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

!
Off Yes, but origin does not specify a max-age Edge cache duration based on the CDN's TTL configuration Yes, Edge also provides a max-age that is the time before the Edge needs to refresh the content from the origin 
 Off No Edge cache duration based on the CDN's TTL configuration No 







 More information 

See cache-control as defined in section 14.9 of [RFC 2616](https://www.ietf.org/rfc/rfc2616.txt).



Contribute in GitHub

Open doc issue

Edit topic





On this page[Respect Header: Off](https://cloud.ibm.com/docs/CDN?topic=CDN-using-cache-control-to-control-an-http-client-s-cache-durationrespect-header-off)[Respect Header: On](https://cloud.ibm.com/docs/CDN?topic=CDN-using-cache-control-to-control-an-http-client-s-cache-durationrespect-header-on)[Summary](https://cloud.ibm.com/docs/CDN?topic=CDN-using-cache-control-to-control-an-http-client-s-cache-durationsummary)[More information](https://cloud.ibm.com/docs/CDN?topic=CDN-using-cache-control-to-control-an-http-client-s-cache-durationmore-information-on-cache-control)


Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

!
1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Pass 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass 
 2.2 Ensure that the --client-cert-auth option is set to true. Automated 1 Pass 
 2.3 Ensure that the --auto-tls option is not set to true. Automated 1 Pass 
 2.4 Ensure that the --peer-cert-file and --peer-key-file options are set as appropriate. Automated 1 Pass 
 2.5 Ensure that the --peer-client-cert-auth option is set to true. Automated 1 Pass 
 2.6 Ensure that the --peer-auto-tls option is not set to true. Automated 1 Pass 
 2.7 Ensure that a unique Certificate Authority is used for etcd. Manual 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 







 3 Control plane configuration 



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.1.1 Do not use client certificate authentication for users. Manual 2 Pass 







 3.2 Logging 



Section 3.3 Logging benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.2.1 Ensure that a minimal audit policy is created. Automated 1 Pass 
 3.2.2 Ensure that the audit policy covers key security concerns. Manual 2 Pass 









 4 Worker Nodes 

Follow the instruction in [Using the compliance operator](https://cloud.ibm.com/docs/openshift?topic=openshift-compliance-operator) to perform automated check for worker node configuration.





 5 Policies
1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Pass 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass 
 2.2 Ensure that the --client-cert-auth option is set to true. Automated 1 Pass 
 2.3 Ensure that the --auto-tls option is not set to true. Automated 1 Pass 
 2.4 Ensure that the --peer-cert-file and --peer-key-file options are set as appropriate. Automated 1 Pass 
 2.5 Ensure that the --peer-client-cert-auth option is set to true. Automated 1 Pass 
 2.6 Ensure that the --peer-auto-tls option is not set to true. Automated 1 Pass 
 2.7 Ensure that a unique certificate authority is used for etcd. Manual 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 







 3 Control plane configuration 



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.1.1 Do not use client certificate authentication for users. Manual 2 Pass 







 3.2 Logging 



Section 3.3 Logging benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.2.1 Ensure that a minimal audit policy is created. Automated 1 Pass 
 3.2.2 Ensure that the audit policy covers key security concerns. Manual 2 Pass 









 4 Worker nodes 

Follow the instruction in [Using the compliance operator](https://cloud.ibm.com/docs/openshift?topic=openshift-compliance-operator) to perform automated check for worker node configuration.





 5 Policies
1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Pass 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass 
 2.2 Ensure that the --client-cert-auth option is set to true. Automated 1 Pass 
 2.3 Ensure that the --auto-tls option is not set to true. Automated 1 Pass 
 2.4 Ensure that the --peer-cert-file and --peer-key-file options are set as appropriate. Automated 1 Pass 
 2.5 Ensure that the --peer-client-cert-auth option is set to true. Automated 1 Pass 
 2.6 Ensure that the --peer-auto-tls option is not set to true. Automated 1 Pass 
 2.7 Ensure that a unique Certificate Authority is used for etcd. Manual 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 







 3 Control plane configuration 



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.1.1 Do not use client certificate authentication for users. Manual 2 Pass 







 3.2 Logging 



Section 3.3 Logging benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.2.1 Ensure that a minimal audit policy is created. Automated 1 Pass 
 3.2.2 Ensure that the audit policy covers key security concerns. Manual 2 Pass 









 4 Worker Nodes 

Follow the instruction in [Using the compliance operator](https://cloud.ibm.com/docs/openshift?topic=openshift-compliance-operator) to perform automated check for worker node configuration.





 5 Policies