vania-janet/multiturn-rag-retrieval-data huggingface dataset:
With the [Network Security Policy tool](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-netsec_policy) that is available through the IBM Cloud Security and Compliance Center Workload Protection service, clients can generate and fine-tune Kubernetes network policies based on the traffic allowed or denied, and track ingress and egress communication. For example, you can configure a "least-privilege" policy to protect your workloads or view existing network policies that have been applied to you workloads.

Workload Protection leverages native Kubernetes features and doesn't require any additional networking requirements other than the Container Network Interface (CNI). Through the UI, clients can view which policies are being applied in real time.
Integrations 

IBM Cloud® Security and Compliance Center Workload Protection provides inbound data source and outbound integrations such as notification channels and S3 captures.

IBM Cloud Security and Compliance Center Workload Protection implements Sysdig Secure functionality. Information that is provided by the Sysdig Secure documentation applies to Workload Protection as well.

For more information, see [Integrations](https://docs.sysdig.com/en/integrations-for-sysdig-secure.html)
* Select the operator representing the test you want to perform on the variable (for example, is or is not). The available operators for a particular value depend upon its data type. (For more information, see [Operators](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-step-conditionsstep-conditions-operators).)
* Select the value you want to evaluate the test against. Again, the values available depend upon the type of value you are testing. For example, a variable containing an options response can be tested against any of the defined options, and a date value can be tested against any date.



4. To add more than one condition to a step, after adding a condition, click New condition group.

One use case where using more than one condition is helpful is if you need to capture a value range. For example, maybe a requirement of opening a checking account is that the customer deposit at least $100 into the account at creation time. You might ask the customer if they want to transfer funds to the account, and if so, how much? To continue with the transfer, the transfer amount must be $100 or more, but cannot exceed $1000. You can add a step with the following conditions:



* How much to transfer?>99
* How much to transfer?<1001



Specify whether all or any of the conditions must be met for the step to be included in the conversational flow.
5. To add another group of conditions, click Add new group.

You can use groups to build complex step conditions. Each group is evaluated true or false as a whole, and then these results are evaluated together. For example, you might build a step that executes only if all conditions in group 1 are true or any condition in group 2 is true. (Groups function like parentheses in the boolean conditions of many programming languages.)

After you add a group, you can define one or more conditions in the new group. Between groups, choose and or or to indicate whether the conditions in both conditional groups or only one of them must be met for the step to be included in the conversational flow.





 Operators
Issues resolved in 5.2R6S6

 Issue Number Priority Summary 

 VRVDR-40281 Major After upgrading from 5.2 to more recent version error “vbash: show: command not found” in operation mode 
 VRVDR-40135 Major Spanning tree packets are not received on a VIF interface bridge port 
 VRVDR-39991 Major Stateful firewall drops packets between two subnets on the same interface 
 VRVDR-36481 Major Upgrade/downgrade from 5.2R4 to 17.1.0/5.2R3 shows /opt/vyatta/sbin/vyatta-install-image.functions: line 372: is_onie_boot: command not found 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved in 5.2R6S6

 Issue Number CVSS score Advisory Summary 

 VRVDR- 40019 8.8 DSA-4086-1 CVE-2017-15412: Debian DSA-4086-1: libxml2 – security update 
 VRVDR- 39907 7.8 CVE-2017-5717 Branch target injection / CVE-2017-5717 / Spectre, aka. Variant #2 









 5.2R6S5 

Released January 19, 2018.



 Security Vulnerabilities Resolved 



Security vulnerabilities resolved in 5.2R6S5

 Issue Number CVSS score Advisory Summary 

 VRVDR- 39891 5.6 DSA-4078-1 CVE-2017-5754: Debian DSA-4078-1: linux – security update (Meltdown) 
 VRVDR- 38265 8.8 DSA-3970-1 CVE-2017-1 









 5.2R6S4 

Released December 15, 2017.



 Issues Resolved 



Issues resolved in 5.2R6S4

 Issue Number Priority Summary 

 VRVDR-39529 Major DHCP server failover is not synchronizing databases 
 VRVDR-39399 Critical Vyatta dropped off network state FAULT in show vrrp/multiple interfaces flap/seg fault
* @return a span from beginOffset of p1 till endOffset of p2
/

create function udfCombineSpans(p1 Span, p2 Span)
return Span like p1
external_name 'udfjars/udfs.jar:com.ibm.test.udfs.MiscScalarFunc!combineSpans'
language java
deterministic
return null on null input;

/
* A function to compare an input Span's size against an input size
* @param span input span
* @param size input size to be compared against
* @return Boolean true if input span's size is greater than input argument size, else false
/

create function udfSpanGreaterThan(span Span, size Integer)
return Boolean
external_name 'udfjars/udfs.jar:com.ibm.test.udfs.MiscScalarFunc!spanGreaterThan'
language java
deterministic;
Show more

The next example shows how to declare a function that is named udfCompareNames that is given a list of names nameList and a single name myName. The output is a list similar to the input list, which contains only the entries from nameList similar to myName.

/
* A function to compare an input string against a list of names
* and returns a list of entries from nameList similar to myName.
* @param nameList a list of names
* @param myName a name to compare against the list
* @return a list of entries from nameList similar to myName
/

create function udfCompareNames(nameList ScalarList, myName String)
return ScalarList like nameList
external_name 'udfjars/udfs.jar:com.ibm.test.udfs.MiscScalarFunc!compareNames'
language java
deterministic;

Example 2: Declaring scalar UDFs with tables as input using Java

The following example illustrates the use of the table as locator input type.
System and Communications Protection (SC) [SC-2 Application Partitioning](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2) <br>[SC-3 Security Function Isolation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-3) 







 2. Use only services that are IBM Cloud for Financial Services Validated 

Requirement: Only use IBM Cloud and third-party managed services which are IBM Cloud for Financial Services Validated.

Purpose & value: IBM Cloud for Financial Services Validated designates that an [IBM Cloud service](https://cloud.ibm.com/catalog?search=label%3Afs_ready) or ecosystem partner service has evidenced compliance to the controls of the IBM Cloud Framework for Financial Services. Using services which are Financial Services Validated makes it much easier to meet all of the control requirements and provide evidence of compliance.

An external service is an IBM Cloud or third-party service deployed outside of the authorization boundaries of your offering and typically not under direct control of your offering. External services used by an offering should be considered extensions of the offering itself. For an offering to be validated against the requirements of the IBM Cloud Framework for Financial Services, all of its external services must meet the same requirements.

For cases where you need additional functionality not covered by any Financial Services Validated service, you are advised to install your own software within your deployment. However, you are then responsible for [ensuring the software](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-self-installed-software) meets all of the IBM Cloud controls.

If you represent a technology vendor seeking the Financial Services Validated designation, then you must request special approval for a temporary deviation if you wish to use services that are are not themselves Financial Services Validated. If you represent a financial institution or if the Financial Services Validated designation is not required by your consumers, then you have freedom to choose based on the level of risk you are willing to accept.
AT&T Vyatta 5400 vRouter security vulnerability fixes 

As of August 30, 2018: This document lists the security vulnerability fixes for the Vyatta 5400 vRouter. When multiple Common Vulnerabilities and Exposures (CVE) numbers are addressed in a single update, the highest Common Vulnerability Scoring System (CVSS) score is listed.



 6.7R14S10 

Released August 30, 2018



 Issues Resolved 



Issues resolved in 6.7R14S10

 Issue Number Priority Summary 

 VSE-9911 Major 6.7R13S3 upgrade to 6.7R14S9 caused “rpc_scheddetected stalls on CPUs/tasks” and system crashed and frozen 









 6.7R14S9 

Released July 16, 2018



 Security Vulnerabilities Resolved 



Security vulnerabilities resolved in 6.7R14S8

 Issue Number CVSS score Advisory Summary 

 VSE-9909 6.5 DSA-4229-1 CVE-2018-5388, CVE-2018-10811: Debian DSA-4229- 1: Strongswan security update 
 VSE-9903 9.8 DLA-1390-1 CVE-2018-1122, CVE-2018-1123, CVE-2018-1124, CVE-2018-1125, CVE-2018-1126: Debian DLA-1390-1: procps security update 









 6.7R14S8 

Released June 1, 2018



 Security Vulnerabilities Resolved 



Security vulnerabilities resolved in 6.7R14S8

 Issue Number CVSS score Advisory Summary 

 VSE-9905 7.5 DLA-1388-1 CVE-2018-11358, CVE-2018-11362, CVE-2018-9258, CVE-2018-9260, CVE-2018-9261, CVE-2018-9263, CVE-2018-9268, CVE-2018-9269, CVE-2018-9270: Debian DLA-1388-1: wireshark – security update
Review the following known limitations:



* Customizing the IP addresses that are allowed to connect to your key management service, such as a Key Protect instance, is not supported.



Additionally, your cluster version impacts the functionality of the KMS provider. To see what KMS features are available for different cluster versions of Red Hat OpenShift on IBM Cloud, review the following table.

To check your cluster version, run the following command.

ibmcloud oc cluster ls

To take advantage of all the KMS features, encryption must be enabled on version 4.5.18_1521_openshift or later.

If KMS was enabled before this version, [update your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-update) to at least version 4.5.18_1521_openshift and then [reenable KMS encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) with a new root key. If you are unsure when KMS was enabled, log in to the IBM Cloud console and click on your KMS instance under [Resources](https://cloud.ibm.com/resources). Find your root key and click the Actions icon ![Action menu icon](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/icons/action-menu-icon.svg) > Key associated resources. If a CRN number is listed for your root key, then you do not need to upgrade your cluster.



* Enable the cluster to use root keys to encrypt secrets.
* Cluster secrets are automatically updated after rotating root keys. Note For versions before 4.5.18_1521_openshift, you must rewrite cluster secrets manually after rotating root keys. You can rewrite secrets by using the oc get secrets --all-namespaces -o json | kubectl replace -f - command.
[Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Version history to verify that a new version was created successfully.







 Creating new versions of imported certificates 

When it's time to renew a certificate that was initially imported to the service, you can use the Secrets Manager UI to manually reimport it. After a certificate is rotated, the previous version is retained in case you need it.

If the certificate that you are rotating was previously imported with an intermediate certificate and a private key, include an intermediate certificate and private key on rotation to avoid service disruptions.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets Manager UI, go to the Secrets list.
4. In the row for the certificate that you want to rotate, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Rotate.
5. Select or enter the new certificate data.

Keep in mind that manually rotating a certificate replaces the content of the certificate with the new data that you provide only. Private keys and intermediate certificates from previous versions are not retained.
6. To rotate the certificate immediately, click Rotate.
7. Optional: Check the version history to view the latest updates.

In the row of the secret that you rotated, click the Actions menu !
You use this API key later to enable the Secrets Manager IAM secrets engine.







 Prepare your Cloud Object Storage instance 

Next, create a bucket in your Cloud Object Storage instance and set up access.



1. Create a test bucket in your instance.



1. In the IBM Cloud console, go to your Resource List.
2. From your list of storage services, select test-cos-instance-tutorial.
3. In the Cloud Object Storage UI, click Create bucket.
4. Create a bucket in the us-south region.
5. Copy the ID of the bucket.



2. Assign read and write access to your new Cloud Object Storage bucket.



1. Go to Manage > Access (IAM) > Access groups.
2. From your list of groups, select test-storage-admin-group.
3. Click the Access tab.
4. Click Assign access.
5. From the list of services, select Cloud Object Storage and click Next.
6. In the Resources section, select Specific resources.
7. In the Attribute type field, select Service instance.
8. From the list of service instances, select test-cos-instance-tutorial and click Next.
9. Assign the Reader, Content Reader, Object Reader, and Object Writer service access roles.
10. Review your selections and click Add.
11. Click Assign.



3. Upload an object to the storage bucket.

You can drag and drop any file or folder from your local system. For example, you can create and upload a file that is named sample.txt with the following sample text.

A quick brown fox jumped over the lazy dog.







 Prepare your Secrets Manager instance 

Finally, configure your Secrets Manager instance to start working with dynamic secrets.



1. From the command line, verify that you can access the Secrets Manager CLI plug-in.

ibmcloud secrets-manager --help

Don't have the plug-in?
Example output when the enablement is in progress.

Master status KMS feature enablement in progress.

Example output when the master is ready.

Master status Ready

After the KMS provider is enabled in the cluster, all cluster secrets are automatically encrypted.
7. Clusters that run version 3.11: Existing secrets are not automatically encrypted and need to be rewritten to be encrypted.



1. [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
2. With cluster-admin access, rewrite the secrets.

kubectl get secrets --all-namespaces -o json | kubectl replace -f -



8. Optional: [Verify that your secrets are encrypted](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionverify_kms).



Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. When you rotate a root key, you can't reuse a previous root key for the same cluster. Similarly, if you disable a root key, operations that rely on reading secrets fail. Unlike deleting a root key, however, you can reenable a disabled key to make your cluster usable again.





 Rotating the root key for your cluster 

To rotate the root key that is used to encrypt your cluster, you can repeat the steps to enable KMS encryption from the [CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms_cli) or [console](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms_ui).
Also, you must create the root CA inside the Secrets Manager. When you select an intermediate CA, the following options are required to make sure that every CA can be found while the CA chain of a private certificate in your VPN server is verified:



* In the Type section, you must select Internal signing.
* In the Type section, you must enable the Encode URL toggle button when you create a CA to encode the issuing certificate URL in end-entity certificates.



* The maximum number of CAs in a private certificate CA chain is 11 (a root CA and 10 intermediate CAs at most).
* In the Certificate revocation list section, enable both CRL building and CRL distribution points toggle buttons if you want to use the CA CRL of a private certificate. A revoked certificate is no longer trusted by the applications after one hour.
* The CA CRL works only if you don't upload a certificate revocation list when you create a VPN server. You don't need to enable a CA CRL if the VPN server's CRL is already uploaded.
* While creating a template for an intermediate CA, in the Certificate roles section:



* Select the Use certificates for server checkbox if that created CA will sign the server certificate for the VPN server.
* Select the Use certificates for client checkbox if that created CA will sign the client certificate for the VPN server.
* Select both Use certificates for server and Use certificates for client checkboxes if that created CA will sign both server and client certificates for the VPN server.





For more information, see [Creating private certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificates&interface=uicreate-certificates) in the Secrets Manager documentation.





 Locating the certificate CRN 

When you configure authentication for a client-to-site VPN server during provisioning using the UI, you can choose to specify the Secrets Manager and SSL certificate, or the certificate's CRN. You might want to do this if you cannot view the Secrets Manager in the menu, which means you don't have access to the Secrets Manager instance.
Create a service ID and set it as an environment variable.

export SERVICE_ID=ibmcloud iam service-id-create kubernetes-secrets-tutorial --description "A service ID for testing Secrets Manager and Kubernetes Service." --output json | jq -r ".id"; echo $SERVICE_ID
3. Assign the service ID permissions to read secrets from Secrets Manager.

ibmcloud iam service-policy-create $SERVICE_ID --roles "SecretsReader" --service-name secrets-manager

By assigning SecretsReader service access, the External Secrets controller has the correct level of access to read secrets from Secrets Manager and populate them in a Kubernetes cluster.
4. Create an IBM Cloud API key for your service ID.

export IBM_CLOUD_API_KEY=ibmcloud iam service-api-key-create kubernetes-secrets-tutorial $SERVICE_ID --description "An API key for testing Secrets Manager." --output json | jq -r ".apikey"

You use this API key later to configure Secrets Manager for your cluster deployment.







 Create a Kubernetes cluster and Secrets Manager instance 

Create a Kubernetes cluster and an instance of Secrets Manager in your IBM Cloud account.

You can create one free Kubernetes cluster and Secrets Manager service instance per IBM Cloud account. If you already have both resources in your account, you can use your existing free cluster and Secrets Manager instance to complete the tutorial.



1. From the command line, select the account, region, and resource group where you want to create a Secrets Manager service instance.

In this tutorial, you interact with the Dallas region. If you're logged in to a different region, be sure to set Dallas as your target region by running the following command.

ibmcloud target -r us-south -g default
2. Create a Kubernetes cluster.

ibmcloud ks cluster create classic --zone dal10 --flavor free --name my-test-cluster
3. Create a Secrets Manager instance.
Configure Secrets Manager to securely manage secrets that are part of your toolchain:



1. If you are configuring this tool integration as you are creating the toolchain, in the Configurable Integrations section, click Secrets Manager. If Secrets Manager is defined as an optional tool integration, it is located under More Tools.
2. If you have a toolchain and are adding this tool integration to it, from the IBM Cloud console, click the menu icon ![hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg) and select DevOps. On the Toolchains page, click the toolchain to open its Overview page. Alternatively, on your app's Overview page, on the Continuous Delivery card, click View toolchain. Then, click Overview.

a. Click Add tool.

b. In the Tool Integrations section, click Secrets Manager.
3. Specify a name for this instance of the Secrets Manager tool integration to use in your toolchain. The name that you specify is used in the UI tools that select Secrets Manager secrets. It is also used as part of the reference that resolves the secret values when the toolchain runs. This instance name is also displayed on the Secrets Manager tool integration tile within the toolchain workspace.
4. Choose to identify this instance by the service instance name.
5. Review the default values for Region and Resource-Group and update, if required.
6. Select the instance of the Secrets Manager service that you want to use.
7. Click Create Integration.





 Applying secrets 

After your Secrets Manager tool integration is configured, you can use it to apply secrets anywhere that they are needed by the toolchain. This tool integration and the Secrets dialog box support both the Arbitrary and the IAM credentials secret types.
"creation_date": "2022-05-03T18:18:14Z",
"downloaded": true,
"expiration_date": "2022-06-04T18:18:43Z",
"id": "2c08d55d-1854-4dbd-9c25-bcd26828fe77",
"payload_available": true,
"serial_number": "6a:bc:7d:63:2a:7c:60:90:00:53:d9:ae:83:b2:1d:bc:97:ae:fb:f1",
"state": 1,
"state_description": "Active",
"validity": {
"not_after": "2022-06-04T18:18:43Z",
"not_before": "2022-05-03T18:18:14Z"
}
}
],
"versions_total": 1
},
"warnings": null
}







 List secrets 

Use the following commands to list the static secrets in your Secrets Manager instance. Allowable values for SECRET_TYPE are: arbitrary, iam_credentials, imported_cert, kv, private_cert, public_cert, and username_password.

List secrets by type.

vault read [-format=FORMAT] ibmcloud/SECRET_TYPE/secrets

List secrets by secret group.

vault read [-format=FORMAT] ibmcloud/SECRET_TYPE/secrets/groups/ID



 Prerequisites 

You need the [Reader service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to list secrets.





 Command options 

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Examples