vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Understanding DevSecOps pipelines 

The various pipelines that are provided in the reference continuous integration and continuous deployment toolchains are based on the Continuous Delivery support for Tekton Pipelines.

To learn more about Tekton Pipelines, see [Working with Tekton pipelines](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-tekton-pipelines). You do not need to be a Tekton expert to use the reference pipelines. These pipelines are predefined with a basic structure that includes placeholders for custom scripts for steps such as builds, automated tests, and deployment. Users can declare their custom scripts for their own pipelines and set values for various environment properties for a specific pipeline.



 Pipeline statuses 

It's important to understand the error or failure conditions for a reference pipeline at certain points. Conceptually, two different types of status result from a task run in a compliance pipeline:



* Compliance status: The pass or fail state of a some check or a set of checks.
* Pipeline status: The success or failure state of a task execution itself.



If a test, scan, or check fails, it does not cause the pipeline itself to fail or stop; the task that is running the test is marked as green.

From a compliance point of view, the result of the unit test does not impact the deployment. You can deploy artifacts with failed checks, but the process keeps evidence about that activity. The compliance flow does not block you from releasing a fix when an outage occurs. For example, a green run for a unit test task that found failing tests means that The task ran successfully and found the following issues.

If a task fails with a red status, it occurs because the pipeline cannot, or should not, continue. Example conditions for failure include:



* Errors in a task or in the pipeline.
* Something happened that means it makes no sense to continue running the pipeline.



For example, if an artifact build fails in the continuous integration, it breaks the purpose of the continuous integration process itself.

To keep the final pipeline status in sync with the compliance results, a task at the end of the pipeline checks the compliance results and sets the pipeline run status to either red or green.
The alphabet attribute specifies the phonetic representation type: ipa or ibm. The ph attribute specifies the phonetic translation string.

For example, consider the word trinitroglycerin. The service's regular pronunciation rules produce a pronunciation that differs from the one commonly used by chemists and physicians. The correct pronunciation can be achieved with a phonetic translation:



* IPA: tɹaɪnˈaɪtɹəglɪsəɹɨn
* SPR: trYn1YtrxglIsxrXn



In these examples, the phonetic translation string is composed of phoneme symbols and a single primary stress mark. The primary stress mark is represented by ˈ in IPA and by 1 in SPR. It is placed just before the symbol for the stressed vowel in both cases. Although the examples do not show it, you can also specify syllable boundaries and secondary stress positions in a phonetic translation. These elements are not required and normally are not needed to achieve a pronunciation. As with sounds-like translations, you can compose a phonetic translation from multiple strings that are delimited by spaces.

You can also specify IPA translations as IPA Unicode values. For more information, see [Understanding phonetic symbols](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-symbols) and the language-specific tables on the pages that are referred to from [Phonetic symbols for supported languages](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-symbolssupportedLanguages). For an example translation that uses IPA Unicode values, see [The phoneme element](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-elementsphoneme_element).



 Working with an existing phonetic translation 

Unless you are an expert in phonology, composing phonetic translations is not an easy task. It is always easier to edit an existing phonetic translation than to compose one from scratch. To help you create phonetic translations, the service's API includes a GET /v1/pronunciation method.
With jq, you filter a list of documents by their field values. This filter makes it easier to get all replication documents, or the details of just one particular view indexing task. The API reference has more information about the options.

See an example of obtaining and formatting a list of active tasks:

curl "$SERVICE_URL/_active_tasks" | jq





 Monitoring view builds and search indexes 

View indexes are rebuilt when a design document is updated. An update to any one of the views causes all the views in the document to be rebuilt.

Search indexes are rebuilt only when their corresponding index function is changed. For each search index that is built and for each design document with views that are changed, a new task is created for each replica and each shard in a cluster.

For example, if 24 shards with three replicas each exist, and you update two search indexes, then 24 x 3 x 2 = 144 tasks run.

To find all the view indexing tasks, pipe the curl output to jq, and let it filter the documents in the array by their type field. A corresponding command works for search indexing tasks.

In each case, the results of searching for a list of indexing tasks is a list of JSON objects: one for each of the active tasks found.

See an example of finding all view indexing tasks by filtering for the indexer type:

curl -s "$SERVICE_URL/_active_tasks" | jq '.[] | select(.type=="indexer")'

See an example of finding all search indexing tasks by filtering for the search_indexer type:

curl -s "$SERVICE_URL/_active_tasks" | jq '.[] | select(.type=="search_indexer")'

See example results after you search for view indexing tasks:

{
"total_changes": 6435,
"started_on": 1371118332,
"user": "username",
"updated_on": 1371118334,
"type": "indexer",
[A magnifying glass to represent a search](https://cloud.ibm.com/docs-content/v1/content/148d3bd95f946aa1bb53ea1540475f522e6b61c9/watson-knowledge-studio-data/images/filter_gray.png) next to the RuleDate class from the Class panel. It is a good practice to check that all dates are captured properly to confirm that you defined the pattern correctly.

![Shows the "Find Annotations" page with two documents that contain dates that match the rule pattern you just defined.](images/rule-add11.png "Shows the "Find Annotations" page with two documents that contain dates that match the rule pattern you just defined.")









 Lesson 8: Creating a rule-based model 

In this lesson, you will learn how to create a rule-based model.



 About this task 

For more information about creating a rule-based model, see [Creating the rule-based model](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-wks_rule_train).





 Procedure 



1. Select Rule-based Model > Versions and click the Rule-based model type mapping tab.
2. Map the RuleDate class to the DATE entity from the type system.



1. Find the DATE entity, and click Edit.

![Shows the user clicking Edit for the "DATE" entity type in the "Rule-based model type mapping" tab.](images/rule-anno2.png "Shows the user clicking Edit for the "DATE" entity type in the "Rule-based model type mapping" tab.")
2. Choose the RuleDate class from the list and click Save.

![Shows the user choosing the "RuleDate" class from the list.](images/rule-anno3.png "Shows the user choosing the "RuleDate" class from the list.")



3.
The following table describes the responsibilities that are related to identity and access management for all VMware Solutions offerings.



Table 5. Responsibilities for identity and access management
The rows are read from left to right. The first column describes the task that a customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM responsibilities Your responsibilities 

 Identity and access Provide the function to restrict access to resources through the IBM Cloud console and REST APIs. Provide default access to the provisioned VMware environment. Manage access to resources through IAM. Manage access to the VMware environment. 







 Security and regulation compliance 

Security and regulation compliance includes tasks such as security controls implementation and compliance certification.



 Security and regulation compliance for VMware Shared 

The following table describes the responsibilities that are related to security and regulation compliance for VMware Shared.



Table 6. Responsibilities for security and regulation compliance for VMware Shared
The rows are read from left to right. The first column describes the task that a customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM responsibilities Your responsibilities 

 Encryption Secure connections are provided to administration portals and replication endpoints. Backups are encrypted uniquely per customer. If required, secure with HTTPS. 







 Security and regulation compliance for VMware Solutions offerings (other than VMware Shared) 

The following table describes the responsibilities that are related to security and regulation compliance for all VMware Solutions offerings, other than VMware Shared.



Table 7. Responsibilities for security and regulation compliance for VMware Solutions offerings (other than VMware Shared)
The rows are read from left to right. The first column describes the task that a customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM responsibilities Your responsibilities 

 Encryption Provide integration with Key Protect and Hyper Protect Crypto Services through KMIP service as an option for implementing data at-rest encryption.
To improve cluster DNS availability, you can set the "includeUnschedulableNodes":true parameter when [Autoscaling the cluster DNS provider](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_autoscale). 
 Ingress resource fields In the Ingress resource definition, several fields are changed, including the API version, service name, and service port, and added the pathType field. To update your Ingress resources to the new format, see the example YAML file in the documentation for the [community Kubernetes Ingress setup](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-setup). 
 Kubernetes seccomp support graduates to general availability (GA) The support for seccomp.security.alpha.kubernetes.io/pod and container.seccomp.security.alpha.kubernetes.io/... annotations are now deprecated, and are planned for removal in Kubernetes version 1.22. A seccompProfile field is now added to the pod and container securityContext objects. The Kubernetes version skew handling automatically converts the new field into the annotations and vice versa. You don't have to change your existing workloads, but you can begin the conversion in preparation for the removal of the annotations before version 1.22. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). 
 Unsupported:kubectl apply --server-dry-run removed The deprecated --server-dry-run option is removed from the kubectl apply command. If your scripts rely on this option, update them to use the --dry-run=server option instead. 
 Unsupported:kubectl get --export removed The deprecated --export option is removed from the kubectl get command.
ibmcloud cdb deployment-user-delete <deployment name or CRN> <username> [--nowait] [--json]



 Command options 



* --nowait or -n Do not wait for the user deletion task to complete. Display the user deletion task details and exit.
* --json or -j Display results as JSON.







 Examples 

Remove the database user called "fred" from the "MyPSQL" deployment

ibmcloud cdb deployment-user-delete MyPSQL fred







 ibmcloud cdb deployment-user-password 

Short version - user-password

Changes the password for a named user on a specified database deployment.

ibmcloud cdb deployment-user-password <deployment name or CRN> <username> <newpassword> [--nowait] [--json]



 Command options 



* --nowait or -n Do not wait for the user password change task to complete. Display the user password change task details and exit.
* --json or -j Display results as JSON.







 Examples 

Change the password of user "fred" on the database deployment "MyPSQL" to "A9876B5432"

ibmcloud cdb deployment-password MyPSQL fred A9876B5432









 Database Configuration 

List or change configurable settings on a deployment. The new configuration is specified in a JSON file or JSON string of settings. Settings vary by database type, see Changing the Database Configuration for [PostgreSQL](https://cloud.ibm.com/docs/services/databases-for-postgresql?topic=databases-for-postgresql-changing-configuration) or for [Redis](https://cloud.ibm.com/docs/services/databases-for-redis?topic=databases-for-redis-changing-configuration).



 ibmcloud cdb deployment-configuration-schema 

Short version - config-schema

Gets the default configuration of the specified deployment.
After you generate the BOM file, use the ibmcloud cra cve command to list any vulnerabilities. For more information about running the ibmcloud cra cve command, see [Vulnerability scan](https://cloud.ibm.com/docs/cli?topic=cli-cra-cli-pluginvulnerability-command).

Make sure that the run-cra task does not contain any errors. If the task contains errors, check whether your pipeline uses the current version of DevSecOps. If the issue is not resolved by checking the version of DevSecOps, the following examples provide some common errors and proposed solutions.

FAILED
Error executing docker pull cmd: [docker pull us.icr.io/opentoolchain/ibmnode:14ubisecure]

You can verify that you have access to the private registry. If you do not have access, you can use the cra-custom-script-path parameter and specify the path to a custom script that runs before Code Risk Analyzer to authenticate to the private registry.

FAILED
Error executing docker build cmd for stage-0: exit status 1

If your Dockerfile requires ARGS, the docker build command for the build stages fails to build because of the missing ARGS. The cra-custom-script-path is required to set up the ARGS as environment variables. For more information about setting up the custom script, see [Example custom scripts for DevSecOps](https://cloud.ibm.com/docs/cli?topic=cli-cra-cli-plugindevsecops-custom-script-examples).

FAILED
Error executing docker build cmd for stage-0: exit status 1
...
COPY file-to-copy.js file-to-copy.js:
------
failed to compute cache key: "/file-to-copy.js" not found: not found

By default, the Code Risk Analyzer bom-generate command builds the Dockerfiles from the context of the location of the Dockerfile itself.
Create a replication slot on a deployment named "MyPostgres", database named "testdb", and slot named "slot1".

ibmcloud cdb postgresql replication-slot-create MyPostgres testdb slot1 wal2json







 ibmcloud cdb postgresql replication-slot-delete 

Short version - rsd

Deletes the specified PostgreSQL replication slot. See the [Wal2json](https://cloud.ibm.com/docs/services/databases-for-postgresql?topic=databases-for-postgresql-wal2json) documentation for more information.

ibmcloud cdb postgresql replication-slot-delete <deployment name or CRN> <slotname> [--json] [--nowait]



 Command options 



* --nowait or -n Do not wait for the group setting task to complete. Display the scaling task's details and exit.
* --json or -j Return the results as JSON.







 Examples 

Deletes a replication slot on a deployment named "MyPostgres" and slot named "slot1".

ibmcloud cdb postgresql replication-slot-delete MyPostgres slot1









 EnterpriseDB 

Perform tasks specific to EnterpriseDB deployments.



 ibmcloud cdb enterprisedb earliest-pitr-timestamp 

Short version - ept

Returns the earliest available time for point-in-time-recovery in ISO8601 UTC format. For more information, see [Point in Time Recovery](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-pitr).

ibmcloud cdb enterprisedb earliest-pitr-timestamp <deployment name or CRN> [--json] [--nowait]



 Command options 



* --nowait or -n Do not wait for the group setting task to complete. Display the scaling task's details and exit.
Tasks 

Tasks are created whenever you perform an action on your deployment. Tasks include things like taking a backup, group scaling, and changing a user password. Most cdb commands poll the running task and exit when it completes. You can change this behavior with the --nowait flag, which returns task information and exits. Records of successful tasks are shown for 24 - 48 hours, and unsuccessful tasks are shown for 7 - 8 days. A historical record of tasks from any time period is available through the [Activity Tracker integration](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-activity-tracker).



 ibmcloud cdb deployment-tasks-list 

Short version - tasks

Displays a list of all tasks that have been run on a specified deployment since it was created. Each task is displayed with its CRN, readable description, percentage completeness, status, and date of creation.

ibmcloud cdb deployment-tasks-list <deployment name or CRN> [--json]



 Command options 



* --json or -j Display results as JSON.







 Examples 

Display a list of the tasks that have been run against a deployment named "NewRedis"

ibmcloud cdb deployment-tasks-list NewRedis







 ibmcloud cdb task-show 

Short version - task

Show the status of a particular task. The task is identified by its CRN ID as shown with the deployment-tasks-list command. If the task is running, the command waits for the task to complete, reporting status changes as it regularly polls.

ibmcloud cdb task-show <CRN> [--nowait] [--json]



 Command options 



* --nowait or -n Do not wait for the task to complete. Display the user password change task details and exit.
* --json or -j Display results as JSON.







 Examples 

Show details of a particular backup task.
For more information, see the [Wal2json](https://cloud.ibm.com/docs/services/databases-for-postgresql?topic=databases-for-postgresql-wal2json) documentation for more information.

ibmcloud cdb postgresql replication-slot-create <deployment name or CRN> <databasename> <slotname> <plugintype> [--json] [--nowait]

The plug-in type is required to be "wal2json".



 Command options 



* --nowait or -n Do not wait for the group setting task to complete. Display the scaling task's details and exit.
* --json or -j Return the results as JSON.







 Examples 

Create a replication slot on a deployment named "MyPostgres", database named "testdb", and slot named "slot1".

ibmcloud cdb postgresql replication-slot-create MyPostgres testdb slot1 wal2json







 ibmcloud cdb postgresql replication-slot-delete 

Short version - rsd

Deletes the specified PostgreSQL replication slot. See the [Wal2json](https://cloud.ibm.com/docs/services/databases-for-postgresql?topic=databases-for-postgresql-wal2json) documentation for more information.

ibmcloud cdb postgresql replication-slot-delete <deployment name or CRN> <slotname> [--json] [--nowait]



 Command options 



* --nowait or -n Do not wait for the group setting task to complete. Display the scaling task's details and exit.
* --json or -j Return the results as JSON.







 Examples 

Deletes a replication slot on a deployment named "MyPostgres" and slot named "slot1".

ibmcloud cdb postgresql replication-slot-delete MyPostgres slot1









 EnterpriseDB 

Perform tasks specific to EnterpriseDB deployments.
Table 2. Responsibilities for change management
The rows are read from left to right. The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM responsibilities Your responsibilities 

 Keep deployed services and resources up to date Apply fixes and updates to the compute resources that are created from the deployable architecture. The following resources are not updated through the deployable architecture unless otherwise indicated.<br><br><br><br> * [Red Hat OpenShift clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-update)<br> * [Kubernetes lusters, worker nodes, and cluster components](https://cloud.ibm.com/docs/containers?topic=containers-update)<br><br><br> 







 Identity and access management 

Identity and access management includes tasks such as authentication, authorization, access control policies, and approving, granting, and revoking access.



Table 3. Responsibilities for identity and access management
The rows are read from left to right. The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM responsibilities Your responsibilities 

 Secure with least privilege Document the minimal IAM access requirements to run the deployable architecture. 
 Manage secrets <br><br> * Generate the necessary secrets (for example, IAM API keys, SSH keys) that are required for the deployable architecture.<br> * Manage generated secrets by following secure best practices.<br><br><br> 







 Security and regulation compliance 

Security and regulation compliance includes tasks such as security controls implementation and compliance certification.



Table 4. Responsibilities for security and regulation compliance
The rows are read from left to right. The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM responsibilities Your responsibilities
The IP address must be in the zone and VLAN that you specify in the annotations. If you don't specify an IP address: If your cluster is on a public VLAN, a portable public IP address is used. Most clusters are on a public VLAN. If your cluster is on a private VLAN only, a portable private IP address is used.

externalTrafficPolicy: Local
: Set to Local.

Example configuration file to create an NLB 2.0 service in dal12 that uses the round-robin scheduling algorithm:

apiVersion: v1
kind: Service
metadata:
name: myloadbalancer
annotations:
service.kubernetes.io/ibm-load-balancer-cloud-provider-zone: "dal12"
service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: "ipvs"
service.kubernetes.io/ibm-load-balancer-cloud-provider-ipvs-scheduler: "rr"
spec:
type: LoadBalancer
selector:
app: nginx
ports:
- protocol: TCP
port: 8080
targetPort: 8080 Optional. By default, the targetPort is set to match the port value unless specified otherwise.
externalTrafficPolicy: Local
Show more
3. Optional: Make your NLB service available to only a limited range of IP addresses by specifying the IPs in the spec.loadBalancerSourceRanges field. loadBalancerSourceRanges is implemented by kube-proxy in your cluster via Iptables rules on worker nodes. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/).
4. Create the service in your cluster.

oc apply -f myloadbalancer.yaml



3. Verify that the NLB service was created successfully. It might take a few minutes for the NLB service to be created properly and for the app to be available.

oc describe service myloadbalancer