vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager 



Section 1.3 Controller manager benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.3.1 Ensure that garbage collection is configured as appropriate. Manual 1 Not checked 
 1.3.2 Ensure that controller manager healthz endpoints are protected by RBAC. Automated 1 Pass 
 1.3.3 Ensure that the --use-service-account-credentials option is set to true. Automated 1 Pass 
 1.3.4 Ensure that the --service-account-private-key-file option is set as appropriate. Automated 1 Pass 
 1.3.5 Ensure that the --root-ca-file option is set as appropriate. Automated 1 Pass 
 1.3.6 Ensure that the RotateKubeletServerCertificate option is set to true. Automated 2 Pass 
 1.3.7 Ensure that the --bind-address option is set to 127.0.0.1. Automated 1 Pass 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Pass 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass
Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager 



Section 1.3 Controller manager benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.3.1 Ensure that garbage collection is configured as appropriate. Manual 1 Not checked 
 1.3.2 Ensure that controller manager healthz endpoints are protected by RBAC. Automated 1 Pass 
 1.3.3 Ensure that the --use-service-account-credentials option is set to true. Automated 1 Pass 
 1.3.4 Ensure that the --service-account-private-key-file option is set as appropriate. Automated 1 Pass 
 1.3.5 Ensure that the --root-ca-file option is set as appropriate. Automated. 1 Pass 
 1.3.6 Ensure that the RotateKubeletServerCertificate option is set to true. Automated 2 Pass 
 1.3.7 Ensure that the --bind-address option is set to 127.0.0.1. Automated 1 Pass 







 1.4 Scheduler 



Section 1.4 Scheduler benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.4.1 Ensure that the healthz endpoints for the scheduler are protected by RBAC. Automated 1 Pass 
 1.4.2 Verify that the scheduler API service is protected by authentication and authorization. Automated 1 Pass 









 2 etcd 



Section 2 etcd benchmark results

 Section Recommendation Manual/Automated Level Result 

 2.1 Ensure that the --cert-file and --key-file options are set as appropriate. Automated 1 Pass
For more information, see [Repository storage](https://bp.veeam.com/vbr/VBP/2_Design_Structures/D_Veeam_Components/D_backup_repositories/repositories%20storage.html).

The protected region bare metal Windows server hosts the following components:



* Proxy - A proxy is a “data mover” component that is used to retrieve VM data from the source datastore, process it and deliver to the target. As a rule, have the proxy as close as possible to the source data. This proxy is used for management components that are located in the protected region.
* Repository - A location used to store backup files for the management components in the protected region and also the target for backup copy jobs from the recovery region.
* SFTP/SMB server - These servers are not Veeam services but native Windows services that are used for file-level backups of some of the management components. A Veeam file copy job copies files to the recovery region for extra protection.



The recovery region bare metal Windows server hosts the following components:



* Backup server - In a two-site environment where replication is used, best practice is to install the Veeam Backup server component in the DR site. In a disaster situation, the backup server is available to start the recovery.
* Veeam Backup & Replication Database - Veeam Backup & Replication stores information about backup infrastructure, jobs settings, job history, sessions, and other configuration data in a Microsoft SQL Server database.
* Enterprise Manager - Enterprise Manager provides centralized management and reporting for one or multiple backup servers through a web interface. While this design has only one backup server instance, it is recommended to deploy Enterprise Manager when encryption is used for backup or backup copy jobs. It is advised to install the Enterprise Manager server on the recovery site so it is available for disaster recovery.
* Proxy server - This proxy is used for management components that are located in the recovery region.
* Repository - A location used to store backup files for the management components in the recovery region and also the target for backup copy jobs from the protected region.
It is recommended that configuration management automation (such as PowerCli, Ansible, or Terraform) is used to provide the required synchronization.





 Caveonix RiskForesight 

The IBM Cloud for VMware® Regulated Workloads automation deploys a Caveonix RiskForesight all-in-one appliance in both the protected region and the recovery region. In the dual region design only the recovery region appliance is used, and is reconfigured so that the protected region vCenter, NSX-T manager are configured as Asset Repositories. The use of a single instance of Caveonix RiskForesight to manage compliance and cyberrisk across both the protected and recovery regions allows a single view of all environments. By placing the single instance of Caveonix RiskForesight in the recovery region, that instance is available when in DR invocation without any DR activities.

vSphere HA provides availability of the RiskForesight instance and for business resiliency. For image-level backups of the VM, configure and store them in the recovery region of the Veeam Repository server. Configure a Veeam backup copy job to copy the backup to the protected site so you can provide an off-site copy of the backup.

If you are using Caveonix RiskForesight to manage compliance and cyberrisk of the workload VMs, review the scaling of the RiskForesight instance. Replace the all-in-one deployment with the appropriate deployment to match the availability and retention requirements. For more information, see [Deployment models for Caveonix RiskForesight](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix-deploy).





 VMware Aria Operations for Logs 

The IBM Cloud for VMware® Regulated Workloads automation deploys a VMware Aria Operations for Logs environment that consists of four appliances with an integrated load balancer in each of the two regions.
The website's URL is prefixed with "HTTPS" instead of "HTTP" and a padlock is shown on the address bar. If the website uses an extended validation (EV) certificate, the browser might also show a green address bar.
* Why do I see a privacy warning?

The TLS certificates issued by IBM Cloud CIS cover the root domain (example.com) and one level of subdomain (.example.com). If you’re trying to reach a second-level subdomain (..example.com) a privacy warning appears in your browser, because these host names are not added to the SAN.

Allow up to 15 minutes for one of our partner Certificates Authorities (CAs) to issue a new certificate. A privacy warning appears in your browser if your new certificate has not yet been issued.
* Why do I see invalid SSL certificate error?

If you see "Error 526, Invalid SSL Certificate" when visiting your site, it might mean your origin certificate is invalid. When the CIS proxy is enabled, a valid CA-signed certificate is required at the origin in the default SSL mode, which is "End-to-end CA Signed". Note that the default setting for the SSL mode was previously "End-to-end Flexible", which ignores the validity of certificates presented by the origin. The new default is applied only to newly added domains. If your domain was added when the default SSL mode was End-to-end Flexible, that setting is not overwritten. You can change the mode to a less strict mode, but that is not recommended for production environments.
* What is DDoS?

A distributed denial-of-service (DDoS) attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. In a DDoS attack, multiple compromised computer systems attack a target such as a server, website, or other network resource, affecting users of the targeted resource.

The flood of incoming messages, connection requests, or malformed packets to the target system forces it to slow down or even crash and shut down, thereby denying service to legitimate users or systems. DDoS attacks have been carried out by diverse threat actors, ranging from individual criminal hackers to organized crime rings and government agencies.
For more information, see [VMware Aria Operations for Networks](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-opsmgmt-vrni).

In the dual region design, install a VMware Aria Operations for Networks instance manually in each region for the monitoring and management of that region. Recovery of the instance in the protected region to the recovery region is not required. VMware Aria Operations for Networks instances are deployed per region to enable service isolation so that each region is considered to be independent.

The use of a VMware Aria Operations for Networks cluster and the use of vSphere HA provides high availability within a region. For business continuity, configure a file level backup. While VMware support image level backups, they recommend that the VMware Aria Operations for Networks appliances are shut down. This process is practical during an upgrade, but not for regular backups. Therefore, it is recommended to configure file level backup, which supports SSH backups. Configure VMware Aria Operations for Networks for scheduled backups with the Veeam Repository server as the target. Configure a Veeam file copy job to copy the backup to the protected site so you can provide an off-site copy of the backup.





 VMware Aria Operations Manager 

The IBM Cloud for VMware® Regulated Workloads automation deploys a consolidated VMware Aria Operations Manager analytics cluster of four nodes: one primary node, one primary replica node, and two data nodes in each of the regions. For more information, see [VMware Aria Operations Manager design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-opsmgmt-vrops).

The dual region design uses this deployed architecture and requires some post-provisioning tasks to create the required design:



* Protected region



* The four-node analytics cluster is reused and two extra remote collectors are deployed on an extra private portable subnet.
* The analytics cluster is protected with Veeam Replication and fails over to the recovery region. IP addresses are not changed.
If that happens, HTTPS traffic is no longer served with that CDN hostname.

Zoom

![Diagram for HTTPS with SAN Certificate](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN/images/state-diagram-san2.svg)

Figure 2: SAN certificate support



Contribute in GitHub

Open doc issue

Edit topic





On this page[Wildcard certificate support](https://cloud.ibm.com/docs/CDN?topic=CDN-about-httpswildcard-certificate-support)[Subject Alternate Name (SAN) certificate support](https://cloud.ibm.com/docs/CDN?topic=CDN-about-httpssan-certificate-support)


Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

!
Viewing your FortiGate firewalls 

You can see which VLANs are protected with firewalls and find more details about your individual firewalls by visiting the VLAN page.



1. From your browser, open the [IBM Cloud UI Console ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/classic/security/firewalls/multivlan/provision) and log in to your account.
2. Click the navigation menu in the [IBM Cloud Catalog ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com) and select Classic Infrastructure > Network > IP Management > VLANs.



Each row in the table represents a VLAN in your infrastructure. IBM© Cloud populates the "VLAN Number" and "Primary Router" information automatically indicating the true VLAN number and the router that it is configured on. The "Name" field can be used to give the VLAN a recognizable name (such as DMZ, intranet, Public, or database).

The far right column Gateway/Firewall contains details about what firewall protection is in place, for example:



* Add Firewall indicates that there are no firewalls in place for servers on this VLAN.
* Individually Protected Servers indicates that one or more servers is using a Hardware Firewall (Shared) and that there is not a Hardware Firewall (Dedicated), FortiGate Security Appliance, or Network Gateway in place. VLAN firewalls and network gateways are not able to be placed on a VLAN that contains individually protected servers.
* Firewall-vlanXXXX.networklayer.com indicates that there is a Hardware Firewall (Dedicated) or a FortiGate Security Appliance in place. Only one VLAN firewall or Network Gateway can be associated with a VLAN. Also, a server can be protected on the public VLAN by a VLAN firewall and associated on the private network with a Network Gateway.
Image-based backups of NSX-T manager are not supported. Therefore, it is recommended to configure a scheduled NSX-T appliance backup by using an SFTP server, as the only option with NSX-T. In the design, the SFTP server destination is a directory on the local Veeam Repository server. This Windows® server is configured as an SFTP server and used for the recovery of the backup files when needed. To limit the number of components needed, a separate stand-alone SFTP server is not used and instead the SFTP service within the Windows OS of the Veeam Repository server is used.

If the Veeam Repository server fails, then VCSA and NSX-T Manager backups are lost. Therefore, Veeam file copy jobs are used to copy the files from the local region to the remote region, which provides an off-site copy of the backup.

While the NSX-T Manager appliance is inoperable, the data plane is not affected, however, configuration changes are not possible. The restore process restores one node first and then prompts you to add the other nodes.

As region management is independent, network configurations in the protected region and the recovery region need to be in sync according to the customer's network resiliency strategy and overlay network design. You can choose different network resiliency strategies for the workload networks. After recovery, you might require some workloads to use the same IP addresses or a different IP addressing scheme.

It is recommended to use automation to create overlay network components so that both regions can be configured consistently. It is recommended that configuration management automation (such as PowerCli, Ansible, or Terraform) is used to provide the required synchronization.





 Caveonix RiskForesight 

The IBM Cloud for VMware® Regulated Workloads automation deploys a Caveonix RiskForesight all-in-one appliance in both the protected region and the recovery region. In the dual region design only the recovery region appliance is used, and is reconfigured so that the protected region vCenter, NSX-T manager are configured as Asset Repositories.
System.out.printf("Copy protected object %s from bucket %s to %s/%s.n", sourceObjectName, sourceBucketName, destinationBucketName, newObjectName);

CopyObjectRequest req = new CopyObjectRequest(
sourceBucketName,
sourceObjectName,
destinationBucketName,
newObjectName
);
req.setRetentionDirective(RetentionDirective.COPY);

cos.copyObject(req);

System.out.printf("Protected object copied from %s/%s to %s/%sn", sourceObjectName, sourceBucketName, destinationBucketName, newObjectName);
}
Show more





 Add or remove a legal hold to or from a protected object 

The object can support 100 legal holds:



* A legal hold identifier is a string of maximum length 64 characters and a minimum length of 1 character. Valid characters are letters, numbers, !, _, ., , (, ), - and \.
* If the addition of the given legal hold exceeds 100 total legal holds on the object, the new legal hold will not be added, a 400 error will be returned.
* If an identifier is too long it will not be added to the object and a 400 error is returned.
* If an identifier contains invalid characters, it will not be added to the object and a 400 error is returned.
* If an identifier is already in use on an object, the existing legal hold is not modified and the response indicates the identifier was already in use with a 409 error.
* If an object does not have retention period metadata, a 400 error is returned and adding or removing a legal hold is not allowed.



The presence of a retention period header is required, otherwise a 400 error is returned.

The user making adding or removing a legal hold must have Manager permissions for this bucket.

public static void addLegalHoldToObject(String bucketName, String objectName, String legalHoldId) {
VLAN firewalls and network gateways are not able to be placed on a VLAN that contains individually protected servers.
* Firewall-vlanXXXX.networklayer.com indicates that there is a Hardware Firewall (Dedicated) or a FortiGate Security Appliance in place. Only one VLAN firewall or Network Gateway can be associated with a VLAN. Also, a server can be protected on the public VLAN by a VLAN firewall and associated on the private network with a Network Gateway.
* GatewayName indicates that the VLAN is associated with that Network Gateway.





 Individually protected servers details 

For VLANs that contain Individually Protected Servers in the Gateway/Firewall field, you can click the associated VLAN number link to display the details of the VLAN, including the associated devices.

In the list of associated devices, you can click each device and scroll to the bottom of the Configuration tab. You see Firewall in the Addons section with Installed or Not Installed for the status.



* Not Installed indicates that no firewall is in place for this device.
* Installed indicates that a firewall is in place and you have a Firewall tab available on the device where you can manage the firewall configuration.







 Dedicated firewall details 

For VLANs that have Firewall-vlanXXXX.networklayer.com in the Gateway/Firewall field, you can click that firewall link to display the details of the Firewall. The device details include the associated router, VLAN, IPv4 and IPv6 subnets, the devices associated with that VLAN, and the controls for routing traffic through or around the firewall.

FortiGate Security Appliance devices have the management IP, username, and password. Management of FortiGate Security Appliances is completed through their own GUI or SSH-based console.





 Network gateway details 

For VLANs that have a Network Gateway device name in the Gateway/Firewall field, you can click the Network Gateway name to display details of the Network Gateway. The device details include the associated front end (FCR) and backend (BCR) VLANs and Network Gateway management options.
On this page[HTTP headers](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-how-http-works-with-cloudanthttp-headers)[Request headers](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-how-http-works-with-cloudantrequest-headers)[Response headers](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-how-http-works-with-cloudantresponse-headers)


Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

![0_ti_146001191_Ver_2_mid_6476e991-b2bf-4d3f-8c2a-21794b99b515_sid_cca51480229211eeac887b94c5a6c542_vid_cca50460229211ee874f7dc32b9b9a8d_vids_0_msclkid_N_pi_918639831_lg_en-US_sw_3840_sh_2160_
[MAS-MS-Register-IBMid-Login](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/MAS-MS-Register-IBMid-Login.png)

Figure 9. MAS-Dedicated Register IBMid Login
3. Privacy Statement may appear. If it does, click I consent

Zoom

![MAS-MS-Register-Privacy](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/MAS-MS-Register-Privacy.png)

Figure 10. MAS-Dedicated Register Privacy
4. After entering your IBMid & password, the following page will be displayed. Click on the Request access button:

Zoom

![MAS-MS-Register-Request-Access](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/MAS-MS-Register-Request-Access.png)

Figure 11. MAS-Dedciated Register Request Access
5. The following dialog box will appear:

Zoom

![MAS-MS-Register-Request-Access-Dialog](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/MAS-MS-Register-Request-Access-Dialog.png)

Figure 12. MAS-Dedicated Request Access Dialog
6. Be sure the I consent checkbox is checked, then type Maximo Application Suite on Cloud in the Product field.