vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* If you are using a Mac computer, the Page Down key is the same as FN + Down Arrow.
* Change the password on the Dedicated Service Tools (DST) Sign On screen. Use PF5 to change the DST password.
* On the next screen, select Option 1 to Perform an IPL. The sign-on screen appears after the IPL completes. Change the system QSECOFR ID password. New security rules require at least a 15-character password.
* CRTUSRPRF and CHGUSRPRF will also use these new security rules.







 Licenses and configuring your network 

You must install the [minimum program temporary fix (PTFs) levels](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-minimum-levels) on your IBM i VM.

After you deploy an IBM i VM and install the proper PTFs, you need to accept the license agreements. To accept the license agreements from the console, you must press 5 on each license agreement to display them. Click PF14 to accept each agreement. After you accept the license agreements, press PF3 and wait until cloud-init configures your network and injects your license keys.

The cloud-init configuration process can take up to 5 minutes. Do not restart your system while cloud-init is running. If you restart your system during this time, you must call IBM support to manually configure your network and license keys.

To verify that cloud-init configured your IP addresses correctly, type the cfgtcp command in the IBM i console window and choose 1. If the two IP addresses match the internal IP addresses of your VM, the cloud-init configuration ran successfully.

Verifying the cloud-init configuration:

Work with TCP/IP Interfaces
System: KCW73A
Type options, press Enter.
1=Add 2=Change 4=Remove 5=Display 9=Start 10=End

Internet Subnet Line Line
Opt Address Mask Description Type
___ 10.1.1.5 255.255.255.192 CLOUDINIT1 ELAN
Review the config.json file to verify that "secret_type": "ibm-kp" is added to the secret section of your CLI output.

cat config.json

Example output

{
"alertingurl": "",
"clusterid": "px-kp-test",
"dataiface": "",
"kvdb": [
"etcd:https://portal-ssl748-34.bmix-dal-yp-12a2312v5-123a-44ac-b8f7-5d8ce1d123456.123456789.composedb.com:56963",
"etcd:https://portal-ssl735-35.bmix-dal-yp-12a2312v5-123a-44ac-b8f7-5d8ce1d123456.12345678.composedb.com:56963"
],
"mgtiface": "",
"password": "ABCDEFGHIJK",
"scheduler": "kubernetes",
"secret": {
"cluster_secret_key": "",
"secret_type": "ibm-kp"
},
"storage": {
"devices": [
"/dev/sdc1"
],
"journal_dev": "",
"max_storage_nodes_per_zone": 0,
"system_metadata_dev": ""
},
"username": "root",
"version": "1.0"
}
6. Exit the pod.





Check out how to [encrypt the secrets in your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect), including the secret where you stored your Key Protect CRK for your Portworx storage cluster.
* You might have subnet conflicts with the IBM-provided default 172.30.0.0/16 range for pods and 172.21.0.0/16 range for services. You can avoid subnet conflicts when you [create a cluster from the CLI](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_create) by specifying a custom subnet CIDR for pods in the --pod-subnet option and a custom subnet CIDR for services in the --service-subnet option.
* If your VPN solution preserves the source IP addresses of requests, you can [create custom static routes](https://cloud.ibm.com/docs/containers?topic=containers-static-routes) to ensure that your worker nodes can route responses from your cluster back to your on-premises network.



The 172.16.0.0/16, 172.18.0.0/16, 172.19.0.0/16, and 172.20.0.0/16 subnet ranges are prohibited because they are reserved for IBM Cloud Kubernetes Service control plane functionality.



 Using the strongSwan IPSec VPN service Helm chart 

Use a Helm chart to configure and deploy the strongSwan IPSec VPN service inside of a Kubernetes pod.

Because strongSwan is integrated within your cluster, you don't need an external gateway appliance. When VPN connectivity is established, routes are automatically configured on all the worker nodes in the cluster. These routes allow two-way connectivity through the VPN tunnel between pods on any worker node and the remote system. For example, the following diagram shows how an app in IBM Cloud Kubernetes Service can communicate with an on-premises server via a strongSwan VPN connection.

Zoom

![Flow of traffic between your cluster and an on-premises data center through the strongSwan VPN service.]
Updating the classic infrastructure VPN password 

You can update your own VPN password, or in the case where a user forgets their password and can't reset it themselves, another user with correct access can update that user's VPN password.

If you have the following access, you can update the VPN password for another user:



*  An IAM policy with the Editor or higher role on the User management service.
*  You are an ancestor in the classic infrastructure hierarchy for the user and you have the Manage users classic infrastructure permission assigned



To update the VPN password, complete the following steps:



1.  In the IBM Cloud® console, click Manage > Access (IAM), and select Users.
2.  Select a user from the list.
3.  From the User details page, go to the VPN password section.
4.  Click the Edit icon ![Edit icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_write.svg) to enter a new VPN password.
5.  Click Update password.
--endpoints=https://1ab234c5-12a1-1234-a123-123abc45cde1.123456ab78cd9ab1234a456740ab123c.databases.appdomain.cloud:32059
5. Find the certificate section of your service credentials and note the certificate_base64.

Example output for certificate:

"certificate": {
"certificate_base64": "AB0cAB1CDEaABcCEFABCDEF1ACB3ABCD1ab2AB0cAB1CDEaABcCEFABCDEF1ACB3ABCD1ab2AB0cAB1CDEaABcCEFABCDEF1ACB3ABCD1ab2..."



5. Encode your username and password to base64.

echo -n "<username_or_password>" | base64
6. Create a Kubernetes secret for your certificate.



1. Create a configuration file for your secret.

apiVersion: v1
kind: Secret
metadata:
name: px-etcd-certs
namespace: kube-system
type: Opaque
data:
ca.pem: <certificate_base64>
username: <username_base64>
password: <password_base64>
2. Create the secret in your cluster.

oc apply -f secret.yaml



7. Choose if you want to [set up encryption for your volumes with IBM Key Protect](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_encryption). If you don't want to set up IBM Key Protect encryption for your volumes, continue with [installing Portworx in your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_deploy).
VSE-9893 6.5 DLA-1330-1 CVE-2018-0739: Debian DLA-1330-1: openssl - security update 
 VSE-9892 9.8 DLA-1328-1 CVE-2017-12627: Debian DLA-1328-1: xerces-c - security update 
 VSE-9891 N/A DLA-1323-1 Debian DLA-1323-1: tzdata - security update 
 VSE-9890 9.8 DLA-1309-1 CVE-2018-1000120, CVE-2018-1000121, CVE-2018- 1000122: Debian DLA-1309-1: curl - security update 
 VSE-9886 8.8 DSA-4071-1 CVE-2017-17512: Debian DSA-4071-1: sensible-utils – security update 
 VSE-9885 6.5 DSA-4018-1 CVE-2017-3735, CVE_2017-3736: DSA-4018-1 openssl – security update 
 VSE-9832 7.5 DLA-1059-1 CVE-2017-11185: Debian DLA-1059-1: strongswan security update 









 6.7R14S6 

Released March 6, 2018.



 Issues Resolved 



Issues resolved in HERE

 Issue Number Priority Summary 

 VSE-9880 Minor Disabling RPF source-validation does not remove setting from all interfaces 







 Security Vulnerabilities Resolved 



Security vulnerabilties resolved in HERE

 Issue Number CVSS score Advisory Summary 

 VSE-9887 6.5 DSA-4101-1 CVE-2018-5334, CVE-2018-5335, CVE-2018-5336: Debian DSA-4101-1: wireshark – security update
: When you upgrade your cluster to version 4.12, a [BGP password](https://docs.tigera.io/calico/latest/reference/resources/bgppeerbgppassword) is automatically configured for Calico. This might disrupt pod networking for several seconds while the BGP password configuration is applied.



 Update before master 

The following table shows the actions that you must take before you [update the cluster master](https://cloud.ibm.com/docs/openshift?topic=openshift-updatemaster).



Changes to make before you update the master to Red Hat OpenShift 4.12

 Type Description 

 Unsupported: Deprecated and removed OpenShift features For more information, review the [OpenShift version 4.12 deprecated and removed features](https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.htmlocp-4-12-deprecated-removed-features) and [Preparing to update to OpenShift Container Platform 4.12](https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-prepare.htmlupdating-cluster-prepare) for actions that might be required. 
 Known OpenShift issues For information on actions that might be required, review the [OpenShift version 4.12 known issues](https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.htmlocp-4-12-known-issues). 
 Pod security admission synchronization If an Operator is installed in a user-created openshift-* namespace, synchronization is turned on by default after a cluster service version (CSV) is created in the namespace. The synchronized label inherits the permissions of the service accounts in the namespace.
tolerations
: If the worker that you deleted was not tainted, but the only workers that remain are tainted, change this setting to allow the VPN pod to run on workers with any taints or specific taints.
4. Install the new Helm chart with your updated values.

helm install <release_name> iks-charts/strongswan -f config.yaml
5. Check the chart deployment status. When the chart is ready, the STATUS field near the top of the output has a value of DEPLOYED.

helm status <release_name>
6. Sometimes, you might need to change your on-prem settings and your firewall settings to match the changes you made to the VPN configuration file.
7. Start the VPN.



* If the VPN connection is initiated by the cluster (ipsec.auto is set to start), start the VPN on the on-prem gateway, and then start the VPN on the cluster.
* If the VPN connection is initiated by the on-prem gateway (ipsec.auto is set to auto), start the VPN on the cluster, and then start the VPN on the on-prem gateway.



8. Set the STRONGSWAN_POD environment variable.

export STRONGSWAN_POD=$(oc get pod -l app=strongswan,release=<release_name> -o jsonpath='{ .items[0].metadata.name }')
9. Check the status of the VPN.

oc exec $STRONGSWAN_POD -- ipsec status



* If the VPN connection has a status of ESTABLISHED, the VPN connection was successful. No further action is needed.
* If you are still having connection issues, see [Why can't I establish VPN connectivity with the strongSwan Helm chart?](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_vpn_fails) to further troubleshoot your VPN connection.
* localSubnetNAT: Ensure that an application in the on-premises remote network can select a specific VPN connection to send and receive traffic to the cluster. In each strongSwan Helm configuration, use localSubnetNAT to uniquely identify the cluster resources that can be accessed by the remote on-premises application. Because multiple VPNs are established from the remote on-premises network to the cluster, you must add logic to the application on the on-premises network so that it can select which VPN to use when it accesses services in the cluster. Note that the services in the cluster are accessible through multiple different subnets depending on what you configured for localSubnetNAT in each strongSwan VPN configuration.
* remoteSubnetNAT: Ensure that a pod in your cluster uses the same VPN connection to return traffic to the remote network. In each strongSwan deployment file, map the remote on-premises subnet to a unique subnet using the remoteSubnetNAT setting. Traffic that is received by a pod in the cluster from a VPN-specific remoteSubnetNAT is sent back to that same VPN-specific remoteSubnetNAT and then over that same VPN connection.



* If pods in the cluster must access services on the remote on-premises network and applications in the remote on-premises network must access services in the cluster, configure the localSubnetNAT and remoteSubnetNAT settings listed in the second bullet point. Note that if a pod in the cluster initiates a request to the remote on-premises network, you must add logic to the pod so that it can select which VPN connection to use to access the services on the remote on-premises network.



3. Configure the remote VPN endpoint software to establish a separate VPN connection to the load balancer IP in each zone.









 Configuring the strongSwan Helm chart 

Before you install the strongSwan Helm chart, you must decide on your strongSwan configuration.

Before you begin



* Install an IPSec VPN gateway in your on-premises data center.
As a result, the transit VLAN’s (native-vlan-id) are different.

 Last commit: 2020-04-16 22:48:33 UTC by root
version 18.4R1-S1.3;
system {
login {
class security {
permissions [ security-control view-configuration ];
}
user admin {
uid 2000;
class super-user;
authentication {
encrypted-password "$6$vKPIcB3I$XlDRg3Oto9tLa7zRPkalSfonrKUEJI7U16XX2lrke3k2sPaV.CY0CJhSBIPx5aXhqo7h1GWPhhMbv0Ce1WANO."; SECRET-DATA
}
}
}
root-authentication {
encrypted-password "$6$cbXBMc8b$jHd6LtR4OjXvjmgubQXAlofNonk6lLbNPs35beda7ffEV4XKEUQiEf1XUA3mMvJv2V1YET3kiWBogqz8h2zB7."; SECRET-DATA
}
services {
ssh {
root-login allow;
}
netconf {
ssh {
port 830;
}
}
web-management {
http {
interface fxp0.0;
}
https {
port 8443;
system-generated-certificate;
interface [ fxp0.0 ge-0/0/0.0 ge-0/0/1.0 ];
}
session {
session-limit 100;
}
}
}
host-name asloma-e2e-tc15-18-1g-1270-sa-vsrx-vSRX;
name-server {
10.0.80.11;
10.0.80.12;
}
syslog {
user * {
any emergency;
Delete the current Helm chart.

helm uninstall vpn -n <namespace>
7. Open the config.yaml file and fix the incorrect values.
8. Save the updated config.yaml file.
9. Install the Helm chart to your cluster with the updated config.yaml file. The updated properties are stored in a ConfigMap for your chart.

helm install vpn iks-charts/strongswan -f config.yaml
10. Check the chart deployment status. When the chart is ready, the STATUS field in the output has a value of DEPLOYED.

helm status vpn
11. After the chart is deployed, verify that the updated settings in the config.yaml file were used.

helm get values vpn
12. Clean up the current test pods.

kubectl get pods -a -l app=strongswan-test

kubectl delete pods -l app=strongswan-test
13. Run the tests again.

helm test vpn







 Limiting strongSwan VPN traffic by namespace or worker node 

If you have a single-tenant cluster, or if you have a multi-tenant cluster in which cluster resources are shared among the tenants, you can [limit VPN traffic for each strongSwan deployment to pods in certain namespaces](https://cloud.ibm.com/docs/containers?topic=containers-vpnlimit_namespace). If you have a multi-tenant cluster in which cluster resources are dedicated to tenants, you can [limit VPN traffic for each strongSwan deployment to the worker nodes dedicated to each tenant](https://cloud.ibm.com/docs/containers?topic=containers-vpnlimit_worker).



 Limiting strongSwan VPN traffic by namespace 

When you have a single-tenant or multi-tenant cluster, you can limit VPN traffic to pods in only certain namespaces.

For example, say that you want pods in only a specific namespace, my-secure-namespace, to send and receive data over the VPN.
* Extract the encryption public key from the encryption certificate by using the following command:

openssl x509 -pubkey -noout -in ibm-hyper-protect-container-runtime-1-0-s390x-11-attestation.crt > contract-public-key.pub
* Verify the signature of the attestation record:

openssl sha256 -verify contract-public-key.pub -signature se-signature.bin se-checksums.txt

Signature verification must be done on a [decrypted attestation file](https://cloud.ibm.com/docs/vpc?topic=vpc-about-attestationdecrypt_attest_record).
* You can now use the hashes from the attestation record for validation.



In case you provided a public key for encrypting the attestation record, the following script might help in decrypting the record.

!/bin/bash

 Example script to decrypt attestation document.

 Usage:
   ./decrpt-attestation.sh <rsa-priv-key.pem> [file]

 Token Format:
   hyper-protect-basic.<ENC_AES_KEY_BASE64>.<ENC_MESSAGE_BASE64>

RSA_PRIV_KEY="$1"
if [ -z "$RSA_PRIV_KEY" ]; then
    echo "Usage: $0 <rsa-priv-key.pem>"
    exit 1
fi
INPUT_FILE="${2:-se-checksums.txt.enc}"
TMP_DIR="$(mktemp -d)"
trap 'rm -r $TMP_DIR' EXIT

PASSWORD_ENC="${TMP_DIR}/password_enc"
MESSAGE_ENC="${TMP_DIR}/message_enc"

 extract encrypted AES key and encrypted message
cut -d. -f 2 "$INPUT_FILE"| base64 -d > "$PASSWORD_ENC"
* Once you have created your password click on the Attempt to Login link.
* Select the link to log in to the License Key Center.
* Select Continue to navigate to the IBM Rational License Key Center.
* Log in to the License Key Center using your email address as your ID and your password.
* If you do not create your password and log in within 72 hours of receiving this e-mail, you will need to request a new email by clicking [here](https://urldefense.proofpoint.com/v2/url?u=https-3A__licensing.subscribenet.com_service_ibmr_passwordfindertoken-3Ftoken-3DiBQqgLdNUxyuxE8Ik8PMKSMDo79ubDnPVuLzb6G50e8V6us7ubXZDYizfshmUft4n9qHifp1xZluaMEBCauDmw-253D-253D&d=DwMDaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=bSeOIO3coRE67_IGnJbSkmdGrML0r3fDG4JKYOYSpt4&m=vXEs4tQw0jGZbxoe8CB4_ay45BzQckFiKIIZfFXQ8oI&s=sUdq8LY1rpYBZyrgdqQXnmvo4BePM0scOTmmhvZXUzE&e=t)





Once the client has logged in and obtained their license key, this must be sent to the TAS MS Provisioning team who will install it in the customer instance.
vpn-strongswan-ping-remote-gw
: Pings the remote.gateway public IP address that you configured in the config.yaml file. If the VPN connection has the ESTABLISHED status, you can ignore the result of this test. If the VPN connection does not have the ESTABLISHED status, this test might fail for the following reasons.



* You did not specify an on-premises VPN gateway IP address. If ipsec.auto is set to start, the remote.gateway IP address is required.
* ICMP (ping) packets are being blocked by a firewall.



vpn-strongswan-ping-remote-ip-1
: Pings the remote.privateIPtoPing private IP address of the on-premises VPN gateway from the VPN pod in the cluster. This test might fail for the following reasons. \n - You did not specify a remote.privateIPtoPing IP address. If you intentionally did not specify an IP address, this failure is acceptable. \n - You did not specify the cluster pod subnet CIDR, 172.30.0.0/16, in the local.subnet list.

vpn-strongswan-ping-remote-ip-2
: Pings the remote.privateIPtoPing private IP address of the on-premises VPN gateway from the worker node in the cluster. This test might fail for the following reasons. \n - You did not specify a remote.privateIPtoPing IP address. If you intentionally did not specify an IP address, this failure is acceptable. \n - You did not specify the cluster worker node private subnet CIDR in the local.subnet list. |
6. Delete the current Helm chart.

helm uninstall vpn -n <namespace>
7. Open the config.yaml file and fix the incorrect values.
8. Save the updated config.yaml file.
9. Install the Helm chart to your cluster with the updated config.yaml file. The updated properties are stored in a ConfigMap for your chart.
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 0.3.58](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog).





 1 July 2019 

Infrastructure permissions
: Updated the [classic infrastructure roles](https://cloud.ibm.com/docs/containers?topic=containers-classic-roles) required for common use cases.

strongSwan VPN service
: If you install strongSwan in a multizone cluster and use the enableSingleSourceIP=true setting, you can now [set local.subnet to the %zoneSubnet variable and use the local.zoneSubnet to specify an IP address as a /32 subnet for each zone of the cluster](https://cloud.ibm.com/docs/containers?topic=containers-vpnstrongswan_4).







 June 2019 



 24 June 2019 

Calico network policies
: Added a set of [public Calico policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesisolate_workers_public) and expanded the set of [private Calico policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesisolate_workers) to protect your cluster on public and private networks.

Ingress ALB change log
: Updated the [ALB nginx-ingress image to build 477](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).

Service limitations
: Updated the [maximum number of pods per worker node limitation](https://cloud.ibm.com/docs/containers?topic=containers-limitationstech_limits). For worker nodes that run Kubernetes 1.13.7_1527, 1.14.3_1524, or later and that have more than 11 CPU cores, the worker nodes can support 10 pods per core, up to a limit of 250 pods per worker node.

Version change logs
Ensure that Cluster Logging is listed in the openshift-logging project with a Status of Succeeded.







 Step 5: Create a cluster logging instance 

You can create a cluster logging instance to deploy pods for Elasticsearch and Kibana servers. It can also deploy Fluentd for collecting infrastructure logs from the worker nodes.

The AU-11 control requires a minimum of 90 days of online audit records and one (1) year's worth of records offline. The default retention periods are lengthened to 90 days in the following example YAML file to reflect this.



1. Create a cluster logging instance that uses the [Red Hat OpenShift on IBM Cloud documentation](https://docs.openshift.com/container-platform/4.6/logging/cluster-logging-deploying.htmlcluster-logging-deploy-console_cluster-logging-deploying).



1. In the YAML field, replace the code with the following example code. The sample code configures the logging stack to complete the following tasks:



* Run the logging stack on the provisioned worker pool.
* Add a retention period of 90 days.
* Add a 200 GB persistent volume to Elasticsearch.



apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
metadata:
name: "instance"
namespace: "openshift-logging"
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 90d
infra:
maxAge: 90d
audit:
maxAge: 90d
elasticsearch:
nodeCount: 3
tolerations:
- key: "logging-monitoring"
operator: "Exists"
effect: "NoExecute"
tolerationSeconds: 600
storage:
storageClassName: "ibmc-vpc-block-general-purpose"
size: 200G
resources:
requests:
memory: "24Gi"
proxy:
resources:
limits: