vania-janet/multiturn-rag-retrieval-data huggingface dataset:
s390x virtual server images 

When you provision IBM Cloud® Virtual Servers for Virtual Private Cloud on IBM Z (s390x processor architecture) in IBM Cloud, you can select from the supported stock images. Now, IBM Hyper Protect is also supported as an operating system and the associated IBM Hyper Protect Container Runtime image can be provisioned for your IBM Cloud Hyper Protect Virtual Servers for IBM Cloud® Virtual Private Cloud instance.

The IBM Hyper Protect Container Runtime image has container runtime support and the image is not SSH enabled (is a locked down image). Even if you select and pass in an SSH key, it will not be used and the key cannot be used to connect to the instance. Container details are provided at instance creation through the contract, specified in the User Data field on the order form. Once the containers start, you can interact with the workload that is brought up on the containers. For more information, see [Contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_se).



 Stock images 

The following operating systems are available as stock images when you create a virtual server.



 IBM Hyper Protect Container Runtime image 

You can now choose IBM Hyper Protect as the operating system for the virtual server instance. On the create virtual server page, under Confidential computing, click the Run your workload with an OS and a profile protected by Secure Execution toggle, to activate support for secure execution images. Then, in the Operating system field, "IBM Hyper Protect" operating system and the "hyper-protect-container-runtime" image must be selected to create a Hyper Protect Virtual Servers for VPC instance. For more information, see [Confidential computing with LinuxONE](https://cloud.ibm.com/docs/vpc?topic=vpc-about-se).

You can choose a profile based on your requirements. You can choose from balanced, compute, and memory secure execution enabled profiles. For more information, see [s390x instance profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-vs-profiles).
When you wrap a DEK with a root key, Key Protect combines the strength of multiple algorithms to protect the privacy and the integrity of your encrypted data.

You cannot wrap a standard key, that is, a key created using the -s parameter (ibmcloud kp key create my-key-name -s).

ibmcloud kp key wrap KEY_ID
-i, --instance-id INSTANCE_ID
[-a, --aad ADDITIONAL_DATA]
[-o, --output OUTPUT]
[-p, --plaintext DATA_KEY]



 Best practices 

Wrapping a data encryption key (DEK) creates a ciphertext. The ciphertext is encrypted information that, when unwrapped, reveals the original DEK.

The Key Protect service does not store your DEK. Save, or persist to storage, the ciphertext to make sure you can retrieve the DEK with the kp key unwrap command.

It is recommended that you never save, or persist to storage, the plaintext DEK. In your application, load the ciphertext from storage, call Key Protect to get the plaintext DEK, and use the DEK to encrypt, or wrap, "other" pieces of information.

Do not save the DEK to persistent storage. Exposing the DEK may allow others to decrypt your data.

A new ciphertext is create each time the root key is wrapped.





 Examples 

These are examples of kp key wrap.



 Example 1 

Key Protect creates a new base64-encoded data encryption key (DEK) and wraps it with the root key.

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
807eb0a6-cc10-4bfe-8331-41a6f712c4ea my-root-key
When you wrap a DEK with a root key, Key Protect combines the strength of multiple algorithms to protect the privacy and the integrity of your encrypted data.

You cannot wrap a standard key, that is, a key created using the -s parameter (ibmcloud kp key create my-key-name -s).

ibmcloud kp key wrap KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]
[-a, --aad ADDITIONAL_DATA]
[-o, --output OUTPUT]
[-p, --plaintext DATA_KEY]



 Best practices 

Wrapping a data encryption key (DEK) creates a ciphertext. The ciphertext is encrypted information that, when unwrapped, reveals the original DEK.

The Key Protect service does not store your DEK. Save, or persist to storage, the ciphertext to make sure you can retrieve the DEK with the kp key unwrap command.

It is recommended that you never save, or persist to storage, the plaintext DEK. In your application, load the ciphertext from storage, call Key Protect to get the plaintext DEK, and use the DEK to encrypt, or wrap, "other" pieces of information.

Do not save the DEK to persistent storage. Exposing the DEK may allow others to decrypt your data.

A new ciphertext is create each time the root key is wrapped.





 Examples 

These are examples of kp key wrap.



 Example 1 

Key Protect creates a new base64-encoded data encryption key (DEK) and wraps it with the root key.

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
807eb0a6-cc10-4bfe-8331-41a6f712c4ea my-root-key
This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.<-- </section "id="section-en-notice-permissions" "> --><-- <section "id="section-en-notice-protect-user" "> --> 3. Protecting Users' Legal Rights From Anti-Circumvention Law No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.<-- </section "id="section-en-notice-protect-user" "> --><-- <section "id="section-en-notice-verbatim" "> --> 4.
[Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. To import a key, click Add and select the Import your own key window.

Specify the key's details:





Table 1. Describes the Import your own key settings.

 Setting Description 

 Key type The [type of key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryptionkey-types) that you would like to manage in Key Protect. Select the Root key button. 
 Name A human-readable alias for easy identification of your key. Length must be within 2 - 90 characters (inclusive). <br> <br>To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location. Note that key names do not need to be unique. 
 Key material The base64-encoded key material, such as an existing key-wrapping key, that you want to store and manage in the service. For more information, check out [Base64 encoding your key material](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keyshow-to-encode-root-key-material). Ensure that the key material is 16, 24, or 32 bytes long, and corresponds to 128, 192, or 256 bits in length. The key must also be base64-encoded. 
 Key alias Optional. [Key aliases](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-key-alias) are ways to describe a key that allow them to be identified and grouped beyond the limits of a display name. Keys can have up to five aliases. 
 Key ring Optional.
PE&O insurance provides coverage for actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission, solely for acts or omissions committed by IBM in providing professional services to our client(s). Coverage includes network security, unauthorized access, unauthorized use, receipt or transmission of a malicious code, denial of service attack, unauthorized disclosure or misappropriation of private information, privacy liability, notification costs, credit card monitoring, and fine & penalties incurred by the customer.



The PE&O Policy itself is IBM Confidential information. Further details on this subject can be accessed (IBMers only) [here](https://w3-connections.ibm.com/wikis/home?lang=en-us!/wiki/Wc0a20474fb23_478a_8f6d_1c6dfd3d680f/page/IBM%20cyber%20insurance%20details)





 Regulated Content 



* IBM TRIRIGA Application Suite offerings are not intended to host government regulated content. Please see the Cloud Services Agreement (link below) Section 2c for details







 Clock synchronization 



* All customer Maximo EAM SaaS Flex and TRIRIGA SaaS Flex Application and Database servers leverage IBM Cloud's internal NTP service as single reference time source for information system processing clocks and security domains.
* Customers are responsible or synchronizing their local environments (workstations, on premise servers) with an authoritative time source.







 Terms of Use 



* General Terms of Use for IBM Cloud Offerings:

[https://www.ibm.com/software/sla/sladb.nsf/sla/tou-gen-terms](https://www.ibm.com/software/sla/sladb.nsf/sla/tou-gen-terms)







 Cloud Service Agreement 



* IBM Cloud Services Agreement (CSA)



[https://www.ibm.com/support/customer/pdf/csa_us.pdf](https://www.ibm.com/support/customer/pdf/csa_us.pdf)
Installing and using private endpoints 

To ensure that you have enhanced control and security over your data when you use the IBM Cloud Command Line Interface (CLI), you have the option of using private routes to IBM Cloud endpoints. Private routes are not accessible or reachable over the internet. By using the IBM Cloud private endpoints feature, you can protect your data from threats from the public network and logically extend your private network.

The CLI uses the private endpoint support that is provided by the IBM Cloud® platform. Platform services that are used by the core CLI provide private endpoint support.



 Before you begin 

You must first enable virtual routing and forwarding in your account, and then you can enable the use of IBM Cloud private service endpoints. For more information about setting up your account to support the private connectivity option, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint). In addition to enabling VRF, you must be on a private network on ibmcloud. For more information, see [how to connect to the IBM Cloud VPN](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-started).

To learn more about private connections on IBM Cloud, see [Secure access to services by using service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview).





 Installing from the shell 

To install the latest CLI for your OS from the shell manually, use the following command for your OS:

If you don't want to install from the shell because it might use root permissions, you can [download and run the installer](https://cloud.ibm.com/docs/cli?topic=cli-cli-private-endpointscli-private-endpoints-download).



* For Mac, copy and paste the following command to a command line and run it:
MP-1 - Media Protection Policy and Procedures 



  Control requirements 

The organization:

MP-1 (a)
:   Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:



1.  A media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2.  Procedures to facilitate the implementation of the media protection policy and associated media protection controls; and



MP-1 (b)
:   Reviews and updates the current:



1.  Media protection policy [IBM Assignment: at least annually]; and
2.  Media protection procedures [IBM Assignment: at least annually].







  NIST supplemental guidance 

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the MP family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.
Private workers can now be run in stand-alone mode.
: [Using Delivery Pipeline Private Workers in stand-alone mode](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-standalone-mode-private-workers).

Private workers can now be managed on a Satellite cluster, providing easier management of workers on Red Hat® OpenShift® clusters by using the Operator Lifecycle Manager (OLM) framework.
: [Installing Delivery Pipeline Private Workers](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-install-private-workerspw_install_prereqs).





 23 June 2022 

New toolchain template demonstrates how to use a pull-based deployment mechanism to continuously deploy Kubernetes resources to multiple clusters on [IBM Cloud Satellite](https://cloud.ibm.com/docs/satellite) by using a Tekton pipeline.
: [Satellite Template](https://cloud.ibm.com/devops/setup/deploy?repository=https://us-south.git.cloud.ibm.com/open-toolchain/satellite-cd-toolchain&env_id=ibm:yp:us-south).





 13 June 2022 

Git Repos and Issue Tracking
: Upgraded to [GitLab 14.10.4](https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/).





 07 June 2022 

Private information in Continuous Delivery and toolchains can now be protected by the Customer Root Key as part of Bring Your Own Key.
: [Bring Your Own Key](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_professional_plan) is available only in a professional plan.





 23 May 2022 

Git Repos and Issue Tracking
; CM brick TCP communication port

COMMFABRICPORT="0"

; How matrix will use private networks

COMMFABRICNETWORKLEVEL="0"

; How inter brick communication will be protected

COMMFABRICENCRYPTION="0"

; TCP port used by the CM brick

MATRIXCMBRICKCOMMPORT="0"

; Startup type for the SQL Server service.

SQLSVCSTARTUPTYPE="Automatic"

; Level to enable FILESTREAM feature at (0, 1, 2 or 3).

FILESTREAMLEVEL="0"

; The max degree of parallelism (MAXDOP) server configuration option.

SQLMAXDOP="4"

; Set to "1" to enable RANU for SQL Server Express.

ENABLERANU="False"

; Specifies a Windows collation or an SQL collation to use for the Database Engine.

SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"

; Account for SQL Server service: DomainUser or system account.

SQLSVCACCOUNT="sqlserversqlsvc"

; Set to "True" to enable instant file initialization for SQL Server service. If enabled, Setup will grant Perform Volume Maintenance Task privilege to the Database Engine Service SID. This may lead to information disclosure as it could allow deleted content to be accessed by an unauthorized principal.

SQLSVCINSTANTFILEINIT="False"

; Windows account(s) to provision as SQL Server system administrators.

SQLSYSADMINACCOUNTS="sqlserverSQLAdmins"

; The number of Database Engine TempDB files.

SQLTEMPDBFILECOUNT="8"

; Specifies the initial size of a Database Engine TempDB data file in MB.

SQLTEMPDBFILESIZE="8"

; Specifies the automatic growth increment of each Database Engine TempDB data file in MB.

SQLTEMPDBFILEGROWTH="64"

; Specifies the initial size of the Database Engine TempDB log file in MB.

SQLTEMPDBLOGFILESIZE="8"
Optional: Verify that the route was added successfully by displaying your new routing table.

route -n







 Step 2. Target the Key Protect private endpoint 

After you configure your VSI to accept IBM Cloud private network traffic, you can target the private endpoint for Key Protect by using the Key Protect API or Key Protect CLI plug-in.



1. In a terminal window, log in to IBM Cloud.

ibmcloud login

If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
2. Optional: Ensure that your account is enabled for VRF and service endpoints.

ibmcloud account show

The following CLI output shows the account details of a VRF and service endpoint-enabled account.

Retrieving account John Doe's Account of john.doe@email.com...
OK

Account ID: d154dfbd0bc2edefthyufffc9b5ca318
Currently Targeted Account: true
Linked Softlayer Account: 1008967
VRF Enabled: true
Service Endpoint Enabled: true

See [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) to learn how to set up your account for connecting to a private network.
3. Set an environment variable to target a Key Protect private endpoint.

export KP_PRIVATE_ADDR=https://private.<region>.kms.cloud.ibm.com

Replace <region> with the region abbreviation that represents the geographic area where your Key Protect instance resides. For the complete list of endpoints, see [Regions and endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsconnectivity-options).







 Step 3. Create a Key Protect resource on the private network
Replace <INSTANCE_ID> with the instance ID representing your Key Protect. Learn more about your instance, including choosing regions, at [Provisioning the Key Protect service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision).

You will be prompted to choose from a list as shown in the results.

Select a Region:
1. au-syd
2. eu-de
3. eu-gb
4. jp-osa
5. jp-tok
6. us-east
7. us-south
8. staging (us-south)
Enter a number:

After you select your region, you can start working with your instance.
5. Optional: Verify that the plug-in was installed successfully.

ibmcloud plugin list







 Updating the Key Protect CLI plug-in 

For best practices, you might choose to update CLI periodically to use new features.

To update the CLI:



1. Log in to IBM Cloud with the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).

ibmcloud login

If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
2. Install the update from the plug-in repository.

ibmcloud plugin update key-protect
3. Optional: Verify that the plug-in was updated successfully.

ibmcloud plugin list

The results should show the version and the status of the plugins, as well as properties about the plugins, like whether ["Private endpoints" are supported](https://cloud.ibm.com/docs/key-protect?topic=key-protect-private-endpoints).

Plugin Name Version Status Private endpoints supported
* UI
* API







 Importing standard keys 

You can add your existing encryption keys by using the IBM Cloud console.

You can add your existing encryption keys programmatically with the Key Protect API.



 Importing standard keys with the console 

[After you create an instance of the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision), complete the following steps to import an existing key by using the IBM Cloud console.

If you enable [dual authorization settings for your Key Protect instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth), keep in mind that any keys that you add to the service require an authorization from two users to delete keys.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. To import a new key, click Add key and select the Import your own key window.

Specify the key's details:





Table 1. Describes the Import your own key settings.

 Setting Description 

 Key type The [type of key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryptionkey-types) that you would like to manage in Key Protect. Click the Standard key button. 
 Name A human-readable alias for easy identification of your key. Length must be within 2 - 90 characters (inclusive). <br> <br>To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location. Note that key names do not need to be unique. 
 Key material The base64-encoded key material, such as an existing key-wrapping key, that you want to store and manage in the service.
1. [Deploy resources using Terraform managed by Schematics](https://github.com/IBM-Cloud/secure-file-storagedeploy-resources-using-terraform-managed-by-schematics) as described in the companion GitHub repository.
2. To monitor events for context-based restrictions, you must have an instance of the Activity Tracker service in the Frankfurt (eu-de) region. For more information, see [Provisioning an instance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-provision).







 Step 2: Overview: Context-based restrictions 

[Context-based restrictions (CBRs)](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis) provide the ability to define and enforce access restrictions for IBM Cloud resources based on the network location and the type of access requests. Because both IAM policies and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials.

A rule governs access to a resource identified by its service name and type as well as by additional attributes. They can include the region, resource group, and other service-specific properties. The attributes in a rule are mostly optional, so that you could govern, e.g., all Key Protect instances together, or target just a specific key ring in an identified Key Protect instance.

The context for a restriction is made up of network zones and service endpoints. You might want to define zones based on specific IP addresses or ranges, or by configuring traffic originating from one or more VPCs or cloud services. With that, access to the sample Key Protect instance might only be allowed from, e.g., a specific Object Storage instance, a well-known range of IP addresses, and only via the private endpoint.

Network zones can be used for the definition of multiple rules. Rules have an enforcement mode which is one of disabled, report-only, or enabled.

At the moment, not all cloud services support the report-only mode. Moreover, these service also do not generate any CBR-related log entries when enabled.