vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Login to Data Security Broker Manager 

Once you have configured the Data Security Broker Manager, the next step is login to the Data Security Broker Manager using the OAuth token.

Complete the following steps to login to the Data Security Broker Manager:



1. Generate an IBM OAuth token. To obtain the OAuth token, login to your IBM Cloud® account from the Command Line Interface using the following steps:

a. Open the Command terminal from your system. b. Execute the following command to login to your IBM Cloud account:

ibmcloud login -sso

When prompted to open the one-time passcode in a browser window, specify Y for "Yes". You will be re-directed to the browser window, from where you can copy and paste the one-time passcode.

Navigate back to the CLI and paste the one-time passcode and select the account in which you wish to login using your IBM Cloud credentials.

Zoom

![Login to IBM Cloud CLI](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/ibm_cli.svg)

Login to IBM Cloud CLI

Ensure that the IBM Cloud account, which is used during the configuration of the Data Security Broker Manager as the Super Admin user, and the IBM Cloud account that you are using to login using the CLI to generate the OAuth token must be the same. Otherwise, you might get an error which says that the OAuth token is invalid.
2. Run the following command to generate the OAuth token:

ibmcloud iam oauth-tokens

Zoom

![OAuth token](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/oauth_token.svg)

OAuth token
For more information, see [Microsoft Sharepoint Online](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-sharepoint-online-cp4d).

Microsoft Windows File System improvements
: Extra configuration options mean you can specify the following information:



* The types of files (by file extension) to include or exclude from a crawl of a Windows directory.
* The character encoding of the data to be crawled. Typically, the encoding is detected automatically. However, you can choose to specify the character encoding as a Java character set yourself.



For more information, see [Windows File System](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-wfs-cp4d).

Field selection is improved
: When you apply an enrichment to a field or choose a field to use as the source for a facet, the fields that are displayed for you to choose from now shows only fields that are valid choices.

Search settings change
: The spelling correction setting changed from being enabled automatically in new projects to being disabled by default. If you want to alert users when they misspell a term in their query, turn on Spelling suggestions. For more information, see [Customizing the search bar](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-search-bar).

A Salesforce crawling issue was fixed
: Previously, Discovery had an issue where it timed out before it crawled some of the object types in a Salesforce collection. If your collection is configured to crawl the following object types, run a full data source crawl to make sure that your collection contains the most up-to-date data from all of the objects in your Salesforce data source:



* Attachment
* ContentVersion
* Document



Security vulnerabilities were addressed
: The following security patches were applied:



* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js](https://www.ibm.com/support/pages/node/6516464)
[SAN state diagram](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN/images/state-diagram-san.png)

SAN state



 Initial steps to Domain Control Validation 

Complete these steps:



1. After you've ordered your CDN with a DV SAN certificate, the certificate requesting process begins. During this process, IBM Cloud® CDN requests a certificate from Akamai. After a certificate becomes available, Akamai issues a request to the certificate authority (CA).

During this time, the CDN status shows as Requesting certificate.
2. After the CA receives the request, it issues a Domain Validation Challenge.

When this happens, your CDN's status changes to Domain validation required.
3. Click the name of the CDN that must be validated. The Overview page opens, where you can see the overall status of your CDN. At the top of the page, an alert appears, reminding you that domain validation is needed. Select the View domain validation button to open a window that shows you the challenge information that you need to complete the validation process.

Zoom

![Domain validation required](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN/images/view-domain-validation.png)

Figure 1: Domain validation required
4. After you've completed one of the validation steps from the section on how to address a Domain Validation Challenge, your CDN moves into Deploying certificate status. During this time, Akamai distributes your validated certificate to their edge servers. Deploying a certificate can take 2 - 4 hours.

When this process is complete, all domains, regardless of the validation method used, move into a CNAME configuration required state.







 Domain Control Validation
By default, the Default resource group is set.
9. Click Create to provision an instance.



The service UI opens.

To provision an instance through the CLI, see [Provisioning a Monitoring instance through the IBM Cloud CLI](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-provisionprovision_cli).





 Step 3. Connect a data source by configuring an agent 

After you provision an instance of the IBM Cloud Security and Compliance Center Workload Protection service in the IBM Cloud, you can deploy the agent on your cluster. The agent collects data that you can use for intrusion detection, posture management, vulnerability scanning, and incident response capabilites.

Zoom

![Agents that can be configured to provide data to IBM Cloud Security and Compliance Center Workload Protection](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection/images/Agent-Collection.svg)

Figure 1. Agents that can be configured to provide data to IBM Cloud Security and Compliance Center Workload Protection

Choose 1 of the following options:



1. [Configure an agent for Kubernetes](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-agent-deploy-kube-helm).
2. [Configire an agent for Red Hat OpenShift](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-agent-deploy-openshift-helm).







 Step 4. Launch the web UI 

After you provision an instance of the IBM Cloud Security and Compliance Center Workload Protection service, and configure a monitoring agent for your node, you can view, monitor, and manage data through the service's web UI.

You launch the web UI within the context of the IBM Cloud Security and Compliance Center Workload Protection instance, from the IBM Cloud UI.

Complete the following steps to launch the monitoring UI:
static-scan To [attach test results to the compliance evidence as evidence artifacts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-add-pipeline-steps), use the save_result command in this stage. save_result No 
 dynamic-scan To [attach test results to the compliance evidence as evidence artifacts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-add-pipeline-steps), use the save_result command in this stage. save_result No 
 containerize [Add artifact names and digests to the pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-config-github). save_artifact Yes 
 sign-artifact Add the image signature from the GPG signing output. save_artifact Yes 
 acceptance-test To [attach test results to the compliance evidence as evidence artifacts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-add-pipeline-steps), use the save_result command in this stage. save_result No 





 Stage results API 

The result states of these custom stages are saved with pipelinectl. The result state of a stage is either success, failure, or skipped. These results can be used later to evaluate whether the custom stage ran successfully.

The following tasks and stages are available:



Table 5. Tasks and stages

 Pipeline Task or stages 

 Pull request pipeline stages setup, test, detect-secrets, and branch-protection. The detect-secrets and branch-protection stages are not custom stages. They are provided by the pipelines by default. 
 Continuous integration pipeline stages setup, test, static-scan, containerize, sign-artifact, deploy, acceptance-test, scan-artifact, release, detect-secrets, branch-protection, bom-check, cis-check, and vulnerability-scan.
* Builds a container image on every Git commit, setting a tag based on build number, timestamp, and commit ID for traceability
* Tests the Dockerfile before the image is created
* Stores the built image in a private image registry
* Automatically configures access permissions for target cluster deployment by using API tokens that can be revoked
* Scans the container image for security vulnerabilities
* Adds a Docker signature upon successful completion
* Inserts the built image tag into the deployment manifest automatically
* Uses an explicit namespace, in cluster, to insulate each deployment (and make it easy to clear, by kubectl delete namespace)
* Automatically builds, validates, and deploys to the Kubernetes cluster any code merged into the target Git repository branch.



The target cluster is configured during toolchain setup (by using an IBM Cloud API key and cluster name). You can later change these settings by altering the Delivery Pipeline configuration.





 Guided setup overview for the CI toolchain 

The Continuous Delivery service provides templates that guide you through the toolchain setup process in a logical order, presenting you with the recommended configuration options that are needed to create your toolchain.

A progress indicator shows the steps to complete the configuration. You can use the progress indicator to navigate to a previous step with a mouse click. The configuration options for the current step are displayed in the main area of the page.

Zoom

![DevSecOps Continuous Integration toolchain welcome page](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-ci-welcome-page.png)

Figure 1. DevSecOps Continuous Integration toolchain welcome page

To advance to the next step, click Continue. You can advance to the next step only when the configuration for the current step is complete and valid. You can navigate to the previous step by clicking Back.

Some steps include a Switch to advanced configuration toggle.
* Creates a change request in Git Repos and Issue Tracking based change management repository and adds deployment evidence to it
* Uses the inventory repository to promote built artifacts to deployment environments like staging and prod
* Checks the CR, and auto approves if all checks pass
* If CR is approved, or emergency, deploys the image from the inventory to production







 Guided setup overview for the CD toolchain 

Any of the methods in this tutorial takes you to the guided setup experience. You are guided through the toolchain setup process in a logical order, and you are presented with the recommended configuration options that are needed to create your toolchain.

A progress indicator shows the steps to complete the configuration. You can use the progress indicator to navigate to a previous step with a mouse click. The configuration options for the current step are displayed in the main area of the page.

Zoom

![DevSecOps Continuous Deployment toolchain welcome page](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-cd-welcome.png)

Figure 1. DevSecOps Continuous Deployment toolchain welcome page

To advance to the next step, click Continue. You can advance to the next step only when the configuration for the current step is complete and valid. You can navigate to the previous step by clicking Back.

Some steps include a Switch to advanced configuration toggle. These steps by default present you with the minimum recommended configuration needed. However, advanced users that need finer grained control can click the Switch to advanced configuration toggle to reveal all options for the underlying integration.

Zoom

![DevSecOps Advanced configuration toggle](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-advanced-options-toggle.png)

Figure 2.
[Menu icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/icons/icon_hamburger.svg) > Observability.
3. Select Logging.

The list of Log Analysis instances is displayed.
4. Select the Log Analysis instance in the region where you want to deploy the template. Then, click Open Dashboard.







 Step 2. Install the template 

Complete the following steps to deploy the VMware template:



1. From the Log Analysis instance UI, click the Settings icon ![Settings icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis//images/config.png) > Template Library. The tiles show the available template libraries.
2. In the Template library section, select the VMware tile.
3. Choose the views and screen resources that you want to deploy. Make sure you select the parsing templates.
4. Click Apply template.

If you do not select one or more options within the template library, all options are deployed.

What you deploy appears under the appropriate sections of the UI. For example, if you deploy a screen, it deploys under Screens.
5. Refresh your browser to see the template objects.



After you deploy the template, it might take a while for the parsing templates to be enabled. The new indexed fields that are included with the parsing templates are needed for the template to filter and display data.







 Predefined views 

Use these views to gain insight on your VMware environment.



Table 1. Predefined devops views

 View name Description
1. Navigate to the Settings tab of your Schematics workspace, update the step4_create_dedicated variable to true and Save the setting.
2. Click on Apply the plan to provision the following resources,



* a dedicated host group
* a dedicated host
* a VSI with encrypted data volume (encryption using IBM Key Protect for IBM Cloud) and with a security group attached.



Zoom

![Add a dedicated host](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution62-vpc-scaling-dedicated/dedicated_host.svg)

Add a dedicated host
3. From the log output, copy the instance IP address and launch [Cloud Shell](https://cloud.ibm.com/shell) to run the below command by replacing the placeholder <IP_ADDRESS> with the instance IP address

export INSTANCE_IP=<IP_ADDRESS>

Typically, you won't set a public IP (floating IP) for an instance. In this case, a floating IP is set allow curl to the app deployed on the instance.
4. Issue the following curl command to query the database. The application running on the instance will read content from the Databases for PostgreSQL over the private endpoint. The data is the same that is available from the frontend application.

curl -s -X POST -H "Content-Type: application/json" --data '{ "query": "query read_database { read_database { id balance transactiontime } }" }' http://$INSTANCE_IP/api/bank
5. Issue the following curl command to query the COS bucket. The application running on the instance will read content from the Object Storage and return the results in JSON format. The data stored in COS is only available to the application running from the instance on the dedicated host.
DVS add hosts

 Menu Field Value 

 Select task Select task Add hosts 
 Select host Click New hosts Click the Capacity Host 
 Select network adapter tasks Select network adapter tasks Select Manage physical adapters and Manage VMkernel adapters 



5. Select one of the private vmnics and click Manage physical network adapters > Assign uplink.
6. Select uplink1 on the pop-up screen and click OK.
7. Repeat these steps for the other private vmnic and assign it to uplink2.
8. Click Next, highlight the vmk0 VMkernel adapter, and click Assign port group.
9. Select dvpg-Private-VM Management on the pop-up window and click OK.
10. Click Next twice and then click Finish to complete the migration to the distributed virtual switch. Note: You might briefly lose network connectivity to the host. The connection reestablishes quickly. After you migrate the vmk0 adapter to the distributed virtual switch, you can add VM kernels to each port group in the DVS.
11. Click Manage > Networking on the host within vCenter.
12. Go to VM Kernel adapters > Add host networking and add the VM kernel adapters that are in Tables 19 and 21. To add these adapters, you migrate to the “VM Kernel adapters” menu that is in the Manage > Networking tab on the host within vCenter. Then, click the “Add host networking” icon and add the following VM Kernel adapters.



Add vmk1 for vMotion



Table 19. Host networking vMotion

 Menu Field Value 

 Select connection type Select connection type VMKernel Network Adapter 
 Select target device Select an existing distributed port group dvpg-Private-vMotion 
 Select network adapter tasks Select network adapter tasks Select Manage physical adapters and Manage VM kernel adapters 
 Port Properties Enable Services Check vMotion traffic 
 IPv4 Settings IPv4 Address *172.16.10.X/24. This is a user-defined address and can be a different subnet if needed.
Due to this limited allowance, administrators must find a way to share access to internet services without giving limited public IP addresses to every node on the LAN. To learn more, see [Forward and NAT rules](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/4/html/security_guide/s1-firewall-ipt-fwd).





 SNAT router configuration 

Complete these steps to accurately configure your SNAT router.



1. Deploy a SLES LPAR on a public network.
2. Create subnets that require the SNAT function to get internet access.
3. Use the following commands to allow private network traffic to be accessible for SNAT-ing:



iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPT

These commands assume that the network device for the public network is eth0, and eth1 for the private network.

You can permanently set IP forwarding by editing the /etc/sysctl.conf file:



1. Find and edit the following line within the /etc/sysctl.conf file (replacing 0 with 1 if required): net.ipv4.ip_forward = 1.
2. Update the sysctl.conf file by entering the following command: sysctl -p /etc/sysctl.conf.
3. Finally, configure the source NAT by entering the following command: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE.







 Configuring Linux VMs to use a SNAT router 



1. [Deploy the Linux VMs](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-linux-deployment) that will be using the SNAT router to access the internet. Make sure that the SNAT router is routing the attached private networks.
2. Set the default router for your Linux VM to the SNAT router IP on the private network.
* Creates a change request in Git Repos and Issue Tracking based change management repository and adds deployment evidence to it.
* Uses the inventory repository to promote built artifacts to deployment environments like staging and prod.
* Checks the CR, and auto approves if all checks pass.
* If CR is approved, or emergency, the toolchain deploys the image from the inventory to production.







 Guided setup overview for the CD toolchain 

Any of the methods in this tutorial takes you to the guided setup experience. You are guided through the toolchain setup process, and you are presented with the recommended configuration options that are needed to create your toolchain.

A progress indicator shows the steps to complete the configuration. You can use the progress indicator to navigate to a previous step. The configuration options for the current step are displayed in the main area of the page.

Zoom

![DevSecOps Continuous Deployment toolchain welcome page](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-cd-welcome.png)

Figure 1. DevSecOps Continuous Deployment toolchain welcome page

To advance to the next step, click Continue. You can advance to the next step only when the configuration for the current step is complete and valid. You can navigate to the previous step by clicking Back.

Some steps include a Switch to advanced configuration toggle. These steps by default present you with the minimum configuration needed. However, advanced users that need finer grained control can click the Switch to advanced configuration toggle to reveal all options for the underlying integration.

Zoom

![DevSecOps Advanced configuration toggle](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-advanced-options-toggle.png)

Figure 2.
* [Step 1: Deploy apps and create app services](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-public-exposeingress-public-vpc-1)
* [Step 2: Set up TLS termination with TLS certificates and Kubernetes secrets](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-public-exposemanaged-ingress-steps-tls)
* [Step 3: Create and configure a public Ingress controller](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-public-exposeingress-public-vpc-3)
* [Step 4: Create the Ingress resource](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-public-exposeingress-public-vpc-4)
* [Step 5: Access your app from the internet](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-public-exposeingress-public-vpc-5)



* [Publicly exposing apps that are outside your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-public-exposeingress-roks4-external)



[Privately exposing apps with Ingress](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-private-exposeingress-private-expose)



* [Prerequisites](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-private-exposeingress-private-prereqs)
* [Privately exposing apps with a public cloud service endpoint](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-private-exposeingress-private-se)
VSE-9880 Minor Disabling RPF source-validation does not remove setting from all interfaces 







 Security Vulnerabilities Resolved 



Security vulnerabilties resolved in HERE

 Issue Number CVSS score Advisory Summary 

 VSE-9887 6.5 DSA-4101-1 CVE-2018-5334, CVE-2018-5335, CVE-2018-5336: Debian DSA-4101-1: wireshark – security update 
 VSE-9884 9.8 DSA-3971-1 VE-2017-11108, CVE-2017-11541, CVE-2017-11542, CVE-2017-11543, CVE-2017-12893, CVE-2017-12894, CVE-2017-12895, CVE-2017-12896, CVE-2017-12897, CVE-2017-12898, CVE-2017-12899, CVE-2017-12900, CVE-2017-12901, CVE-2017-12902, CVE-2017-12985, CVE-2017-12986, CVE-2017-12987, CVE-2017-12988, CVE-2017-12989, CVE-2017-12990, CVE-2017-12991, CVE-2017-12992, CVE-2017-12993, CVE-2017-12994, CVE-2017-12995, CVE-2017-12996, CVE-2017-12997, CVE-2017-12998, CVE-2017-12999, CVE-2017-13000, CVE-2017-13001, CVE-2017-13002, CVE-2017-13003, CVE-2017-13004, CVE-2017-13005, CVE-2017-13006, CVE-2017-13007, CVE-2017-13008, CVE-2017-13009, CVE-2017-13010, CVE-2017-13011, CVE-2017-13012, CVE-2017-13013, CVE-2017-13014, CVE-2017-13015, CVE