vania-janet/multiturn-rag-retrieval-data huggingface dataset:
When you update a root CA certificate, the change impacts your entire public-key infrastructure. To minimize impact, it is recommended that you set a long validity period for your root CA certificate. In Secrets Manager, the default TTL for root certificates is 10 years.







 Choosing an algorithm for generating keys 

Before you create a certificate authority in Secrets Manager, you must choose a key algorithm for generating the public and private keys for your CA. The public and private key-pair is used to authenticate an SSL/TLS connection. If you're not sure where to start, you can use the following suggested guide for selecting a key algorithm.



1. Choose an algorithm family.

The key algorithm that you select determines the encryption algorithm and key size to use to generate keys and sign certificates. As a best practice, use the same algorithm family for all certificates that belong to a certificate chain. Secrets Manager supports the following families of algorithms.



Table 2. Supported algorithm families and key sizes

 Algorithm family Description Supported key sizes 

 RSA Widely used and compatible with most browsers and servers, RSA is the industry standard for public-key cryptography. 2048 bits <br>4096 bits 
 Elliptic curve (EC) Generates stronger keys and smaller certificates. For example, a 256-bit EC key is equivalent in encryption strength to a 3072-bit RSA key. 224 bits <br>256 bits <br>384 bits <br>521 bits 



2. Choose a key size.

The key size or length that you select determines the encryption strength. The larger the key size for an algorithm family, the more difficult it is to break. Keep in mind that longer key lengths results in more data to store and transmit, which can impact the performance of your certificate. As a best practice, choose a key size that is appropriate for the TTL or validity period of your certificate.

For longer living certificates, it is recommended to use longer key lengths to provide more encryption protection.









 Using certificate authority unauthenticated endpoints 

If you're using leaf certificates that are issued by a CA in Secrets Manager for your applications, use the following API calls to gain access to the issuing CA Certificate Revocation List (CRL) and CA certificate.
Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass 
 1.2.27 Ensure that the --service-account-lookup option is set to true. Automated 1 Pass 
 1.2.28 Ensure that the --service-account-key-file option is set as appropriate. Automated 1 Pass 
 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile options are set as appropriate. Automated 1 Pass 
 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Automated 1 Pass 
 1.2.31 Ensure that the --client-ca-file option is set as appropriate. Automated 1 Pass 
 1.2.32 Ensure that the --etcd-cafile option is set as appropriate. Automated 1 Pass 
 1.2.33 Ensure that the --encryption-provider-config option is set as appropriate. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager
Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass 
 1.2.27 Ensure that the --service-account-lookup option is set to true. Automated 1 Pass 
 1.2.28 Ensure that the --service-account-key-file option is set as appropriate. Automated 1 Pass 
 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile options are set as appropriate. Automated 1 Pass 
 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Automated 1 Pass 
 1.2.31 Ensure that the --client-ca-file option is set as appropriate. Automated 1 Pass 
 1.2.32 Ensure that the --etcd-cafile option is set as appropriate. Automated 1 Pass 
 1.2.33 Ensure that the --encryption-provider-config option is set as appropriate. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager
Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass 
 1.2.27 Ensure that the --service-account-lookup option is set to true. Automated 1 Pass 
 1.2.28 Ensure that the --service-account-key-file option is set as appropriate. Automated 1 Pass 
 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile options are set as appropriate. Automated 1 Pass 
 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Automated 1 Pass 
 1.2.31 Ensure that the --client-ca-file option is set as appropriate. Automated 1 Pass 
 1.2.32 Ensure that the --etcd-cafile option is set as appropriate. Automated 1 Pass 
 1.2.33 Ensure that the --encryption-provider-config option is set as appropriate. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager
Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 1.2.24 Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Automated 1 Pass 
 1.2.25 Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Automated 1 Pass 
 1.2.26 Ensure that the --request-timeout option is set as appropriate. Automated 1 Pass 
 1.2.27 Ensure that the --service-account-lookup option is set to true. Automated 1 Pass 
 1.2.28 Ensure that the --service-account-key-file option is set as appropriate. Automated 1 Pass 
 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile options are set as appropriate. Automated 1 Pass 
 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file options are set as appropriate. Automated 1 Pass 
 1.2.31 Ensure that the --client-ca-file option is set as appropriate. Automated 1 Pass 
 1.2.32 Ensure that the --etcd-cafile option is set as appropriate. Automated 1 Pass 
 1.2.33 Ensure that the --encryption-provider-config option is set as appropriate. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 1.2.34 Ensure that encryption providers are appropriately configured. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 1.2.35 Ensure that the API Server makes use of only Strong Cryptographic Ciphers. Manual 1 Pass 







 1.3 Controller manager
In the case of the Dilithium mechanism CKM_IBM_DILITHIUM, it provides a marshaled object identifier (OID) that represents the strength of Dilithium algorithm to use. Currently, only the strength of [Dilithium 4 round 2](http://oid-info.com/get/1.3.6.1.4.1.2.267.1.6.5) is supported. Dilithium keys 
 CKA_IBM_USE_AS_DATA An object is used for hashing or key derivation operations when CK_TRUE EC private keys, EC public keys 
 CKA_ID Key identifier for public or private key pair or key. Default is empty. EC private keys, EC public keys, RSA private keys, RSA public keys, DH private keys, DH public keys, DSA private keys, DSA public keys, AES keys, DES keys, Generic keys 
 CKA_ISSUER DER-encoding of the certificate issuer name. Default is empty. Not applicable 
 CKA_JAVA_MIDP_SECURITY_DOMAIN Java MIDP security domain for a certificate. Default is CK_SECURITY_DOMAIN_UNSPECIFIED. Not applicable 
 CKA_KEY_TYPE Type of key. EC private keys, EC public keys, RSA private keys, RSA public keys, DH private keys, DH public keys, DSA private keys, DSA public keys, AES keys, DES keys, Generic keys 
 CKA_LABEL Description of the object. Default is empty. EC private keys, EC public keys, RSA private keys, RSA public keys, DH private keys, DH public keys, DSA private keys, DSA public keys, AES keys, DES keys, Generic keys 
 CKA_LOCAL CK_TRUE only if the key was generated locally (on the token) with a C_GenerateKey or C_GenerateKeyPair call or created with a C_CopyObject call as a copy of a key that had the CKA_LOCAL attribute set to CK_TRUE. EC private keys, EC public keys, RSA private keys, RSA public keys, DH private keys, DH public keys, DSA private keys, DSA public keys, AES keys, DES keys, Generic keys
This toleration allows the route daemon set to run on the two worker nodes that have the dedicated="tenantB" taint and on the two untainted worker nodes. The strongSwan VPN pods for this deployment also run on the two untainted worker nodes.









 Upgrading or disabling the strongSwan Helm chart 

Ensure that you consistently upgrade your strongSwan Helm chart for the latest features and security fixes.

Review the supported versions of the strongSwan Helm chart. Typically, a chart version becomes deprecated 6 months after its release date.



* Supported: 2.7.9, 2.7.8, 2.7.7, 2.7.6, 2.7.5, 2.7.4, 2.7.3, 2.7.2
* Deprecated: 2.7.1, 2.7.0, 2.6.9, 2.6.8, 2.6.7
* Unsupported: 2.6.6 and earlier



For release dates and change logs for each strongSwan Helm chart version, run helm show readme iks-charts/strongswan and look for the Version History section.

To upgrade your strongSwan Helm chart to the latest version, use the helm upgrade command.

helm upgrade -f config.yaml <release_name> iks-charts/strongswan

You can disable the VPN connection by deleting the Helm chart.

helm uninstall <release_name> -n <namespace>





 Using a Virtual Router Appliance 

The [Virtual Router Appliance (VRA)](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-about-the-vra) provides the latest Vyatta 5600 operating system for x86 bare metal servers. You can use a VRA as VPN gateway to securely connect to an on-premises network.

All public and private network traffic that enters or exits the cluster VLANs is routed through a VRA.
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.1implementation-guidance)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.1nist-supplemental-guidance)



[IA-5 (2) - Pki-based Authentication](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.2ia-5.2)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.2control-requirements)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.2additional-ibm-cloud-for-financial-services-specifications)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.2nist-supplemental-guidance)



[IA-5 (3) - In-person or Trusted Third-party Registration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.3ia-5.3)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.3control-requirements)



[IA-5 (4) - Automated Support for Password Strength Determination](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.4ia-5.4)
Because the strongSwan VPN pod can be scheduled to a worker node in any zone, this list of IPs ensures that a load balancer IP can be used in any zone where the VPN pod is scheduled.
* connectUsingLoadBalancerIP: Set to true. When the strongSwan VPN pod is scheduled onto a worker node, the strongSwan service selects the load balancer IP address that is in the same zone and uses this IP to establish the outbound connection.
* local.id: Specify a fixed value that is supported by your remote VPN endpoint. If the remote VPN endpoint requires you to set the local.id option (leftid value in ipsec.conf) to the public IP address of the VPN IPSec tunnel, set local.id to %loadBalancerIP. This value automatically configures the leftid value in ipsec.conf to the load balancer IP address that is used for the connection.
* Optional: Hide all the cluster IP addresses behind a single IP address in each zone by setting enableSingleSourceIP to true. This option provides one of the most secure configurations for the VPN connection because no connections from the remote network back into the cluster are permitted. You must also set local.subnet to the %zoneSubnet variable, and use the local.zoneSubnet to specify an IP address as a /32 subnet for each zone of the cluster.



2. In your remote network firewall, allow incoming IPSec VPN connections from the public IP addresses you listed in the zoneLoadBalancer setting.
3. Configure the remote VPN endpoint to allow an incoming VPN connection from each of the possible load balancer IPs that you listed in the zoneLoadBalancer setting.







 Configuring a single inbound VPN connection to a multizone cluster 

When you require incoming VPN connections and the remote VPN endpoint can automatically re-establish the VPN connection to a different IP when a failure is detected, you can use a single inbound VPN connection that floats between different worker nodes across all availability zones in your cluster.

The remote VPN endpoint can establish the VPN connection to any of the strongSwan load balancers in any of the zones.
A status of ESTABLISHED means that the VPN connection was successful.

kubectl exec $STRONGSWAN_POD -- sudo ipsec status

Example output

Security Associations (1 up, 0 connecting):
k8s-conn[1]: ESTABLISHED 17 minutes ago, 172.30.xxx.xxx[ibm-cloud]...192.xxx.xxx.xxx[on-premises]
k8s-conn{2}: INSTALLED, TUNNEL, reqid 12, ESP in UDP SPIs: c78cb6b1_i c5d0d1c3_o
k8s-conn{2}: 172.21.0.0/16 172.30.0.0/16 === 10.91.152.xxx/26



* When you try to establish VPN connectivity with the strongSwan Helm chart, it is likely that the VPN status is not ESTABLISHED the first time. You might need to check the on-premises VPN endpoint settings and change the configuration file several times before the connection is successful.



1. Run helm uninstall <release_name> -n <namespace>
2. Fix the incorrect values in the configuration file.
3. Run helm install vpn iks-charts/strongswan -f config.yaml



You can also run more checks in the next step.
* If the VPN pod is in an ERROR state or continues to crash and restart, it might be due to parameter validation of the ipsec.conf settings in the chart's ConfigMap.



1. Check for any validation errors in the strongSwan pod logs by running kubectl logs $STRONGSWAN_POD.
2. If validation errors exist, run helm uninstall <release_name> -n <namespace>
3. Fix the incorrect values in the configuration file.
4. Run helm install vpn iks-charts/strongswan -f config.yaml





4. You can further test the VPN connectivity by running the five Helm tests that are in the strongSwan chart definition.
The simplest solution for configuring the strongSwan VPN service in a multizone cluster is to use a single outbound VPN connection that floats between different worker nodes across all availability zones in your cluster.

When the VPN connection is outbound from the multizone cluster, only one strongSwan deployment is required. If a worker node is removed or experiences downtime, kubelet reschedules the VPN pod onto a new worker node. If an availability zone experiences an outage, kubelet reschedules the VPN pod onto a new worker node in a different zone.



1. [Configure one strongSwan VPN Helm chart](https://cloud.ibm.com/docs/containers?topic=containers-vpnvpn_configure). When you follow the steps in that section, ensure that you specify the following settings.



* ipsec.auto: Change to start. Connections are outbound from the cluster.
* loadBalancerIP: Do not specify an IP address. Leave this setting blank.
* zoneLoadBalancer: Specify a public load balancer IP address for each zone where you have worker nodes. [You can check to see your available public IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-subnetsreview_ip) or [free up a used IP address](https://cloud.ibm.com/docs/containers?topic=containers-subnetsfree). Because the strongSwan VPN pod can be scheduled to a worker node in any zone, this list of IPs ensures that a load balancer IP can be used in any zone where the VPN pod is scheduled.
* connectUsingLoadBalancerIP: Set to true. When the strongSwan VPN pod is scheduled onto a worker node, the strongSwan service selects the load balancer IP address that is in the same zone and uses this IP to establish the outbound connection.
* local.id: Specify a fixed value that is supported by your remote VPN endpoint.
If you have a performance-critical environment, consider using a VPN solution that runs outside of the cluster on dedicated hardware.
* The strongSwan Helm chart runs a single VPN pod as the IPSec tunnel endpoint. If the pod fails, the cluster restarts the pod. However, you might experience a short down time while the new pod starts and the VPN connection is re-established. If you require faster error recovery or a more elaborate high availability solution, consider using a VPN solution that runs outside of the cluster on dedicated hardware.
* The strongSwan Helm chart does not provide metrics or monitoring of the network traffic flowing over the VPN connection. For a list of supported monitoring tools, see [Logging and monitoring services](https://cloud.ibm.com/docs/openshift?topic=openshift-health).
* Only strongSwan Helm chart versions that were released in the last 6 months are supported. Ensure that you consistently [upgrade your strongSwan Helm chart](https://cloud.ibm.com/docs/openshift?topic=openshift-vpnvpn_upgrade) for the latest features and security fixes.



Your cluster users can use the strongSwan VPN service to connect to your Kubernetes master through the private cloud service endpoint. However, communication with the Kubernetes master over the private cloud service endpoint must go through the 166.X.X.X IP address range, which is not routable from a VPN connection. You can expose the private cloud service endpoint of the master for your cluster users by [using a private network load balancer (NLB)](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_private_se). The private NLB exposes the private cloud service endpoint of the master as an internal 172.21.x.x cluster IP address that the strongSwan VPN pod can access. If you enable only the private cloud service endpoint, you can use the Kubernetes dashboard or temporarily enable the public cloud service endpoint to create the private NLB.





 Configuring the strongSwan VPN in a multizone cluster
2. If validation errors exist, run helm uninstall <release_name> -n <namespace>
3. Fix the incorrect values in the configuration file.
4. Run helm install vpn iks-charts/strongswan -f config.yaml





4. You can further test the VPN connectivity by running the five Helm tests that are in the strongSwan chart definition.

helm test vpn



* If all the tests pass, your strongSwan VPN connection is successfully set up.
* If any of the tests fail, continue to the next step.



5. View the output of a failed test by looking at the logs of the test pod.

kubectl logs <test_program>

Some tests have requirements that are optional settings in the VPN configuration. If some tests fail, the failures might be acceptable depending on whether you specified these optional settings. Refer to the following table for information about each test and why it might fail.

vpn-strongswan-check-config
: Validates the syntax of the ipsec.conf file that is generated from the config.yaml file. This test might fail due to incorrect values in the config.yaml file.

vpn-strongswan-check-state
: Checks that the VPN connection has a status of ESTABLISHED. This test might fail for the following reasons.



* Differences between the values in the config.yaml file and the on-premises VPN endpoint settings.
* If the cluster is in "listen" mode (ipsec.auto is set to add), the connection is not established on the on-premises side.



vpn-strongswan-ping-remote-gw
: Pings the remote.gateway public IP address that you configured in the config.yaml file. If the VPN connection has the ESTABLISHED status, you can ignore the result of this test. If the VPN connection does not have the ESTABLISHED status, this test might fail for the following reasons.



* You did not specify an on-premises VPN gateway IP address.
: If you install strongSwan in a multizone cluster and use the enableSingleSourceIP=true setting, you can now [set local.subnet to the %zoneSubnet variable and use the local.zoneSubnet to specify an IP address as a /32 subnet for each zone of the cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-vpnstrongswan_4).







 June 2019 



 24 June 2019 

Calico network policies
: Added a set of [public Calico policies](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesisolate_workers_public) and expanded the set of [private Calico policies](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesisolate_workers) to protect your cluster on public and private networks.

Ingress ALB change log
: Updated the [ALB nginx-ingress image to build 477](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 21 June 2019 

Accessing clusters
: Added steps for [automating access to a cluster by using a Red Hat OpenShift login token](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_oc_console).

Troubleshooting Red Hat OpenShift clusters
: Added a [troubleshooting section](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_clusters) to the Creating a Red Hat OpenShift on IBM Cloud cluster tutorial.





 18 June 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of versions 0.3.47 and 0.3.49](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog).