vania-janet/multiturn-rag-retrieval-data huggingface dataset:
3.2.2 Ensure that the audit policy covers key security concerns. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-remediations-123) Shared 









 4 Worker node security configuration 

Review the Worker Node Security Configuration results of the version 1.5 CIS Kubernetes benchmark.



 4.1 Worker node configuration files 



Section 4.1 Worker Node Configuration benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.2 Ensure that the kubelet service file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.3 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root. Scored 1 Pass IBM 







 4.2 Kubelet 



Section 4.2 Kubelet benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.2.1 Ensure that the --anonymous-auth option is set to false. Scored 1 Pass IBM
3.2.2 Ensure that the audit policy covers key security concerns. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) Shared 









 4 Worker node security configuration 

Review the Worker Node Security Configuration results of the version 1.5 CIS Kubernetes benchmark.



 4.1 Worker node configuration files 



Section 4.1 Worker Node Configuration benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.2 Ensure that the kubelet service file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.3 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root. Scored 1 Pass IBM 







 4.2 Kubelet 



Section 4.2 Kubelet benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.2.1 Ensure that the --anonymous-auth option is set to false. Scored 1 Pass IBM
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive Not Scored 1 Pass IBM 
 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root Not Scored 1 Pass IBM 
 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive Scored 1 Pass IBM 
 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd Scored 1 Pass IBM 
 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.14 Ensure that the admin.conf file ownership is set to root:root Scored 1 Pass IBM 
 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root Scored 1 Pass IBM 
 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root Scored 1 Pass IBM 
 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root Scored 1 Pass IBM 
 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 Scored 1 Pass IBM 







 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility
The following example shows the structure of the warnings_and_errors object:

"warnings_and_errors": [
{
"message": "CWSMR0032W: A Watson Speech to Text final utterance has a confidence score of 0.1, which does not meet the confidence score threshold of 0.2. The utterance will be ignored.",
"id": "CWSMR0032W"
},
{
"message": "CWSMR0031W: The synthesis stream from the Watson Text To Speech service can't keep up with the playback rate to the caller, so audio might skip. transaction ID=a1b2c3d4e5",
"id": "CWSMR0031W"
}
]

The object for each warning contains the following properties:



Properties of the warnings_and_errors object

 Property Type Description 

 message String The text of the warning message. 
 id String The unique message identifier. 







 max_response_milliseconds 

The max_response_milliseconds object contains the following properties:



Properties of the max_response_milliseconds object

 Property Type Description 

 assistant Number The maximum round-trip latency (in milliseconds), calculated from all Watson Assistant requests related to the call. 
 text_to_speech Number The maximum time (in milliseconds) between when a text utterance is sent to the Text to Speech service and when the phone integration receives the first packet of synthesized audio. This value is calculated from all Text to Speech requests related to the call. 
 speech_to_text Number The maximum latency (in milliseconds) between when silence is detected in the caller's speech and when a final result from the Speech to Text service is received. This value is calculated from all Speech to Text recognition results related to the call. 







 realtime_transport_network_summary 

When RTCP is enabled, the realtime_transport_network_summary object provides statistics for the inbound stream in the inbound_stream object and statistics for the outbound stream in the outbound_stream object.
NFS performance level options

 Option Details 

 0.25 IOPS/GB This option is designed for workloads that are not used often. Example applications include vaulted data, hosting large databases with legacy data, or virtual disk images of virtual memory system as backup. 
 2 IOPS/GB This option is designed for most general-purpose workloads. Example applications include hosting small databases, backing up web applications, or virtual machine disk images for a hypervisor. 
 4 IOPS/GB This option is designed for higher-intensity workloads that have a high percentage of active data at a time. Example applications include transactional databases. 
 10 IOPS/GB This option is designed for the most demanding workload types, such as analytics. Example applications include high-transaction databases and other performance-sensitive databases. This performance level is limited to a maximum capacity of 4 TB per file share. 







 vSAN storage 

If you select vSAN storage, specify the following settings.



 Size for vSAN capacity disks 

Select an option for the capacity disks that you need.





 Number of vSAN capacity disks 

Specify the number of capacity disks that you want to add.





 Size for vSAN cache disks 

Review the Size for vSAN cache disks value.





 Number of vSAN cache disks 

Review Number of vSAN cache disks.





 Enable vSAN deduplication and compression 

vSAN storage depends on the number of servers and your total disk capacity, and the use of deduplication and compression.

The amount of storage reduction from deduplication and compression depends on many factors, including the type of data stored and the number of duplicate blocks. Larger disk groups tend to provide a higher deduplication ratio. For more information, see [Using deduplication and compression](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vsan.doc/GUID-3D2D80CC-444E-454E-9B8B-25C3F620EFED.html).





 vSAN Enterprise license 

Use the IBM-provided VMware license for the vSAN component by selecting Include with purchase.
4.1.6 Ensure that the kubelet.conf file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root. Scored 1 Pass IBM 
 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive. Scored 1 Pass IBM 
 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root. Scored 1 Pass IBM 







 4.2 Kubelet 



Section 4.2 Kubelet benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 4.2.1 Ensure that the --anonymous-auth option is set to false. Scored 1 Pass IBM 
 4.2.2 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 4.2.3 Ensure that the --client-ca-file option is set as appropriate. Scored 1 Pass IBM 
 4.2.4 Ensure that the --read-only-port option is set to 0. Scored 1 Pass IBM 
 4.2.5 Ensure that the --streaming-connection-idle-timeout option is not set to 0. Scored 1 Pass IBM 
 4.2.6 Ensure that the --protect-kernel-defaults option is set to true. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) IBM 
 4.2.7 Ensure that the --make-iptables-util-chains option is set to true. Scored 1 Pass IBM 
 4.2.8 Ensure that the --hostname-override option is not set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) IBM
Maintain IBM Cloud high availability SLA Operate the Continuous Delivery service in accordance with the IBM Cloud Public [Service Level Agreements (SLAs)](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-slas). 
 Provide high availability capabilities Provide capabilities, such as IBM-owned infrastructure in multizone regions (MZR), to meet local access and low latency requirements for each supported region. Use the list of [available regions](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-endpoints) to plan for and create new instances of the service. 
 Monitor agents Provide images and instructions for how to install agents in environments that you want to monitor, such as Kubernetes and Openshift. Install and configure agents. <br>Monitor that the agents are running in your environment. 







 Change management 

You and IBM share responsibilities for keeping IBM Cloud Security and Compliance Center Workload Protection service components at the latest version. You are responsible for change management of your agents, dashboards, and alert definitions.



Table 2. Responsibilities for change management

 Task IBM Responsibilities Your Responsibilities 

 Update the IBM Cloud Security and Compliance Center Workload Protection service Provide regular updates to the service with new features, fixes for defects, and security fixes. 
 Update the agent image that is hosted in IBM Cloud Provide regular updates to the agent image with new features, fixes to defects, and security fixes. Document changes in the [Agent release notes](https://docs.sysdig.com/en/sysdig-agent-release-notes.html) Update the agent to keep it up to date as new versions are made available. 
 Update default rules and policies Update the default rules and policies as requirements change. Update custom policies and track changes by using your own change management process. 
 Update pre-defined alert definitions Update the default alert definitions as requirements change. Update custom alert definitions and track changes by using your own change management process. 
 Track versions of custom rules, policies, notifications, and teams Use your own change management process to control versions of monitoring resources such as rules, policies, teams, and notifications. 







 Identity and access management
VRVDR-54848 N/A DLA-2611-1 CVE-2020-27840, CVE-2021-20277: Debian DLA-2611-1 : ldb security update 
 VRVDR-54712 8.1 DLA-2588-1 CVE-2021-20234, CVE-2021-20235: Debian DLA-2588-1 : zeromq3 security update 









 1912m 



 Issues Resolved 



Issues resolved for 1912m

 Issue Number Priority Summary 

 VRVDR-54586 Major Dataplane crash in connection sync on closing tcp session 
 VRVDR-53889 Major BFD mbuf leak when deployed in a VNF using PCI-Passthrough on ixgbe 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1912m

 Issue Number CVSS score Advisory Summary 

 VRVDR-54801 7.2 DLA-2605-1 CVE-2021-27928: Debian DLA-2605-1 : mariadb-10.1 security update 
 VRVDR-54788 8.1 DLA-2604-1 CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25684, CVE-2020-25687: Debian DLA-2604-1 : dnsmasq security update 
 VRVDR-54770 9.8 DLA-2596-1 CVE-2017-12424, CVE-2017-20002: Debian DLA-2596-1 : shadow security update 
 VRVDR-54563 7.5 DLA-2574-1 CVE-2021-27212: Debian DLA-2574-1 : openldap security update 
 VRVDR-54562 9.8 DLA-2570-1 CVE-2021-26937: Debian DLA-2570-1: screen security update 
 VRVDR-54531 8.1 DLA-2568-1 CVE-2020-8625: Debian DLA-2568-1 : bind9 security update 









 1912k 



 Issues Resolved
Open source licenses 

The IBM® license agreement and any applicable information on the web download page for IBM products refers Licensee to this file for details that concern notices applicable to code, which is included in IBM Cloud Hyper Protect Virtual Servers.

Notwithstanding the terms and conditions of any other agreement Licensee may have with IBM or any of its related or affiliated entities (collectively "IBM"), the third-party code that is identified later in this document is subject to the terms and conditions of the IBM license agreement for the Program and not the license terms that may be contained in the subsequent notices. The notices are provided for informational purposes.

Note: This Notices file may identify information that is not used by, or that was not shipped with, the Program as Licensee installed it.

IBM does not represent or warrant that the information in this NOTICES file is accurate. Third-party websites are independent of IBM and IBM does not represent or warrant that the information on any third-party website that is referenced in this NOTICES file is accurate. IBM disclaims any and all liability for errors and omissions or for any damages that accrue from the use of this NOTICES file or its contents, including without limitation URLs or references to any third-party websites.



 Hyper Protect Virtual Servers notices and information 

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
NOTICES AND INFORMATION

Hyper Protect Virtual Servers

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

TABLE OF CONTENTS

THE REMAINDER OF THIS IBM NOTICES FILE CONSISTS OF THE FOLLOWING
SECTIONS:

CC-BY-2.5
CC-BY-3.0
CC-BY-4.0
CC-BY-SA-3.0
CC-BY-SA-4.0
Each key is a hashed value that you can send to IBM to provide feedback or receive support.



* contract_types: An array that identifies the document's contract type or types.



* confidence_level: The confidence level of the identification of the contract type. Possible values include High, Medium, and Low.
* text: A contract type, which is listed as a string.
* provenance_ids: An array that contains zero or more keys. Each key is a hashed value that you can send to IBM to provide feedback or receive support.
* location: The location of the contract type as defined by its begin and end indexes.



* contract_terms: An array that identifies the duration or durations of the contract.



* confidence_level: The confidence level of the identification of the contract terms. Possible values include High, Medium, and Low.
* text: A contract term, which is listed as a string.
* provenance_ids: An array that contains zero or more keys. Each key is a hashed value that you can send to IBM to provide feedback or receive support.
* location: The location of the contract term as defined by its begin and end indexes.



* payment_terms: An array that identifies the document's payment duration or durations.



* confidence_level: The confidence level of the identification of the payment term. Possible values include High, Medium, and Low.
* text: A payment term, which is listed as a string.
* text_normalized: The normalized text, if applicable.
* interpretation: The details of the normalized text, if applicable.



* value: A string that lists the value that was found in the normalized text.
* numeric_value: An integer or double that expresses the numeric value of the value key.
* unit: A string that lists the unit of the value that was found in the normalized text.

The value of unit is the [ISO-4217 currency code](https://www.iso.org/iso-4217-currency-codes.html) that is identified for the currency amount (for example, USD or EUR).
See also [container](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2010901), [registry](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2064940), [namespace](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2031005), [layer](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2028320), [base image](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx5366487), [parent image](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx8439210), [private image repository](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx8439215).





 imprint mode 

An operational mode in which crypto units are assigned to a user.





 infrastructure as a service (IaaS) 

The delivery of a computer infrastructure, including server functionality, networking functionality, data center functionality, and storage functionality as an outsourced service.





 input/output operations per second (IOPS) 

A standard computing benchmark used to determine the best configuration settings for servers.





 instance 

An entity that consists of resources that are reserved for a particular application or a service.





 instantiate 

The process of starting and initializing a smart contract on a blockchain channel. After instantiation, peers on the channel that have the smart contract installed can accept smart contract invocations.





 inter-annotator agreement 

A measure of how similarly a document in two or more document sets is annotated.





 intermediate certificate 

A subordinate certificate that is issued by the trusted root certificate authority (CA) specifically to issue end-entity server certificates. The result is a certificate chain that begins at the trusted root CA, passes through the intermediate certificate, and ends with the SSL certificate issued to the organization.
After instantiation, peers on the channel that have the smart contract installed can accept smart contract invocations.





 inter-annotator agreement 

A measure of how similarly a document in two or more document sets is annotated.





 intermediate certificate 

A subordinate certificate that is issued by the trusted root certificate authority (CA) specifically to issue end-entity server certificates. The result is a certificate chain that begins at the trusted root CA, passes through the intermediate certificate, and ends with the SSL certificate issued to the organization. See also [trusted root](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2042234), [certificate authority](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2016383).





 Internet of Things (IoT) 

The global network of endpoints that can capture or generate data. For example, a smartphone, smart watch and back-end server might all communicate with each other, sending data back and forth, or even to additional devices within the network.





 Internet Small Computer System Interface (iSCSI) 

An IP-based standard for linking data storage devices over a network and transferring data by carrying SCSI commands over IP networks.





 invoke 

To activate an action. See also [action](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2012974).





 IOPS 

See [input/output operations per second](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx3858854).





 IoT 

See [Internet of Things](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx6714341).





 iSCSI 

See [Internet Small Computer System Interface](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2119615).







 J 



 JAR file 

A Java archive file.





 JavaScript Object Notation (JSON) 

A lightweight data-interchange format that is based on the object-literal notation of JavaScript.
umh-8x1920 8 64 1,920 3,490 48,000 OLTP * 
 umh-10x2400 10 80 2,400 3,970 60,000 OLTP * 
 umh-12x2880 12 96 2,880 4,450 72,000 OLTP * 
 umh-16x3840 16 128 3,840 5,410 96,000 OLTP 
 umh-20x4800 20 160 4,800 6,370 120,000 OLTP * 
 umh-22x5280 22 176 5,280 6,850 132,000 OLTP * 
 umh-25x6000 25 200 6,000 7,570 150,000 OLTP * 
 umh-30x7200 30 240 7,200 8,770 180,000 OLTP * 
 umh-35x8400 35 280 8,400 10,370 210,000 OLTP * 
 umh-40x9600 40 320 9,600 11,170 240,000 OLTP * 
 umh-50x12000 50 400 12,000 13,570 300,000 OLTP * 
 umh-60x14400 60 480 14,400 15,970 360,000 OLTP 



Profile types that are marked with an * asterisk, are not listed on the SAP HANA Hardware Directory by SAP but are certified for running SAP HANA production systems. The directory lists the smallest, median, and largest within each profile family. This action was taken by SAP to avoid too many records, as the scalability of IBM POWER hardware enables significantly more granular sizing. For more information, see [SAP Note 2947579 - SAP HANA on IBM Power Virtual Servers](https://launchpad.support.sap.com//notes/2947579).





 Understanding IBM Power Virtual Server profile names 

The IBM Power Virtual Server for SAP HANA have profile names that are contextual and sequential. SAP HANA has multiple families of profiles, each associated with the required Service Level Agreements (SLAs):



* cnp1 = Nonproduct development for testing or development use only. Not intended for production deployments; not supported or certified for SAP production.