vania-janet/multiturn-rag-retrieval-data huggingface dataset:
This value is valid only for the container log source. If you don't specify a namespace, then all namespaces in the cluster use this configuration.

--hostname LOG_SERVER_HOSTNAME
: The hostname or IP address of the log collector server.

--port LOG_SERVER_PORT
: The port of the log collector server. This value is optional when the logging type is syslog. If you don't specify a port, then the standard port 514 is used for syslog and 9091 is used for ibm.

--space CLUSTER_SPACE
: Optional: The name of the space that you want to send logs to. This value is valid only for log type ibm and is optional. If you don't specify a space, logs are sent to the account level. If you do, you must also specify an org.

--org CLUSTER_ORG
: Optional: The name of the Cloud Foundry org that the space is in. This value is valid only for log type ibm and is required if you specified a space.

-p, --app-path
: The path on the container that the apps are logging to. To forward logs with source type application, you must provide a path. Wildcards, such as /var/log/.log, can be used, but recursive globs, such as /var/log//test.log, can't be used. To specify more than one path, use multiple options, such as -p /var/log/myApp1/&ast; -p /var/log/myApp2/&ast;. This value is required for log source application.

-C, --app-container
: To forward logs from apps, you can specify the name of the container that contains your app. To specify more than one container, use multiple options, such as -C /var/log/myApp1/&ast; -C /var/log/myApp2/&ast;. If no containers are specified, logs are forwarded from all the containers that contain the paths that you provided. This option is only valid for log source application.
kind: ConfigMap
metadata:
name: node-local-dns-config
namespace: kube-system
data:
stubDomains: 
{"abc.com" : ["1.2.3.4"]}
4. After a few minutes, the NodeLocal DNS cache pods pick up the ConfigMap changes.









 Setting up zone-aware DNS 

Set up zone-aware DNS for improved cluster DNS performance and availability in your [multizone IBM Cloud Kubernetes Service cluster](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-clusters). This setup extends [NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_cache) to prefer cluster DNS traffic within the same zone.

By default, your cluster is set up with cluster-wide DNS resources, not zone-aware DNS resources. Even after you set up zone-aware DNS, the cluster-wide DNS resources remain running as a backup DNS. Your zone-aware DNS resources are separate from the cluster-wide DNS, and changing zone-aware DNS does not impact the cluster-wide DNS.

Do not use the [DNS cache label](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_cache) when you use zone-aware DNS in your cluster.



 Setting up zone-aware DNS 

Complete the following step to set up zone-aware DNS in your multizone cluster.



1. Update any [DNS egress network policies](https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dns/nodelocaldnsnetwork-policy-and-dns-connectivity) that are impacted by zone-aware DNS, such as policies that rely on pod or namespace selectors for DNS egress. Run the following command to get a list of your network policies.
kubectl get pods --all-namespaces -o=jsonpath='{range .items[]}{"n"}{.metadata.name}{":t"}{range .spec.volumes[]}{.persistentVolumeClaim.claimName}{" "}{end}{end}' | grep "<pvc_name>"

Example output

blockdepl-12345-prz7b: claim1-block-bronze
4. Remove the pod that uses the PVC. If the pod is part of a deployment, remove the deployment.

kubectl delete pod <pod_name>
5. Verify that the pod is removed.

kubectl get pods
6. Remove the PVC.

kubectl delete pvc <pvc_name>
7. Review the status of your PV. Use the name of the PV that you retrieved earlier as VOLUME. When you remove the PVC, the PV that is bound to the PVC is released. Depending on how you provisioned your storage, your PV goes into a Deleting state if the PV is deleted automatically, or into a Released state, if you must manually delete the PV. Note: For PVs that are automatically deleted, the status might briefly say Released before it is deleted. Rerun the command after a few minutes to see whether the PV is removed.

kubectl get pv <pv_name>
8. If your PV is not deleted, manually remove the PV.

kubectl delete pv <pv_name>
9. Verify that the PV is removed.

kubectl get pv
Add a Hello World guard to securely expose the Hello World application to the internet.

ibmcloud ce application create -n ${SERVICE_NAME}-guard --min 1 -p 22000 
-e GUARD_URL=${GUARD_URL} 
-e SERVICE_URL=${SERVICE_URL} 
-e SERVICE_NAME=${SERVICE_NAME} 
-e NAMESPACE=${NAMESPACE} 
-i ghcr.io/ibm/workload-security-guard/guard-rproxy

Example output

Creating application 'myapp-guard'...
[...]
Run 'ibmcloud ce application get -n myapp-guard' to check the application status.
OK

https://myapp-guard.p8abcd4abcd.us-south.codeengine.appdomain.cloud

You can access the protected Hello World application through the URL that is exposed by Hello World guard.

Notes:



* Deploy a Guard for any application you want to protect.
* Provide Guard with the project namespace and the corresponding application name and url it protects.
* Provide Guard with the url of the Guard-Learner.
* Set USE_CONFIGMAP=true to maintain the micro-rules in a configmap named guardian-${SERVICE_NAME} .
* Consider setting the minimum scale of the Guard app to a single instance with the --min 1 option.







 Step 5: Managing the security of the Hello World application and gaining situational awareness 

Guard offers situational awareness into the application security posture. You can find security alerts in the log file of Guard, as they occur.

ibmcloud ce application logs -n ${SERVICE_NAME}-guard

Example output

[...]
{"level":"warn","message":"SECURITY ALERT! HttpRequest: Headers: KeyVal: Known Key X-B3-Traceid: Digits: Counter out of Range: 25"}
[...]

Security alerts appear as warnings in the guard log file and start with the string SECURITY ALERT!.
apiconnect.role_default_updateConsumerSubcollectionSpaceScope.update Update the Role Default object by name or ID 
 apiconnect.role_default_delConsumerSubcollectionSpaceScope.delete Delete the Role Default object by name or ID 
 apiconnect.space_create.create Create a Space object 
 apiconnect.space_clear.delete Clear the Space objects 
 apiconnect.space_update.update Update the Space object by name or ID 
 apiconnect.space_del.delete Delete the Space object by name or ID 
 apiconnect.space_transferOwner.create Transfer owner to an associate 
 apiconnect.space_stageDraftProductSpaceSubcollection.create Stage a draft product 
 apiconnect.space_publishDraftProductSpaceSubcollection.create Publish a draft product 
 apiconnect.space_stageSpaceSubcollection.create Stage the product 
 apiconnect.space_publishSpaceSubcollection.create Publish the product 
 apiconnect.invitation_createSpaceScope.create Create a Space Invitation object 
 apiconnect.invitation_clearSpaceScope.delete Clear the Space Invitation objects 
 apiconnect.invitation_updateSpaceScope.update Update the Space Invitation object by name or ID 
 apiconnect.invitation_delSpaceScope.delete Delete the Space Invitation object by name or ID 
 apiconnect.invitation_regenerateSpaceScope.create Regenerate the Space Invitation 
 apiconnect.invitation_registerSpaceScope.create Register using the Space Invitation 
 apiconnect.invitation_acceptSpaceScope.create Accept using the Space Invitation 
 apiconnect.role_updateSpaceScope.update Update the Role object by name or ID 
 apiconnect.member_invitation_createSpaceScope.create Create a Member Invitation object 
 apiconnect.member_invitation_clearSpaceScope.delete Clear the Member Invitation objects 
 apiconnect.member_invitation_updateSpaceScope.update Update the Member Invitation object by name or ID
Namespace: openshift-image-registry
Priority: 2000000000
PriorityClassName: system-cluster-critical
Node: 10.xxx.xx.xxx/10.xxx.xx.xxx
Start Time: Wed, 19 Feb 2020 15:38:53 -0500
Labels: docker-registry=default
Annotations: openshift.io/scc: anyuid
2. Describe the security context constraint and check the user and groups in the Access section.

oc describe scc <scc>

Example output

NAME: anyuid
Priority: <none>
Access:
Users: <none>
Groups: system:authenticated
3. If you don't want the user or group to have the permissions of the SCC, remove the user or group from the SCC. For more information, review the default [Red Hat OpenShift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_sccoc_sccs) and [IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_sccibm_sccs) SCCs that are set in the cluster.

oc adm policy remove-scc-from-group <scc> <(user|group)>
4. Add the user or group to the SCC with the appropriate permissions.

oc adm policy add-scc-to-group <scc> <(user|group)>
5. Delete the pod so that the pod is rescheduled with the new SCC permissions.

oc delete pod -n <project> <pod>
Deploying DevSecOps Application Lifecycle Management by using the IBM Cloud CLI 

Deploy an instance of the DevSecOps Application Lifecycle Management deployable architecture through the IBM Cloud CLI.

Follow these steps:



1. Create a values.json file on your local computer. values.json contains your custom configuration, for example product version, cluster, and namespace. A sample values.json that you can modify is as follows:

{
"toolchain_name" : "DevSecOps",
"toolchain_region" : "us-south",
"toolchain_resource_group" : "Default",
"registry_name_space" : "my-registry-namespace",
"cluster_name" : "mycluster-free",
"sm_location" : "us-south",
"sm_name" : "sm-compliance-secrets",
"sm_resource_group" : "Default",
"sm_secret_group" : "Default"
}
2. Edit values.json to reflect your configuration. You can find your configuration values as follows:



* You can specify your own toolchain name ("toolchain_name") and a toolchain region ("toolchain_region"). For more information on toolchain regions, see [Region and data center locations for resource deployment](https://cloud.ibm.com/docs/overview?topic=overview-locations).
* From the IBM Cloud console, click Manage > Account > Resource groups to find your resource group ("toolchain_resource_group").
* From the IBM Cloud console, click the menu icon ![Hamburger icon](https://cloud.ibm.com/docs-content/v1/content/880fa35b13cb9428675d718aa36ca2825b4c87c8/icons/icon_hamburger.svg) and click Kubernetes. Use the Cluster and Container Registry options to find the cluster and container registry details ("cluster_name" and "registry_name_space").
Before you run the command, update the INSTANCE variable with the name of your instance, and update the NAMESPACE variable with the namespace where your instance in installed:

INSTANCE=wa ; NAMESPACE=cpd ; DRY_RUN="--dry-run=client --output=yaml" To apply the changes, change to an empty string
DRY_RUN=""
cat <<EOF | tee wa-network-policy-base.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
annotations:
oppy.ibm.com/internal-name: infra.networkpolicy
labels:
app: ${INSTANCE}-network-policy
app.kubernetes.io/instance: ${INSTANCE}
app.kubernetes.io/managed-by: Ansible
app.kubernetes.io/name: watson-assistant
component: network-policy
icpdsupport/addOnId: assistant
icpdsupport/app: ${INSTANCE}-network-policy
icpdsupport/ignore-on-nd-backup: "true"
icpdsupport/serviceInstanceId: inst-1
service: conversation
slot: ${INSTANCE}
tenant: PRIVATE
velero.io/exclude-from-backup: "true"
name: ${INSTANCE}-network-policy
namespace: ${NAMESPACE}
spec:
ingress:
- from:
- podSelector:
matchLabels:
service: conversation
slot: ${INSTANCE}
- podSelector:
matchLabels:
slot: global
- podSelector:
matchLabels:
component: watson-gateway
- podSelector:
matchLabels:
component: dvt
- podSelector:
matchLabels:
dwf_service: ${INSTANCE}-clu
network-policy: allow-egress
- podSelector:
matchLabels:
5.3.2 Ensure that all Namespaces have Network Policies defined Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.4.1 Prefer using secrets as files over secrets as environment variables Not Scored 1 Pass Shared 
 5.4.2 Consider external secret storage Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.6.3 Apply Security Context to Your Pods and Containers Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.6.4 The default namespace should not be used Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared
oc get pods --all-namespaces -o=jsonpath='{range .items[]}{"n"}{.metadata.name}{":t"}{range .spec.volumes[]}{.persistentVolumeClaim.claimName}{" "}{end}{end}' | grep "<pvc_name>"

Example output

NAME READY STATUS RESTARTS AGE
web-server 1/1 Running 0 55s
2. Remove the pod that uses the PVC. If the pod is part of a deployment or statefulset, remove the deployment or statefulset.

oc delete pod <pod_name>

oc delete deployment <deployment_name>

oc delete statefulset <statefulset_name>
3. Verify that the pod, deployment, or statefulset is removed.

oc get pods

oc get deployments

oc get statefulset



3. Delete the PVC.

oc delete pvc <pvc_name>
4. Verify that your PV is automatically removed.

oc get pv







 Removing the VMware storage configuration from your cluster 

If you no longer plan on using VMware in your cluster, you can use the CLI unassign your cluster from the storage configuration.

Removing the storage configuration removes the driver from all assigned clusters. Your PVCs, PVs, and data are not removed. However, you might not be able to access your data until you re-install the driver in your cluster again.



 Removing the VMWare storage configuration using the console 



1. From the Satellite storage dashboard, select the storage configuration you want to delete.
2. Select Actions > Delete
3. Enter the name of your storage configuration.
4. Select Delete.







 Removing the VMWare storage configuration using the command line 



1. List your storage assignments and find the one that you used for your cluster.
Configure a Prometheus deployment:

kubectl edit deployment prometheus-deployment -n <PROMETHEUS_NAMESPACE>

Add the following sections to the deployment config file:

apiVersion: apps/v1
kind: Deployment
...
spec:
replicas: 1
...
spec:
containers:
- name: prometheus-server
args:
...
volumeMounts:
- name: secret-files
mountPath: /etc/secrets
volumes:
- name: secret-files
secret:
secretName: <SECRET_NAME>
Show more
2. Modify the Prometheus configMap to include the Prometheus remote_write block.

Get the name of the configMap by running the following command:

kubectl get cm -n <PROMETHEUS_NAMESPACE>

For Prometheus v2.25 and previous versions, follow these instructions:

Edit the configMap:

kubectl edit cm <PROMETHEUS_CONFIG_MAP> -n <PROMETHEUS_NAMESPACE>

Add the remote_write section:

prometheus.yml: 
global:
evaluation_interval: 1m
scrape_interval: 1m
scrape_timeout: 10s
scrape_configs:
- job_name: ...
remote_write:
- url: https://<INGESTION_URL>/prometheus/remote/write
bearer_token_file: /etc/secrets/<SECRET_NAME>

Where

<SECRET_NAME> is the name of the secret.

<INGESTION_URL> indicates the ingestion endpoint. You must set this value to the ingestion endpoint for the region where the Monitoring instance is available.

For Prometheus version 2.26 and later versions, follow these instructions:

Edit the configMap:

kubectl edit cm <PROMETHEUS_CONFIG_MAP> -n <PROMETHEUS_NAMESPACE>
ibmcloud cr namespace-list (ibmcloud cr namespaces) 

Displays all

namespacesthat are owned by your IBM Cloud account. You can use this command to list your namespaces so that you can verify which namespaces are assigned toresource groups, and which namespaces are unassigned. Namespaces that are assigned to a resource group also show in the Resource list page of the IBM Cloud console.

ibmcloud cr namespace-list [--verbose | -v]



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Command options 

--verbose, -v
: (Optional) List all the namespaces and include information about the resource group and the creation date of the namespace.





 Example 

View a list of all your namespaces, including information about resource groups and creation dates.

ibmcloud cr namespace-list -v







 ibmcloud cr namespace-rm 

Removes a

namespacefrom your IBM Cloud account. Images in this namespace are deleted when the namespace is removed.

ibmcloud cr namespace-rm NAMESPACE [--force | -f]



 Prerequisites 

To find out about the required permissions, see [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).





 Command options 

NAMESPACE
: The namespace that you want to remove.

--force, -f
: (Optional) Force the command to run with no user prompts.





 Example 

Remove the namespace birds.

ibmcloud cr namespace-rm birds







 ibmcloud cr plan 

Displays your pricing plan for the registry region that you're targeting.

ibmcloud cr plan



 Prerequisites
Step 6: Disable and reenable 

Optional: If you completed the debugging steps and your cluster still does not scale, you can disable and reenable the autoscaler by editing the config map.



1. Edit the iks-ca-configmap.

kubectl edit cm iks-ca-configmap -n kube-system

Example output:

apiVersion: v1
data:
workerPoolsConfig.json: 
[{"name": "default", "minSize": 2, "maxSize": 5, "enabled": true }]
kind: ConfigMap
metadata:
annotations:
workerPoolsConfigStatus: '{"2:5:default":"SUCCESS"}'
creationTimestamp: "2020-03-24T17:44:35Z"
name: iks-ca-configmap
namespace: kube-system
resourceVersion: "40964517"
selfLink: /api/v1/namespaces/kube-system/configmaps/iks-ca-configmap
uid: 11a1111a-aaaa-1a11-aaa1-aa1aaaa11111
2. Set the enabled parameter to false and save your changes.
3. Edit the iks-ca-configmap again. Set the enabled parameter to true and save your changes.

kubectl edit cm iks-ca-configmap -n kube-system
4. If your cluster still does not scale after disabling and reenabling the cluster autoscaler,you can edit the minSize or maxSize parameters in the iks-ca-configmap. Sometimes,editing the minSize and maxSize worker parameters successfully restarts the cluster autoscaler.

kubectl edit cm iks-ca-configmap -n kube-system
5. Edit the minSize or maxSize parameters and save your changes.
Create a Kubernetes secret named px-ibm in the portworx namespace of your cluster to store your IBM Key Protect information.



1. Create a configuration file for your Kubernetes secret with the following content.

apiVersion: v1
kind: Secret
metadata:
name: px-ibm
namespace: portworx
type: Opaque
data:
IBM_SERVICE_API_KEY: <base64_apikey>
IBM_INSTANCE_ID: <base64_guid>
IBM_CUSTOMER_ROOT_KEY: <base64_rootkey>
IBM_BASE_URL: <base64_endpoint>

metadata.name
: Enter px-ibm as the name for your Kubernetes secret. If you use a different name, Portworx does not recognize the secret during installation.

data.IBM_SERVICE_API_KEY
: Enter the base64 encoded IBM Key Protect or Hyper Protect Crypto Services API key that you retrieved earlier.

data.IBM_INSTANCE_ID
: Enter the base64 encoded service instance GUID that you retrieved earlier.

data.IBM_CUSTOMER_ROOT_KEY
: Enter the base64 encoded root key that you retrieved earlier.

data.IBM_BASE_URL
: IBM Key Protect: Enter the base64 encoded API endpoint of your service instance.
: Hyper Protect Crypto Services: Enter the base64 encoded Key Management public endpoint.
2. Create the secret in the portworx namespace of your cluster.

kubectl apply -f secret.yaml
3. Verify that the secret is created successfully.

kubectl get secrets -n portworx



4. If you set up encryption before your installed Portworx, you can now [install Portworx in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_deploy).
ibm-app-cluster-critical IBM 900000000 Select pods that are deployed into the ibm-system namespace when you create the cluster use this priority class to protect critical functionality for apps, such as the load balancer pods. 



You can check which pods use the priority classes by running the following command.

oc get pods --all-namespaces -o custom-columns=NAME:.metadata.name,PRIORITY:.spec.priorityClassName





 Creating a priority class 

To set pod priority, you need to use a priority class.

Before you begin:



* [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
* Ensure that you have the [Writer or Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms) for the default namespace.





1. List existing priority classes. You can use an existing priority class as a template for the new class.

oc get priorityclasses
2. Choose the priority class that you want to copy and create a local YAML file.

oc get priorityclass <priority_class> -o yaml > Downloads/priorityclass.yaml
3. Make your priority class YAML file.

apiVersion: scheduling.k8s.io/v1alpha1
kind: PriorityClass
metadata:
name: <priority_class_name>
value: <1000000>
globalDefault: <false>
description: "Use this class for XYZ service pods only."



Understanding the YAML file components

 Components Description 

 name Required: The name of the priority class that you want to create. 
 value Required: Enter an integer less than or equal to 1 billion (1000000000). The higher the value, the higher the priority. Values are relative to the values of other priority classes in the cluster.