vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [CVE-2022-4450](https://nvd.nist.gov/vuln/detail/CVE-2022-4450)
* [CVE-2023-0215](https://nvd.nist.gov/vuln/detail/CVE-2023-0215)
* [CVE-2023-0286](https://nvd.nist.gov/vuln/detail/CVE-2023-0286)
* [CVE-2023-23914](https://nvd.nist.gov/vuln/detail/CVE-2023-23914)
* [CVE-2023-23915](https://nvd.nist.gov/vuln/detail/CVE-2023-23915)
* [CVE-2023-23916](https://nvd.nist.gov/vuln/detail/CVE-2023-23916)







 1.5.1_3705_iks, released 30 January 2023 

Updates the golang version to 1.19.5.





 1.5.1_3683_iks, released 24 January 2023 

Introduces support for multiple platform architectures such as AMD64 and s390x.





 1.5.1_3536_iks, released 3 January 2023 

Initial release of 1.5.1. For more information, see the [community release documentation](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.5.1).







 Version 1.4.0 



 1.4.0_5159_iks, released 5 July 2023 



* Resolves [CVE-2023-32731](https://nvd.nist.gov/vuln/detail/CVE-2023-32731)







 1.4.0_5068_iks, released 6 June 2023 



* Updates golang version to 1.20.4.
* [Change log for version 4.2.1_895, released 17 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog421_895_is_block_relnote)
* [Change log for version 4.2.0_890, released 28 February 2022](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog420_890_is_block_relnote)



* [Version 4.1](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog041_is_block)



* [Change log for version 4.1.3_846, released 14 February 2022](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog413_846_is_block_relnote)
* [Change log for version 4.1.2_834, released 27 January 2022](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog412_834_is_block_relnote)
* [Change log for version 4.1.1_827, released 20 January 2022](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog0411837_is_block_relnote)
* [Change log for version 4.1.0_807, released 06 January 2022](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog41_is_block_relnote)



* [Version 4.0](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog0400_is_block)
* [CVE-2021-3998](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3998)
* [CVE-2021-3999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3999)
* [CVE-2022-23218](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23218)
* [CVE-2022-23219](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23219)



: For more information, see the [Istio security bulletin 2022-004](https://istio.io/latest/news/security/istio-security-2022-004/).





 Change log for 1.13.1, released March 9th, 2021 

Review the changes that are included in version 1.13.1 of the managed Istio add-on.

Previous version
: 1.12.4

Current version
: 1.13.1

Updates in this version
: See the Istio release notes for [Istio 1.13.1](https://istio.io/latest/news/releases/1.13.x/announcing-1.13.1/.).







 Version 1.12 (unsupported) 

Version 1.12 of the managed Istio add-on is unsupported.

If you want to upgrade from Istio minor version 1.11 to version 1.12 and your Istio components were provisioned at version 1.10 or earlier, you must take steps to [set up your mutating and validating webhooks](https://cloud.ibm.com/docs/containers?topic=containers-istioistio_minor) before you upgrade. If you do not make these changes before upgrading to 1.12, the upgrade will stall.
: In the string data section, enter the resource group that you want your Block Storage for Classic instance to get access to. If you don't enter a resource group, the instance is automatically authorized to access resources of the resource group that your cluster belongs to.

encrypted
: In the string data section, enter true to create a secret that sets up encryption for Block Storage for Classic volumes. If you set this option to true, you must provide the root key CRN of your Key Protect service instance that you want to use in parameters.encryptionKey. For more information about encrypting your data, see [Setting up encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-encryption) for your Block Storage for VPC.

encryptionKey
: In the data section, if you entered true for parameters.encrypted, then enter the root key CRN of your Key Protect service instance that you want to use to encrypt your Block Storage for Classic volumes. To use your root key CRN in a secret, you must first convert it to base64 by running echo -n "<root_key_CRN>" | base64. For more information about encrypting your data, see [Setting up encryption for your Block Storage for VPC](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-encryption).
3. Create your Kubernetes secret.

oc apply -f secret.yaml
4. Follow the steps in [Adding Block Storage for VPC to your apps](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-add) to create a PVC with your custom settings. Make sure to create the PVC with the customized storage class that the cluster admin created and use the same name for your PVC that you used for your secret. Using the same name for the secret and the PVC triggers the storage provider to apply the settings of the secret in your PVC.







 Enforcing base64 encoding for the Key Protect root key CRN
: In the string data section, enter true to create a secret that sets up encryption for Block Storage for Classic volumes. If you set this option to true, you must provide the root key CRN of your Key Protect service instance that you want to use in parameters.encryptionKey. For more information about encrypting your data, see [Setting up encryption](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-encryption) for your Block Storage for VPC.

encryptionKey
: In the data section, if you entered true for parameters.encrypted, then enter the root key CRN of your Key Protect service instance that you want to use to encrypt your Block Storage for Classic volumes. To use your root key CRN in a secret, you must first convert it to base64 by running echo -n "<root_key_CRN>" | base64. For more information about encrypting your data, see [Setting up encryption for your Block Storage for VPC](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-encryption).
3. Create your Kubernetes secret.

kubectl apply -f secret.yaml
4. Follow the steps in [Adding Block Storage for VPC to your apps](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-add) to create a PVC with your custom settings. Make sure to create the PVC with the customized storage class that the cluster admin created and use the same name for your PVC that you used for your secret. Using the same name for the secret and the PVC triggers the storage provider to apply the settings of the secret in your PVC.







 Enforcing base64 encoding for the Key Protect root key CRN 



1. As the cluster admin, create a Kubernetes secret that includes the base64 encoded value for your Key Protect root key CRN.
As mentioned in the preparation of the [workload section](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_workload) of the contract, the archive subsection contains the base64 encoded TGZ file archive of docker-compose.yml. The logging.pub file in our example will undergo the same encoding and compression since it's stored in the same folder. As a result, the created instance will acquire the public key for subsequent log encryption.



This tutorial also provides sample files such as env.yaml, workload.yaml, and user-data.yaml. They are only meant as references for correct schema.





 Before you begin 



1. Install [OpenSSL](https://www.openssl.org/) for encryption. This tutorial uses version 3.0 or later.
2. Set up your logging instance by following the [documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-logging-for-hyper-protect-virtual-servers-for-vpc).
3. The example runs on a Linux system.







 Prepare your contract 

This tutorial will get you started with a simple Hyper Protect Virtual Server for VPC contract that only has an [env section](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_env) and a [workload section](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_workload).

As recommended in the [documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_encrypt), we will encrypt both sections. When the instance boots, the bootloader decrypts the contract if it's encrypted.
* SAP_SLES_15_SP3_HANA
* SAP_SLES_15_SP3_APPLICATIONS
* SAP_SLES_15_SP4_HANA
* SAP_SLES_15_SP4_APPLICATIONS
* RHEL_7
* RHEL_8
* RHEL_8_6
* RHEL_9



File Storage for VPC IPsec connection requires Mutual SSL. The Mount Helper makes the following calls to generate and configure the certificates at swanctl.



* Mount Helper retrieves the INSTANCE IDENTITY TOKEN:

curl -iks -X PUT -H "Metadata-Flavor: ibm" https://169.254.169.254/instance_identity/v1/token?version=2023-06-20
* With the instance identity token, the Mount Helper generates the certificate request with the csr.

curl -X POST "https://169.254.169.254/instance_identity/v1/certificates?version=2023-07-11" -H "Accept:application/json" -H "Authorization: Bearer $IAM_TOKEN" --data-raw '{ "csr": "$csr" }'



The Mount Helper makes new certificate requests every 45 minutes, as the lifetime of the certificate is 1 hour. The new certificate is generated before the old certificate expires to ensure seamless connection. The certificates are generated with the shorter life span for security reasons.

You can use the utility for encrypted or unencrypted connections. For encrypted connections, the Mount Helper uses the instance metadata service protocol option that is set to either http or https. For more information, see the API reference for metadata_service option of [instance provisioning](https://cloud.ibm.com/apidocs/vpc/latestcreate-instance).

For more information, see the [readme file](https://github.com/IBM/vpc-file-storage-mount-helper).



 Requirements and restrictions
For more information, see [Viewing backup jobs](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-view-policy-jobs).





 17 December 2022 

IBM Hyper Protect Container Runtime image ibm-hyper-protect-container-runtime-1-0-s390x-7 updates
: For the IBM Hyper Protect Container Runtime image version ibm-hyper-protect-container-runtime-1-0-s390x-7, new certificates are available.



* [Attestation certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-7-attestation.crt)
* [Encryption certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-7-encrypt.crt)
* [Intermediate certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-7-intermediate.crt)



Certificate revocation list



* Starting from ibm-hyper-protect-container-runtime-1-0-s390x-7-encrypt.crt and ibm-hyper-protect-container-runtime-1-0-s390x-7-attestation.crt, the certificates contain Certificate Revocation List (CRL) Distribution Points. You can use the CRL to verify that your certificates are valid (not revoked). For more information, see [Certificate revocation list](https://cloud.ibm.com/docs/vpc?topic=vpc-cert_validatecertificate-revocation-list).







 15 December 2022 

Bare metal servers now support custom images
: You can now create custom images to use on your bare metal servers.
For more information, see [Accessing virtual server instances by using VNC or serial consoles (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_console)







 January 2021 



 26 January 2021 

New region
: The Osaka region endpoint is now in service at https://jp-osa.iaas.cloud.ibm.com. For more information, see [Creating a VPC in a different region](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-in-a-different-region). See also [Endpoint URLs](https://cloud.ibm.com/apidocs/vpcendpoint-url) in the IBM Cloud VPC API.





 11 January 2021 

Customer-managed encryption (GA)
: Customer-managed encryption, which supports deleting or disabling customer root keys and provides new statuses, is now available in the Washington DC (WDC) region. All VPC service regions now support this feature.







 December 2020 



 22 December 2020 

Customer-managed encryption (GA)
: For block storage volumes and encrypted custom images, deleting or disabling a customer root key (CRK) is now managed by these VPC services. When you delete a root key, the resources become unusable for normal operations. A new unusable status and reason code encryption_key_deleted or encryption_key_disabled has been added to the API for GET / volumes and GET / image methods. These statuses also appear in the CLI and UI. For more information, see [Disabling root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-disable-root-keys) and [Deleting root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-delete-root-keys).
2022/11/21 08:24:15 Done with the blueprint init flow job

OK







 Policy commands 

Schematics Policy is a beta feature that is available for evaluation and testing purposes. It is not intended for production usage. Refer to the list of [limitations](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-beta-limitationssc-bp-beta-limitation) for the beta release.





 Enable BYOK or KYOK commands 

You can use your encryption keys from key management services (KMS), IBM Key Protect(BYOK), and IBM Cloud Hyper Protect Crypto Services (KYOK) to encrypt and secure data stored in Schematics. For more information about how to protect sensitive data in Schematics, see [protecting your sensitive data in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datadata-storage).



 Prerequisites 

The key management system lists the instance that are created from your specific location and region. Following prerequisites are followed to perform the KMS activity.



* You should have your KYOK, or BYOK. To create the IBM Key Protect keys, see [create KYOK root key by using UI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys). To create an IBM Cloud Hyper Protect Crypto Services keys, see [create BYOK root key by using UI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys).
* You need to [add root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keysimport-root-key-gui) to Schematics services.
* You need to configure [service to service authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauthcreate-auth) to integrate BYOK, and KYOK in Schematics service.
[Set up the IBM Container Registry](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_serversetupconreg_sbs).
2. [Set up the Secure Build Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_serversetupsbs_sbs).
3. [Build the application image by using the Secure Build Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_serverbuildimage_sbs).
4. [Deploy the image by using Hyper Protect Virtual Servers BYOI and run the application in a secure environment](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_serverdeploy_sbs).



During this task flow, you create two Hyper Protect Virtual Servers instances: One instance for the Secure Build Server and one instance for your application.





 Step 1: Step 1: Set up the IBM Container Registry 

For this tutorial you need to set up IBM Container Registry and create a new namespace. The container registry is used to store the built application container image in the new namespace.



 1. Use the following commands to log in to IBM Cloud 

ibmcloud login --sso
ibmcloud target -g default





 2. Run the following command to create an API key for your user ID. 

ibmcloud iam api-key-create myapikey -d "API key for SBS tutorial"

The output displays the created API key. Make a note of the API Key value, you need it later to provide the API Key when you set up the Secure Build Server. The following snippet shows example output:

Creating API key myapikey under <your account id> as <your user id>...
OK
API key myapikey was created

Please preserve the API key!
Your firewalls are configured with the Container Registry private IP addresses.
: You must include the new private IP addresses in your firewall configuration. For more information about connecting to Container Registry over the private network, see [Securing your connection to Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_private).

For more information about the new and current Container Registry private IP addresses, see the following topics:



* For IBM Cloud Kubernetes Service, see [Permit worker nodes to communicate with IBM Cloud Container Registry](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_private_container_registry).
* For Red Hat® OpenShift® on IBM Cloud®, see [Permit worker nodes to communicate with IBM Cloud Container Registry](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_private_container_registry).
Policy-free authorization is discontinued in the following Container Registry regions:



* us-south (us.icr.io)
* uk-south (uk.icr.io)
* eu-central (de.icr.io)
* ap-south (au.icr.io)
* ap-north (jp.icr.io)



Other regions are unaffected because they already require IAM access policies for all accounts.

For more information, see [IAM access policies are required from 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_policy) and [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-user).





 23 June 2022 

Change to Container Registry private IP addresses in the following regions only: br-sao, ca-tor
: If you're using Cloud Identity and Access Management (IAM) restricted IP address lists and you're connecting to Container Registry over the private network in the br-sao and ca-tor regions, your lists of allowed IP addresses must now include the private subnet and IP addresses of your own hosts. The IBM Cloud Container Registry private IP addressees also changed. This change also affects you if you have allowlists or a firewall rule. Other regions are not affected yet.

For more information, see [Container Registry private IP addresses changed on 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_network) and [Using IAM IP address access restrictions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_iam_ip).





 20 April 2022 

Container Registry private IP addresses are changing from 23 June 2022
: By 23 June 2022, if you're using Cloud Identity and Access Management (IAM) restricted IP address lists and you're connecting to Container Registry over the private network, you must update your lists of allowed IP addresses to include the private subnet and IP addresses of your own hosts.
[Install IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli) and the [container registry CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-devtools-manuallyidt-install-container-registry-cli-plugin).
4. Create a [VPC and a subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-consolecreating-a-vpc-and-subnet) with a [public gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-create-public-gateways) and a [security group](https://cloud.ibm.com/vpc-ext/network/securityGroups) with rules that allow at least inbound IP connections on port 8443 and all outbound IP connections.
5. Create a [Log Analysis instance](https://cloud.ibm.com/catalog/services/logdna?callback=%2Fobserve%2Flogging%2Fcreate) on IBM Cloud. Make a note of the ingestion host and the ingestion key.
6. Install [Git](https://github.com/git-guides/install-git).







 Estimated time 

Completing this tutorial takes approximately 60 minutes.





 Steps 



 Step 1. Build the PayNow application container image 



1. Use Git to clone the [repo](https://github.com/ibm-hyper-protect/paynow-website).
2. Build the PayNow container image for the linux/s390x platform and tag the container image with the following command:

docker buildx build --platform linux/s390x -t us.icr.io/hpvs-sample/paynow-website .
3. Log in to the IBM Cloud Container Registry with the following commands:
Registry: Choose and set up an [image registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registry) so that developers can pull images from the registry in their app deployment YAML files. Your cluster comes with the following default configurations that your developers can use.



* Internal Red Hat OpenShift container registry: The [internal registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registryopenshift_internal_registry) is set up by default, with the images stored in an attached storage device. You can also choose to [pull an image from a private registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registryimagestream_registry) like IBM Cloud Container Registry into the image stream of the internal registry so that the image is available locally to all the projects in the cluster.
* Private registry: Your cluster is set up to pull images from [IBM Cloud Container Registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registryopenshift_iccr) in the default project only. To pull images from a private registry in other projects, [create an image pull secret](https://cloud.ibm.com/docs/openshift?topic=openshift-registryother) in the other projects or [import an image from your private registry into the internal registry image stream](https://cloud.ibm.com/docs/openshift?topic=openshift-registryimagestream_registry).



2. CI/CD:



* Review available [options for automating app deployment](https://cloud.ibm.com/docs/openshift?topic=openshift-cicd).
* Set up toolchains with [IBM® Continuous Delivery Pipeline for IBM Cloud®](https://cloud.ibm.com/docs/openshift?topic=openshift-cicdcontinuous-delivery-pipeline).









 Add storage
[Analyzing logs](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_logsregistry_logs)



* [Locations of platform services logs](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_logsregistry_logs_locations)
* [Where to look for IBM Log Analysis logs](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_logsregistry_logs_region)



[IAM and Activity Tracker actions by API method](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam)



* [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_reg)



* [Authorization API methods](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_reg_auth)
* [Image API methods](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_reg_images)
* [Message API methods](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_reg_messages)
* [Namespace API methods](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_reg_namespace)
* [Plan API methods](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_reg_plans)
* [Quota API methods](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_reg_quota)