vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Removing the Iter8 container](https://cloud.ibm.com/docs/codeengine?topic=codeengine-slovalidationtutcleanup-slovalidationtut)
* [Next steps for Iter8](https://cloud.ibm.com/docs/codeengine?topic=codeengine-slovalidationtutnextsteps-slovalidationtut)



[Securing your application with Guard](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started-with-guardgetting-started-with-guard)



* [Deploy a guard-learner application as a per-project service](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started-with-guardguard-learner)
* [Creating and deploying a protected Hello World application](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started-with-guardguard-deploy-app)
* [Finding the namespace and service URLs](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started-with-guardguard-get-parameters)
* [Exposing the Hello World application to the internet through Guard](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started-with-guardguard-expose-app)
* [Managing the security of the Hello World application and gaining situational awareness](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started-with-guardguard-situational-awareness)
* [Clean up the tutorial applications](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started-with-guardguard-cleanup)







 Pricing for Code Engine 

[Pricing for Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-pricingpricing)
However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Identification and Authentication (IA) [IA-2 (1) Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2.1) 
 System and Communications Protection (SC) [SC-7 (5) Boundary Protection | Deny by Default / Allow by Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) 







 Next steps 

If using the VPC reference architecture, see [Storage for VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-storage).

If using the Satellite reference architecture, see [Storage for Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-storage).
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest)



Most Relevant Controls:



Table 11. Related controls for data encryption

 Family Control 

 System and Communications Protection (SC) [SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-12 Cryptographic Key Establishment and Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12) <br>[SC-12 (2) Cryptographic Key Establishment and Management | Symmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.2) <br>[SC-12 (3) Cryptographic Key Establishment and Management | Asymmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.3) <br>[SC-13 Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-13) <br>[SC-28 Protection of Information At Rest](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28) <br>[SC-28 (1) Protection of Information at Rest | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28.1) 







 12.
5.2.5 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.6 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.7 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.8 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.9 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.3.2 IBM Cloud Kubernetes Service has a set of [default Calico and Kubernetes network policies defined](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies). 
 5.4.2 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 5.5.1 IBM Cloud Kubernetes Service can optionally [enable image security enforcement](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-image-sec).
* [3 Control plane configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-section-3-410)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-31-410)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-32-410)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-section-4-410)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-41-410)
* [4.2 Kubelet](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-42-410)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-section-5-410)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-51-410)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-52-410)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-53-410)
* [3 Control plane configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-section-3-46)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-31-46)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-32-46)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-section-4-46)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-41-46)
* [4.2 Kubelet](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-42-46)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-section-5-46)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-51-46)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-52-46)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-53-46)
* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-section-2-120)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-section-3-120)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-31-120)
* [3.2 Logging](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-32-120)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-section-4-120)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-41-120)
* [4.2 Kubelet](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-42-120)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-section-5-120)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-51-120)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-52-120)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-53-120)
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) IP Firewall only 
 Egress Rules ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg)
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) IP Firewall only 
 Egress Rules ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) 
 Ingress Rules ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/d4c3786f8c60e7b8960682eaca5d28a1d2d8a237/icons/checkmark-icon.svg) IP Firewall only 
 Egress Rules !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) IP firewall only 
 Public Network Protection !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) IP firewall only 
 Public Network Protection ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) !
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) 
 Ingress Rules ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) !
To set up custom network policies, you must [install the calicoctl CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiescli_install). 
 Support for IBM Cloud network firewalls Red Hat OpenShift on IBM Cloud is compatible with all [IBM Cloud firewall offerings](https://www.ibm.com/cloud/network-security). For example, you can set up a firewall with custom network policies to provide dedicated network security for your standard cluster and to detect and remediate network intrusion. For example, you might choose to set up a [Virtual Router Appliance](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-about-the-vra) to act as your firewall and block unwanted traffic. When you set up a firewall, [you must also open up the required ports and IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall) for each region so that the master and the worker nodes can communicate. 







 What else can I do to reduce the surface for external attacks for Classic clusters? 

The more apps or worker nodes that you expose publicly, the more steps you must take to prevent external malicious attacks. Review the following table to find options for how to keep apps and worker nodes private.



Private services and worker node options

 Security feature Description 

 Limit the number of exposed apps By default, your apps and services that run within the cluster are not reachable over the public internet. You can choose if you want to expose your apps to the public, or if you want your apps and services be reachable on the private network only. When you keep your apps and services private, you can leverage the built-in security features to assure secured communication between worker nodes and pods.
set security firewall name APP-TO-INSIDE default-action drop
set security firewall name APP-TO-INSIDE default-log

set security firewall name INSIDE-TO-APP default-action drop
set security firewall name INSIDE-TO-APP default-log
commit

If a set command is accidentally run twice, you receive a message 'Configuration path xxxxxxxx is not valid. Node exists'. This can be ignored. To change an incorrect parameter, it is necessary to first delete the node with 'delete security xxxxx xxxx xxxxx'.
2. Create the IBM Cloud private network resource group. This address group defines the IBM Cloud private networks that can access the enclosure and the networks that can be reached from the enclosure. Two sets of IP addresses need access to and from the secure enclosure. These IP addresses are the SSL VPN data centers and the IBM Cloud Service Network (backend/private network). [IBM Cloud IP Ranges](https://cloud.ibm.com/docs/hardware-firewall-dedicated?topic=hardware-firewall-dedicated-ibm-cloud-ip-ranges) provides the full list of IP ranges that are allowed.



* Define the SSL VPN address of the data center(s) you are using for VPN access. From the 'SSL VPN datacenters' section of IBM Cloud IP ranges, select the VPN access points for your data center or DC cluster. This example shows the VPN address ranges for the IBM Cloud London data centers.

set resources group address-group ibmprivate address 10.2.220.0/24
set resources group address-group ibmprivate address 10.200.196.0/24
set resources group address-group ibmprivate address 10.3.200.0/24
* Define the address ranges for the IBM Cloud 'Service Network (on backend/private network)' for DAL10, WDC04, and your target data center. The example here is DAL10, WDC04 (two addresses), and LON06.

set resources group address-group ibmprivate address 10.200.80.0/20
The following example creates a network zone to allow a single public IP address to access. You can also use this example in conjunction with the [one IP example rule](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrone-ip). For more information about this scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).

ibmcloud cbr zone-create --addresses 129.41.86.7 --description "Allow only client IP" --name allow-client-ip







 Creating network zones from the console 



1. Determine the resources that you want add to your allowlist.
2. Follow the steps to [create context-based restrictions in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create). Add the Kubernetes service to your network zones to allow Red Hat OpenShift on IBM Cloud to access services and resources in your account.









 Creating rules 

Define rules to protect access to resources in your account. The contexts that you define in your rules determine how the resources in your network zones (allowlists) can interact with the resources defined in the rule.

Review the [limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcbr-limitations) before you create rules.



 Creating rules by using the API 

Review the following example requests to create rules. For more information about the v1/rules API, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

After you create a rule, it might take up to 10 minutes to before you can update that rule due to IAM TTL response caching.

The following example payload creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID zone can access the cluster. Since no operations are specified, resources in the NETWORK-ZONE-ID zone can access both the cluster and management APIs.

{
* [Running calicoctl commands from behind an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-firewall_calicoctl)
* [Allowing access to the Red Hat OpenShift image registry in an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallopenshift-registry)



* [Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-allowlist_workers)



* [Allowing ingress from a cluster to another service](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-allowlist_workers_ingress)
* [Allowing egress to a cluster from another service](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-allowlist_workers_egress)



* [Updating IAM allowlists for Kubernetes Service IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewalliam_allowlist_vpc)









 Managing security and compliance with Red Hat OpenShift 

[Managing security and compliance with Red Hat OpenShift](https://cloud.ibm.com/docs/openshift?topic=openshift-manage-security-compliancemanage-security-compliance)



* [Monitoring security and compliance posture with Red Hat OpenShift](https://cloud.ibm.com/docs/openshift?topic=openshift-manage-security-compliancemonitor-clusters)



* [Available goals for Red Hat OpenShift](https://cloud.ibm.com/docs/openshift?topic=openshift-manage-security-complianceclusters-available-goals)









 Using the compliance operator