vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you want to specify a bucket name for the auto created bucket, set ibm.io/auto-create-bucket: true and ibm.io/auto-delete-bucket: false and ibm.io/bucket: "<bucket_name>". 
 can't access bucket <bucket_name>: NotFound: Not Found You tried to access a bucket that you did not create, or the storage class and s3fs API endpoint that you specified don't match the storage class and s3fs API endpoint that were used when the bucket was created. See [can't access an existing bucket](https://cloud.ibm.com/docs/containers?topic=containers-cos_access_bucket_fails). 
 Put https://s3-api.dal-us-geo.objectstorage.service.networklayer.com/<bucket_name>: net/http: invalid header field value "AWS4-HMAC-SHA256 Credential=1234a12a123a123a1a123aa1a123a123 n/20190412/us-standard/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=12aa1abc123456aabb12aas12aa123456sb123456abc" for key Authorization The values in your Kubernetes secret are not correctly encoded to base64. Review the values in your Kubernetes secret and encode every value to base64. You can also use the [kubectl create secret](https://cloud.ibm.com/docs/containers?topic=containers-storage-cos-understandcreate_cos_secret) command to create a new secret and let Kubernetes automatically encode your values to base64. 
 can't access bucket <bucket_name>: Forbidden: Forbidden You specified ibm.io/auto-create-bucket: false and tried to access a bucket that you did not create, the secret access key or access key ID of your IBM Cloud Object Storage HMAC credentials are incorrect, or the regional endpoint of the bucket has changed. You can't access a bucket that you did not create.
oc get secret

Example output

NAME TYPE DATA AGE
cos-write-access ibm/ibmc-s3fs 2 7d19h
default-au-icr-io kubernetes.io/dockerconfigjson 1 55d
default-de-icr-io kubernetes.io/dockerconfigjson 1 55d
...
6. [Install the IBM Cloud Object Storage plug-in](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_cos_install), or if you already installed the plug-in, [decide on the configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_cos_installconfigure_cos) for your IBM Cloud Object Storage bucket.
7. Optional: [Add your secret to the default storage classes](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_cos_install).







 Limitations 



* IBM Cloud Object Storage is based on the s3fs-fuse file system. You can review a list of limitations in the [s3fs-fuse repository](https://github.com/s3fs-fuse/s3fs-fuselimitations).
* To access a file in IBM Cloud Object Storage with a non-root user, you must set the runAsUser and fsGroup values in your deployment to the same value.
[Install the IBM Cloud Object Storage plug-in](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_install), or if you already installed the plug-in, [decide on the configuration](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_installconfigure_cos) for your IBM Cloud Object Storage bucket.
7. Optional: [Add your secret to the default storage classes](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_install).







 Limitations 



* IBM Cloud Object Storage is based on the s3fs-fuse file system. You can review a list of limitations in the [s3fs-fuse repository](https://github.com/s3fs-fuse/s3fs-fuselimitations).
* To access a file in IBM Cloud Object Storage with a non-root user, you must set the runAsUser and fsGroup values in your deployment to the same value.
For example, if you specify the starting URL of https://www.example.com and a path depth of 4, then the crawler will access the page https://www.example.com/some/more/examples/index.html, which is located at a path that is four levels away from the root URL.

You can enter a positive value only. If unspecified, the default value is 5. The maximum path depth allowed is 20.

Maximum hops
: The number of consecutive links to follow from the start URL.

If unspecified, the default value is 5. The maximum number of links that the crawler can follow is 20. To not allow any hops, enter 0.

Ignore robots.txt
: Enable this setting if you want the crawler to ignore the allow and deny rules that are outlined by the website in its robots.txt file.

Keep in mind that sites typically use the file to improve crawl results. For example, they might use the robots.txt file to prevent duplicate information from being crawled, to prevent draft content from being read, or to delay crawling so as not to overload their site.

Rules to crawl domain
: Specify the domain names that you want to either allow or forbid the crawler to crawl.

Domain names are case sensitive and the wildcard character (*) can occur anywhere in the domain name.

The order of the rules is significant. The crawler applies the first rule that matches a candidate URL. The default rule, forbid domain *, forbids all Web crawling and must occur last in the list of domain rules.

You can define the following types of rules, for example:



* To exclude the entire ibm.com domain:

forbid domain www.ibm.com
* To crawl any domain that ends with ibm.com:

allow domain .ibm.com
* To crawl only port 443 on IBM domains that begin with server:

allow domain server.ibm.com:443



Rules to crawl URL prefixes
: Specify the HTTP and HTTPS prefixes that you want to either allow or forbid the crawler to crawl.

The wildcard character (*) can occur one or more times in the URL.
* Agent extends the benefits of using [Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-learn-about-schematics) in conjunction with [IBM Cloud Satellite®](https://cloud.ibm.com/docs/satellite?topic=satellite-getting-started): To provision and configure hybrid cloud resources, including private cloud resources, private data-center resources, and other public cloud resources.
* Agent extends the benefits of Schematics to securely manage hybrid cloud infrastructure by using [Terraform](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-about), [Ansible](https://cloud.ibm.com/docs/schematics?topic=schematics-getting-started-ansible), and other automation tools: To perform deployment, configuration, and day-2 operations in a consistent manner – using a single pane of glass.
* While your Schematics jobs are waiting in a shared queue for multiple tenants: the corresponding jobs that run on the agents will not wait in any queue, and starts sooner. In other words, the workload from other tenants do not affect your performance and response time.
* If your automation needs special software or versions, and require more capacity (CPU, memory) to run: The multi-tenanted Schematics service will not be able to handle it. Agents can be deployed and configured to use dedicated infrastructure to run your automation that can be scaled up or down depending on the capacity needs. In addition, Agent images can be extended to include or use your own automation software and versions in conjunction with automation engine provided by the Schematics runtime.
* The multi-tenanted Schematics service uses network access policies: that cater to all its tenants, hence cannot be tuned to a single tenant requirements. Agents enables you to implement fine gained control over your network access policies to access your private network resources.
SC-7 (8) - Route Traffic to Authenticated Proxy Servers 



  Control requirements 

SC-7 (8) - 0
:   The information system routes [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.





  NIST supplemental guidance 

External networks are networks outside of organizational control. A proxy server is a server (i.e., information system or application) that acts as an intermediary for clients requesting information system resources (e.g., files, connections, web pages, or services) from other organizational servers. Client requests established through an initial connection to the proxy server are evaluated to manage complexity and to provide additional protection by limiting direct connectivity. Web content filtering devices are one of the most common proxy servers providing access to the Internet. Proxy servers support logging individual Transmission Control Protocol (TCP) sessions and blocking specific Uniform Resource Locators (URLs), domain names, and Internet Protocol (IP) addresses. Web proxies can be configured with organization-defined lists of authorized and unauthorized websites.
* Instance ID that indicates the Cloud Object Storage instance where the bucket is provisioned.







 Predefined views to monitor archiving of an instance 

Use these views to monitor the archiving of Activity Tracker hosted event search instances.

To use these views, you must customize them with data from your account.

The following table outlines the predefined views that you can use to monitor 1 bucket:



Table 2. Bucket monitoring predefined views

 View name Description 

 Client errors (4XX) Reports unauthorized attempts to access your archives, and other types of bad requests for 1 bucket. Shows any requests that have a response reason code (RC) value of 4XX. 
 Server errors (5XX) Reports server errors for 1 bucket. Shows any requests that have a response reason code (RC) value of 5XX. 
 Unauthorized access Reports unauthorized attempts to access your archives and manage 1 bucket. Checks reason codes 403 and 401. 
 Partial content Reports errors uploading an object in multiple parts into 1 bucket so you can find out when data is not complete. 



To use these views, you must customize them by entering the bucket name.

The following table outlines the predefined views that you can use to monitor when archiving is enabled or disabled in an instance, and when data is archived or the bucket deleted:



Table 3. Archiving enablement predefined views

 View name Description 

 Enable archiving Reports when archiving is enabled for 1 instance. 
 Disable archiving Reports when archiving is disabled for 1 instance. 
 Hourly archiving Reports every time an object (file) is uploaded to the bucket that is configured for archiving for the instance that you are monitoring. 
 Bucket delete Reports when the bucket configured to collect data for 1 instance is deleted. 
 Archive failures Reports unsuccessful requests uploading objects to a bucket. Reports all reason codes except 200. 



To use these views, you must customize them by entering the Activity Tracker hosted event search instance CRN, the bucket name, and the service ID that is used to authenticate and work with the bucket.

The information on these views include the following information for each record:



* Action that you can use to identify the type of request.
* Region where the bucket is located.
The base search distinguished name specifies the subtree in which you want the crawl to be constrained.

DN is a distinguished name that is defined by a series of relative distinguished names separated by commas. Each relative distinguished name consists of an attribute name-and-value pair that represents an object in a directory.

For example, in Active Directory, attributes can include a common name (CN) such as Jane Doe and an organizational unit (OU) such as Research. Most distinguished names include one or more domain component (DC) attributes, which define the namespace where the LDAP directory is hosted.

Here's an example of a distinguished name for Jane:

CN=Jane Doe,OU=Research,DC=IBM,DC=COM

LDAP user filter
: A filter to apply to the search to use to find LDAP entries that you want to crawl.

If unspecified, a default value is applied that is considered the best filter for the server type that you selected. You can edit the predefined filter value.



* Expand the Advanced configuration section to list specific attributes to include or exclude from the search.

For example, you might need to know the country in which an employee works, so you want to include a c attribute that stores the ISO country code. Or maybe you never want to return an employee's serial number, so you exclude the serialnumber attribute.
* Specify the search scope. You can choose to crawl records that are one level from the search base DN or to crawl the entire subtree that is associated with the search base DN.
* If the LDAP directory data source has binary attributes, you can enable the Allow binary attributes option.

When enabled, the crawler creates a separate document for each binary attribute that is specified. The document also contains any other non-binary LDAP attribute values.

For more information about the binary option, see [RTF 4522](https://datatracker.ietf.org/doc/html/rfc4522).

In the Binary attributes field, specify the names of the binary attributes that you want to index.



9. If you want the crawler to extract text from images on the site, expand More processing settings, and set Apply optical character recognition (OCR) to On.
Global load balancers <br><br> * 3 pools<br> * 3 origin servers<br> * 5 Health checks<br> * 60s health checks<br> * Geo Routing<br> * Health checks from single region<br> * 60s minimum TTL for non-proxied global load balancers<br><br><br> <br><br> * 20 pools <br> (additional pools available for charge)<br> * 20 origin servers<br> * 100 health checks<br> * 5s health checks<br> * Smart Routing<br> * Health checks from multiple regions<br> * 10s minimum TTL for non-proxied global load balancers<br><br><br> <br><br> * 20 pools <br> (additional pools available for charge)<br> * 20 origin servers<br> * 100 health checks<br> * 5s health checks<br> * Smart Routing<br> * Health checks from multiple regions<br> * 10s minimum TTL for non-proxied global load balancers<br><br><br> <br><br> * 20 pools <br> (additional pools available for charge)<br> * 20 origin servers<br> * 100 health checks<br> * 5s health checks<br> * Smart Routing<br> * Health checks from multiple regions<br> * 10s minimum TTL for non-proxied global load balancers<br><br><br> <br><br> * Up to 100 pools<br> * 100 origin servers<br> * Up to 100 health checks<br> * 5s health checks<br> * Smart Routing<br> * Health checks from multiple regions<br> * 10s minimum TTL for non-proxied global load balancers<br><br><br> 
 WAF OWASP and Default CIS rule set OWASP and Default CIS rule set OWASP and Advanced CIS rule set OWASP and Premier CIS rule set OWASP and Default CIS rule set
Check whether DevSecOps Toolchain signs build artifacts to attest their provenance CM-3(2)(0), SA-10(1)(0), SA-10(b), SA-10(c), SA-15(a), SA-3(a), SA-3(d), SA-8(0), SI-2(2)(0), SI-2(a), SI-2(d), and SI-7(0) Rule was added 
 Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely CM-3(2)(0), CM-4(0), CM-4(1)(0), CM-6(1)(0), CM-6(a), CM-6(b), CM-6(c), CM-6(d), CM-7(1)(a), CM-7(b), RA-5(1)(0), RA-5(2)(0), RA-5(3)(0), RA-5(a), RA-5(b), RA-5(c), RA-5(d), SA-10(e), SA-15(a), SA-3(a), SA-3(d), SA-8(0), SI-2(2)(0), SI-2(a), SI-2(b), SI-2(c) and SI-2(d) Rule was added 
 Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies CM-3(2)(0), CM-4(0), CM-5(0), CM-9(a), CM-9(d), SA-10(b), SA-10(e), SA-15(a), SA-3(a), SA-3(d), SA-8(0), SI-2(2)(0), SI-2(a), SI-2(b), SI-2(d), and SI-7(0) Rule was added
https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_waf_rule)<br> * [ibm_cis_webhook](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_webhook)<br><br><br> <br><br> * [ibm_cis](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis)<br> * [ibm_cis_alerts](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_alerts)<br> * [ibm_cis_auth_origin](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_auth_origin)<br> * [ibm_cis_cache_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_cache_settings)<br> * [ibm_cis_certificates](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_certificates)<br> * [ibm_cis_custom_certificates](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_custom_certificates)<br
> * [ibm_cis_page_rules](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_page_rules)<br> * [ibm_cis_range_apps](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_range_apps)<br> * [ibm_cis_rate_limit](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_rate_limit)<br> * [ibm_cis_waf_groups](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_waf_groups)<br> * [ibm_cis_waf_packages](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_waf_packages)<br> * [ibm_cis_waf_rules](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_waf_rules)<br> * [ibm_cis_webhooks](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_webhooks)<br><br><br> 







 Key Management Service 



 Resources Data sources
5.2.5 Minimize the admission of containers with allowPrivilegeEscalation Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.2.6 Minimize the admission of root containers Not Scored 2 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.2.7 Minimize the admission of containers with the NET_RAW capability Not Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.2.8 Minimize the admission of containers with added capabilities Not Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.2.9 Minimize the admission of containers with capabilities assigned Not Scored 2 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 







 5.3 Network policies and CNI 



Section 5.3 Network policies and CNI benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.3.1 Ensure that the CNI in use supports Network Policies Not Scored 1 Pass IBM 
 5.3.2 Ensure that all Namespaces have Network Policies defined Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.4.1 Prefer using secrets as files over secrets as environment variables Not Scored 1 Pass Shared
5.2.5 Minimize the admission of containers with allowPrivilegeEscalation Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.2.6 Minimize the admission of root containers Not Scored 2 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.2.7 Minimize the admission of containers with the NET_RAW capability Not Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.2.8 Minimize the admission of containers with added capabilities Not Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.2.9 Minimize the admission of containers with capabilities assigned Not Scored 2 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 







 5.3 Network policies and CNI 



Section 5.3 Network policies and CNI benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.3.1 Ensure that the CNI in use supports Network Policies Not Scored 1 Pass IBM 
 5.3.2 Ensure that all Namespaces have Network Policies defined Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.4.1 Prefer using secrets as files over secrets as environment variables Not Scored 1 Pass Shared
Build custom crawlers ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Use App Connect to crawl other external data sources ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Apply answer finding to search queries ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Optical Character Recognition v2 ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Patterns enrichment ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 App switcher menu where you can get service instance information and usage statistics ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Import and apply UIMA text analysis models created in Watson Explorer Content Analytics Studio ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Monitor usage with activity tracker events ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Monitor usage of the Analyze API from the product user interface ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg)
: PodSecurity (Optional in Kubernetes version 1.24, enabled in version 1.25 and later)
: PodSecurityPolicy (Kubernetes version 1.24 and earlier)
: NodeRestriction
: TaintNodesByCondition
: CertificateApproval
: CertificateSigning



* CertificateSubjectRestriction
* DefaultIngressClass
* RuntimeClass
* DenyServiceExternalIPs



Feature gates
: See [Feature gates](https://cloud.ibm.com/docs/containers?topic=containers-service-settingsfeature-gates)

TLS cipher support
: TLS version =< 1.2 (Kubernetes version 1.19 and earlier):



* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256



: TLS version 1.3 (Kubernetes version 1.19 and later):



* TLS_AES_128_GCM_SHA256
* TLS_CHACHA20_POLY1305_SHA256
* TLS_AES_256_GCM_SHA384







 kube-controller-manager 

Review the default settings for the kube-controller-manager master component in IBM Cloud Kubernetes Service.

Feature gates
: See [Feature gates](https://cloud.ibm.com/docs/containers?topic=containers-service-settingsfeature-gates)

Pod garbage collection threshold
: terminated-pod-gc-threshold=12500