vania-janet/multiturn-rag-retrieval-data huggingface dataset:
5.2.3 Minimize the admission of containers wanting to share the host IPC namespace Automated 1 Not checked 
 5.2.4 Minimize the admission of containers wanting to share the host network namespace Automated 1 Not checked 
 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation. Automated 1 Not checked 
 5.2.6 Minimize the admission of root containers Manual 2 Not checked 
 5.2.7 Minimize the admission of containers with the NET_RAW capability Manual 1 Not checked 
 5.2.8 Minimize the admission of containers with added capabilities Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 5.2.9 Minimize the admission of containers with capabilities assigned Manual 2 Not checked 







 5.3 Network policies and CNI 



Section 5.3 Network policies and CNI benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.3.1 Ensure that the CNI in use supports network policies. Manual 1 Pass 
 5.3.2 Ensure that all namespaces define network policies. Automated 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.4.1 Prefer using secrets as files over secrets as environment variables. Manual 1 Not checked 
 5.4.2 Consider external secret storage. Manual 2 Not checked 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.5.1 Configure image provenance by using image controller configuration parameters. Manual 2 Not checked 







 5.7 General policies 



Section 5.7 General policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.7.1 Create administrative boundaries between resources by using namespaces. Manual 1 Not checked
5.2.4 Minimize the admission of containers wanting to share the host network namespace. Automated 1 Not checked 
 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation. Automated 1 Not checked 
 5.2.6 Minimize the admission of root containers. Manual 2 Not checked 
 5.2.7 Minimize the admission of containers with the NET_RAW capability. Manual 1 Not checked 
 5.2.8 Minimize the admission of containers with added capabilities. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 
 5.2.9 Minimize the admission of containers with capabilities assigned. Manual 2 Not checked 







 5.3 Network policies and CNI 



Section 5.3 Network policies and CNI benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.3.1 Ensure that the CNI in use supports network policies. Manual 1 Pass 
 5.3.2 Ensure that all namespaces have network policies defined. Automated 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations) 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.4.1 Prefer to use secrets as files over secrets as environment variables. Manual 1 Not checked 
 5.4.2 Consider external secret storage. Manual 2 Not checked 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.5.1 Configure image provenance by using image controller configuration parameters. Manual 2 Not checked 







 5.7 General policies 



Section 5.7 General policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.7.1 Create administrative boundaries between resources by using namespaces. Manual 1 Not checked
5.2.4 Minimize the admission of containers wanting to share the host network namespace. Automated 1 Not checked 
 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation. Automated 1 Not checked 
 5.2.6 Minimize the admission of root containers. Manual 2 Not checked 
 5.2.7 Minimize the admission of containers with the NET_RAW capability. Manual 1 Not checked 
 5.2.8 Minimize the admission of containers with added capabilities. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 5.2.9 Minimize the admission of containers with capabilities assigned. Manual 2 Not checked 







 5.3 Network policies and CNI 



Section 5.3 Network policies and CNI benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.3.1 Ensure that the CNI in use supports network policies. Manual 1 Pass 
 5.3.2 Ensure that all namespaces have network policies defined. Automated 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.4.1 Prefer to use secrets as files over secrets as environment variables. Manual 1 Not checked 
 5.4.2 Consider external secret storage. Manual 2 Not checked 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.5.1 Configure image provenance by using image controller configuration parameters. Manual 2 Not checked 







 5.7 General policies 



Section 5.7 General policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.7.1 Create administrative boundaries between resources by using namespaces. Manual 1 Not checked
* [Mounting the secret as a volume to your pod](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingmount_secret)
* [Referencing the secret in environment variables](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingreference_secret)



* [Removing a service from a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingunbind-service)







 Understanding high availability and disaster recovery 

[Understanding high availability and disaster recovery](https://cloud.ibm.com/docs/openshift?topic=openshift-haha)



* [About high availability](https://cloud.ibm.com/docs/openshift?topic=openshift-haha-about)
* [Overview of potential points of failure in Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-hafault_domains)







 Understanding remote health monitoring 

[Understanding remote health monitoring](https://cloud.ibm.com/docs/openshift?topic=openshift-remote-health-monitoring-opt-outremote-health-monitoring-opt-out)



* [Understanding the impacts of opting out](https://cloud.ibm.com/docs/openshift?topic=openshift-remote-health-monitoring-opt-outremote-health-impacts)
* [Opting out of remote health reporting](https://cloud.ibm.com/docs/openshift?topic=openshift-remote-health-monitoring-opt-outremote-health-opt-out)







 API reference 

[IBM Cloud Kubernetes Service API](https://containers.cloud.ibm.com/global/swagger-global-api//)

[IBM Cloud Kubernetes Service API JSON](https://containers.cloud.ibm.com/global/swagger-global-api/swagger.json)
For more information, [Deploying the Secure Build Server as a Hyper Protect Virtual Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-imagebuilddeploysecurebuild), and [Tutorial: Using Secure Build Server with a digital wallet](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_server).





 16 December 2022 

Updated: Secure Build Server version
: The Secure Build Server image is updated to 1.3.0.8. Ensure that you update to the latest Secure Build CLI code and also use the latest secure_build.asc file. Also, you can specify ISV secrets when you are building your applications securely. For more information, [Deploying the Secure Build Server as a Hyper Protect Virtual Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-imagebuilddeploysecurebuild), and [Tutorial: Using Secure Build Server with a digital wallet](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_server).

Updated: Red Hat simple signing of images
: Use Red Hat simple signing when using the IBM Cloud Container Registry (ICR) because there is no support for images that are signed by using Docker Content trust. For more information about using Red Hat signing, see [Using your own image](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-byoi), and [Deploying the Secure Build Server as a Hyper Protect Virtual Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-imagebuilddeploysecurebuild).

Updated: SUSE registry support
: You can pull images from the SUSE registry when you deploy a SUSE Linux Enterprise (SLE) base container image, or building your applications securely based on one.





 30 September 2022
5.2 Pod Security Policies 



Section 5.2 Pod Security Policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.2.1 Minimize the admission of privileged containers. Manual 1 Not checked 
 5.2.2 Minimize the admission of containers wanting to share the host process ID namespace. Automated 1 Not checked 
 5.2.3 Minimize the admission of containers wanting to share the host IPC namespace. Automated 1 Not checked 
 5.2.4 Minimize the admission of containers wanting to share the host network namespace. Automated 1 Not checked 
 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation. Automated 1 Not checked 
 5.2.6 Minimize the admission of root containers. Manual 2 Not checked 
 5.2.7 Minimize the admission of containers with the NET_RAW capability. Manual 1 Not checked 
 5.2.8 Minimize the admission of containers with added capabilities. Manual 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 
 5.2.9 Minimize the admission of containers with capabilities assigned. Manual 2 Not checked 







 5.3 Network policies and CNI 



Section 5.3 Network policies and CNI benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.3.1 Ensure that the CNI in use supports network policies. Manual 1 Pass 
 5.3.2 Ensure that all namespaces have network policies defined. Automated 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.4.1 Prefer to use secrets as files over secrets as environment variables. Manual 1 Not checked 
 5.4.2 Consider external secret storage. Manual 2 Not checked 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results
After you determine a TTL or validity period for leaf certificates, you set the value by using a [certificate template](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificate-templates) so that your preferred TTL is applied each time a new leaf certificate is generated.

The shorter the TTL of your leaf certificates, the more protected you are against inadvertent exposure or compromise of your certificate and its private key. A shorter validity period for your certificates means that you reduce the likelihood of compromise, but it also requires that you rotate the certificate more frequently to ensure that it stays valid. To avoid an inadvertent outage, you can schedule [automatic rotation](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-automatic-rotation) of your private certificates.
2. Choose a validity period for the subordinate CA.

As a best practice, set a validity period for a subordinate CA certificate that is significantly longer than the validity periods of the certificates that they issue. Define a validity period of a parent CA that is two to five times the period of any child CA certificate or leaf certificate that it issues. For example, if you have a [two-level CA hierarchy](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-create-certificatestwo-level-ca) and you want to issue leaf certificates with a TTL of one year, configure the subordinate issuing CA with a TTL of three years. You can always update subordinate CA certificates without replacing the root CA certificate.
3. Choose a validity period for your root CA.

When you update a root CA certificate, the change impacts your entire public-key infrastructure. To minimize impact, it is recommended that you set a long validity period for your root CA certificate. In Secrets Manager, the default TTL for root certificates is 10 years.







 Choosing an algorithm for generating keys 

Before you create a certificate authority in Secrets Manager, you must choose a key algorithm for generating the public and private keys for your CA. The public and private key-pair is used to authenticate an SSL/TLS connection.
* The name of the Portworx block storage class has changed from portworx-shared-gp3 to portworx-db-gp3-sc.
* The createSecret property has been removed for the MinIO and PostgreSQl datastores. The property is only used internally. The Speech services always use a secrets object if you create one, and they always automatically create the object if none is provided.



User-provided secrets object now supported for RabbitMQ datastore
: You can now provide security credentials for the RabbitMQ datastore, just as you can for the MinIO and PostgreSQL datastores. The documented process is similar for all three datastores.

Defect fix: Multiple consecutive SSML <phoneme> tags are now parsed correctly
: Defect fix: The service now correctly synthesizes text that contains consecutive <phoneme> tags. Previously, if the text contained two or more consecutive <phoneme> tags, the service synthesized only the first tag, ignoring the others.

Security vulnerabilities addressed
: No security vulnerabilities were fixed for version 4.5.0.





 25 May 2022 (Version 4.0.9) 

Version 4.0.9 is now available
: Text to Speech for IBM Cloud Pak for Data version 4.0.9 is now available. This version supports IBM Cloud Pak for Data version 4.x and Red Hat OpenShift versions 4.6 and 4.8. For more information about installing and managing the service, see [Installing Watson Text to Speech](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=speech-installing-watson-text).

New support for audio/alaw audio format
: The list of supported audio formats now includes audio/alaw;rate={rate}. Like audio/basic and audio/mulaw, this format provides single-channel audio that is encoded by using 8-bit u-law (or mu-law) data that is sampled at 8 kHz.
"expiration_date": "2020-12-31T23:59:59Z",
"id": "2ca56a3b-a6e8-d2e2-5377-b6559babfac0",
"labels": [
"label-1",
"label-2"
],
"last_update_date": "2020-10-05T21:47:27Z",
"name": "my-test-arbitrary-secret",
"secret_data": {
"payload": "this is my secret data"
},
"secret_type": "ARBITRARY",
"state": 1,
"state_description": "Active",
"versions": [
{
"created_by": "iam-ServiceId-b7ebcf90-c7a9-495b-8ce8-bbf33cb95ca0",
"creation_date": "2020-10-05T21:47:27Z",
"id": "88473a6c-4877-5079-f999-c9a39e3407ea"
}
]
},
"warnings": null
}

The command to import an imported_cert secret returns the following output:

{
"request_id": "7b41ad30-8098-9f57-62cf-bd757d43238f",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"algorithm": "RSA",
"common_name": "example.com",
"created_by": "iam-ServiceId-b7ebcf90-c7a9-495b-8ce8-bbf33cb95ca0",
"creation_date": "2021-06-03T22:41:56Z",
<br><br> * Deploy PowerVS instances for SAP NetWeaver workload<br> * Prepare operating system for SAP NetWeaver workload<br><br><br> PowerVS instance <br><br> * Allow customer to specify number of instances that must be deployed and CPU and memory for every instance<br> * Attach all required storage filesystems<br> * Attach networks for management, backup and for SAP system internal communication<br> * Connect instance with infrastructure management services like DNS, NTP, NFS<br> * Perform OS configuration for SAP NetWeaver<br><br><br> Allow customer to specify additional parameters, like non-standard file system sizes 
 <br><br> * Deploy PowerVS instance for hosting shared SAP system files<br> * Prepare operating system<br><br><br> PowerVS instance Host shared SAP system files on one of PowerVS instances for SAP NetWeaver and do not deploy a separate PowerVS instance <br><br> * Allow customer to deploy PowerVS instance with specified CPU and memory<br> * Attach specified storage filesystems<br> * Attach networks for management, backup and for SAP system internal communication<br> * Connect instance with infrastructure management services like DNS, NTP, NFS<br> * Perform OS configuration<br> * Allow customer to specify additional parameters, like non-standard file system sizes<br><br><br> 







 Key and password management architecture decisions 



Table 3. Key and passwords management architecture decisions

 Requirement Component Choice Alternative choice 

 <br><br> * Use public/private SSH key to access virtual server instances by using SSH<br> * Use SSH proxy to log in to all virtual server instances by using the bastion host<br> * Do not store private SSH keys on any virtual instances or on the bastion host<br> * Do not allow any other SSH login methods except the one with specified private and public SSH key pairs<br><br><br> Public SSH key - provided by customer. Private SSH key - provided by customer. Ask customer to specify the keys. Accept the input as secure parameter or as reference to the key stored in IBM Cloud Secure Storage Manager. Do not print SSH keys in any log files.
Manual 2 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 







 3 Control plane configuration 



 3.1 Authentication and authorization 



Section 3.1 Authentication and Authorization benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.1.1 Do not use client certificate authentication for users. Manual 2 Pass 







 3.2 Logging 



Section 3.3 Logging benchmark results

 Section Recommendation Manual/Automated Level Result 

 3.2.1 Ensure that a minimal audit policy is created. Automated 1 Pass 
 3.2.2 Ensure that the audit policy covers key security concerns. Manual 2 Pass 









 4 Worker Nodes 

Follow the instruction in [Using the compliance operator](https://cloud.ibm.com/docs/openshift?topic=openshift-compliance-operator) to perform automated check for worker node configuration.





 5 Policies 



 5.1 RBAC and service accounts 



Section 5.1 RBAC and Service Accounts benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.1.1 Ensure that the cluster-admin role is used only where required. Manual 1 Pass 
 5.1.2 Minimize access to secrets. Manual 1 Not checked 
 5.1.3 Minimize wildcard use in roles and ClusterRoles. Manual 1 Not checked 
 5.1.4 Minimize access to create pods. Manual 1 Not checked 
 5.1.5 Ensure that default service accounts are not actively used. Automated 1 Not checked 
 5.1.6 Ensure that Service Account Tokens are mounted only where necessary. Manual 1 Not checked 







 5.2 Pod Security Policies 



Section 5.2 Pod Security Policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.2.1 Minimize the admission of privileged containers. Manual 1 Not checked 
 5.2.2 Minimize the admission of containers wanting to share the host process ID namespace. Automated 1 Not checked 
 5.2.3 Minimize the admission of containers wanting to share the host IPC namespace. Automated 1 Not checked
"downloaded" : true,
"serial_number" : "d9:be:fe:35:ba:09:42:b5",
"expiration_date" : "2022-03-24T05:06:15Z",
"version_custom_metadata" : {
"custom_version_key" : "custom_version_value"
},
"validity" : {
"not_after" : "2022-03-24T05:06:15Z",
"not_before" : "2022-03-07T13:05:46Z"
}
}, {
"created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
"creation_date" : "2022-03-07T13:06:15Z",
"id" : "a89a962a-a518-11ec-b909-0242ac120003",
"state" : 1,
"state_description" : "Active",
"payload_available" : true,
"downloaded" : true,
"serial_number" : "d9:be:fe:35:ba:09:42:b5",
"expiration_date" : "2022-03-24T05:06:15Z",
"version_custom_metadata" : {
"custom_version_key" : "custom_version_value"
},
"validity" : {
"not_after" : "2022-03-24T05:06:15Z",
"not_before" : "2022-03-07T13:05:46Z"
}
} ],
"locks_total" : 1,
"custom_metadata" : {
"custom_key" : "custom_value"
}
} ]
}







 ibmcloud secrets-manager secret-version-metadata
* Use IBM Cloud Schematics to securely manage and share the Terraform state.
* Use the Continuous Delivery secrets references when you specify secrets within the ibm_cd_toolchain_tool, ibm_cd_tekton_pipeline_property, or ibm_cd_tekton_pipeline_trigger_property resources.



If you are using the Terraform command-line tool, use the following practices to limit the exposure of sensitive data:



* Use Terraform variables to inject values into Terraform blocks.
* Allow the Terraform command-line tool to prompt for values when you run commands such as terraform plan or terraform apply.
* Control access to your Terraform state since it might contain secrets. Local Terraform state is written in plain text.
* Use the Continuous Delivery secrets references when you specify secrets within the ibm_cd_toolchain_tool, ibm_cd_tekton_pipeline_property, or ibm_cd_tekton_pipeline_trigger_property resources.



To limit the exposure of sensitive data, avoid the following practices:



* Writing secrets in plain text inside any Terraform blocks, such as resource blocks, data blocks, or provider blocks.
* Writing secrets in plain text within the terraform.tfvars, terraform.tfvars.json, .auto.tfvars, or .auto.tfvars.json files.
* Delivering the terraform.tfvars, terraform.tfvars.json, .auto.tfvars, or .auto.tfvars.json files that contain secrets to source code repos.
* Delivering your Terraform state into source code repos.



Use IBM Cloud Schematics instead of the Terraform command-line tool to process your Terraform configurations. IBM Cloud Schematics offers several advantages such as secure storage of sensitive configuration properties.

For more information about IBM Cloud Schematics, see the [IBM Cloud Schematics documentation](https://cloud.ibm.com/docs/schematics).

For more information about sensitive data in Terraform state, see [Sensitive Data in State](https://developer.hashicorp.com/terraform/language/state/sensitive-data).
* [Setting up TLS secrets for the IBM-provided Ingress subdomain](https://cloud.ibm.com/docs/containers?topic=containers-secretstls-default)
* [Setting up TLS secrets for custom subdomains](https://cloud.ibm.com/docs/containers?topic=containers-secretstls-custom)



* [Managing non-TLS secrets](https://cloud.ibm.com/docs/containers?topic=containers-secretsnon-tls)



* [Creating a non-TLS secret in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-secretsnon-tls-create)
* [Managing non-TLS secret fields](https://cloud.ibm.com/docs/containers?topic=containers-secretsnon-tls-field)



* [Secrets FAQ](https://cloud.ibm.com/docs/containers?topic=containers-secretssecrets-faq)



[Setting up Secrets Manager in your Kubernetes Service cluster](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgrsecrets-mgr)



* [About Secrets Manager](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgrsecrets-mgr_about)



* [What functionality can I gain with Secrets Manager?](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgrsecrets-mgr_about_functionality)



* [Secrets Manager FAQ](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgrsecrets-mgr_migration_faq)
* [Setting up your Secrets Manager instance](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgrsecrets-mgr_setup)