vania-janet/multiturn-rag-retrieval-data huggingface dataset:
An IBM Cloud API key is an example of such a secret. These secrets must be securely stored within an IBM-recommended secrets management tool, such as [IBM Key Protect for IBM Cloud](https://www.ibm.com/cloud/key-protect), [IBM Cloud® Secrets Manager](https://www.ibm.com/cloud/secrets-manager), or [Hashicorp Vault](https://www.vaultproject.io/). The secrets management tool can be integrated into the toolchain so that you can easily reference the secrets in your Tekton pipeline.

This tutorial uses IBM Cloud® Secrets Manager as the vault for secrets.





 Evidence Storage 

The evidence repository stores evidence for all the tasks that the pipeline runs. This evidence is collected by the pipeline during the pipeline run.

Select an existing evidence repository, preferably the evidence repository that was created when you configured the continuous integration (CI) toolchain.

It is a best practice to use a Cloud Object Storage bucket as an evidence locker to store all the evidence and artifacts that are collected during the pipeline run.

For more information about evidence storage, see [Evidence](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-evidence).





 Evidence 

Repository URL: URL of the Evidence Locker Repository configured in your CI Toolchain as captured in the previous step.





 Cloud Object Storage bucket 

To use this feature, you must have a Cloud Object Storage instance and a bucket. Click [Using Cloud Object Storage buckets as an evidence locker](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-bucket-evidence) to create a Cloud Object Storage instance. For more information on configuring a bucket that can act as a compliance evidence locker, see [Configuring Cloud Object Storage for storing evidence](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-config).



* Cloud Object Storage instance, Bucket name, and Cloud Object Storage endpoint fields are automatically populated.
ServiceNow API Token servicenow-token Required: CD onlyUsed to access Service Now for change management operations 
 HashiCorp Vault Role ID role-id Required: CI & CDUsed to authenticate with the HashiCorp Vault server 
 HashiCorp Vault Secret ID secret-id Required: CI & CDUsed to authenticate with the HashiCorp Vault server 
 IBM Cloud Object Storage Writer API Key cos-api-key Required: CI & CDUsed to authenticate with the Object Storage service - This key must have writer permission 
 SonarQube password or authentication token sonarqube-password Optional: CIUsed to authenticate with the SonarQube source code analyzer 



If you are using a HashiCorp Vault server, ensure that the HashiCorp Vault tool integration uses the [AppRole Auth Method](https://www.vaultproject.io/docs/auth/approle) method. When you use the AppRole authentication method, you need role-id and secret-id to successfully integrate the HashiCorp Vault server with the toolchain. Because role-id and secret-id are secrets in themselves, it is recommended to store them by using a [IBM Key Protect tool integration](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-keyprotect) so that they can be securely retrieved and applied in the toolchain workflow. All other toolchain secrets should be stored and retrieved by using the HashiCorp Vault tool integration.

If the pipeline environment property git-token is not set, ibmcloud-api-key is used to retrieve the Git Repos and Issue Tracking Access Token by default. However, if ibmcloud-api-key does not have access to git, git-token must be set.



 Configuring the secrets stores 

With IBM Cloud, you can choose from various secrets management and data protection offerings that help you protect your sensitive data and centralize your secrets. You can choose between the vault integrations depending on your requirements as explained in [Managing IBM Cloud secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manage-secrets-ibm-cloud).
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 
 Secret deletion blocked com.ibm.cloud.secrets-manager.secret_deletion_blocked One time ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) !
By setting values with a .tfvars file, you can separate sensitive values from the rest of your variable values, and ensure that your users who work with your configuration know which values are sensitive. For security purposes, you must maintain and share the .tfvars file only with your users who have the appropriate access. You must also be careful not to store .tfvars files with sensitive values into version control such as Github, in clear text.

arbitrary_secret_payload = "my sensitive arbitrary payload"
3. Create the arbitrary secret in the main.tf file.

resource "ibm_sm_arbitrary_secret" "sm_arbitrary_secret" {
instance_id = local.instance_id
region = local.region
description = "Extended description for this arbitrary secret"
labels = [ "tf-resource"]
name = "test-arbitrary-secret"
secret_group_id = ibm_sm_secret_group.sm_secret_group_test.secret_group_id
payload = var.arbitrary_secret_payload
}
Related controls in IBM Cloud Framework for Financial Services 

The following IBM Cloud Framework for Financial Services controls are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 Next steps
You can now create [import tokens](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keysusing-import-tokens) to enable added security for keys that you upload to Key Protect.

To find out more about your options for importing keys, check out [Bringing your encryption keys to the cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keys). For a guided tutorial, see [Tutorial: Creating and importing encryption keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-tutorial-import-keys).







 July 2019 



 31 July 2019 

Announcing private endpoint support
: You can now connect to Key Protect over the IBM Cloud private network by targeting a private endpoint for the service.



* To get started, enable [virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) for your infrastructure account. For more information, see [Using private endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-private-endpoints).









 June 2019 



 22 June 2019 

Announcing IBM Cloud Activity Tracker integration
: You can now monitor API calls to the Key Protect service by using IBM Cloud Activity Tracker. To learn more about monitoring Key Protect activity, see [IBM Cloud Activity Tracker events](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-events).







 May 2019 



 22 May 2019 

Key Protect now uses IBM Cloud Hardware Security Module 7.0 for cryptographic storage and operations
: Your Key Protect keys are stored in FIPS 140-2 Level 3-compliant, tamper-evident hardware for all regions. To learn more about the features and benefits of IBM Cloud HSM 7.0, check out the [product page](https://cloud.ibm.com/cloud/hardware-security-module).





 15 May 2019
Scaling: Enable [horizontal pod autoscaling](https://cloud.ibm.com/docs/openshift?topic=openshift-update_appapp_scaling) to automatically increase or decrease the number of instances of your apps based on CPU.







 Secure your app 

Use Kubernetes secrets to store confidential information, such as credentials or keys, and encrypt data in Kubernetes secrets to prevent unauthorized users from accessing sensitive app information.



1. Secrets: Store personal or sensitive information in [Kubernetes secrets](https://cloud.ibm.com/docs/openshift?topic=openshift-securitypi) that your app can access.
2. Secret encryption: [Encrypt secrets by using a KMS provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) and [verify that secrets are encrypted](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionverify_kms).







 Expose your app 

Publicly expose an app in your cluster to the internet or privately expose an app in your cluster to the private network only.



1. Plan service discovery:



1. Understand the [basics of Kubernetes service discovery](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_deployservice_discovery).
2. [Choose an app exposure service](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_network_planning) that fits your requirements for incoming traffic to the app.



2. Expose your app:



* Load balancers:



* Classic clusters:



1. Create an [NLB 1.0](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer) or [NLB 2.0](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-v2).
2.
* Blog post [Towards Zero Trust with Context-Based Restrictions](https://www.ibm.com/cloud/blog/towards-zero-trust-with-context-based-restrictions)
* Blog post [Introducing Context-Based Restrictions](https://www.ibm.com/cloud/blog/announcements/introducing-context-based-restrictions)
* [What is Zero Trust?](https://www.ibm.com/topics/zero-trust)
* Tutorial: [Best practices for organizing users, teams, applications](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applicationsusers-teams-applications)
[SC-8 - Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8sc-8)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8control-requirements)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8implementation-guidance)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8nist-supplemental-guidance)



[SC-8 (1) - Cryptographic or Alternate Physical Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1sc-8.1)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1control-requirements)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1additional-ibm-cloud-for-financial-services-specifications)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1implementation-guidance)
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) 
 Manage runtime policies ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) 
 Manage image scanning policies ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) 
 Manage Activity Audit ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) !
[Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) 
 vApp: View VM and VM's Disks Encryption Status ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) !
[Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) 
 vApp: View VM and VM's Disks Encryption Status ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) !
[Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) 
 Organization vDC Named Disk: View Encryption Status ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) 
 Organization vDC Named Disk: View Properties !
Nov 29 10:24:07 hpvs211vsi systemd info verify-disk-encryption-invoker.service: Succeeded.
...
Nov 29 10:24:08 hpvs211vsi verify-disk-encryption info Checked for mount point /mnt/data, LUKS encryption with 1 key slot found
Nov 29 10:24:08 hpvs211vsi verify-disk-encryption info HPL13001I: Root disk and all the data disks are encrypted
...

Note:



1. You can't configure the interval of the disk encryption status checks.
2. To address Denial-of-Service attacks, requests are throttled at three per five minutes.
3. To verify that the mounted data volume is encrypted, you can trigger explicitly echo 'HPL13000I' | systemd-cat on the VSI, and the results are captured in the logs.
For more information, see [vSAN KMS Health Check intermittently fails with SSL handshake timeout error](https://kb.vmware.com/s/article/67115).

To use vSphere encryption, edit your VM storage policies to require disk encryption.





 Important caveats 

Some VMs require special planning for encryption, especially if they are involved in a possible circular dependency to obtain the key material to operate themselves. Consider the following information:



* vCenter Server is involved in retrieving encryption keys. This VM should not be encrypted using vSphere encryption or located on an encrypted vSAN datastore.
* The Micorsoft Windows® Active Directory controllers in your environment are used for hostname resolution to connect to key management. You should not encrypt them using vSphere encryption or locate them on an encrypted vSAN datastore unless you are prepared to provide alternate hostname resolution if you need to restart your environment.
* VMware does not recommend encrypting VMware NSX® VMs by using vSphere encryption.
* Entrust does not recommend encrypting Entrust CloudControl™ VMs that use vSphere encryption.







 Key rotation 

Rotate your [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keysrotate-keys) or [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys) customer root key (CRK) by using the IBM Cloud console or API.



* For vSAN encryption, rotate your VMware key encryption keys (KEKs) and optionally data encryption keys (DEKs) from the vSAN general settings in your vCenter Server cluster.
* For vSphere encryption, rotate your VMware KEKs and DEKs (optionally) by using the Set-VMEncryptionKey PowerShell command.







 Key revocation 

You can revoke all keys in use by KMIP for VMware by deleting your chosen CRK from your key manager.
vhd-util copy -n debian8-ne.vhd -N debian8-aes512.vhd -k aes512.dek
7. Verify that the VHD files are encrypted by using the following command.

vhd-util key -p -n <vhd_filename>

Example command with output:

vhd-util key -p -n debian8-aes512.vhd
0000000000000000000000000000000000000000000000000000000000000000
21681bba94f04b33b112f5f90a0faa885a6d1dbf1bd68ed16c5b995143088eda



If the VHD file is encrypted, you see two hash values in the output as shown in the previous example. The first hash is all zeros. The second hash is the SHA256 hash that the AES encryption key uses to encrypt and decrypt the VHD. Make sure that the SHA256 hashes for the VHD files are the same as the hashes shown in Step 5.

The example command in Step 7 creates a new encrypted VHD file that is named, “debian8-aes512.vhd”. It's encrypted with the AES 512-bit encryption key from the keyfile named “aes512.dek”. The SHA256 hash for its encryption is 21681bba94f04b33b112f5f90a0faa885a6d1dbf1bd68ed16c5b995143088eda.
[Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) 
 Organization vDC Named Disk: Move ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) 
 Organization vDC Named Disk: View Encryption Status ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) !
3000446 - Check whether Security Groups for VPC doesn't allow PING for the default security group
3000447 - Check whether Virtual Private Cloud (VPC) classic access is disabled
3000449 - Check whether Virtual Private Cloud (VPC) has no public gateways attached
3000451 - Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port
3000441 - Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to port 22
3000442 - Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to port 3389
3000452 - Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port
3000453 - Check whether Virtual Servers for VPC instance has the minimum interfaces
3000454 - Check whether Virtual Servers for VPC instance doesn't have a floating IP
3000455 - Check whether Virtual Servers for VPC instance has all interfaces with IP-spoofing disabled
3000456 - Check whether Virtual Servers for VPC is in a resource group other than ""Default""
3000457 - Check whether Virtual Servers for VPC boot volumes are enabled with customer-managed encryption and Bring Your Own Key (BYOK)
3000458 - Check whether Virtual Servers for VPC boot volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
3000459 - Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Bring Your Own Key (BYOK)
3000460 - Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
3000461 - Check whether Virtual Servers for VPC is provisioned from an encrypted image
3000462 - Check whether Virtual Servers for VPC is provisioned from customer-defined list of images
3000463 - Check whether Virtual Servers for VPC instances are identifable by the workload they are running based on the Auto Scale for VPC instance group definition