vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-52-48)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-53-48)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-54-48)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-55-48)
* [5.6 General policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-56-48)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48)







 Version 4.7 

[4.7 version information and update actions](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_versions_47cs_versions_47)



* [Release timeline](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_versions_47release_timeline_47)
* [Preparing to update](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_versions_47prep-up-47)



* [Update before master](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_versions_4747_before)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-4.14nist-supplemental-guidance)



[AC-4 (21) - Physical / Logical Separation of Information Flows](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-4.21ac-4.21)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-4.21control-requirements)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-4.21implementation-guidance)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-4.21nist-supplemental-guidance)



[AC-5 - Separation of Duties](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5ac-5)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5control-requirements)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5additional-ibm-cloud-for-financial-services-specifications)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5implementation-guidance)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-benchmark-32-411)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-section-4-411)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-benchmark-41-411)
* [4.2 Kubelet](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-benchmark-42-411)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-section-5-411)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-benchmark-51-411)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-benchmark-52-411)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-benchmark-53-411)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-benchmark-54-411)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411cis-benchmark-55-411)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-1nist-supplemental-guidance)



[PS-2 - Position Risk Designation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-2ps-2)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-2control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-2nist-supplemental-guidance)



[PS-3 - Personnel Screening](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-3ps-3)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-3control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-3nist-supplemental-guidance)



[PS-4 - Personnel Termination](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-4ps-4)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-4control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ps-4nist-supplemental-guidance)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-32)



* [4 Worker Nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-4)
* [5 Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-5)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-51)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-52)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-53)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-54)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-55)
* [5.7 General policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-57)



* [IBM Remediations and explanations](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_412_coco-benchmark-412-remdiations)







 Version 4.11
_rules](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_firewall_rules)<br> * [ibm_cis_global_load_balancers](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_global_load_balancers)<br> * [ibm_cis_healthchecks](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_healthchecks)<br> * [ibm_cis_ip_addresses](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_ip_addresses)<br> * [ibm_cis_logpush_jobs](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_logpush_jobs)<br> * [ibm_cis_mtls](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_mtls)<br> * [ibm_cis_mtls_apps](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_mtls_apps)<br> * [ibm_cis_origin_pools](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/cis_origin_pools)<br
The following diagram shows how CIS routes traffic to the pool with the lowest EWMA among three regions: Eastern North America, Europe, and Australia. In this case, the ENAM pool is selected, because it has the lowest RTT.

Zoom

![Figure showing traffic steering](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/cis-traffic-steering.svg)

Figure 1. Traffic steering in CIS





 Geo Steering 

Geo steering directs traffic to pools based on the client’s region or PoP. Only domains on Enterprise plans can perform geo steering by PoP. Users specify the pools to which the load balancer directs traffic for a geographical region or PoP. You can assign multiple pools to the same region, and the load balancer uses them in failover order. If there is no configuration for a region or pool, the load balancer uses the default failover order.

Our partners at Cloudflare have 13 geographic regions. The region of a client is determined by the region of the Cloudflare data center that answers the client’s DNS query. These regions are listed in the following table, along with their region codes.



Table 1. Geographic regions and codes

 Region Code Region 

 WNAM Western North America 
 ENAM Eastern North America 
 WEU Western Europe 
 EEU Eastern Europe 
 NSAM Northern South America 
 SSAM Southern South America 
 OC Oceania 
 ME Middle East 
 NAF Northern Africa 
 SAF Southern Africa 
 SAS Southern Asia 
 SEAS Southeast Asia 
 NEAS Northeast Asia
Configuring a global load balancer 

If you have an e-commerce website, or are hosting an application that must always be accessible to your users, then you're likely concerned about 24 x 7 availability and performance of your application.

The global load-balancing capabilities available with IBM Cloud Internet Services (CIS) can help improve reliability and scalability of your applications while delivering the best possible user experience.

On your dashboard, you'll see three lists that show the

load balancers, origin pools, andhealth checks. The lists display the new or updated global load balancer, or one of its components after you've provisioned or updated it. Initially, the lists are empty, and before you create a load balancer you must take a few actions.

CIS can support load balancer pools that use a private IP address, but there are limitations:



* you cannot use proxy services or health checks.
* you can only use DNS-based load balancing.



Refer to the [Quick setup](https://cloud.ibm.com/docs/cis?topic=cis-configure-glbglobal-load-balancer-quick-setup) if you already know what to do!

In this step-by-step demo, learn how to configure a setup similar to the following diagram.

Zoom

![Global load balancer](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/cis-glb1.svg)

Figure 1. Diagram of global load balancer example

In this example, the application resources are deployed in two data center locations, one in US West and the other in US East. Users might be accessing this application from all over the world.



 Step 1: Configure your global load balancer 

Configure your global load balancer.



1. Navigate to the Reliability section to begin working with global load balancers.
2. Scroll to the Health Checks section and click Create health check to define a custom health check.

This configuration is optional.
curl -sL https://ibm.biz/install-sysdig-k8s-agent | bash -s -- -a APIKEY -c ingest.us-south.monitoring.cloud.ibm.com -ac 'sysdig_capture_enabled: false' --nodeanalyzer --analysismanager https://ingest.us-south.monitoring.cloud.ibm.com/internal/scanning/scanning-analysis-collector --collector_port 6443 --api_endpoint us-south.monitoring.cloud.ibm.com --openshift





 Removing an agent 

Run the following command to remove an agent:

curl -sL https://ibm.biz/install-sysdig-k8s-agent | bash -s -- -a ACCESS_KEY -c COLLECTOR_ENDPOINT --openshift --remove

Where ACCESS_KEY is the ingestion key for the instance.





 Verifying the state of the agent 

Run the following command to check the status of the agent:

oc get pods -n ibm-observe

If pods are listed with status running, the agent is running.

If no pods are listed, the agent is not running.

In the event that the pods are not running but you expect the agent to be running, you can run the following command to understand why:

oc get events
AC-2 (4) - Automated Audit Actions 



  Control requirements 

AC-2 (4) - 0
:   The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Audit logging of application provider events and SIEM](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit-provider)
*  [Audit logging of IBM Cloud events](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)
*  [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check that Activity Tracker Event Routing is configured to collect global events generated by IBM Cloud services
)<br> * [ibm_cis_global_load_balancer](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_global_load_balancer)<br> * [ibm_cis_healthcheck](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_healthcheck)<br> * [ibm_cis_logpush_jobs](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_logpush_jobs)<br> * [ibm_cis_mtlss](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_mtls)<br> * [ibm_cis_mtls_apps](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_mtls_app)<br> * [ibm_cis_origin_auth](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_origin_auth)<br> * [ibm_cis_origin_pool](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_origin_pool)<br> * [ibm_
Choose 1 of the following options to con figure a target in your account:



* [Managing IBM Cloud Object Storage (COS) targets](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2_cos).
* [Managing IBM Cloud Activity Tracker Event Routing AT hosted event search targets](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2_at).
* [Managing IBM Cloud Activity Tracker Event Routing (Event Streams) hosted event search targets](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2_ies)
Access Control (AC) [AC-2 Account Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-2) <br>[AC-5 Separation of Duties](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5) <br>[AC-6 Least Privilege](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6) 
 Identification and Authentication (IA) [IA-5 Authenticator Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5) <br>[IA-5 (1) Authenticator Management | Password-Based Authentication](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.1) 







 Next steps 



* [Tagging IBM Cloud resources and managing access through tags](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resources)
curl -sL https://ibm.biz/install-sysdig-k8s-agent | bash -s -- -a APIKEY -c ingest.us-south.monitoring.cloud.ibm.com -ac 'sysdig_capture_enabled: false' --nodeanalyzer --analysismanager https://ingest.us-south.monitoring.cloud.ibm.com/internal/scanning/scanning-analysis-collector --collector_port 6443 --api_endpoint us-south.monitoring.cloud.ibm.com







 Removing an agent 

Run the following command to remove an agent:

curl -sL https://ibm.biz/install-sysdig-k8s-agent | bash -s -- -a ACCESS_KEY -c COLLECTOR_ENDPOINT --remove

Where ACCESS_KEY is the ingestion key for the instance.





 Verifying the state of the agent 

Run the following command to check the status of the agent:

kubectl get pods -n ibm-observe

If pods are listed with status running, the agent is running.

If no pods are listed, the agent is not running.

In the event that the pods are not running but you expect the agent to be running, you can run the following command to understand why:

kubectl get events -n ibm-observe
CP-10 (2) - Transaction Recovery 



  Control requirements 

CP-10 (2) - 0
:   The information system implements transaction recovery for systems that are transaction-based.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Business continuity and disaster recovery overview](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdr)







  NIST supplemental guidance 

Transaction-based information systems include, for example, database management systems and transaction processing systems. Mechanisms supporting transaction recovery include, for example, transaction rollback and transaction journaling.
AC-2 (7) - Role-based Schemes 



  Control requirements 

The organization:

AC-2 (7) (a)
:   Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;

AC-2 (7) (b)
:   Monitors privileged role assignments; and

AC-2 (7) (c)
:   Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Audit logging of application provider events and SIEM](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit-provider)
*  [Audit logging of IBM Cloud events](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)
*  [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)







  NIST supplemental guidance 

Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. These privileged roles include, for example, key management, account management, network and system administration, database administration, and web administration.
[Policies icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/policies.png) and click Controls. The controls are displayed.

You can filter the list by:

Severity
: The severity that is assigned to the control: high (H), medium (M), or low (L).

Type
: The infrastructure type. For example, cluster, host, identity, or resource.

Target
: The specfic platforms or distributions that a control evaluates resources against.

You can also search on any word, or part of a word, in the control name.

Multiple filters can be specified to create more specific filter expressions.
3. Click a control to work with it. The control details are displayed.

The details displays:



* The control title.
* The control severity.
* The control type. For example, Host.
* The control author. The author is Sysdig for IBM Cloud Security and Compliance Center Workload Protection provided controls.
* A description of the control.
* The policies that are linked to the control.

Hovering over a policy displays the policy details. For example, the requirement number for the compliance standard.



4. Click the Code tab.

The code used to evaluate the objects and how the evaluation rules are structured is displayed. The code is shown in [Rego format.](https://www.openpolicyagent.org/docs/latest/policy-language/) Where appropriate, required inputs are included.

You can copy or download this code to use as a template for other policies.
5. Click the Remediation Playbook tab.

The steps to resolve the failing control are displayed.
* UI
* CLI
* API







 Upgrading to a new Major Version 

When a major version of a database is at its end of life (EOL), upgrade to the current major version. You can upgrade IBM Cloud® Databases for Elasticsearch deployments to use the newest version of Elasticsearch.

Upgrade to the latest version of Elasticsearch available to Databases for Elasticsearch. You can find the latest version from the catalog page, from the cloud databases cli plug-in command [ibmcloud cdb deployables-show](https://cloud.ibm.com/docs/databases-cli-plugin?topic=databases-cli-plugin-cdb-referencedeployables-show), or from the cloud databases API [/deployables](https://cloud.ibm.com/apidocs/cloud-databases-apiget-all-deployable-databases) endpoint.

Upgrading is handled through [restoring a backup](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-dashboard-backups&interface=uirestore-backup) of your data into a new deployment. Restoring from a backup has a number of advantages:



* The original database stays running and production work can be uninterrupted.
* You can test the new database out of production and act on any application incompatibilities.
* The entire process can be rerun at any point.
* A fresh restoration reduces the likelihood that unneeded artifacts of the older version of the database are carried over to the new database.





 Before upgrading 

Before you start to upgrade your cluster to version 7.x, you must take the following actions.
* UI
* CLI
* API







 Updating a network load balancer 

You can update an IBM Cloud® Network Load Balancer for VPC (NLB) with the UI, CLI, or API.



 Updating a network load balancer in the UI 

To update an NLB in the IBM Cloud console, perform the following procedure:



1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login) and log in to your account.
2. Select the Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) from the upper left, then click VPC Infrastructure > Load balancers.
3. Select the region of your load balancer.
4. Select the load balancer that you want to update.
5. Select Back-end pools if you need to edit a pool or virtual server instance parameters.
6. Select Front-end listeners if you need to edit listener parameters.
7. After you're done editing, select Save to save your changes.



The Active button on the upper left of your screen now shows as Updating. When Updating changes back to Active, the update is done and the new changes are applied.





 Updating a network load balancer from the CLI 

The following example shows how to use the CLI to update your network load balancer pool to use the algorithm least_connections and the port of the member:

ibmcloud is load-balancer-pool-update r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 --algorithm least_connections

Sample output: