vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can provide your variables and credentials for this stage from [variables in the pipeline UI](https://cloud.ibm.com/docs/devsecops?topic=devsecops-custom-scriptscd-devsecops-scripts-secrets) and the [pipeline trigger webhook payload](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-webhook-payloads).

The scripts that are provided as part of the common base image can help perform a deployment by using schematics or Terraform CLI. The parameters to configure the scripts for the deployment action are described in Table 8 and Table 9.



 Configuration parameters to use Schematics as deployment tool 



Table 8. Configuration parameters to use Schematics as deployment tool

 Property Default Description 

 schematics-workspace-name <schematics-workspace-prefix><toolchain name>-<pipeline id> Workspace to use or to create if it does not exist. If the workspace exists, it must be a workspace created without a link to a Git repository. For more information, see [Schematics Workspace creation](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-cli-referenceschematics-workspace-new). This restriction is because the script uploads the IaC configuration artifact as a tar file by using [Schematics Workspace upload](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-cli-referenceschematics-workspace-upload). 
 schematics-workspace-prefix Prefix used for workspace creation when no workspace is specified for the deployment action. 
 schematics-workspace-resource-group Defaults to the resource group of the toolchain. Resource group to be used for the schematics workspace creation. 
 schematics-workspace-region Defaults to the region of the toolchain. Region to be used for the schematics workspace creation.
[Architecture for a resilient infrastructure for a single availability zone](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-ref-arch-saz)Architecture for a resilient infrastructure for a single availability zone

Deploying your application across the availability zone in a multiple-zone region provides the highest resiliency, 4 9's. However, there are scenarios where deploying across the zones is not wanted, such as needing the latency to be minimal or the application is deemed not critical.

Virtual Servers for Classic Virtual Private Cloud (VPC)

+2

IBM Cloud Load Balancer,High availability and resiliency for infrastructure



* 60 minutes
* 2022-06-22



[Enabling Auto scale for better capacity and resiliency](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-ha-auto-scale)Enabling Auto scale for better capacity and resiliency

This tutorial shows you how to set up compute (virtual server instance) Auto scale for horizontal scaling. You create an Auto scale instance template that defines the details of the virtual server instances that are created. After you define the template, you define instance groups to set the scaling policies that determine when and how many virtual server instances are added or removed. The instance group setup includes enabling the backend orchestration to add the newly created virtual server instances to the backend server pool for the cloud load balancer.

Virtual Servers for Classic Virtual Private Cloud (VPC)

+2

IBM Cloud Load Balancer,High availability and resiliency for infrastructure



* 45 minutes
* 2021-04-20



[Regional snapshots in 3-tier architecture](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-regional-snapshots-3-tier-arch)Regional snapshots in 3-tier architecture

Block storage snapshots can be created in IBM Cloud® VPC Gen2. You can use this feature for a backup and restore of a 3-tier application. Block storage snapshots can also be used to scale out a 3-tier system with minimal changes to your application.
Access to CP4D 1 Day 
 Log Request 1 Day 
 Application Server Restarts 1 Day 







 Incident Management and RCA Process 

The IBM SRE team has monitoring in place for all sites and infrastructure under our control. These are designed to allow the SRE team to pro-actively respond to service impacting or service threatening events or conditions. When a site is unavailable, or there are infrastructure issues leading to monitor alerts, an incident record is automatically generated within our Incident Management System.

At the same time, for production environments, a SRE Incident Response Team (IRT) provides 24/7 critical outage support. The goal of IRT is to ensure our customer's applications are running when they should, and to provide effective and timely customer communication during availability incidents or Severity 1 cases during off hours. IRT is sometimes referred to as the "on call" team.

IRT is not considered standard support. It is for emergency and Sev1 cases only. Please see our Support & Operations section for standard support details and hours of operation.

How is the IBM SRE Incident Response Team (IRT) organized?

The IRT is organized into a 2-person rotating schedule on 8-hour cycles over 7 days. This means that there are two IRT members for each 8 hour period: a Client Communicator and a First Responder. IBM SRE uses a region based “follow the sun” support model. The IRT schedule is maintained and updated by IBM on a regular basis.

Client Communicator



* The Client Communicator (CC) is responsible for ensuring that any customer affected by a Severity 1 incident or alert is receiving prompt and frequent communication regarding the status of their incident. This resource does not necessarily have technical skills or access to investigate / act upon systems that are failing. The CC may also be expected to triage requests that do not fall within the definition of Severity 1 and communicate with the customer regarding these issues.



First Responder



* The First Responder (FR) is a technical role that requires access to systems that may be in a failed or failing state, as well as the skills required to understand what can be done to recover affected environment(s).
: [Grafeas](https://grafeas.io) is an open source CI/CD service that provides a common way for how to retrieve, store, and exchange metadata during the software supply chain process. For example, if you integrate Grafeas into your app build process, Grafeas can store information about the initiator of the build request, vulnerability scan results, and quality assurance sign-off so that you can make an informed decision if an app can be deployed to production. You can use this metadata in audits or to prove compliance for your software supply chain.

IBM® Continuous Delivery Pipeline for IBM Cloud®
: With your app configuration files organized in a source control management system such as Git, you can build your pipeline to test and deploy code to different environments, such as test and prod. IBM Cloud® Continuous Delivery allows you to automate your app builds and container deployments to Kubernetes clusters by using a toolchain. To get started, see [Setting up a continuous delivery pipeline for a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-cicdcontinuous-delivery-pipeline). You can also check out [this tutorial on Continuous Deployment to Kubernetes](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-continuous-deployment-to-kubernetescontinuous-deployment-to-kubernetes).

Helm
: [Helm](https://helm.sh) is a Kubernetes package manager. You can create new Helm charts or use preexisting Helm charts to define, install, and upgrade complex Kubernetes applications that run in IBM Cloud Kubernetes Service clusters. For example, you can specify all Kubernetes resources that your app requires in a Helm chart. Then, you can use Helm to create the YAML configuration files and deploy these files in your cluster..
: In Red Hat OpenShift clusters that run version 4, use [Operators](https://cloud.ibm.com/docs/openshift?topic=openshift-operators) instead of Helm charts.
Architecture 



 Cloud Architecture 

Maximo Application Suite (MAS) is a feature rich suite of applications delivered using key IBM, Red Hat and AWS technologies. The MAS as a Service (MAS-SaaS) delivers this functionality on the Amazon Web Services (AWS) platform.

On site customer visits to AWS data centers are not allowed for security reasons. Street address locations of data centers are not disclosed. This is in accordance to IBM's NIST guidelines and AICPA Trust Services criteria.





 Instance Architecture 

The following diagram shows a high level overview of the architecture for each individual client instance.

Zoom

![MAS-SaaS Architecture](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-SaaS-Architecture-View.png)

Figure 1. MAS-SaaS Architecture





 MAS-SaaS Architecture Highlights 



* MAS-SaaS customers are provisioned a single (1) environment by default
* All clients will be provisioned in their own application instance using a dedicated namespace
* IT Administration for the environment is solely managed by IBM's MAS SaaS SRE operations team
* Clients can access their environment via browser based URL
* MAS-SaaS is an internet based offering that runs over HTTPS. There is no private cloud or direct connect option for MAS-SaaS
* Clients are provided application administrator access
* All servers are Red Hat Linux O/S
* Maximo Manage databases are IBM DB2 Warehouse. Oracle and MS SQLServer are not supported.







 MAS-SaaS Integrations 

IBM Maximo Application Suite as a Service supports integration to / from external systems. There are different options available to provide secure integration connections such as SSL, VPN, and Cloud Object Storage integration. HTTPS (SSL) is the standard encryption method and is supported for XML based interfaces using HTTP Post and Web Service endpoints. In addition, the REST API is available over HTTPS. All these integration methods can also be implemented with authentication.
[IBM Cloud for Financial Services reference architecture with BIG-IP WAF](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/f5-bigip/vpc-single-region-edge.svg)

Figure 1. Single-region IBM Cloud for Financial Services reference architecture for VPC with BIG-IP

There are two main components to this solution:



* CIS provides global load balancing and layer 3/4 protection against distributed denial-of-service (DDoS) attacks.
* BIG-IP that provides WAF protection and layer 7 protection against denial-of-service (DoS) attacks.



CIS is not Financial Services Validated. Because of this, TLS connections must not be terminated in CIS and should be configured only for pass-through connections. CIS global load balancers must be configured with the proxy configuration setting value of off. CIS Use range applications sto provide DDoS protection in front of global load balancers.



 Network path 

The following diagram shows the flow of network traffic from a client application passing through CIS and BIG-IP to server-side applications running in Red Hat OpenShift on IBM Cloud.

Zoom

![IBM Cloud Network path from client application through CIS and BIG-IP to provider's Red Hat OpenShift on IBM Cloud application](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/f5-bigip/cis-flow.svg)

Figure 2. Network path from client application to Red Hat OpenShift on IBM Cloud application passing through CIS and BIG-IP.

The network flow goes through the following steps:



1. Client applications connect to a CIS Range application through a public hostname that is exposed by CIS. This connection is treated as a TCP connection (not an HTTPS connection) by CIS and passes through CIS without TLS termination.
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 59s
Created: 2021-03-01T20:08:36-06:00

Destination Type: job
Destination: myjob
Bucket: mybucket
Event Type: all
Ready: true

Conditions:
Type OK Age Reason
CosConfigured true 55s
Ready true 55s
ReadyForEvents true 55s
SinkProvided true 55s

Events:
Type Reason Age Source Messages
Normal FinalizerUpdate 61s cossource-controller Updated "mycosevent" finalizers



Now every time that you change your bucket, your job receives notification.

Job runs that are created by subscriptions are deleted after 10 minutes.

Want to try a tutorial? See [Subscribing to Object Storage events](https://cloud.ibm.com/docs/codeengine?topic=codeengine-subscribe-cos-tutorial). Looking for more code examples? Check out the [Samples for IBM Cloud Code Engine GitHub repo](https://github.com/IBM/CodeEngine).





 Viewing event information for a job from the console 

To view information about your event subscriptions,



1. From the [Code Engine Projects page](https://cloud.ibm.com/codeengine/projects), go to your project.
2. From the Overview page, click Event subscriptions to view a listing of defined subscriptions.



If your job prints information to log files, as the sample codeengine job does, then view the log files for your event consumer application. See [Viewing job logs from the console](https://cloud.ibm.com/docs/codeengine?topic=codeengine-view-logsview-joblog-cli).





 Viewing event information for a job with the CLI
Adding an environment 

One environment will be created with each instance. In IBM Planning Analytics® as a Service, you now have the ability to create and manage additional environments (Dev or Prod), and invite specific Planning Analytics Workspace users to environments though self-serve. The following steps will allow you to create a secondary environment in Planning Analytics Administration.



1.  Log in to your Planning Analytics service instance.
2.  On the Planning Analytics Workspace home page, click the Administration tile.
3.  On the Administration page, click the Environments tab.
4.  Click Add and enter the environment name. Select if this will be a Development or Production environment, then click Create.



To create or manage environments, you need environment admin privileges. The first user is given this privilege by default and it can be granted to other Administrators by enabling the toggle for that user. Users can have different access privilege for each environment.

The first environment created cannot be deleted, and there must always be one environment.

The resource quota is shared between environments. The Service Instance Quota in Planning Analytics Administration will show your total quota, and how much has been used.
RCA (Root Cause Analysis)

For Severity 1 incidents, IBM SRE and the Incident Response Team (IRT) have a primary goal to restore service and remediate any disruption as soon as possible. Addressing the symptoms of an issue can often be sufficient enough to successfully restore service, but the underlying root cause may not have been identified during this process due to time constraints. A Root Cause Analysis (RCA) can be requested by customers for further analysis to help identify the underlying cause. As part of this process, the client and/or their implementer may be required to review specific configurations within the Maximo or TRIRIGA application. Root Cause Analysis can include specific actions to prevent the same issue occurring again in the future. This detail will be given back to the client in the case itself, or in an associated child case if opened separately. Unlike an Incident Report, an RCA is not a separate document and doesn't include a summary of the primary issue or timeline of significant activity during the event. The original case will already have this detail captured.

Under what type of circumstances an RCA can be requested



* RCA's are only provided for production environments
* RCA's are provided for Severity 1 incidents that are outside of the agreed SLA (99.9% availability for the Production environment)
* RCA’s are not provided for single/isolated incidents
* RCA's can be provided for frequently recurring issues in production that have a significant impact on your business



How to request an RCA



* If the case in which the incident occurred is still open, customers can request a Root Cause Analysis as an entry within the case itself.
* If the case in which the incident occurred is closed, a new case should be opened by the customer specifically requesting an RCA. It should include the original case number of the incident.
* For example: "Request for RCA on TS00001111"



RCA lead times

An RCA can take between 5 to 10 business days to be completed. RCA detail will be provided in the applicable case.





 IBM Support Guides 

An IBM Support Guide for Maximo Application Suite is available. See link below. The guide contains information such as Contact Information, Hours of Operation, Severity Level Guidelines and Response Time Objectives and Issue Escalation
Incident and operations management 

You and IBM share responsibilities for the set up and maintenance of your Red Hat OpenShift on IBM Cloud cluster environment for your application workloads. You are responsible for incident and operations management of your application data.



Table 2. Responsibilities for incident and operations management

 Resource IBM responsibilities Your responsibilities 

 Worker nodes <br><br> * Deploy a fully managed, highly available dedicated master in a secured, IBM-owned infrastructure account for each cluster.<br> * Provision worker nodes in your IBM Cloud infrastructure account.<br> * Ensure that worker nodes successfully provision when the user account and permissions are correctly set up, and sufficient quota exists.<br> * Fulfill requests for more infrastructure, such as adding, reloading, updating, and removing worker nodes.<br> * Provide tools, such as the [cluster autoscaler](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-scaling-classic-vpc), to extend your cluster infrastructure.<br> * Integrate ordered infrastructure resources to work automatically with your cluster architecture and become available to your deployed apps and workloads.<br> * Fulfill automation requests to help recover worker nodes.<br><br><br> <br><br> * Use the provided API, CLI, or console tools to adjust [compute](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workers) and [storage](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-plan) capacity to meet the needs of your workload.<br> * Use the provided API, CLI, or console tools to request that worker nodes are rebooted, reloaded, or replaced, and troubleshoot issues such as when the worker nodes are in an [unhealthy state](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_worker_nodes).<br><br><br>
Test Changes X 
 Go Live X 







 Post Live MAS-SaaS Activities 

This is the support for customers after the go live. Any new issue is investigated and resolved and then the client moves to steady state.





 Roles and Responsibilities 

Both IBM and the client have critical roles in the successful transition to the Maximo Application Suite SaaS offering. These responsibilities are summarized in the attached spreadsheet below (MAS-SaaS Migration Swimlanes). At a high level, IBM is responsible for the technical components of the migration and the client would be responsible for ensuring business processes are working, custom and unique features of their implementation are identified, and updates to integration's and accounted for in the plan.

If the source database is being converted from another platform (for example Oracle or SQLServer) it is the customers responsibility to perform validation of the converted DB2 database and correct any issues identified before providing to the SRE team for import into the target MAS-SaaS environment.

IBM and the customer share the responsibility to ensure the appropriate personnel are available to meet the agreed project plan.





 Additional Notes 





 Database Backup Image/Export 

The IBM SRE team would prefer a database backup image provided the image is from the same database version as you are running in MAS-SaaS. We can accept/use an export done using (db2move/db2look). We would like you to send the export as well as backup image if possible. The database backup image and export files should be uploaded to the following IBM Cloud COS bucket. The bucket detail and its connection detail will be send via welcome letter.

Bucket name: masms-XX-X-XXX-XXXXX-"InstanceName"-XX-XXX-cust-files





 Doclink and Attachment Files 

Doclink and Attachment Files should be uploaded to the following IBM Cloud COS bucket. Please upload your doclinks directory with all required subfolders The structure of these files and directories will be maintained when copied to the Manage server location.

Bucket name: masms-XX-X-XXX-XXXXX-"InstanceName"-XX-XXX-cust-files

Note:
Use the provided tools to manage authentication, authorization, and access control policies. 
 Satellite Connector Agent Image Provide an interface for the Satellite Connector Agent image to connect to a Satellite Connector by leveraging IBM IAM credentials. Maintain and rotate the IAM credentials needed by the agent image. 







 Security and regulation compliance 

Security and regulation compliance includes tasks such as security controls implementation and compliance certification.



Table 5. Responsibilities for security and regulation compliance.

 Task IBM responsibilities Your responsibilities 

 General <br><br> * Provide platform-level compliance to certain standards. For more information, see [IBM Cloud compliance](https://cloud.ibm.com/docs/overview?topic=overview-compliance).<br> * Provide tools to manage billing, usage, and identity and access control (IAM).<br> * Set default security settings for Satellite components. These settings do not guarantee security, and might be modified by the user.<br><br><br> <br><br> * Identify government, industry, and proprietary corporate standards that are required for the environment.<br> * Review the physical premises that host the underlying infrastructure for security controls to protect the data center.<br><br><br> 
 Satellite Location <br><br> * Maintain security and regulation compliance for the IBM Cloud-managed location control plane.<br> * Update the managed master components.<br> * Provide patch updates for the control plane components that run in the location worker nodes.<br> * Provide the ability to control access to locations through IBM Cloud IAM.<br><br><br> <br><br> * You are responsible for keeping your host infrastructure secure and compliant, including applying worker node patch updates to the hosts that run the location control plane.<br><br><br>