vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To get started, you need [Key Protect](https://cloud.ibm.com/catalog/key-protect) or [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services) provisioned on your IBM Cloud account. For more information, see [provisioning a key protect instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision) or see [provisioning a Hyper Protect Crypto Services instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).

To integrate with a key management service, perform the following steps:



1. From your App Configuration service instance dashboard, click Integrations. By default, the integrations displays the services supported along with integrations in the current App Configuration service.
2. From Key Management tile, click Connect +. This displays the Key Management side panel.

Zoom

![Create KMS integration](https://cloud.ibm.com/docs-content/v1/content/f3dada89f147af3b88388a2218ddbf64b3c41e5f/app-configuration/images/ac-integrations-kms-create.png)

Figure 1. Create KMS integration
3. Select Key Protect or Hyper Protect Crypto Services from the Service drop-down list, as per your requirement.
4. For the Instance, select one of these options:



* Create a new instance - to create a new instance of the selected service. Selecting this option takes you to the respective provisioning page of the service selected.
* Choose existing instance - select this option if you already have a Key Protect or Hyper Protect Crypto Services instance. Select the Instance name and Root key from the drop-down list.



5. Click Create to apply the use of your Key Protect or Hyper Protect Crypto Services instance's root key to encrypt the segment data stored by your App Configuration instance.



The newly created Key Management information is listed under Connected instance.
To decrypt data, the wrapped DEK is unwrapped to get the DEK. This process is possible only by accessing the KEK, which in this case is your root key that is stored in your KMS. Key Protect keys are secured by FIPS 140-2 Level 3 certified cloud-based hardware security modules (HSMs), and Hyper Protect Crypto Services keys are secured by FIPS 140-2 Level 4 certified cloud-based HSMs.



 Enabling customer-managed keys for App ID by using Key Protect 

If you choose to work with a key that you manage, you must ensure that valid IAM authorization is assigned to the App ID service.



1. [Create an instance of Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provisionprovision-gui).
2. [Generate or import your own root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys) to your instance of Key Protect. When you use Key Protect to create a root key, the service generates cryptographic key material that is rooted in cloud-based HSMs. Be sure that the name of your key does not contain any personal information such as your name or location.
3. Grant service access to Key Protect. You must be the account owner or an administrator for the instance of Key Protect that you're working with. You must also have at least Viewer access for the App ID service.



1. Go to Manage > Access IAM > Authorizations.
2. Create an authorization to allow access to Key Protect.
3. Select the source account.
4. Select App ID as your source service.
5. Select Key Protect as your target service.
6. Specify the scope of the access.
7. Assign the Reader role.
8. Click Authorize.



4. Create an instance of the App ID service.



1. Select your Key Protect instance.
2. Select the root key that you previously authorized.
3. Click Create.
Add the high availability service to the RHEL firewall if firewalld.service is installed and enabled.

On both nodes, run the following commands.

firewall-cmd --permanent --add-service=high-availability

firewall-cmd --reload





 Starting the PCS daemon 

Start the PCS daemon, which is used for controlling and configuration of RHEL HA Add-On clusters through PCS.

On both nodes, run the following commands.

systemctl enable --now pcsd.service

Make sure that the PCS service is running:

systemctl status pcsd.service





 Setting a password for hacluster user ID 

Set the password for the hacluster user ID.

On both nodes, run the following command.

passwd hacluster





 Authenticating the cluster nodes 

Use the following command to authenticate user hacluster to the PCS daemon on the nodes in the cluster. The command prompts you for the password that you set in the previous step.

On NODE1, run the following command.

pcs host auth ${NODE1} ${NODE2} -u hacluster

If you get an error message similar to Error: Unable to communicate with {NODE2}, check whether you have any proxy variables set in your environment (env | grep -i proxy). You need to unset these variables or define a no_proxy variable to exclude the cluster nodes: export no_proxy=${NODE1},${NODE2},$no_proxy





 Configuring and starting the cluster nodes 

Configure the cluster configuration file and synchronize the configuration to the specified nodes.

The --start option also starts the cluster service on the nodes.

On NODE1, run the following command.

pcs cluster setup ${CLUSTERNAME} --start ${NODE1} ${NODE2}

pcs status





 Creating the fencing device 

STONITH is an acronym for "Shoot The Other Node In The Head" and protects your data from corruption in a split brain situation.

STONITH (fencing) must be enabled for a RHEL HA Add-On production cluster.
Choose whether to generate a free phone number for your assistant, integrate with your contact center, or connect to an existing SIP trunk:



* To generate a free phone number for your assistant, click Generate a free phone number.

Generating a free phone number is supported only for Watson Assistant instances in the Dallas and Washington DC data centers.
* To integrate with a [contact center](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-phone-nicecxone), click Integrate with your contact center.
* To use an existing phone number you have already configured with a [SIP trunk provider](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-phone-configdeploy-phone-config-sip-providers), click Use an existing phone number with an external provider.



Click Next.
5. If you are integrating with a contact center, follow the instructions to configure the contact center. Skip this step if you are generating a free phone number.



1. On the Select contact center page, select the tile of the connect center you would like to use.
2. On the Connect to contact center page, enter the required information. There is a Test Connection button on the page to validate the connection. Click Next.



6. If you are using an existing phone number, follow the instructions to configure the SIP trunk. Skip this step if you are generating a free phone number.



1. On the Bring your own SIP trunk page, copy the SIP URI and assign it to your SIP trunk. Click Next.



7. On the Phone number page (only for Integrate with your contact center and Use an existing phone number with an external provider), specify the phone number of the SIP trunk. Specify the number by using the international phone number format: +1 958 555 0123. Do not surround the area code with parentheses.

Currently, only one primary phone number can be added during initial setup of the phone integration. You can add more phone numbers in the phone integration settings later.

Click Next.
8.
In a text editor, create a high-order Pre-DNAT policy called deny-lb-port-80.yaml to deny all incoming TCP and UDP traffic from any source IP to the NLB IP address and port. Replace <loadbalancer_IP> with the NLB public IP address from your cheat sheet.

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
name: deny-lb-port-80
spec:
applyOnForward: true
preDNAT: true
ingress:
- action: Deny
destination:
nets:
- <loadbalancer_IP>/32
ports:
- 80
protocol: TCP
source: {}
- action: Deny
destination:
nets:
- <loadbalancer_IP>/32
ports:
- 80
protocol: UDP
source: {}
selector: ibm.role=='worker_public'
order: 800
types:
- Ingress
Show more
2. Apply the policy.



* Linux:

calicoctl apply -f filepath/deny-lb-port-80.yaml
* Windows and OS X:

calicoctl apply -f filepath/deny-lb-port-80.yaml --config=filepath/calicoctl.cfg



3. Using the value from your cheat sheet, verify that you now can't access the public NLB IP address. The connection times out because the Calico policy you created is blocking traffic to the NLB.

curl --connect-timeout 10 <loadbalancer_IP>:80
4. In a text editor, create a low-order Pre-DNAT policy called allowlist.yaml to allow traffic from your system's IP to the NLB IP address and port. Using the values from your cheat sheet, replace <loadbalancer_IP> with the public IP address of the NLB and <client_address> with the public IP address of your system's source IP.
You as a cloud developer can use standard interfaces from your applications for cryptographic operations with data integrity and confidentiality. Hyper Protect Crypto Services supports secure connectivity from cloud application to cloud HSM, and allows for enterprise control of Cloud HSM for application keys.

As IBM is starting to provide a new set of capabilities to support your workloads to move to the cloud, you can benefit from the cryptographic capabilities of Hyper Protect Crypto Services for both your new and existing workloads. With the introduction of Enterprise PKCS #11 over gRPC (GREP11), you have access to a full range of cryptographic operations, such as signing, signature validation, message authentication codes, random number generation.

Some code samples for [using GREP11 with Golang](https://github.com/IBM-Cloud/hpcs-grep11-go) and [JavaScript](https://github.com/IBM-Cloud/hpcs-grep11-js) are available for you to try out.

Zoom

![EP11 HSM](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/PKCS11.svg)

Figure 7. Cryptographic operations with Enterprise PKCS #11





 What's next 



* You can use Hyper Protect Crypto Services as the root key provider for other IBM Cloud services. For more information about integrating Hyper Protect Crypto Services, check out [Integrating services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).
* Use Hyper Protect Crypto Services to provide highly secured key management capability for your encryption keys. To find out more about programmatically managing your keys, check out the [Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
* To find out more about encrypting your data by using the cloud HSM function of Hyper Protect Crypto Services, check out the
For more information about adding an inbound rule, see [Managing security groups](https://cloud.ibm.com/docs/security-groups?topic=security-groups-managing-sg).
5. Ensure that Java™ SDK is installed on your VM or use the following command to install it: yum install -y tar java.
6. Optional. If you need to store secrets in Key Protect, perform base64 encoding of the value. For more information about the required command details, see [Image signing: generating a GPG key](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-image-signing).





 Related content 



* [Getting started with toolchains](https://cloud.ibm.com/devops/getting-started)
* [Getting started with Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-getting-started)









 Step 1: Create the toolchain 

To create a Develop an application for a Virtual Machine toolchain, click

[![Create toolchain](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/create_toolchain_button.png)](https://cloud.ibm.com/devops/setup/deploy?repository=https%3A%2F%2Fgithub.com%2Fopen-toolchain%2Fsimple-vsi-toolchain&env_id=ibm:yp:us-south)

Alternatively, from the IBM Cloud console, click the menu icon ![hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg), and select DevOps.
If no utterance is received before the timeout occurs, the phone integration sends a message to the assistant that includes the post_response_timeout_occurred property set to true. 
 cdr_custom_data Object A JSON object containing key/value pairs to be stored in the CDR record for the call. Each time this object is sent, its contents are merged with data sent previously during the call. 
 turn_settings.timeout_count Integer The time (in milliseconds) to wait for Watson Assistant to finish processing each conversation turn. 







 Example request JSON 

"voice_telephony" : {
"post_response_timeout_count":10000,
"final_utterance_timeout_count":30000,
"turn_settings": {
"timeout_count": 5000
},
"cdr_custom_data" : {
"custom_data_1": "data 1",
"custom_data_2": "data 2"
}
}







 text_messaging 

Included only if the SMS with Twilio integration is in use.



 Properties 

Properties contained in the private object are treated as private variables, which are not included in logs.



Properties of the text_messaging object

 Name Type Description 

 assistant_phone_number String The phone number associated with with the Watson Assistant end of the conversation. 
 private.user_phone_number String The phone number from which the customer's SMS message originated. 







 Example JSON 

"text_messaging": {
"private":{
"user_phone_number":"+18595553456"
},
"assistant_phone_number":"+18885556789"
}







 whatsapp 

Included only if the WhatsApp integration is in use.



 Properties 

Properties contained in the private object are treated as private variables, which are not included in logs.



Properties of the whatsapp object

 Name Type Description 

 assistant_phone_number String The phone number associated with with the Watson Assistant end of the conversation.
[CheckPoint Connection Configure Pre-shared Key](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-checkpoint-configure-pre-shared-key.png)

Figure 8: CheckPoint connection configure pre-shared key
9. To enable directional match, select Menu > Global properties > VPN > Advanced, then click Enable VPN Directional Match in VPN Column.

Zoom

![CheckPoint Connection Enable Directional Match](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-checkpoint-enable-directional-match.png)

Figure 9: CheckPoint connection enable directional match
10. To add directional matching VPN rules, select SmartConsole > Security Policies > Access Control > Policy, then add a new VPN rule. The directional rule must contain these directional matching conditions:



* Your VPN community > Your VPN community
* Your VPN community > Internal_Clear
* Internal_Clear > Your VPN community



Zoom

![CheckPoint Connection Add Directional Matching VPN Rules](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-checkpoint-add-directional-vpn-policy.png)

Figure 10: CheckPoint connection add directional matching VPN rules
11. To install the policy, select SmartConsole > Security Policies, then click Install Policy.

Zoom

!
The next step is to configure the client end of the communication to trust the queue manager certificate. Choose the administration tool that you would like to use and follow the appropriate instructions below.



* [Configuring security for remote administration using IBM MQ Explorer](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_remote_ssl_exp_admin)
* [Configuring security for remote administration using runmqsc CLI](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_remote_ssl_runmqsc_admin)







 Securing Application Connections 

The next step is to configure your application connection so that it is uses TLS encryption when connecting to the queue manager.



* [Connect securely from MQI C & JMS application](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_connect_app_ssl)
[Add IKE v2 Policy](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-add-ike-v2-policy2.png)

Add IKE v2 Policy
* Configure the IPSec Proposal settings, which define the combination of security protocols and algorithms that secure traffic in an IPsec tunnel.

Zoom

![Add IKE v2 IPSec Proposal](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-add-ike-v2-ipsec-proposal2.png)

Add IKE v2 IPSec Proposal
* Specify the Pre-shared Key that is defined on both the local and remote device. The key can be 1-127 alphanumeric characters. Then, click NEXT.

Zoom

![Pre-Shared Key](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-pre-shared-key2.png)

Pre-shared Key



5. Review the summary and click FINISH.
6. Create an access control policy to permit traffic across the VPN. To do so, follow these steps:



1. Click Policies from the menu bar.
2. Click the + button to add an access rule. Select your local network object for Source, and your remote network object as Destination. You can create network objects for the Source and the Destination.
3. Select Allow for Action, and then click OK.



Zoom

!
In the navigation menu, click the All Products & Services icon.
2. Click Phone Numbers.
3. Under Manage Numbers, configure the phone number you want your assistant to use. Select Buy a Number to buy a new number, or Port & Host to port an existing phone number.
4. In the Active Numbers list, click the new phone number.
5. Under Voice and Fax, configure the following settings:



* For CONFIGURE WITH field, select Webhook, TwiML Bins, Functions, Studio, or Proxy.
* For A CALL COMES IN, select Studio Flow. Select your flow from the drop-down list.
* For PRIMARY HANDLER FAILS, select Studio Flow. Select your flow from the drop-down list.



6. Go to the Watson Assistant user interface, open the phone integration settings for your assistant.
7. In the Phone number field, type the phone number you configured in Flex Studio.
8. Click Save and exit.







 Test your phone number 

You can now test that your phone number is connected to your flow by triggering a Say/Play widget in the Twilio Flex Flow editor.



1. Drag a Say/Play widget onto your flow canvas.
2. Configure the Say/Play widget with a simple phrase like I'm alive..
3. Connect the Incoming call node on your Trigger widget to your Say/Play widget.
4. Call your phone number. You should hear your Twilio flow respond with your test phrase.
5. Delete the Say/Play widget and continue to the next step.
6. If this test did not work as expected, double check your phone number configuration to make sure its attached to your flow.







 Creating a Twilio function to handle incoming calls 

Now we need to configure the call flow to direct inbound calls to the assistant using a Twilio function. Follow these steps:



1. In the navigation menu, click the All Products & Services icon.
2. Click Services.
3.
* For known limitations and restrictions, see [Known limitations](https://cloud.ibm.com/docs/dl?topic=dl-known-limitations).







 Partner-specific instructions 



* [AT&T NetBond for Cloud](https://cloud.ibm.com/docs/dl?topic=dl-netbond)
* [AT&T NetBond Essentials via Equinix Fabric](https://cloud.ibm.com/docs/dl?topic=dl-att-netbond-essentials)
* [Cologix](https://cloud.ibm.com/docs/dl?topic=dl-cologix-instructions)
* [DE-CIX](https://cloud.ibm.com/docs/dl?topic=dl-de-cix)
* [Equinix](https://cloud.ibm.com/docs/dl?topic=dl-equinix)
* [Megaport](https://cloud.ibm.com/docs/dl?topic=dl-megaport)
* [Verizon SCI via Equinix Fabric](https://cloud.ibm.com/docs/dl?topic=dl-verizon-sci)







 Ordering instructions 

To order Direct Link Connect, follow these steps:



1. Log in to your [IBM Cloud account](https://cloud.ibm.com/login).
2. Click Menu ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl/images/menu_icon.png) on the upper left of the page, then click Interconnectivity.
3. Scroll to locate the Connect tile, then click Order Direct Link Connect.

Alternatively, you can click Direct Link on the left navigation pane to view the Direct Link page, which lists existing Direct Link instances. From this page, you can click Order Direct Link > Direct Link Connect.
4.
Integration channel support 



 Phone 

 ![Yes](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/checkmark-icon.svg) 







 Fields 



 Name Type Description Required? 

 response_type string stop_activities Y 
 activities list A list of objects identifying the activities to stop. Y 
 activities[].type string The name of the activity to stop. Y 



Currently, the following activities for the phone integration can be stopped:



* speech_to_text_recognition: Stops recognizing speech. All streaming audio to the Speech to Text service is stopped.
* dtmf_collection: Stops processing of inbound DTMF signals.







 Example 

This example uses the stop_activities response type to stop recognizing speech. Because this command is specific to the phone integration, the channels property specifies voice_telephony only.

{
"generic": [
{
"response_type": "stop_activities",
"activities":
{
"type": "speech_to_text_recognition"
}
],
"channels":
{
"channel":"voice_telephony"
}
]
}
]
}
Show more







 text 

Displays text (or reads it aloud, for the phone integration). To add variety, you can specify multiple alternative text responses. If you specify multiple responses, you can choose to rotate sequentially through the list, choose a response randomly, or output all specified responses.



 Integration channel support 



 Web chat Phone SMS Slack Facebook WhatsApp 

 ![Yes](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/checkmark-icon.svg) !
Select a location.
2. Set the name to secure-file-storage-kp.
3. Select the resource group where to create the service instance and click Create.



2. Under Keys, click the Add button to create a new root key. It will be used to encrypt the storage bucket and App ID data.



1. Set the key type to Root key.
2. Set the name to secure-file-storage-root-enckey.
3. Then Add key.





Bring your own key (BYOK) by [importing an existing root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keysimport-root-keys).





 Setup storage for user files 

The file sharing application saves files to a Object Storage bucket. The relationship between files and users is stored as metadata in a IBM Cloudant database. In this section, you'll create and configure these services.



 A bucket for the content 



1. Create an instance of [Object Storage](https://cloud.ibm.com/catalog/services/cloud-object-storage).



1. Select a Standard plan and Set the name to secure-file-storage-cos.
2. Use the same resource group as for the previous services and click Create.



2. Under Service credentials, create a New credential.



1. Set the name to secure-file-storage-cos-acckey.
2. Set Role to Writer.
3. Under Advanced options, check Include HMAC Credential. This is required to generate pre-signed URLs.
4. Click Add.
5. Make note of the credentials. You will need them in a later step.



3. Click Endpoints from the menu:



1. Set Resiliency to Regional and set the Location to the target location:
2. For Classic infrastructure: Copy the Private service endpoint. It will be used later in the configuration of the application.
3.