vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"subtype":
"AdministrativeDivision",
"GovernmentalJurisdiction",
"OlympicHostCity",
"PlaceWithNeighborhoods",
"CityTown",
"City"
],
"name": "Atlanta",
"dbpedia_resource": "http://dbpedia.org/resource/Atlanta"
}
},
{
"type": "Location",
"text": "Georgia",
"disambiguation": {
"subtype":
"StateOrCounty"
]
}
}
]
},
"action": {
"verb": {
"text": "be",
"tense": "past"
},
"text": "were",
"normalized": "be"
}
}
]
Show more

In the preceding example, you could query the relation subject text by accessing enriched_text.relations.subject.text

sentiment is calculated for relations even if the sentiment enrichment is not selected. To learn more about sentiment scoring, see [Sentiment analysis](https://cloud.ibm.com/docs/discovery?topic=discovery-configservicesentiment-analysis). It does not extract entities or keywords (as shown in the example) unless you also select the entity and keyword enrichments. See [Entity extraction](https://cloud.ibm.com/docs/discovery?topic=discovery-configserviceentity-extraction) and [Keyword extraction](https://cloud.ibm.com/docs/discovery?topic=discovery-configservicekeyword-extraction) about those enrichments.

The subject, action, and object are extracted for every sentence that contains a relation.





 Sentiment analysis 

Identifies attitude, opinions, or feelings in the content that is being analyzed.
What are the best practices that you must follow in creating a workspace for the Terraform template? 

Follow these practices in creating a workspace for the Terraform template.



* Check whether you have the [right permissions](https://cloud.ibm.com/docs/schematics?topic=schematics-access) to create a workspace.
* Check whether the location and the url endpoint are pointing to the same region when you create or update the Schematics Workspace. For more information about location and endpoint, see [Where is the information stored](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datapi-location)?
* Check whether you want to [delete the Workspace](https://cloud.ibm.com/docs/schematics?topic=schematics-sch-delete-wks) and [destroy](https://cloud.ibm.com/docs/schematics?topic=schematics-sch-destroy-wks) the associated cloud resources, or both. This job cannot be undone. If you remove the workspace and keep the cloud resources, you need to manage the resources with the resource list or CLI.
* Do not use one workspace to manage an entire staging or production environment. When you deploy all your IBM Cloud resources into a single workspace, it can become difficult for various teams to coordinate updates and manage access for these resources.







 How can you ensure that the sensitive data used by the Terraform automation, do not leak in the logs or outputs? 

You need to set the variable or output parameter as sensitive to make sure that the data is not leaked in the logs or outputs.





 How can you protect the access to workspaces and its data? 

As the account owner or an authorized account administrator, you can assign IBM Cloud® Identity and Access Management (IAM) service access roles to your users. The IAM service access roles determine the actions that you can set on an IBM Cloud Schematics resource, such as a workspace or an action.
![Sample application architecture](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/overview/images/BCDR-Architecture-Diagram-image4_sample_architecture.svg)

Figure 4. An architecture diagram showing a sample application architecture



 Continuous availability profile 

The [continuous availability recovery class](https://cloud.ibm.com/docs/overview?topic=overview-understanding-drplan-objectives) can be defined as one for applications that requires the platform to be available in less than an hour in the event of a disaster where the primary MZR becomes unavailable.



 Continuous availability profile - Compute 

Zoom

![Continuous availability compute architecture](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/overview/images/BCDR-Architecture-Diagram-image5-Compute.svg)

Figure 5. Continuous availability compute architecture

In order to meet continuous availability RTO/RPO goals, these components will need to be preconfigured and at their production workload capacity.

The size of the Kubernetes Service clusters in US East might need to be only large enough to support continuous availability and advanced recovery class workloads. All applications can always be deployed there (as they are today in Dedicated), but for standard recovery and no-recovery class applications they could be stopped. The idea would be to allow for higher availability requirement apps to immediately become available with enough capacity to run them if a failure occurs. But to save money, the cluster would be scaled up to match only the primary cluster and support the lower requirement workloads when needed. These apps have longer RTO in which the scaling operation would complete.

The same technique can be applied to updates to the Code Engine applications or Kubernetes Service clusters. The first step would be to scale up the backup cluster to full capacity, matching the primary cluster, before starting the upgrade.
Databases <br><br> * [Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-databases-ihsdbaas_mongodb)<br> * [Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-databases-ihsdbaas_postgresql)<br><br><br> 



The remainder of the topic goes into more detail about how these services fit into the reference architecture.



 Core 



 IBM Cloud Satellite 

Most of the services that are mentioned run entirely in IBM Cloud but two exceptions:



* Satellite, which as described earlier, has some components that run in IBM Cloud and some components that run in your Satellite location.
* Red Hat OpenShift on IBM Cloud, which refers to the Red Hat OpenShift on IBM Cloud-enabled type of the service, runs in your Satellite location.



These exceptions have implications for what it means to be Financial Services Validated and that is represented in the following diagram and details.

Zoom

![Financial Services Validated components in the Satellite reference architecture](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/satellite/images/satellite-fs-validated-definition/satellite-fs-validated-definition.png)

Figure 2. Financial Services Validated components in the Satellite reference architecture



* Satellite components that run in IBM Cloud are validated to the same IBM Cloud Framework for Financial Services controls as any other Financial Services Validated product.
* Satellite components and IBM Cloud services that run in your on-premises environment that do not have a dependency on your configuration or underlying internal network and infrastructure components, are also validated to the applicable controls that were validated for these components in IBM Cloud.
AmazonS3 cosClient = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(credentials))
.withEndpointConfiguration(new EndpointConfiguration(endpoint_url, location)).withPathStyleAccessEnabled(true)
.withClientConfiguration(clientConfig).build();
return cosClient;
}
}
Show more



 Examine a bucket’s lifecycle configuration, including expiration 

This implementation of the GET operation uses the lifecycle query parameter to examine lifecycle settings for the bucket. An HTTP 404 response will be returned if no lifecycle configuration is present.

Cloud IAM users must have the Reader role to examine a lifecycle policy from a bucket.

Classic Infrastructure Users must have Read permissions on the bucket to examine a lifecycle policy from a bucket.

Syntax

GET https://{endpoint}/{bucket}?lifecycle path style
GET https://{bucket}.{endpoint}?lifecycle virtual host style

Example Header Request

GET /images?lifecycle HTTP/1.1
Host: s3.us.cloud-object-storage.appdomain.cloud
Date: Wed, 7 Feb 2018 17:50:00 GMT
Authorization: authorization string
Content-Type: text/plain
Content-Length: 305

Using the IBM Cloud® Object Storage SDKs only requires calling the appropriate functions with the correct parameters and proper configuration.

var aws = require('ibm-cos-sdk');
var ep = new aws.Endpoint('s3.us-south.cloud-object-storage.appdomain.cloud');
var config = {
endpoint: ep,
apiKeyId: 'ZRZDoNoUseOLL7bRO8SAMPLEHPUzUL_-fsampleyYE',
ibmAuthEndpoint: 'https://iam.cloud.ibm.com/identity/token',
Understanding the Object Storage credentials 

IBM Cloud Object Storage access credentials are configured as key-value pair parameters in IBM Analytics Engine. These parameters start with the prefix fs.cos. followed by an identifier, which you can define, and end with the name of the credential.

Note that you can configure one IBM Analytics Engine service instance to work with multiple Object Storage instances or multiple Object Storage credentials. To differentiate between the different sets of credentials, you use separate identifiers or literals, which you can defined.

The following diagram shows how the Object Storage credentials are used in IBM Analytics Engine.

Zoom

![Authentication to Object Storage resources from IBM Analytics Engine](https://cloud.ibm.com/docs-content/v1/content/cd4be197c8921ed12923aa899ac93a8ab643c158/AnalyticsEngine/images/cos-credentials-in-iae.svg)

Figure 1. A description of the read and read-write credential options in Cloud Object Storage

The diagram shows two Object Storage instances with two different data buckets b1 and b2. To distinguish between the two instances, two identifiers are used, cosInstance1 and cosInstance2. Note that the bucket names (b1 and b2) that you use must be the actual names of the existing buckets in Object Storage. You can only choose the name of the identifier so that you can distinguish between Object Storage instances.



 Structure of HMAC credentials 

For HMAC style authentication, you must define the following parameters in IBM Analytics Engine:

fs.cos.<identifier>.access.key=<Access Key ID>
fs.cos.<identifier>.endpoint=<EndPoint URL>
fs.cos.<identifier>.secret.key=<Secret Access Key>

Note that the endpoint URL has the format s3.direct.us.cloud-object-storage.appdomain.cloud and doesn't require the prefix https://.





 Structure of API key credentials
If you're using the CLI or API to assign access, use cognos-dashboard for the service name.

Platform roles

Service roles

Actions



Table 21. Platform roles - Cognos Dashboard
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 IBM Cloud Compliance and Security Center 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use compliance for the service name.

Platform roles

Service roles

Actions



Table 22. Platform roles - IBM Cloud Compliance and Security Center
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Consult with IBM Cloud Garage 

Review the available platform and service roles and the actions mapped to each to help you assign access.
An NSX® load balancer is configured to spread load across these VMs for ports 6443 and 22623, exposing the api and api-int functions.





 Worker hosts 

The worker hosts are Red Hat Enterprise Linux CoreOS (RHCOS), a new container-oriented operating system designed for running containers. The worker nodes are known as the data-plane, where the actual Kubernetes workloads are deployed. An NSX load balancer is configured to spread load across these VMs for ports 80 and 443, exposing the wildcard DNS and *.apps.





 Common services 

The Red Hat OpenShift deployment uses the following components of the IBM Cloud for VMware Solutions SDDC architecture to help with the execution and installation:



* Time services
* Domain name resolution
* NSX load balancers
* NSX DHCP services
* NSX software defined networking



For more information, see [IBM Cloud for VMware Solutions SDDC architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vcs-openshift-arch).





 Related links 



* [VMware vCenter Server and Red Hat OpenShift architecture overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vcs-openshift-intro)
* [System context for vCenter Server and Red Hat OpenShift architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vcs-openshift-syscontext)
* [IBM Cloud networking and infrastructure](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vcs-openshift-sddc-infra)
* [Storage options on IBM Cloud and Red Hat OpenShift](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vcs-openshift-storage)
The Region, Resource group, and Service name fields are automatically populated based on available choices. Click the drop-down indicators to see the other choices.





 Evidence Storage 

The evidence repository stores all the evidence and artifacts that are generated by the DevSecOps CI pipeline.

Toggle the COS bucket slider to also store all the evidence in a Cloud Object Storage bucket that can be configured on the next page.





 Cloud Object Storage bucket 

To use this feature, you must have a Cloud Object Storage instance and a bucket. [Click here](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-bucket-evidence) to create a Cloud Object Storage instance, and [read the recommendation](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-config) for configuring a bucket that can act as a compliance evidence locker.



* Cloud Object Storage instance, Bucket name, and Cloud Object Storage endpoint fields are automatically populated.
* Enter the Service ID API key



* Preferred: An existing key can be imported from a secrets vault by clicking the key icon.
* An existing key can be copy and pasted.





The endpoint field is optional. It is recommended to select or provide the endpoint during the setup of the toolchain or during the pipeline run.





 Deploy 

Configure the target Kubernetes cluster where the application is deployed:



* App name: The name of the application.



* Default: hello-compliance-app



* IBM Cloud API Key: The API key is used to interact with the ibmcloud CLI tool in several tasks.



* Preferred: An existing key can be imported from a secrets vault by clicking the key icon.
* An existing key can be copy and pasted.
* A new key can be created from here by clicking the New +.





The newly generated API key can be immediately saved to a secrets vault.

If the API key is valid and has sufficient access, the Container registry region and namespace Cluster region, name, namespace, and resource group are automatically populated.
Name: myproject
ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Subdomain: aabon2dfwa0
Domain: us-south.codeengine.appdomain.cloud
Region: us-south
Kubectl Context: 4svg40kna19

Kubernetes Config:
Context: aabon2dfwa0
Environment Variable: export KUBECONFIG=/user/myusername/.bluemix/plugins/code-engine/myproject-01234567-abcd-abcd-abcd-abcdabcd1111.yaml

Then, copy the export command, paste it into your command-line interface, and run it.



Verify that your environment is set correctly by running the kubectl config command.

kubectl config current-context

If the context is correctly set, the output matches the Kubectl Context value of your project. For example, if your Kubectl Context value of your project is 4svg40kna19, the command returns 4svg40kna19.

For more information about Kubernetes and how it works with Code Engine architecture, see [Learning about Code Engine architecture and workload isolation](https://cloud.ibm.com/docs/codeengine?topic=codeengine-architecture).





 Required access authorities to work with Knative API 

After you set up your environment, you can interact with Knative API. You must have the correct level of authority for specific tasks. These roles are set in Identity and access management. See [IBM Cloud service roles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iamservice).



Table 1. Knative authorities

 Resource Manager role Writer role Reader role 

 services.serving.knative.dev get, list, watch, create, delete, update, patch, apply, edit get, list, watch, create, delete, update, patch, apply, edit get, list, watch
An XCCDF document represents a structured collection of security configuration rules for some set of target systems.
* Open Vulnerability and Assessment Language (OVAL) – A language that is used to encode system details, and an assortment of content repositories. The language standardizes the three main steps of the assessment process:



* Representing configuration information of systems for testing.
* Analyzing the system (vulnerability, configuration, and patch state)
* Reporting the results of this assessment.





* Security Technical Implementation Guide (STIG) - A cybersecurity methodology for standardizing security protocols within networks, servers, computers, and logical designs to enhance overall security. When these guidelines are implemented, they enhance security for software, hardware, physical, and logical architectures to further reduce vulnerabilities.
* Service Provider - The top-level organization.
* Cloud Provider - Provides the infrastructure that the software defined cloud operates on. RiskForesight can be configured for multiple Cloud Providers.
* Organizations - Tenant organizations and suborganizations of the service provider. If the asset repository is vCenter Server, the organization or tenant list must be created manually.
* Roles - Pre-configured roles and service provider-created roles. Preconfigured roles are not editable by the service provider.
* Organization Users - Users of the Tenant Organizations and Sub-Organizations.
* Asset Repository - An integration point that enables RiskForesight to synchronize the current asset across the CSP (Cloud Service Provider) management zone and customer zone. The current version of RiskForesight supports the synchronization for VMware® Cloud Director and vCenter Server®. It also supports data collection from VMware NSX® Manager. Assets are collected from the Asset Repository. The Service Provider assigns Assets that are collected from vCenter Server to Tenant Organizations and Sub-Organizations of the Service Provider. An Asset can be assigned only to one Organization.
* Remote Access - Provides end machine credentials to enable scans for vulnerability and compliance monitoring and to collect system events logs. The Service Provider can enable remote access for their own assets only. Tenants have control over remote access from their Assets.
* Applications and Subapplications - A logical way to group assets. Example application - SAP.
The initial list of qualified IBM Business Partners for Vyatta 5400 migration assistance is:



List of qualified business partners

 Business Partner Contact Name Contact Information 

 Techwave Chandra Rao - Vice President, Cloud Business [chandra.jampa@techwave.net](mailto:chandra.jampa@techwave.net) 
 SureSkills Kevin Reid [kevin.reid@sureskills.com](mailto:kevin.reid@sureskills.com); +353 87 225 6401 
 Element Solutions Sherry Thompson, Executive Director [sthompson@elementsolutions.com](mailto:sthompson@elementsolutions.com); +1-646-942-1996 
 BlueIT Oreste Guerrini [oreste.guerrini@blueit.it](mailto:oreste.guerrini@blueit.it) 



For more information, contact IBM Cloud Sales at 866.398.7638.
* Built-in HA tools in IBM Cloud Kubernetes Service balance the workload within each geographic region, including self-healing and load balancing.
* With the toolchains and Helm deployment tools, the apps are also deployed to clusters across the globe, so workloads and data meet regional regulations.







 Step 4: Data sharing 



* IBM Cloudant is a modern NoSQL database suitable a range of data-driven use cases from key-value to complex document-oriented data storage and query.
* To minimize queries to the regional databases, IBM Cloudant is used to cache the user's session data across apps.
* This choice improves the front-end app usability and performance across apps on IBM Cloud Kubernetes Service.
* While worker apps in IBM Cloud Kubernetes Service analyze on-premises data and store results in IBM Cloudant, IBM Cloud® Functions reacts to changes and automatically sanitizes data on the incoming feeds of data.
* Similarly, notifications of research breakthroughs in one region can be triggered through data uploads so that all researchers can take advantage of new data.









 Results 



* Microservices greatly reduce time to delivery for patches, bug fixes, and new features. Initial development is fast, and updates are frequent.
* Researchers have access to clinical data and can share clinical data, while they comply with local regulations.
* Patients who participate in disease research feel confident that their data is secure and making a difference, when it is shared with large research teams.
The serializer that is supported is confluent and the data type supported is avro. The schemas are created and stored in the Event Streams schema registry. For more information, see [Event Streams schema registry](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-ES_schema_registry).

The following schema naming strategies are allowed:



* Topic naming strategy: the name of the topic is used to derive the schema artifact ID. The ID takes the form "<topicName>-key" for key and "<topicName>-value" for value, where topicName is the name of topic.
* Record naming strategy: the name of the record in the schema is used to derive the schema artifact ID. The ID takes the form "<composite-recordName>-key" for key and "<composite-recordName>-value" for value. If the schema namespace field is specified, the composite-recordName takes the value of "<namespace>.<recordName>", otherwise it takes the value of "<recordName>".
* TopicRecord naming strategy: Both the name of the topic and the name of the record are used to derive the schema artifact ID. The ID takes the form "<topicName>-<recordName>-key" for key and "<topicName>-<composite-recordName>-value" for value, where topicName is the name of topic. If the schema namespace field is specified, the composite-recordName takes the value of "<namespace>.<recordName>", otherwise it takes the value of "<recordName>".



The following code shows an example of sending a message that conforms to a schema that is specified under the schema field by using curl:

curl -v -X POST 
-H "Authorization: Bearer $token" -H "Content-Type: application/json" -H "Accept: application/json" 
-d '{
"value": {
"type": "avro",