vania-janet/multiturn-rag-retrieval-data huggingface dataset:
function_namespace Required for Functions The IBM Cloud® Functions namespace that you want to use. The namespace is composed from your Cloud Foundry organization and space in the format <org>_<space>. You can specify the namespace in your provider block or retrieve the value from the FUNCTION_NAMESPACE environment variable. 
 generation Required for VPC infrastructure (Deprecated) The generation of Virtual Private Cloud infrastructure that you want to use. If this value is not specified, 2 is used by default. You can specify the generation in your provider block or retrieve the value from the IC_GENERATION or IBMCLOUD_GENERATION environment variables. If both environment variables are defined, IC_GENERATION takes precedence. 
 max_retries Optional The maximum number of times that a request to the IBM Cloud infrastructure API is sent before the request is considered failed. The default value is 10. Use this parameter when you receive network-related timeouts or rate limit exceeded error codes. You can specify the number in your provider block or retrieve the value from the MAX_RETRIES environment variable. 
 region Optional The IBM Cloud region where you want to create your resources. If this value is not specified, us-south is used by default. You can specify the region in the provider block or retrieve the value from the IBMCLOUD_REGION or IC_REGION environment variables. If both environment variables are specified, IC_REGION takes precedence. 
 resource_group Optional The ID of the resource group that you want to use for your IBM Cloud resources. To retrieve the ID, run ibmcloud resource groups. You can specify the resource group in the provider block or retrieve the value from the IC_RESOURCE_GROUP or IBMCLOUD_RESOURCE_GROUP environment variables. If both environment variables are defined, IC_RESOURCE_GROUP takes precedence. 
 zone Required for Power Systems The zone of an IBM Cloud region where you want to create Power System resources. This value is required if you want to work with resources in a multizone-capable region. For example, if you want to work in the eu-de region, you must enter eu-de-1 or eu-de-2. You can specify the zone in the provider block or retrieve the value from the IC_ZONE or IBMCLOUD_ZONE environment variables.
* [Management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-management)



* [Regions and zones](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-management-regions-zones)
* [Subnets for management tools](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-management-subnets)
* [Connectivity inbound to VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-management-connectivity-inbound)
* [Bastion host](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-management-connectivity-vpn)
* [Connectivity between VPCs](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-management-connectivity)



* [Workload VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-workload)



* [Regions and zones](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-regions-zones)
* [Connectivity to workload VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsivpc-architecture-detailed-workload-connectivity)
* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationsingle-deployment-vpc)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationsingle-deployment-satellite)



* [Organization for multiple deployments](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationmultiple-deployments)



* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationmultiple-deployments-vpc)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationmultiple-deployments-satellite)



* [Scaling the number of deployments within an account](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationscaling-deployments)



* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationscaling-deployments-satellite)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationscaling-deployments-satellite)



* [Managing scalability with an enterprise](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationenterprises)



* [Rationale for using an enterprise](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationenterprises-rationale)
CM-4 (1) - Separate Test Environments 



  Control requirements 

CM-4 (1) - 0
:   The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.





  Additional IBM Cloud for Financial Services specifications 



*  The test environment must mirror the production environment.
*  Customer data must not be placed into non-production environments.







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities
*  Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely
*  Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts
*  Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities
*  Check whether DevSecOps Toolchain source code contains no secrets
*  Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code
*  Check whether DevSecOps Toolchain passes acceptance tests to validate every deployment







  NIST supplemental guidance 

Separate test environment in this context means an environment that is physically or logically isolated and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment, and information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not used, organizations determine the strength of mechanism required when implementing logical separation (e.g., separation achieved through virtual machines).
* --region: Cloud Object Storage region (us-east, us-south, eu-de). Required if destination is cloud-storage.
* --image-path: Cloud Object Storage image path. Required if destination is cloud-storage.
* --job: The operation will be processed as a job.
* --task: [DEPRECATED] The operation will be processed as a task. Task processing is deprecated in favor of job processing. Default.



--------------------







 ibmcloud pi instance-capture-show 



 View the job details of the last server instance capture 

ibmcloud pi instance-capture-show INSTANCE_ID [--json]



* INSTANCE_ID: The unique identifier or name of the instance.



Options



* --json: Format output in JSON



--------------------







 ibmcloud pi instance-create 



 Create a server instance
* You have a vCenter Server instance with vSAN. This solution architecture does not dictate the type of vSphere data store.
* You have extra optional services, such as Caveonix, VMware Aria Operations Manager, and VMware Aria Operations™ for Logs.
* You select a different option for the Veeam service as three options are available. This solution architecture does not dictate the VM option for the Veeam service. VSI or bare metal options are also available. For more information, see [Veeam Backup and Replication 12 overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview).
* You expand your Veeam service from a simple deployment "all-in-one" to an advanced deployment by deploying extra Veeam components on different servers.
* You select a different ADDNS option. This solution architecture does not dictate the type of option, either two VMs or a single VSI options are available. For more information, see [Domain Name System Configuration](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_orderinginstance-network-interface-settingsvc_orderinginstance-dns-config).



If you have a vCenter Server instance that is deployed with the Veeam service added and Veeam is version 12, then this is a suitable base topology for the immutable backup solution architecture. The immutable backup solution architecture consists of:



* Linux hardened repository - The hardened repository is one or more IBM Cloud bare metal servers that run a supported Linux OS. The hardened repository is configured as an immutable storage repository. The IBM Cloud bare metal servers are ordered with internal disks and a RAID card to present this directly attached storage to the OS to be used as a backup repository.
* Optionally, the immutable backup solution architecture can include one or more sandboxes.
The internode network is only used for communication between nodes and the data transfer that might be required between the nodes during operations.



Within each environment is a separate networking design. The classic infrastructure environment network is the forerunner and is the most robust option of many traditional and physical networking concepts. The VPC Infrastructure environment network is a software-defined network. The IBM Power environment network (as a complementary offering from IBM Power Systems) is designed with networking principles for enterprise-grade performance.

Given these environment networks are different, configuring additional NIC throughput changes for the different infrastructure options:



* Bare Metal, on Classic Infrastructure network: To maximize performance and redundancy, the physical network interfaces (NIC) are provided with 10 Gbps and then provisioned with bonding using Link Aggregation Control Protocol (LACP). The switches are configured automatically when ordering redundancy on the physical NIC. Additional NIC cards might be added, depending on the physical machine specificiation and physical switch availability of ports.
* Intel Virtual Server, on VPC Infrastructure network: To maximize performance and redundancy, up to 5 network interfaces (vNIC) on multiple Subnets can be added.
* IBM Power Virtual Server, on IBM Power Infrastructure network: To maximize performance redundancy, multiple network interfaces (vNIC) attached to different VLANs (and their respective Subnets) can be added.
* VMware for SAP, on Classic Infrastructure network....



* IBM Cloud for VMware Solutions, on Classic Infrastructure network: redundant adapters for VMware are set up by the VMware vSphere Distributed Switch (VDS) using either [VDS on NSX-V](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-nsx-v-designnsx-v-design-distr-switch) or [VDS on NSX-T](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-nsx-t-designnsx-t-design-distr-switch), in accordance with current VMware best practices for SDDC.
Then, you use Terraform on IBM Cloud to rapidly build, configure, and replicate the resources in your cloud environments. 
 Automate cloud resource lifecycle By using Terraform templates to build your cloud environment, you can orchestrate the provisioning, update, and deletion of your IBM Cloud resources, and easily replicate your configuration across environments. 
 Enable Infrastructure as Code By codifying your cloud environment, you can treat your Terraform templates the same way as you treat your app code. You can author your templates in any code editor, check them into a version control system such as GitHub, and let your team review and monitor updates before you apply these changes in your cloud environment. By applying these DevOps core practices, you can enable Infrastructure as Code (IaC) for your cloud environments. 







 Key terms 

Learn about the key terms that are used in Terraform on IBM Cloud.



Key terms

 Term Description 

 IBM Cloud Provider plug-in for Terraform To support a multi-cloud approach, Terraform works with different cloud providers. A cloud provider is responsible for understanding the resources that you can provision, their API, and the methods to expose these resources in the cloud. To make this knowledge available to users, each cloud provider must provide a command-line plug-in for Terraform. The IBM Cloud Provider plug-in is IBM's command-line plug-in for Terraform. 
 Data source Data sources are Terraform objects that you can use to retrieve information about IBM Cloud resources that you previously provisioned with Terraform on IBM Cloud. 
 Resource Resources are Terraform objects that refer to IaaS, PaaS, or SaaS services that you can provision, update, or delete in IBM Cloud. Typical examples include bare metal servers, virtual servers, auto scaling groups, load balancers, or non-infrastructure related services, such as Key Protect or Identity and Access Management (IAM) access policies. The resources that are supported in Terraform on IBM Cloud are defined by the IBM Cloud Provider plug-in for Terraform. 
 Terraform configuration file A Terraform configuration file defines the IBM Cloud resources that you want to create. You can configure one resource per file, or combine multiple resources in one file.
* UI
* CLI
* API







 x86 instance profiles 

When you provision IBM Cloud® Virtual Servers for Virtual Private Cloud, you can select from six families of profiles: Balanced, Compute, Memory, Very High Memory, Ultra High Memory, Storage Optimized, and GPU.

A profile is a combination of instance attributes, such as the number of vCPUs, amount of RAM, network bandwidth, and default bandwidth allocation. The attributes define the size and capabilities of the virtual server instance that is provisioned. In the IBM Cloud console, you can select the most recently used profile or click View All Profiles to choose the profile that best fits your needs.

For more information about profiles for IBM Z (s390x processor architecture), see [s390x instance profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-vs-profiles).

The following profile families are available:



Table 2. Virtual server family selections

 Families Description 

 [Balanced](https://cloud.ibm.com/docs/vpc?topic=vpc-profilesbalanced) Balanced profiles offer a core to RAM ratio 1 vCPU to 4 GiB of RAM ratio and are best for midsize databases and common cloud applications with moderate traffic. 
 [Compute](https://cloud.ibm.com/docs/vpc?topic=vpc-profilescompute) Compute profiles offer a core to RAM ratio 1 vCPU to 2 GiB of RAM ratio and are best for moderate to high web traffic workloads. Compute profiles are best for workloads with intensive CPU demands, such as high web traffic workloads, production batch processing, and front-end web servers. 
 [Memory](https://cloud.ibm.com/docs/vpc?topic=vpc-profilesmemory) Memory profiles offer a core to RAM ratio 1 vCPU to 8 GiB of RAM ratio and are best for memory caching and real-time analytics workloads. Memory profiles are best for memory intensive workloads, such as large caching workloads, intensive database applications, or in-memory analytics workloads.
Getting started with virtual servers 

You can deploy IBM Cloud® Virtual Servers in a matter of minutes. The virtual servers are deployed from your choice of virtual server images and in the geographic region that makes sense for your workloads.

Newer version available. Try our Virtual Servers for VPC. For more information, see [Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).

When you create a virtual server in the classic infrastructure, you can choose between a public (multi-tenancy) environment or a dedicated (single-tenancy) environment. Then, depending on the chosen environment, you must also select hourly, monthly, or transient virtual servers. With public virtual servers, you also choose to use either SAN-based storage or local storage.



 Before you begin 

Before you begin, review the following prerequisites.



1. You must have an upgraded account to order virtual servers. This process can take some time and requires your request to be approved before you can continue. For more information about upgrading your account, see [Account types](https://cloud.ibm.com/docs/account?topic=account-accounts).
2. Review and choose your deployment options. For more information, see the following topics:





Table 1. Deployment options

 Deployment options Description 

 [Public virtual server](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-public-virtual-servers) IBM-managed, multi-tenancy virtual server deployments 
 [Transient virtual server](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-vs-transient) IBM-managed, multi-tenancy virtual server deployments offered at a reduced cost and best suited for flexible workloads 
 [Reserved virtual server](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-reserved-virtual-servers) IBM-managed, multi-tenancy virtual server deployments with guaranteed capacity for a contract term
Physical infrastructure design 

The physical infrastructure consists of the following components:



* Physical compute - The physical compute provides the physical processing and memory that is used by the virtualization infrastructure. For this design, the compute components are provided by IBM Cloud® bare metal server for IBM Cloud VPC.
* Physical network - The physical network provides the network connectivity into the environment that is used by the network virtualization. The network is provided by the IBM Cloud VPC.
* Physical storage - The physical storage provides the raw storage capacity that is used by the virtualization infrastructure. Storage components are provided either by NVMe U.2 SSDs attached to IBM Cloud bare metal server for IBM Cloud VPC or by IBM Cloud VPC file share that uses NFS v4.1.



Zoom

![Physical infrastructure](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-overview-physical.svg)

Figure 1. Physical infrastructure



 Physical compute design 

Each VMware® deployment begins with a minimum of two hosts, depending on the choice of storage solution and High Availability (HA) architecture that you want. You are responsible to design your VMware deployment and its clusters to meet your HA goals.

The server configurations available in the solution meet or exceed the minimum requirements to install, configure, and manage vSphere® ESXi™. The IBM Cloud bare metal server for VPC on IBM Cloud VPC uses second Generation Intel® Xeon® Platinum 8260 processors.

Various configurations for CPU, RAM, and storage are available to satisfy different requirements. These predefined configurations are called profiles, for example bx2d-metal-192x768. The following information describes the naming rule of the profiles:



* b represents a Balanced family profile.
* x represents the x86_64 CPU architecture.
* 2 represents the current generation of processors (Cascade Lake).
* d represents NVMe U.2 SSDs.
One of the most important features of the reference architectures is the definition of physical and logical separation between the edge, management, and workload planes. It is your responsibility to ensure that separation stays in place.

Implementation guidance: Explore and choose one of the supported reference architectures for the IBM Cloud for Financial Services:



* [IBM Cloud® Virtual Private Cloud reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-about), with options for using one or both of:



* [IBM Cloud® Virtual Servers for Virtual Private Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsi)
* [Red Hat® OpenShift® on IBM Cloud®](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-openshift)



* [IBM Cloud Satellite® reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-about)
* [IBM Cloud® for VMware® Regulated Workloads reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vmware-overview)



Most Relevant Controls:



Table 1. Related controls for use of reference architecture

 Family Control 

 System and Communications Protection (SC) [SC-2 Application Partitioning](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2) <br>[SC-3 Security Function Isolation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-3) 







 2. Use only services that are IBM Cloud for Financial Services Validated 

Requirement: Only use IBM Cloud and third-party managed services which are IBM Cloud for Financial Services Validated.
* IBM Cloud Object Storage
* IBM Cloud Databases for PostgreSQL
* IBM Key Protect for IBM Cloud
* IBM Cloud® Continuous Delivery
* IBM Cloud Container Registry
* IBM Cloud Kubernetes Service
* Red Hat OpenShift on IBM Cloud



The IBM Cloud platform, including the console, CLI, Identity and Access Management, and global catalog, is a globally accessible instance that is independent of any region or zone. Global resources like the platform are accessible from a global endpoint.





 Deployment Tiers 

IBM identifies the following deployment tiers that can contain core services, market driven services or both.



Table 1. Deployment tiers and service types

 Deployment tier Core service Market-driven services 

 [MZR](https://cloud.ibm.com/docs/overview?topic=overview-locationstable-mzr) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) 
 [Single campus MZR](https://cloud.ibm.com/docs/overview?topic=overview-locationssingle-campus-mzr) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/icons/checkmark-icon.svg) !