vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Best practices for organizing users, teams, applications 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial gives an overview of the concepts available in IBM Cloud for identity and access management and how they can be implemented to support the multiple development stages of an application.

When building an application, it is very common to define multiple environments. They reflect the development lifecycle of a project from a developer committing code to the application code being made available to the end-users. Sandbox, test, staging, UAT (user acceptance testing), pre-production, production are typical names for these environments.

Isolating the underlying resources, implementing governance and access policies, protecting a production workload, validating changes before pushing them to production, are some of the reasons why you would want to create these separate environments.



 Objectives 



* Learn about IBM Cloud® Identity and Access Management.
* Configure a project with separation between roles and environments.
* Setup continuous integration.







 Define a project 

Let's consider a sample project with the following components:



* several microservices deployed in Kubernetes Service or virtual server instances (VSIs) within IBM Cloud VPC (Virtual Private Cloud),
* databases,
* file storage buckets.



In this project, we define three environments:



* Development - this environment is continuously updated with every commit, unit tests, smoke tests are executed. It gives access to the latest and greatest deployment of the project.
* Testing - this environment is built after a stable branch or tag of the code. This is where user acceptance testing is made. Its configuration is similar to the production environment. It is loaded with realistic data (anonymized production data as example).
* Production - this environment is updated with the version validated in the previous environment.



A delivery pipeline manages the progression of a build through the environment. It can be fully automated or include manual validation gates to promote approved builds between environments - this is really open and should be set up to match the company best practices and workflows.
The hosts that make up the control plane are from IBM Cloud, but the hosts that make up the services are located multiple other customer-owned edge or infrastructure providers. Note that while you can use other IBM Cloud virtual servers, such as Virtual Servers for VPC for test environments, the only supported IBM Cloud infrastructure to use in IBM Cloud Satellite® for production environments is IBM Cloud® Bare Metal Servers for Classic that is running Red Hat CoreOS.

Zoom

![Compute resources in both IBM Cloud and multiple edge or data centers.](https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/topology-3.svg)

Figure 3. Compute hosts in both IBM Cloud and different edge or data centers





 4. Compute hosts are located in multiple edge or data centers 

In this example, the compute resources are located in multiple data centers or edge. IBM manages the Satellite management plane, but the hosts that make up the location, including the control plane and the hosts required for your services are on customer-owned infrastructure.

Zoom

![Compute resources in different edge or data centers.](https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/topology-4.svg)

Figure 4. Compute hosts in different edge or data centers





 5. Compute hosts, including Satellite control plane, are located in multiple edge or data centers 

In this example, the compute resources are located in multiple data centers or edge. The Satellite control plane is located in a single data center or edge, while the hosts required for your services are on separate data centers or edge.

Zoom

![Compute resources in different edge or data centers.]
For more information, see the single-tenant environment, [Dedicated virtual server](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-dedicated-virtual-servers) offering.

The following families of public instances are available for this offering.



Table 1. Public virtual server family selections

 Families Description 

 [Balanced](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-virtual-server-profilesbalanced) Best for common cloud workloads that require a balance of performance and scalability. Uses network-attached storage. 
 [Balanced local storage](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-virtual-server-profilesbalanced-local-storage) Best for large database workloads that require high I/O performance with low latency. 
 [Variable compute](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-virtual-server-profilesvariable-compute) Best for workloads that don’t require steady, high-CPU performance. 
 [Compute](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-virtual-server-profilescompute) Best for moderate to high web traffic workloads. 
 [Memory](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-virtual-server-profilesmemory) Best for memory caching and real-time analytics workloads. 
 [GPU](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-about-virtual-server-profilesgpu) Best for high-performance workloads. 



Some of these families are also available for IBM Cloud® Virtual Servers for Virtual Private Cloud. For more information, see [Virtual Servers for VPC](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-getting-started).



 Next steps
Also, on the number of sandboxes that are needed, and the number of recovered VMs to be instantiated at any time.





 Production environment 

The production environment is the vSphere environment that hosts the production data. The production environment can be in IBM Cloud or elsewhere. This site hosts:



* Production data refers specifically to the VM images (VMDKs) of the VMs running in the production environment.
* Production backup infrastructure is existing backup applications and infrastructure that are used to protect the production data. The isolated recovery environment solution architecture is independent of the production backup infrastructure and does not connect or interface to it.
* Backup admins are your existing team responsible for the production backup. To enable separation of duties, the team members must be different from the cyber-recovery admin team members.
* IaaS admins are your existing team responsible for the maintenance of the infrastructure. To enable separation of duties, the team members must be different from the cyber-recovery admin team members.
* Production vCenter manages the production vSphere hosts. The Veeam BUR server requires access to the production vCenter.
* Production ESXi hosts the production data and is managed by the production vCenter. The Veeam BUR server requires access to the production vSphere hosts.
* Cyber-recovery backup is the backup of production data to the isolated recovery environment. A cyber-recovery backup is different from a production backup.
* Control traffic is the access that is required by the Veeam backup server to the production vCenter and ESXi hosts to enable cyber-backup operations.
* Cyber-recovery backup proxy is a Veeam VMware backup proxy that is used to transport data from the production environment to the cyber-recovery site. It is an architecture component that sits between the cyber-backup server and other components of the cyber-backup infrastructure. While the cyber-backup server administers tasks, the cyber-recovery backup proxy processes jobs and delivers backup traffic. Basic backup proxy tasks include retrieving VM data, compression, de-duplicating, encrypting, and forwarding to the cyber-recovery backup repository.
Edge environments for AI, IoT, and machine learning 

Create an IBM Cloud Satellite® location with Red Hat OpenShift clusters on compute infrastructure that is deployed at the edge near your Internet of Things (IoT) devices. Then, through your Satellite location, your apps can access a suite of IBM Cloud artificial intelligence (AI) and machine learning services to maximize the value of your data wherever the data is located.



 Solving common edge workload challenges with IBM Cloud 

Common challenges of edge workloads include training the machine learning models and using predictive model inferencing. With Satellite, you can access the IBM Cloud services that addresses these challenges where your edge workloads actually run.

Training a machine learning model
: Training your machine learning model typically involves significant compute resources for memory, GPU, and storage. Instead of installing and managing training model software onto your compute infrastructure, you can add the compute infrastructure to a Satellite location. Then, you can access IBM Cloud Pak® for Data, which includes tools such as Watson Studio and IBM Watson® Machine Learning for data analysis and model training. By accessing these tools as cloud services, you simplify the installation and management of the software. You also can use these same cloud services across all your edge infrastructure, no matter the underlying infrastructure provider.

Model inferencing
: Model inferencing is the task of using a trained model to make predictions, detect anomalies, and categorize data from your edge environment. Because of memory, storage, and latency requirements, model inferencing is most effectively run as near to your IoT sensors and other data sources as possible. You can create a Satellite location with managed Red Hat OpenShift clusters right where your data is located in your edge environments. Then, you can set up a serverless programming model such as Red Hat™ OpenShift™ Serverless™ to provide a simplified programming model with a REST interface to query your trained model to produce a prediction.





 Setting up your edge solution with Satellite 

While you can set up many possible solutions to the challenges of your edge environment, you can use Satellite to provide a consistent, scalable experience across environments. An example setup is as follows.



1. Set up machine learning and model training for your data.
2.
The [Cloud Databases "Hello World" Kubernetes tutorial](https://github.com/IBM-Cloud/clouddatabases-helloworld-kubernetes-examples) repository holds sample IBM Cloud® applications that show you how to connect to a Cloud Databases deployment to an IBM Cloud Kubernetes Service application written in various programming languages.

Each Git branch of the examples repository corresponds to samples in a particular programming language. For example, when you click Branch, a Node branch exists where all examples are written in JavaScript that uses Node.js. The files in each folder correspond to either a database or a message queue.
Learning about CIS architecture and workload isolation 

Review the following sample architecture for IBM Cloud® Internet Services, and learn about different isolation levels so that you can choose the solution that best meets the requirements of the workloads that you want to run in the cloud.



 CIS architecture and workload isolation 

Cloud Internet Services (CIS) is a public, global, multitenant service offered in partnership with Cloudflare. It offers DNS name resolution, global load balancing, and security and CDN services, for zones or domains delegated to this service.

In the control plane, you can configure your zone and the services that are applied to traffic to your site via UI, CLI, or API. All access authorization and authentication to your zone or domain is managed through Identity and Access Management (IAM) access policies.

All configuration requests eventually reach the multitenant Cloud Internet Services (CIS) control plane on IBM Cloud® as API calls to an SSL-secured API endpoint. The control plane interacts with the platform IAM service to authenticate the user and authorize the action. The original request targets the customer's Cloud Internet Services (CIS) instance. Each Cloud Internet Services (CIS) instance is uniquely mapped to an anonymized subaccount in Cloudflare's system. The request is converted to a Cloudflare API request that targets the subaccount and is delivered via HTTPS to the Cloudflare API endpoint. Zones and domains from different customers are isolated and maintained in separate subaccounts within the Cloud Internet Services (CIS) account at Cloudflare. Access to the account at Cloudflare is strictly controlled and limited. Access to the Cloud Internet Services (CIS) control plane infrastructure is also strictly controlled and limited to essential maintenance personnel only.

Data that is stored at Cloudflare is encrypted except when it is required to be publicly accessible, for example, in the case of DNS records, the control plane is separate from the data plane.

The data plane for your site is handled exclusively by Cloudflare. All proxied traffic is resolved to an IP address owned by Cloudflare and routed through Cloudflare's Anycast network to the nearest data center capable of processing the request.
* [Deploying Red Hat OpenShift environment as a managed service wherever it is needed](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-common1)



* [Finance use cases for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-finance)



* [Leveraging mainframe data for customers restricted from moving data to cloud](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-finance1)
* [Providing a unified environment for developing, verifying, and running containers for customer on third-party clouds](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-finance2)
* [Extending IBM Cloud security and compliance for customers maintaining cloud security](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-finance3)



* [Insurance use cases for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-insurance)



* [Analytics platform on-premises](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-insurance1)



* [Manufacturing use cases for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-manufacture)



* [Internet of things (IoT) service platform](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-manufacture1)
* [Enabling the digital transformation of on-premises legacy systems at steel mills and other manufacturing plants](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-manufacture2)
* [Establishing a service platform for point of sale (POS) or multi function printer (MFP) systems](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-manufacture3)
Migration considerations 

The VPC+ Cloud Migration tool duplicates your environment on IBM Cloud® Virtual Private Cloud and does not cancel your IBM Cloud classic infrastructure. You can cancel your existing classic environment from the IBM Cloud console.



 Considerations for virtual server instances 

Virtual server instances must use one of the following operating systems:



* CentOS 7.x, 8.x
* Debian 9.x, 10.x
* Red Hat 7.x, 8.x
* Ubuntu Linux 16.04.x, 18.04.x
* Windows 2012, 2012R2, 2016



If you have virtual servers that are not using one of the supported operating systems, you need to migrate them to a supported level before migration.

Virtual servers must be cloud-init enabled and have Virtio drivers. For Linux images that do not meet this criteria, see [Creating a Linux custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-linux-custom-image) to prepare the image. For Windows images that do not meet this criteria, see [Creating a Windows custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-windows-custom-image). As an option, you can run a script to validate if your Linux or Windows image meets the minimum OS requirements, is cloud-init enabled, and has Virtio drivers. For more information, see the [script details](https://github.com/IBM-Cloud/vpc-migration-tools/tree/main/os-precheck-scripts).

Additionally, virtual servers must meet the following requirements:



* No add-ons
* Stock OS image
* Primary volume size doesn't exceed 100 GB
* Supported operating systems



The VPC+ Cloud Migration tool does not log in to your virtual server instances nor does it have access to them. VPC+ Cloud Migration, which is managed by Wanclouds, follows industry best practices to ensure that their application tool is secure and protects your sensitive information.



 VMDK image conversion
Building a highly available infrastructure for 3-tier web application in VPC 

This reference architecture describes three methods of deploying a 3-tier web application on IBM Cloud® Virtual Private Cloud. This information applies to most 3-tier web applications that need to be resilient and highly available applications



 Tier Description 

 The front-end web tier The 1st- tier is usually the user interaction that takes in user input and parses the data to be handed off to the next tier. 
 The application tier The 2nd-tier takes the data from the web tier to process and apply logic. This action can include writing or pulling data from the data tier or providing results back to the web tier. 
 The data tier The 3rd-tier stores the application data that can be in written form or query form. The storage varies across different storage technologies, such as block volumes or object storage, depending on the application requirements. 





 Deployment Considerations 

IBM Cloud VPC is only offered in multizone regions (MZR) which are made up of three or more zones. Each zone is isolated from each other to contain failures within a zone. The zones are also interconnected with a high-speed connection for higher bandwidth and lower latency for intra-zone communications.





 Component Considerations 



 Virtual Servers 

Servers in each of the 3-tiers have different requirements. When you provision your virtual servers, you have multiple options for virtual server profiles: Balanced, Compute, and Memory. The vCPU-to-memory ratio varies across the different profiles, but within the profile the ratio is constant. Within a profile, the number of vCPUs and memory increases along with the bandwidth performance. Use the following information when you are provisioning your servers.



 Tier Server requirements 

 Front-end web tier This tier tends to be higher in traffic workload. These workloads are more CPU-intensive than memory-intensive. So, you want to select a Compute profile that has a vCPU ratio to memory of 1:2. Within the Compute profile, select the appropriate type based on your vCPU and memory requirements. 
 Application tier This tier tends to be more memory-intensive and involves more caching. For this workload, select a Memory profile where the ratio of vCPU-to-memory is more weighted to the memory, 1:8.
Example for a high availability setup in a public cloud provider 

The following image shows a highly available setup for compute hosts that are in a public cloud provider. All virtual machines are hosted on a separate physical machine that is dedicated to you only. To ensure further isolation and availability, all compute hosts are spread across multiple availability zones within the same metro. Because the availability zones belong to the same metro, the requirements for networking speed and latency between the hosts are met.

Zoom

![High availability setup with compute hosts that are in a public cloud provider.](https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite//images/sat_control_plane_to_cloud_ha.svg)

Figure 4. High availability setup with compute hosts that are at a public cloud provider
* Built-in security and isolation to enable rapid delivery of secure applications.
* Cloud services that include cognitive capabilities from IBM® Watson™.
* Ability to manage dedicated cluster resources for both stateless applications and stateful workloads.





 Virtual machines vs containers 

VMs, traditional apps run on native hardware. A single app does not typically use the full resources of a single compute host. Most organizations try to run multiple apps on a single compute host to avoid wasting resources. You could run multiple copies of the same app, but to provide isolation, you can use VMs to run multiple app instances (VMs) on the same hardware. These VMs have full operating system stacks that make them relatively large and inefficient due to duplication both at runtime and on disk.

Containers are a standard way to package apps and all their dependencies so that you can seamlessly move the apps between environments. Unlike virtual machines, containers do not bundle the operating system. Only the app code, runtime, system tools, libraries, and settings are packaged inside containers. Containers are more lightweight, portable, and efficient than virtual machines.

In addition, containers allow you to share the host OS. This reduces duplication while still providing the isolation. Containers also allow you to drop unneeded files such as system libraries and binaries to save space and reduce your attack surface. Read more on virtual machines and containers [here](https://www.ibm.com/docs/en/linux-on-systems?topic=linuxonibm/com.ibm.linux.z.ldvd/ldvd_r_plan_container_vm.htm).





 Kubernetes orchestration 

[Kubernetes](https://kubernetes.io/) is a container orchestrator to manage the lifecycle of containerized apps in a cluster of worker nodes. Your apps might need many other resources to run, such as volumes, networks, and secrets which will help you connect to other cloud services, and secure keys. Kubernetes helps you to add these resources to your app. The key paradigm of Kubernetes is its declarative model.
[Creating a three-tier highly available architecture on an IBM Cloud VPC](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-create-three-tier-architecture)Creating a three-tier highly available architecture on an IBM Cloud VPC

This tutorial describes the three-tiered architecture of an application that is rehosted on IBM cloud. The tutorial outlines the steps to implement a Highly Available solution in the IBM Cloud VPC infrastructure that spans multiple availability zones in one region. The strategies can differ and vary depending upon your application (web, app, and DB) and the redundancy necessary at each level. The tutorial provides a few guidelines for setting up a three tier OLTP application. Wherever possible, guidelines are provided on infrastructure, security, and operations. You might need to refer to your vendors’ supported methods of replication for the tiers, depending on the software components in your architecture.

Virtual Servers for Classic Virtual Private Cloud (VPC)

+2

IBM Cloud Load Balancer,High availability and resiliency for infrastructure



* 60 minutes
* 2021-06-24



[Architecture for a resilient infrastructure for a single availability zone](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-ref-arch-saz)Architecture for a resilient infrastructure for a single availability zone

Deploying your application across the availability zone in a multiple-zone region provides the highest resiliency, 4 9's. However, there are scenarios where deploying across the zones is not wanted, such as needing the latency to be minimal or the application is deemed not critical.

Virtual Servers for Classic Virtual Private Cloud (VPC)

+2

IBM Cloud Load Balancer,High availability and resiliency for infrastructure



* 60 minutes
* 2022-06-22



[Enabling Auto scale for better capacity and resiliency](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-ha-auto-scale)Enabling Auto scale for better capacity and resiliency

This tutorial shows you how to set up compute (virtual server instance) Auto scale for horizontal scaling.