vania-janet/multiturn-rag-retrieval-data huggingface dataset:
A completed CIO template is a requirement for any ecosystem partner seeking to be Financial Services Validated.





 Reference architectures and deployment guidance 

[Reference architectures](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-reference-architecture-overview) have been defined which can be used as a basis for meeting the security and regulatory requirements defined by the controls. The reference architectures each center on specific IBM Cloud technologies, including:



* [IBM Cloud® Virtual Private Cloud reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-about), with options for using one or both of:



* [IBM Cloud® Virtual Servers for Virtual Private Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsi)
* [Red Hat® OpenShift® on IBM Cloud®](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-openshift)



* [IBM Cloud Satellite® reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-about)
* [IBM Cloud® for VMware® Regulated Workloads reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vmware-overview)



In addition, prescriptive [deployment and configuration guidance](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-deployment-setup-environment) is provided for the components in each of these reference architectures. The guidance is intended as an easier to consume supplement to the CIO templates that is more appropriate for architects and developers trying to build and implement applications for IBM Cloud for Financial Services.









 Becoming IBM Cloud for Financial Services Validated
* [15 June 2022](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-relnotesschematics-june1522)



* Enhance Schematics getting started section





* [May 2022](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-relnotesschematics-may22)



* Review the release notes for May 2022.
* [12 May 2022](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-relnotesschematics-may1222)



* Enhance documentation with the security and compliance section
* Enhance documentation with the best practices



* [5 May 2022](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-relnotesschematics-may0522)



* Release Schematics command-line plug-in





* [April 2022](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-relnotesschematics-apr22)



* Review the release notes for April 2022.
* [30 April 2022](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-relnotesschematics-apr3022)



* Support detecting drift
* Support stopping or terminating the running job
* Support more frequently asked questions (FAQs)
* Support enhanced Schematics resource view



* [26 April 2022](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-relnotesschematics-apr2622)



* Release Schematics command-line plug-in



* [17 April 2022](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-relnotesschematics-apr2722)
ibmcloud schematics workspace new --file FILE_NAME --state STATE_FILE_PATH [--agent-id AGENT_ID] [--github-token GITHUB_TOKEN] [--output OUTPUT] [--json]

For more information about the flags see [workspace new](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-cli-reference&interface=clischematics-workspace-new) command.

Example

ibmcloud schematics workspace new --file FILE_NAME --state STATE_FILE_PATH





 ibmcloud schematics workspace get with Agent 

Retrieve the details of an existing workspace, including the values of all input variables and Schematics Agent.

Syntax

ibmcloud schematics workspace get --id WORKSPACE_ID [--output OUTPUT]

For more information about the flags see [workspace get](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-cli-reference&interface=clischematics-workspace-get) command.







 Blueprint commands 

Schematics Blueprints is a [beta feature](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-beta-limitations) that are available for evaluation and testing purposes. It is not intended for production usage. Refer to the list of [limitations](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-beta-limitationssc-bp-beta-limitation) for the beta release.



 ibmcloud schematics blueprint create 

Create a blueprint config from the command line using the ibmcloud schematics blueprint create command. Creating a blueprint config is the first step to deploy a blueprint environment. The blueprint config is created from user provided parameters via the command line that specifies the source of the blueprint template in a Git repository, and input values sourced from Git hosted input files and locally sourced input values.
The schematics agent, catalog, projects, and schematics workspaces must co-reside in a single account.

Additional Components not shown in the diagram:



Table 2. Additional components

 Component Quantity Description 

 Activity Tracker 1 Provides an audit trail for activity within the account 
 IBM Cloud Logging 1 Provides log monitoring for the infrastructure hosting the Schematics Agent 
 IBM Cloud Monitoring 1 Provides performance and error monitoring for the Schematics Agent 
 Event Notifications 1 Provides notifications for Projects 





 Authorization 

Rather than authorizing users to deploy infrastructure as code directly, authorize project instances within the central administration account to deploy resources and create child accounts. Authorizing projects to deploy resources and create child accounts ensures that only changes to the enterprise account structure and key shared infrastructure can be made through projects. As projects are subject to the governance provided by catalog onboarding and project configuration management, this helps implement the zero trust security best practice that is required by many compliance programs, including [Financial Services Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-zero-trust).

User access to the projects and resources within the Central Administration account is best performed with Access Groups or Trusted Profiles. This keeps the number of policies low, making it easier to reason about access permissions and reducing opportunity for error. A typical organization should be able operate their central administration account with on the order of 10 access groups or trusted profiles.





 Rationale for centralized management across development and production 

Centralizing management of deployable architectures and their configuration into an admin account provides the following benefits:



* Single place to find IaC related to enterprise administration. The admin catalog ensures that only approved, tested, and compliant deployable architectures are available to the user. Using a single catalog allows administrators to find and use these deployable architectures easily.
* One catalog to publish IaC related to enterprise administration. Having a single catalog to maintain makes it easier to ensure that the correct set of deployable architectures is exposed and maintained. This includes ensuring that updates to deployable architectures are available and deployed in a timely fashion.
* Centralized access control and monitoring for key Enterprise infrastructure.
For more details, review the [workspace in IBM Cloud Schematics](https://cloud.ibm.com/schematics/workspaces) if you created the cluster from the UI. Or, if you created the cluster from the CLI, review the [IBM Cloud Provider Plug-in for Terraform template](https://github.com/terraform-ibm-modules/terraform-ibm-cluster/tree/master/examples/secure-roks-cluster).

The following resources are provisioned by default, but you can customize some resources, for example worker node flavor.



* 1 Virtual Private Cloud (VPC) instance with the following details:



* 3 subnets, 1 per zone.
* 1 security group with pre-configured rules.



* 1 Red Hat OpenShift on IBM Cloud cluster with the following features:



* 9 worker nodes of flavor type bx2.16x64 with 16 vCPUs and 64 GB of memory that are evenly spread across the 3 zones in your VPC.
* 1 default worker pool with 3 worker nodes per zone across 3 zones.



* 1 IBM Cloud Log Analysis instance to enable logging from the cluster.
* 1 IBM Cloud Activity Tracker instance to enable audit logs from the cluster, such as when a user creates a call against the Red Hat OpenShift on IBM Cloud API.
* 1 IBM Cloud Monitoring instance to enable metrics such as node usage from the cluster.
* 1 IBM Key Protect instance and customer root key (CRK) to encrypt the cluster master, including Kubernetes secrets in the cluster.
* 1 IBM Cloud Object Storage instance and bucket to back up certain [cluster data](https://cloud.ibm.com/docs/containers?topic=containers-service-archibm-data). You can optionally select your own instance.







 Creating a secure cluster by using a template from the UI 

With the secure cluster template, you can create a cluster from the UI with IBM Cloud Schematics that already includes certain security integrations such as encryption, logging, and monitoring enabled by default.



1.
Click one of the following options for the cluster deployment target and toolchain pipeline type. This action takes you to the Deploy to IBM Cloud page where you create a Schematics workspace. Complete the required fields on that page, and then click Next.

The following options use the [simple-helm-toolchain template](https://github.com/open-toolchain/simple-helm-toolchain), which uses a Classic pipeline structure.

[![Deploy to Kubernetes on IBM Cloud](https://cloud.ibm.com/docs-content/v1/content/efbf7b33e3aca029f69f9244bced9dd4d8acb848/apps/images/Deploy_to_kube.svg)](https://cloud.ibm.com/schematics/workspaces/create?repository=https://github.com/IBM-Cloud/Scalable-web-app-java/tree/master/terraform/simple-kube&terraform_version=terraform_v1.3)[![Deploy to OpenShift on IBM Cloud](https://cloud.ibm.com/docs-content/v1/content/efbf7b33e3aca029f69f9244bced9dd4d8acb848/apps/images/Deploy_to_Openshift.svg)](https://cloud.ibm.com/schematics/workspaces/create?repository=https://github.com/IBM-Cloud/Scalable-web-app-java/tree/master/terraform/simple-openshift&terraform_version=terraform_v1.3)

The following options use the [secure-kube-toolchain template](https://github.com/open-toolchain/secure-kube-toolchain), which uses a Tekton pipeline structure.

[!
Release Schematics command-line plug-in
: The Schematics [command-line plug-in v1.7.1](https://cloud.ibm.com/docs/schematics?topic=schematics-cli_version-releases) released on 11 February 2022.







 January 2022 

Review the release notes for January 2022.



 31 January 2022 

Release Schematics command-line plug-in
: The Schematics [command-line plug-in v1.7.0](https://cloud.ibm.com/docs/schematics?topic=schematics-cli_version-releases) released on 18 January 2022.

Supports installer for PowerLinux™ and System/390 Linux™
: The Schematics supports command-line installer for [PowerLinux™ 64-bit and System/390 Linux™ 64-bit](https://cloud.ibm.com/docs/schematics?topic=schematics-setup-cli) Operating System.







 December 2021 

Review the release notes for December 2021.



 30 December 2021 

Release Schematics command-line plug-in
: The Schematics [command-line plug-in v1.6.2](https://cloud.ibm.com/docs/schematics?topic=schematics-cli_version-releases) released on 2nd December 2021.







 November 2021 

Review the release notes for November 2021.



 30 November 2021 

Centrally manage access tags for Schematics Workspaces in your account
: To create and associate access tags for Schematics Workspaces in your account, see [Manage access tag in your account](https://cloud.ibm.com/docs/schematics?topic=schematics-accessaccess-tag).

Support WinRM in user interface
: Schematics supports [Windows Remote Management (WinRM)](https://cloud.ibm.com/docs/schematics?topic=schematics-action-workingcreate-action-working) for Schematics Actions.

Global catalog settings for Schematics Workspaces location
"full_url": "https://github.com/IBM/ibm-spectrum-scale-ibm-cloud-schematics",
"has_uploadedgitrepotar": false
},
"template_data": [
{
"id": "434f99a3-2633-4b",
"folder": "",
"compact": false,
"type": "terraform_v1.0.0",
"values_url": "https://us.schematics.cloud.ibm.com/v1/workspaces/us-south.workspace.Sample-Schematic-Scale-API-workspace.096bd8d8/template_data/434f99a3-2633-4b/values",
"values": "",
"variablestore":
{
"name": "bastion_key_pair",
"secure": false,
"value": "scale-hpcc-key",
"type": "",
"description": ""
},
{
"name": "vpc_availability_zones",
"secure": false,
"value": "us-south-2",
"type": "",
"description": ""
},
{
"name": "vpc_region",
"secure": false,
"value": "us-south",
"type": "",
"description": ""
},
{
"name": "remote_cidr_blocks",
"secure": false,
"value": ""169.252.0.0/18"]",
"type": "",
"description": ""
},
{
"name": "ibm_customer_number",
"secure": false,
"value": "12345",
Pricing for VPC infrastructure varies based on regional location and sustained usage.

This information applies to VPC worker nodes only.

Regional uplift charges
: When you create a cluster on VPC infrastructure, the worker nodes might incur an uplift charge that varies by the [multizone location](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zoneszones-vpc) that you create the cluster in. The uplift charge is a percentage (%) of the hourly rate (r), and is added to the hourly rate of the worker node. The total hourly rate cost for a worker node can be calculated as r + (r × %). In the [Red Hat OpenShift cluster creation console](https://cloud.ibm.com/kubernetes/catalog/create?platformType=openshift), this uplift is reflected in the pricing calculator as you configure your cluster details. The following table describes the pricing uplift by region.
: For a table that describes the pricing uplift by region, see [Regional pricing for VPC](https://cloud.ibm.com/vpc-ext/provision/vs).

Sustained usage discounts
: For virtual server instances that are billed at an hourly rate, discounted prices depend on how long the instance runs during the billing month. For more information, expand the Sustained usage discounts on IBM Cloud Virtual Servers for VPC section on the [Pricing for VPC](https://cloud.ibm.com/vpc-ext/provision/vs) page.







 Estimating costs 

See [Estimating your costs](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-costcost).

Keep in mind that some charges are not reflected in the estimate, such as tiered pricing for increased hourly usage. For more information, see [Understanding costs for your clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-costscosts-for-clusters).





 Managing costs
For more information, see [About restoring from a backup snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-baas-vpc-restore).
* Am I charged for usage?

Yes. Cost for backups is calculated based on GB capacity that is stored per month, unless the duration is less than one month. The backup exists on the account until it reaches its retention period, or when you delete it manually, or when you reach the end of a billing cycle, whichever comes first.

Pricing of subsequent backups can also increase or decrease when you [increase source volume capacity](https://cloud.ibm.com/docs/vpc?topic=vpc-expanding-block-storage-volumes) or [adjust IOPS](https://cloud.ibm.com/docs/vpc?topic=vpc-adjusting-volume-iops) by specifying a different IOPS profile for the source volume. For example, expanding volume capacity increases costs. However, changing an IOPS profile from a 5-IOPS/GB tier to a 3-IOPS/GB tier decreases the monthly and hourly rate. Billing for an updated volume is automatically updated to add the prorated difference of the new price to the current billing cycle. The new full amount is then billed in the next billing cycle.

Pricing for backups is also set by region of the source volume. For more information, see [Pricing](https://www.ibm.com/cloud/vpc/pricing).



 Can I use data backups for disaster recovery? 

Using the [backup service](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about), you can regularly back up your volume data based on a schedule that you set up. You can create backup snapshots as frequently as 1 hour. You can also create copies of your backup snapshot in other regions. However, the backup service does not provide continual backup with automatic failover. Restoring a volume from a backup or snapshot is a manual operation that takes time.
* What metrics am I charged for if I am using VPN gateway for VPC?

The following metrics are collected for VPN gateway billing on a monthly basis:



* VPN Gateway Instance Hour: How much time your VPN gateway instance is up and running.
* VPN Connection Hour: How much time each of your VPN connections is established and maintained on the VPN gateway.
* Floating IP: The number of active floating IP addresses being used by the VPN gateway instance.



See the IBM Cloud VPN tab on the [Pricing](https://www.ibm.com/cloud/vpc/pricing) page for the unit pricing per hour in each region for VPN gateway.

While using a VPN gateway, you are also charged for all outbound public internet traffic billed at VPC data rates. See the Data Transfer tab on the [Pricing](https://www.ibm.com/cloud/vpc/pricing) page for details about the unit pricing for outbound data transfer.
* Why doesn't the route-based VPN gateway route the traffic?

If you configured a VPC route and its next hop is a VPN connection, the following use cases block the traffic forwarded through the VPN connection.



* The security groups associated with the VPC instance do not permit the traffic; the network ACLs associated with the subnet of the VPC instance and VPN gateway blocked the traffic. For more information about configuring security groups and network ACLs, see [Configuring ACLs and security groups for use with VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-acls-security-groups-vpn).
* The traffic source IP is not in any subnet associated with the VPC routing table. For example, the VPC routing table is associated with subnet A and includes a route whose next hop is a VPN connection. However, when the traffic reaches the VPN gateway, the source IP is not in subnet A or any other subnets that are associated with the routing table. Therefore, the VPN gateway drops the traffic.





Virtual Private Networks (VPN)



* What is IBM Cloud VPN?
When you use fast restore, the data is pulled from a cached backup snapshot in another zone of your VPC. For more information, see [About restoring from a backup snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-baas-vpc-restore).





 Am I charged for usage? 

Yes. Cost for backups is calculated based on GB capacity that is stored per month, unless the duration is less than one month. The backup exists on the account until it reaches its retention period, or when you delete it manually, or when you reach the end of a billing cycle, whichever comes first.

Pricing of subsequent backups can also increase or decrease when you [increase source volume capacity](https://cloud.ibm.com/docs/vpc?topic=vpc-expanding-block-storage-volumes) or [adjust IOPS](https://cloud.ibm.com/docs/vpc?topic=vpc-adjusting-volume-iops) by specifying a different IOPS profile for the source volume. For example, expanding volume capacity increases costs. However, changing an IOPS profile from a 5-IOPS/GB tier to a 3-IOPS/GB tier decreases the monthly and hourly rate. Billing for an updated volume is automatically updated to add the prorated difference of the new price to the current billing cycle. The new full amount is then billed in the next billing cycle.

Pricing for backups is also set by region of the source volume. For more information, see [Pricing](https://www.ibm.com/cloud/vpc/pricing).



 Can I use data backups for disaster recovery? 

Using the [backup service](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about), you can regularly back up your volume data based on a schedule that you set up. You can create backup snapshots as frequently as 1 hour. You can also create copies of your backup snapshot in other regions. However, the backup service does not provide continual backup with automatic failover.
Billing for an updated volume is automatically updated to add the prorated difference of the new price to the current billing cycle. The new full amount is then billed in the next billing cycle.

Pricing for Block Storage for VPC volumes is also set by region. For more information, see [Pricing](https://www.ibm.com/cloud/vpc/pricing).
* Are there limits on the number of volumes I can create?

 Are there limits on the number of volumes I can create? 

You can create up to 300 total Block Storage for VPC volumes (data and boot) per account in a region. To increase this [quota](https://cloud.ibm.com/docs/vpc?topic=vpc-quotasblock-storage-quotas), open a [support case](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-help) and specify the zone where you need more volumes.
* After a data volume is created with a specific capacity, can the capacity later be increased?

 After a data volume is created with a specific capacity, can the capacity later be increased? 

You can increase the capacity of data volumes that are attached to a virtual server instance. You can indicate capacity in GB increments up to 16,000 GB capacity, depending on your volume profile. For more information, see [Increasing Block Storage for VPC volume capacity](https://cloud.ibm.com/docs/vpc?topic=vpc-expanding-block-storage-volumes).
* Can I increase capacity of a boot volume?

 Can I increase capacity of a boot volume? 

Boot volume capacity can be increased during instance provisioning or later, by directly modifying the boot volume. This feature applies to instances that are created from stock or custom images. You can also specify a larger boot volume capacity when you create an instance template. The boot volume can't be unattached from an instance (that is, stored as stand-alone data volume). For more information, see [Increasing boot volume capacity](https://cloud.ibm.com/docs/vpc?topic=vpc-resize-boot-volumes).