vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you provision your instance with public interfaces, the access to public network is provided through public uplinks. They are attached to a portable subnet on a public VLAN on the IBM Cloud public network. The uplinks have IP addresses specific to this data center and they cannot move between the data centers.
4. You must manually deploy two additional edge cluster transport nodes and create a new edge cluster for your Tier-0 and Tier-1 Gateways in the second IBM Cloud data center hosts.
5. In the second IBM Cloud data center, the access to private network is provided through private uplinks. They are attached to a portable subnet on a private primary VLAN on the IBM Cloud private network. If you provision your instance with public interfaces, the access to public network is provided through public uplinks. They are attached to a portable subnet on a public VLAN on the IBM Cloud public network. The uplinks have IP addresses specific to this data center and they cannot move between the data centers.
6. You must manually deploy two or more edge cluster transport nodes in the regional edge cluster, at least one in each zone or data center for high availability. Then, create a new edge cluster by using these edge transport nodes, and create your regional Tier-0 in this cluster. You can select which data center (or edge node) is your preferred Tier-0 path in the regional cluster. You can separate routing tables at this level by using VRF lite capability in the Tier-0 Gateway. For more information, see VMware documentation.
7. Manually create an overlay transit segment and create uplinks in Tier-0 Gateways into the transit segment. Establish dynamic routing between the Tier-0 Gateways and BGP is the preferred routing protocol. If you use VRF lite capability in the Tier-0 Gateway, you might use multiple transit segments depending on your design.
8. Then, create your Tier-1 Gateways in the regional edge cluster. You can select which data center (or edge node) is your preferred Tier-1 path in the regional cluster. You can separate routing tables at this level and decide which routes as advertised to the north bound Tier-0.
For more information, see [Managing projects](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project).





 Logs 

Code Engine provides logs for apps, jobs, and builds to help you determine what happened when deployments do not run properly. You can find logs by running commands similar to the following examples.

ibmcloud ce app logs -n <APPNAME>
ibmcloud ce jobrun logs -n <JOBRUN-NAME>
ibmcloud ce buildrun logs -n <BUILDRUN_NAME>

You can also use the IBM Log Analysis service, which is available for more long-term persistence of log messages. For more information, see [Viewing logs](https://cloud.ibm.com/docs/codeengine?topic=codeengine-view-logs).





 Creating a service 

Creating an instance of a managed service is similar in Cloud Foundry and Code Engine.

To create a new service to use with your Cloud Foundry application, use the following command.

ibmcloud cf create-service cloudantNoSQLDB lite myNameCloudant

To create a new service to use with Code Engine applications,

ibmcloud resource service-instance-create myNameCOS cloud-object-storage lite global





 Service binding 

After you create your application, you can then "bind" your application to the service.

With Cloud Foundry, run the following command.

ibmcloud cf bind-service appName instanceName

With Code Engine,

ibmcloud ce app bind --name appName --service-instance instanceName

The service instance credentials (coordinates) are injected into the app (or job) by using environment variables. The Cloud Foundry equivalent of VCAP_SERVICES in Code Engine is CE_SERVICES. For more information, see [Integrating IBM Cloud service with service binding](https://cloud.ibm.com/docs/codeengine?topic=codeengine-service-binding).





 Updating an app or job 

After you create your application or job, you can update properties of your workload by using the update command. For example, to update an application in Code Engine,
For more information, see [Known issues and limitations](https://cloud.ibm.com/docs/account?topic=account-known-issues).





 Managing access to products for all users in the console 

You can use filters to manage which products in the public catalog are available to all users in your account. For example, you might want to restrict access to third-party products. Or, you might want users to work with a specific software type. If your account is a parent account in an IBM Cloud enterprise, the filters that you set apply to all child account groups and accounts. For more information, see [Managing products for IBM Cloud enterprise](https://cloud.ibm.com/docs/account?topic=account-catalog-enterprise-restrict).



1. Go to Manage > Catalogs > Settings in the IBM Cloud console.
2. Confirm that the visibility of the public catalog is set to On.
3. In the What products are available? section, select Exclude all products in the IBM Cloud catalog.
4. Set one or more [filters](https://cloud.ibm.com/docs/account?topic=account-filter-accountcatalog-filters-customize) to customize what products are available by category.
5. (Optional) Add exceptions to the filter rules that you set in the previous step.
6. Use the Preview table to confirm your selections, and click Update.







 Managing access to products for specific users in the console 

Set filters at a private catalog level for fine-grained control of which products in the public catalog are available only to the users you choose.



1. Go to Manage > Catalogs, Private catalogs in the IBM Cloud console.
2. Select a catalog from the list to navigate to its details page.

The Products in the IBM Cloud catalog table that's displayed on the page shows the list of products that are available at the account level. The availability is based on the filters the account owner or administrator set. Account-level filters apply to all the private catalogs in the account.
3. Click Manage filters.
4.
For more information, see [Known issues and limitations](https://cloud.ibm.com/docs/account?topic=account-known-issues).





 Managing access to products for all users in the console 

You can use filters to manage which products in the public catalog are available to all users in your account. For example, you might want to restrict access to third-party products. Or, you might want users to work with a specific software type. If your account is a parent account in an IBM Cloud enterprise, the filters that you set apply to all child account groups and accounts. For more information, see [Managing products for IBM Cloud enterprise](https://cloud.ibm.com/docs/account?topic=account-catalog-enterprise-restrict).



1. Go to Manage > Catalogs > Settings in the IBM Cloud console.
2. Confirm that the visibility of the public catalog is set to On.
3. In the What products are available? section, select Exclude all products in the IBM Cloud catalog.
4. Set one or more [filters](https://cloud.ibm.com/docs/account?topic=account-filter-account&interface=uicatalog-filters-customize) to customize what products are available by category.
5. (Optional) Add exceptions to the filter rules that you set in the previous step.
6. Use the Preview table to confirm your selections, and click Update.







 Managing access to products for specific users in the console 

Set filters at a private catalog level for fine-grained control of which products in the public catalog are available only to the users you choose.



1. Go to Manage > Catalogs, Private catalogs in the IBM Cloud console.
2. Select a catalog from the list to navigate to its details page.

The Products in the IBM Cloud catalog table that's displayed on the page shows the list of products that are available at the account level. The availability is based on the filters the account owner or administrator set. Account-level filters apply to all the private catalogs in the account.
3. Click Manage filters.
4.
Ordering a Premium VLAN 

When you're ready to explore a more complex network topology, you can add more VLANs to isolate traffic between groups of devices. Unlike Automatic VLANs, which are automatically assigned to fulfill the needs of other products, a Premium VLAN stays on your account until canceled.

Pricing is visible during the ordering process for Premium VLANs.

Follow these steps to order a Premium VLAN:



1.  From your browser, open the [IBM Cloud console](https://cloud.ibm.com/) and log in to your account.
2.  From the console, click the Menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/3fa5994ae9adccdcd1e1af1de40af9e12f188fef/icons/icon_hamburger.svg) and select Classic Infrastructure.
3.  In the navigation pane, select Network > IP Management > VLANs.
4.  Select Order and complete your specific configuration.





  What happens next 

A new VLAN with your specific configuration appears on your account within a few moments, except in cases that require approval processes for your account status.

New Premium VLANs are typically delivered without a primary subnet. The absence of a primary subnet is not an indication that one won't be added in the future. To understand more about what primary subnets are and how to use them, review [Subnets and IPs](https://cloud.ibm.com/docs/subnets?topic=subnets-getting-started).
After you create the CSR, you can generate your SSL certificate on a public certificate authority.







 Uploading SSL certificates 

You can apply a security protocol to provide communication privacy for your app to prevent eavesdropping, tampering, and message forgery. If you have a Lite account, you must upgrade your account to upload a certificate.

In order to use TLS certificates in IBM Cloud Foundry custom domains you need to perform few steps:



1. Obtain, if not already having it, a valid certificate from a Certificate Authority (via CSR creation) [Ref](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-ssl_csrcreate_csr)
2. Upload certificates into a IBM Cloud Secrets Manager instance [Ref](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-ssl_csrssl_import)
3. Authorise IBM Cloud Foundry service to access uploaded certificates [Ref](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-ssl_csrssl_cert_auth)
4. Let custom domain uses the uploaded certificate by mapping its CRN.[Ref](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-ssl_csrssl_cert_custom_domain)



SSL certificate mapping is a region specific operation. If you are using the same custom domain and SSL cert across multiple regions, you need to map certificate for each one.

When an expired or expiring certificate must be renewed, and after the new certificate is ready, delete the existing certificate and then add the new one.

When you use a custom domain to serve the SSL certificate, use the following region endpoints to provide the URL route for your organization in IBM Cloud:



Table 1. Cloud Foundry custom domain region endpoints

 Region Endpoint 

 US-South custom-domain.us-south.cf.cloud.ibm.com
To further protect your connection to Secrets Manager, you can choose to provision an instance that uses a private service endpoint. For more information about setting up your account to support the private connectivity option, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).
9. Click Create to create an instance of Secrets Manager in the account, region, and resource group that you selected.



To update your service plan after you create an instance, see [Updating your service plan](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-changing).





 Creating a Secrets Manager instance from the CLI 

You can also create an instance of Secrets Manager by using the IBM Cloud CLI.



1. Log in to IBM Cloud through the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).

ibmcloud login

If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
2. Select the account, region, and resource group where you want to create a Secrets Manager service instance.

ibmcloud target -r <region> -g <resource_group_name>
3. Create an instance of Secrets Manager within that account and resource group.

ibmcloud resource service-instance-create <instance_name> secrets-manager <plan>



Table 1. Descripition of the information that is required to provision the Secrets Manager service

 Variable Description 

 Instance name (name) A unique alias for your service instance. 
 Pricing plan (plan) The pricing plan that you want to use, provided as a plan ID. To obtain the plan ID, run ibmcloud catalog service secrets-manager.
Image Compression supported file extensions: .jpg, .jpeg, .jpe, .jif, .jfif, and .jfi.

In order for the feature Image Compression to work for DCA, you must make sure that the path of the image files is cacheable. See [Caching](https://cloud.ibm.com/docs/CDN?topic=CDN-dynamic-content-accelerationcaching-cache-content) to set the images cacheable.







 Caching 

When DCA is enabled for your CDN mapping or origin, the Akamai Edge servers cache (or prevent caching of) contents based on your settings:



* To enable caching of contents under the path, set Respect header to ON and set the caching headers in your origin (for example, Cache-Control:public, max-age=31536000).
* To prevent caching of contents, do one of the following:



* Set Respect header to ON and include headers in your origin, which prevents caching (for example, Cache-Control: no-cache, no-store).
* Set Respect header to OFF (default), create a TTL with a path to match your contents, and set a 0 value.





In some cases, you might want to mix static (for example, images, CSS, JS) and dynamic assets under the same path, so you might need to make some assets cacheable. You can do this with the following options:



* Set Respect header to ON and set the caching headers in your origin (for example, Cache-Control:public, max-age=31536000).
* Set Respect header to OFF (default), create a TTL with path to match your static contents, and set the value as the wanted caching time.
Services that are managed with IAM belong to a resource group. When you create an instance of one of these services from the catalog, you're prompted to assign the instance to a resource group. Be sure to plan how you want to organize resources in your account before you assign them to a resource group.

Your resource group selection at the time of creating the instance is final and can't be changed.

Your resource group selection at the time of creating the instance is final and can't be changed.

The IBM Cloud account owner can add resources to any resource group, but other users must be granted access by using an IAM access policy. Users in your account must be assigned two access policies to create resources from the catalog and add them to a resource group:



* A policy with viewer role or higher on the resources group itself
* A policy with editor role or higher on the service in the account



To add the resources to a resource group, complete the following steps:



1. In the IBM Cloud console, go to Manage > Account > Account resources > Resource groups.
2. Click the Actions![List of actions icon](https://cloud.ibm.com/docs-content/v1/content/814aeaf04800bb4f74ea1c057d4abb166a5f357a/icons/action-menu-icon.svg) menu, and select Add resources.
3. From here, you are directed to the catalog. You can search the products or filter based on a specific category, provider, pricing plan, type of compliance, or release type. Examples of resources include apps, service instances, container clusters, storage volumes, virtual servers, and software.







 Adding resources to a resource group by using the API 

See [Managing catalog settings](https://cloud.ibm.com/docs/account?topic=account-filter-accountset-public-visibility-api) to set the visibility of the IBM Cloud® catalog and to control access to products in the public catalog and private catalogs for users in your account.





 Viewing resources in a resource group 

To easily view the resources that are assigned to a resource group, go to the Navigation Menu icon !
Services that are managed with IAM belong to a resource group. When you create an instance of one of these services from the catalog, you're prompted to assign the instance to a resource group. Be sure to plan how you want to organize resources in your account before you assign them to a resource group.

Your resource group selection at the time of creating the instance is final and can't be changed.

Your resource group selection at the time of creating the instance is final and can't be changed.

The IBM Cloud account owner can add resources to any resource group, but other users must be granted access by using an IAM access policy. Users in your account must be assigned two access policies to create resources from the catalog and add them to a resource group:



* A policy with viewer role or higher on the resources group itself
* A policy with editor role or higher on the service in the account



To add the resources to a resource group, complete the following steps:



1. In the IBM Cloud console, go to Manage > Account > Account resources > Resource groups.
2. Click the Actions![List of actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) menu, and select Add resources.
3. From here, you are directed to the catalog. You can search the products or filter based on a specific category, provider, pricing plan, type of compliance, or release type. Examples of resources include apps, service instances, container clusters, storage volumes, virtual servers, and software.







 Adding resources to a resource group by using the API 

See [Managing catalog settings](https://cloud.ibm.com/docs/account?topic=account-filter-accountset-public-visibility-api) to set the visibility of the IBM Cloud® catalog and to control access to products in the public catalog and private catalogs for users in your account.





 Viewing resources in a resource group 

To easily view the resources that are assigned to a resource group, go to the Navigation Menu icon !
Prerequisites for provisioning DevSecOps toolchain operations 

Use these steps to provision DevSecOps toolchain operations. These steps are not required for a Terraform deployment of the DevSecOps toolchains.



 Create a continuous delivery service 

Continuous delivery supports the repositories and pipelines in the toolchain. To create a continuous delivery service, see [Continuous Delivery](https://cloud.ibm.com/catalog/services/continuous-delivery).

You can evaluate the continuous delivery service for 30 days by using the lite plan.





 Create a Kubernetes cluster 

Create either a [Kubernetes cluster](https://cloud.ibm.com/kubernetes/catalog/cluster/create), or a [Red Hat OpenShift cluster](https://cloud.ibm.com/kubernetes/catalog/create?platformType=openshift).

While you are evaluating the service, you can use the free pricing plan. The cluster might take some time to provision. As the cluster is created, it progresses through the following stages: Deploying, Pending, and Ready. For more information, see [Getting started with Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started).





 Create a Container Registry namespace 



1. Create a [Container Registry namespace](https://cloud.ibm.com/registry/namespaces). Container Registry provides a multi-tenant private image registry that you can use to store and share your container images with users in your IBM Cloud account.
2. Select the location for your namespace, and click Create.



For more information, see [Getting started with Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started).





 Create a signing key 

Create an image signing key with the proper encoding to sign your application Docker images.

This key is required for the CI pipeline. The default secret name entry is signing_key.
IBM Cloud Object Storage is certified for ISO 27001, ISO 27017, and ISO 27018.

For available certificates, please refer to listings titled “IBM Cloud Services (PaaS and SaaS) certificates” on the IBM Cloud Compliance page.





 System and Organization Controls (SOC) 

IBM Cloud Object Storage is certified for SOC 1 Type 2, SOC 2 Type 2, and SOC 3.





 Payment Card Industry (PCI) data security standards 

IBM Cloud Object Storage is compliant with the PCI data security standards.





 HIPAA readiness 

IBM Cloud Object Storage meets the required IBM controls that are commensurate with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security and Privacy Rule requirements. These requirements include the appropriate administrative, physical, and technical safeguards required of Business Associates in 45 CFR Part 160 and Subparts A and C of Part 164. HIPAA readiness for IBM Cloud Object Storage applies to the following plan:



* IBM Cloud Object Storage – Standard pricing plan



If you or your company is a covered entity as defined by HIPAA, you must enable the HIPAA Supported setting on your IBM Cloud account if you run sensitive workloads that are regulated under HIPAA and the HITECH Act. HIPAA support from IBM requires that you agree to the terms of the [Business Associate Addendum (BAA) agreement](http://www-03.ibm.com/software/sla/sladb.nsf/sla/baa?OpenDocument) with IBM for your IBM Cloud account.

After you enable HIPAA Supported setting in your IBM Cloud account, you cannot disable it. See [IBM Cloud Docs: Enabling the HIPAA Supported setting](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedenabling-hipaa) for additional information.





 General Data Protection Regulation (GDPR) readiness 

Please visit [IBM's commitment to GDPR readiness](https://www.ibm.com/data-responsibility/gdpr/) page to learn about IBM’s GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey.