vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Wait for the DEPLOY stage to complete.
10. After the DEPLOY stage completes open a new tab and paste in the dev.INGRESS_SUBDOMAIN of the cluster.



If you don't see your application updating, confirm all the steps passed and review their respective logs.

Note: If you prefer to work locally for making and viewing updates to the application. Once your changes are pushed to the repository they will also trigger a build in the Delivery Pipeline.





 Step 4: Deploy to a production environment 

In this section, you will complete the deployment pipeline by deploying the application to development and production environments respectively.

There are [different options](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applications) to handle the deployment of an application to multiple environments. In this tutorial, you will deploy the application to two different namespaces.



1. Go to the toolchain you created earlier and click the Delivery Pipeline tile.
2. Rename the DEPLOY stage to Deploy dev by clicking on the settings icon, then Configure Stage.

Zoom

![Access the settings Icon](https://cloud.ibm.com/docs-content/v1/content/efbf7b33e3aca029f69f9244bced9dd4d8acb848/apps/includes/solution-tutorials/includes/solution-tutorials/images/solution21/deploy_stage.png)

Access the settings Icon
3. To save the changes scroll down and click Save.
4. Clone the Deploy dev stage (settings icon > Clone Stage) and name the cloned stage as Deploy prod.
5. On the Input panel change the stage trigger to Run jobs only when this stage is run manually.
6. In Environment properties panel, set CLUSTER_NAMESPACE to production. Update the HELM_UPGRADE_EXTRA_ARGS property Value: --set ingress.enabled=true,ingress.hosts={prod.INGRESS_SUBDOMAIN}
7. Save the stage.
8.
Wait for the DEPLOY stage to complete.
10. After the DEPLOY stage completes open a new tab and paste in the dev.INGRESS_SUBDOMAIN of the cluster.



If you don't see your application updating, confirm all the steps passed and review their respective logs.

Note: If you prefer to work locally for making and viewing updates to the application. Once your changes are pushed to the repository they will also trigger a build in the Delivery Pipeline.





 Step 4: Deploy to a production environment 

In this section, you will complete the deployment pipeline by deploying the application to development and production environments respectively.

There are [different options](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applications) to handle the deployment of an application to multiple environments. In this tutorial, you will deploy the application to two different namespaces.



1. Go to the toolchain you created earlier and click the Delivery Pipeline tile.
2. Rename the DEPLOY stage to Deploy dev by clicking on the settings icon, then Configure Stage.

Zoom

![Access the settings Icon](https://cloud.ibm.com/docs-content/v1/content/cbb80bf851fb762a838129cba09d5674f8bfffda/Registry/includes/solution-tutorials/includes/solution-tutorials/images/solution21/deploy_stage.png)

Access the settings Icon
3. To save the changes scroll down and click Save.
4. Clone the Deploy dev stage (settings icon > Clone Stage) and name the cloned stage as Deploy prod.
5. On the Input panel change the stage trigger to Run jobs only when this stage is run manually.
6. In Environment properties panel, set CLUSTER_NAMESPACE to production. Update the HELM_UPGRADE_EXTRA_ARGS property Value: --set ingress.enabled=true,ingress.hosts={prod.INGRESS_SUBDOMAIN}
7. Save the stage.
8.
Your deployment environments 

Risk analysis is useful for customers that deploy to several environments. You can view all of your apps deployments and deployment environments. With risk analysis, you get an overview of the risks that are associated with your applications from all of your environments. The Risk Analysis page is automatically populated with the most recent information that is sent from your continuous integration and continuous delivery (CI/CD) tools.

Zoom

![Deployment Risk analysis](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/DRA_risk_analysis.png)

Figure 1. Risk Analysis page

Within the Risk Analysis dashboard you can select from two tabs: Application and Environment. Within the Application tab, you can see the number of active builds and risk evaluations for each of your apps. In the Environment tab, you can view the location of the app, the number of deployed applications, and the risk evaluations associated with the environment.

To view the Risk Analysis page, complete the following steps:



1.  From the IBM Cloud console, click the menu icon ![hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg), and select DevOps.
2.  On the Toolchains page, click your toolchain to open its Overview page.
3.  On the IBM Cloud tools card, click the DevOps Insights tool integration.
4.  From the menu, select Risk Analysis.
Understanding latency 

Go Hybrid with IBM Cloud® Direct Link: making your workloads run faster, worldwide

IBM Cloud® offers data centers with Direct Link capabilities around the globe. Therefore, you can count on minimal latency when you use Direct Link to create your Hybrid cloud solution by linking your IBM Cloud to your existing infrastructure.

Whether you have an online store, run big data solutions, or have your employees set up on a network with access to files around the world, you never want to hear that slow page loading on the web, or slow data transfer, is keeping you from a sale. Slowdowns can be caused by network latency, which is the measurement of how quickly data travels between two connected points on the internet. You can think of it as the amount of time it takes for one packet of data to get from one place to another.

Globally, the internet’s overall latency can vary significantly—depending on how far the data must travel physically, how many times the data must hop between service providers, how much bandwidth is available along the way, what other data is traveling across the same path, in addition to other variables. IBM Cloud Direct Link offers deterministic latency with greater security, relative to the internet for predictable performance.



 Understanding network latency 

As a best practice, every network provider wants to offer the lowest network latency to the greatest number of customers, and every customer wants to obtain the lowest possible latency. It’s a desirable, shared outcome.

Theoretically, data can travel at the speed of light across optical fiber network cables, but for all the reasons that are just given, data typically travels much more slowly. For example, if a particular network connection has reached its bandwidth capacity, data packets might temporarily queue up to wait for their turn to travel across that pathway. As another example, if a particular service provider’s network selects a network route that is not optimal, data packets can be sent hundreds or thousands of miles away from their destination in the process of getting to their destination! These kinds of delays and detours are the causes of higher network latency—and slower data transfers.

We express network latency in milliseconds (that’s 1,000 milliseconds per second).
To learn more about Delivery Pipelines, see and [Working with pipelines](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipeline_about) and [Working with Tekton pipelines](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-tekton-pipelines).





 Protecting your data when you use Terraform 

When you use Terraform to manage Continuous Delivery resources, some of the variables, arguments, and attributes that are processed by Terraform might carry secret values such as passwords or API tokens. These values might be specified by you in your Terraform configuration language files, they might be retrieved and stored in Terraform state by the Terraform tool, or both. The following list provides examples of secret values that you must protect when you use Terraform.



* The IAM API Key that the IBM Cloud Terraform Provider requires to authenticate to the IBM Cloud. This key is specified in the ibmcloud_api_key argument of your Terraform module's provider "ibm" block.
* The arguments or attributes that represent passwords, access tokens, API keys, or other kinds of secrets in some ibm_cd_toolchain_tool resources and data sources.
* Property values that are designated as secrets in some ibm_cd_tekton_pipeline_property or ibm_cd_tekton_pipeline_trigger_property resources or data sources.



Use IBM Cloud Schematics and the following practices to limit the exposure of sensitive data:



* Use Terraform variables to inject values into Terraform blocks.
* Use IBM Cloud Schematics to securely manage and share secrets.
* Use IBM Cloud Schematics to securely manage and share the Terraform state.
* Use the Continuous Delivery secrets references when you specify secrets within the ibm_cd_toolchain_tool, ibm_cd_tekton_pipeline_property, or ibm_cd_tekton_pipeline_trigger_property resources.



If you are using the Terraform command-line tool, use the following practices to limit the exposure of sensitive data:



* Use Terraform variables to inject values into Terraform blocks.
[IBM Cloud projects](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects) allow an enterprise to ensure that only approved IaC is deployed and to track how the resulting resources correspond to projects, teams, and cost centers.



 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. IBM Cloud Framework for Financial Services controls

 Family Control 

 Configuration Management (CM) [CM-2 Baseline Configuration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-2) 
 [CM-2 (2) Automation Support for Accuracy / Currency](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-2.2) 
 [CM-3 Configuration Change Control](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-3) 
 Access Control (AC) [AC-5 Separation of Duties](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5) 









 Separate development and production 

Development environments must be separated from production environments as they have different accounting, resource utilization, access, availability, networking, and compliance requirements. However, at the same time development environments should be kept in sync with production environments so that users testing in development can be confident that the application will behave similarly in production.

This recommendation creates a clean separation between development and production environments, but uses infrastructure as code to ensure that development and production are aligned.



 Related controls in IBM Cloud Framework for Financial Services
This means even if on a LTS release over the three years, there will still be a need to upgrade some elements.



Within these parameters:



* Clients can request specific dates for upgrading their environments. Clients on an LTS release can remain on that release for the time it is supported.
* Non production environments will be done during the week
* Production environments are typically done over the weekend
* Clients can determine the length of time between upgrading non production and production assuming the production upgrade happens prior to the existing version being out of support.
* Clients must request via a ticket the dates.
* Clients on non Long Term Support versions will be notified via Client Communication Center (CCC) with proposed dates to ensure clients remain in support. Clients can defer, but only within the window to stay on a supported version.
* All client stakeholders must register to receive CCC notifications & communications
* IBM will share long-range anticipated upgrade windows upon request via ticket



Non-Production Upgrades



* Client must request upgrades via [IBM support case](https://www.ibm.com/mysupport) including the target environment and suggested dates when upgrades can occur
* Non-Production environments are upgraded during weekdays.



Production Upgrades



* Production environments will be upgraded no earlier than 4 weeks after the non-production upgrade
* Some requests (e.g. data back-flow) are unavailable between non-production & Production upgrades
* Production environments are upgraded on weekends







 Post Maintenance Customer Testing / Validation 

After completion of maintenance windows or upgrades by the SRE team, it will be the customer's responsibility to perform regression testing and validate that the application is working as expected. The IBM SRE team do not have front end application access to customer environmentd. Customers are required to check general applicaton functionality and any business critical components. Additionally, any customer specific integrations (JMS) or custom configurations (automation scripts, applications, etc) will need to be validated as well.





 Emergency Maintenance 

In exceptional cases such as critical security patching, the The IBM Maximo Application Suite Dedicated Services team may need to schedule unplanned emergency maintenance outages outside of a Planned Maintenance window for Production systems.
AC-4 - Information Flow Enforcement 



 Control requirements 

AC-4 - 0
: The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].





 Additional IBM Cloud for Financial Services specifications 



* The organization must document all information flows that involve the transfer of customer data. An information flow control policy must be developed and maintained that indicates the source and destination of each flow, the system of record and whether the information is altered during transmission.
* The organization shall maintain a catalog of all customer metadata processed and/or transmitted by the organization on behalf of the customer. Metadata should be defined by each customer.
* The organization "service delivery" and "corporate" environments must be maintained as separate environments. That is, clear physical and/or logical boundaries separating the two environments must exist.







 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port
* Check whether Event Streams network access is restricted to a specific IP range
* Check whether Virtual Servers for VPC instance doesn't have a floating IP
* Check whether Application Load Balancer for VPC has public access disabled
* Check whether OpenShift clusters are accessible only by using private endpoints
* Check whether Cloud Object Storage quota enforcement is off for buckets that are configured to use Activity Tracker Event Routing
* Check whether Virtual Private Cloud (VPC) security groups have inbound ports that are open only to permitted IP addresses
* Check whether Hyper Protect DBaaS for MongoDB is accessible only using private endpoints
Logging activity with a webhook 

Plus

Enterprise

You can log activity by making a call to an external service or application every time a customer submits input to the assistant.

A webhook is a mechanism that allows you to call out to an external program based on events in your program.

This feature is available only to Plus and Enterprise plan users.

Add a log webhook to your assistant if you want to use an external service to log Watson Assistant activity. You can log two kinds of activity:



* Messages and responses: The log webhook is triggered each time the assistant responds to user input. You can use this option as an alternative to the built-in analytics feature to handle logging yourself. (For more information about the built-in analytics support, see [Metrics overview](https://cloud.ibm.com/docs/assistant?topic=assistant-logs-overview).)

The log webhook is not supported for API clients that use the v1 /message method.
* Call detail records (CDRs): The log webhook is triggered after each telephone call a user makes to your assistant using the phone integration. A Call Detail Record (CDR) is a summary report that documents the details of a telephone call, including phone numbers, call length, latency, and other diagnostic information. CDR records are only available for assistants that use the phone integration.



The log webhook does not return anything to your assistant.

For environments where private endpoints are in use, keep in mind that a webhook sends traffic over the internet. For more information, see [Private network endpoints](https://cloud.ibm.com/docs/assistant?topic=assistant-securitysecurity-private-endpoints).



 Defining the webhook 

You can define one webhook URL to use for logging every incoming message or CDR event.

The programmatic call to the external service must meet these requirements:



* The call must be a POST HTTP request.



To add the webhook details, complete the following steps:



1. From your assistant, click the !
Manual IP address ranges supported 172.16.0.0/12, 192.168.0.0/16, 10.254.0.0/16, any public IP addresses 
 Bring Your Own IP (BYOIP) Supports BYOIP for non-overlapping RFC-1918 IP ranges between VPC networks and on-premise networks (see [Routing considerations for IANA-registered IP assignments](https://cloud.ibm.com/docs/vpc?topic=vpc-interconnectivityrouting-considerations-iana) for details). ADDITIONAL NOTE: While we are focussed on a VPC environment, in some cases you may still have resources on IBM Classic Infrastructure which you will need to include as part of the on-prem connectivity. Be aware that IBM Classic Infrastructure uses a 10.0.0.0/8 range so additional considerations with BYOIP may need to be made as described in the [documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-interconnectivityrouting-considerations-iana). 
 MACsec MACsec support is available in CHI01 and WDC02. Compatible with Cisco switches. 
 Bi-directional Forwarding Detection(BFD) All MZRs have Direct Link (2.0) offering support. 
 Billing/Pricing Metered based on the data utilization and unmetered flat rate support. Inbound data transfer to IBM Cloud is free. Data transfer for [egress](https://cloud.ibm.com/docs/dl?topic=dl-pricing-for-ibm-cloud-dlmetered-data-transfer-charge) varies based on region. Global routing (access to all IBM Cloud data centers globally) is free. 







 Connection Patterns 

The following pattern depicts how individual infrastructure (VPC and Classic) can be added as connections !
Lifecycle for CentOS operating systems

 Operating sytem End of support License model 

 CentOS 8 minimal 31 December 2021 Free 
 CentOS 7.9 minimal 30 June 2024 Free 







 Debian 

The following table describes the end of support date and license model for Debian operating systems. This guest OS is a free operating system. For more information, see [Debian community](https://www.debian.org/).



Table 2. Lifecycle for Debian operating systems

 Operating sytem End of support License model 

 Debian 11 minimal 01 June 2026 Free 
 Debian 10 minimal 01 June 2024 Free 
 Debian 9 minimal 30 June 2022 Free 







 Fedora CoreOS 

The version of Fedora® CoreOS is updated regularly, with the previous release deprecating when a new version is released. This guest OS is a free operating system. For more information, see [Fedora](https://getfedora.org/).



Table 3. Lifecycle for Fedora CoreOS operating systems

 Operating sytem End of support License model 

 Fedora CoreOS latest N/A Free 







 Red Hat Enterprise Linux (RHEL) 

The following table describes the end of support date and license model for Red Hat® Enterprise Linux® operating systems. This guest OS is a paid operating system. For more information, see [Red Hat Enterprise Linux](https://www.redhat.com/en/technologies/linux-platforms/enterprise-linux).



Table 4. Lifecycle for Red Hat Enterprise Linux (RHEL) operating systems

 Operating sytem End of support License model 

 RHEL 9.0 minimal 31 May 2024 Pay-as-you-Go / BYOL 
 RHEL 9.0 (SAP HANA and SAP applications) 31 May 2026 Pay-as-you-Go 
 RHEL 8.6 minimal 31 May 2024 Pay-as-you-Go / BYOL 
 RHEL 8.6 (SAP HANA and SAP applications) 31 May 2026 Pay-as-you-Go 
 RHEL 8.4 minimal 31 May 2023 Pay-as-you-Go / BYOL
SLES 12 SP4 (SAP HANA and SAP applications) 30 June 2023 Pay-as-you-Go 







 Ubuntu LTS 

The following table describes the end of support date and license model for Ubuntu operating systems. This guest OS is a free operating system. For more information, see [Ubuntu](https://ubuntu.com/).



Table 7. Lifecycle for Ubuntu operating systems

 Operating sytem End of support License model 

 Ubuntu 22.04 minimal 30 April 2027 Free 
 Ubuntu 20.04 minimal 30 April 2025 Free 
 Ubuntu 18.04 minimal <br><br>[1] 31 May 2023 Free 
 Ubuntu 16.04 minimal 01 April 2021 Free 







 Windows Server 

The following table describes the end of support date and license model for Windows Server operating systems. This guest OS is a paid operating system. For more information, see [Microsoft Windows Server](https://www.microsoft.com/en-us/windows-server).



Table 8. Lifecycle for Windows Server operating systems

 Operating sytem End of support License model 

 Windows Server 2022 full standard 14 October 2031 Pay-as-you-Go / BYOL 
 Windows Server 2019 core 09 January 2029 Pay-as-you-Go / BYOL 
 Windows Server 2019 full standard 09 January 2029 Pay-as-you-Go / BYOL 
 Windows Server 2016 core 11 January 2027 Pay-as-you-Go / BYOL 
 Windows Server 2016 full standard 11 January 2027 Pay-as-you-Go / BYOL 
 Windows Server 2012 full standard 10 October 2023 Pay-as-you-Go / BYOL 
 Windows Server 2012 r2 full standard 10 October 2023 Pay-as-you-Go / BYOL 
 Windows Server 2019 Standard Edition with SQL Server 2019 Web Edition 08 January 2030 Pay-as-you-Go 



BYOL: For Windows operating systems, you can bring your own license (BYOL) to IBM Cloud VPC when you import a custom image. These images are registered and licensed by you. You maintain control over your license and incur no additional costs by using your license.