vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Toggle auto link when you provision an instance To toggle auto link when you provision an instance, navigate to the Secure access setting in the Metadata window on the instance provision page. Toggle the secure access switch so that it displays Enabled.





 Enable secure access by using the UI 

You can enable secure access to the instance metadata service. When secure access is enabled, the metadata service is accessible only to the virtual server instance by encrypted HTTP secure protocol (HTTPS). When secure access is disabled, the metadata service is accessible only to the virtual server instance by unencrypted HTTP protocol. Secure access is disabled by default.

Additional properties might be required in the following scenarios:



* You are using the IBM Cloud CLI Virtual Server Instance for VPC compute resource identity login method. For more information, see [Logging in as a Virtual Server Instance Compute Resource Identity](https://cloud.ibm.com/docs/cli?topic=cli-vsi-cri-login).
* You are using the IBM Cloud SDK with [VPC Instance Authentication](https://github.com/IBM/ibm-cloud-sdk-commonauthentication) inside an instance with secure access to the instance metadata service enabled. For more information, see [IBM Cloud Go SDK](https://github.com/IBM/go-sdk-core/blob/main/Authentication.mdvpc-instance-authentication)





 Enable secure access when you provision an instance 

To enable secure access when provisioning an instance, navigate to the Secure access setting in the Metadata window when you Create an instance from the Virtual server instances for VPC page. Toggle the secure access switch so that it displays Enabled.





 Enable secure access on an existing instance 

To enable secure access on an existing instance, navigate to the Secure access setting on the Instance details page of your instance.







 Set the metadata hop limit by using the UI 

You can set the hop limit for IP response packets from the metadata service. The hop limit can be any value from 1 (default) to 64. The metadata service must be enabled.



 Set the metadata hop limit when you provision an instance
LOYALTY MOBILE APP provides targeted marketing with digital coupons, shopping lists, product inventory (prices, availability) on a store map, and social sharing.
3. SOCIAL MEDIA ANALYTICS provides personalization by detecting customers’ preferences in terms of trends: cuisines, chefs, and ingredients. The analytics connect regional trends with an individual’s Twitter, Pinterest, and Instagram activity.
4. DEVELOPER-FRIENDLY TOOLS accelerate roll-out of features and bug fixes.



Back-end inventory systems for product inventory, store replenishment, and product forecasting have a wealth of information, but modern analytics can unlock new insights about how to better move high-end products. By using a combination of IBM Cloudant and IBM Streaming Analytics, the CMO can find the sweet spot of ingredients to match to custom in-store events.

IBM® Event Streams for IBM Cloud® acts as the just-in-time events platform to bring in the rapidly changing information from the inventory systems to IBM Streaming Analytics.

Social media analytics with Watson Discovery (personality and tone insights) also feed in trends to the inventory analysis to improve product forecasting.

The loyalty mobile app provides detailed personalization information, especially when customers use its social sharing features, such as posting recipes.

In addition to the mobile app, the Developers are busy with building and maintaining the existing loyalty app that’s tied to traditional checkout coupons. In short, they need to focus on coding instead of managing the infrastructure. Thus, they chose IBM Cloud Kubernetes Service because IBM simplifies infrastructure management.



* Managing Kubernetes master, IaaS, and operational components, such as Ingress and storage
* Monitoring health and recovery for worker nodes
* Providing global compute, so Developers aren't responsible for infrastructure setup in data centers



Compute, storage, and event management that run in public cloud with access to back-end ERP systems

Technical solution:



* IBM Cloud Kubernetes Service
* IBM® Event Streams for IBM Cloud®
* IBM Cloudant
* IBM Streaming Analytics
* IBM Watson Discovery







 Step 1: Containerize apps, by using microservices 



* Structure inventory analysis and mobile apps into microservices and deploy them to containers in IBM Cloud Kubernetes Service.
Site-to-Site IPsec VPN 

A Site-to-Site IPsec VPN can be configured between the IBM Cloud environment and a customer site or third party location. This type of VPN establishes a persistent tunnel between the two sites. Site-to-Site VPNs are not configured by default. The setup and configuration of a Site-to-Site VPN can be complex and will require both IBM and the customer's network SMEs to work together. Initial VPN settings and shared parameters must first be agreed upon by both parties. Source and destination IPs must then be determined along with the type and direction of traffic. The tunnel must be stood up, along with routing, IP Address NATing, and applicable firewall rules on both sides. VPNs can take 2-4 weeks to design, setup, test and validate (from start to finish). Proper time should be allowed for a VPN build when planning integrations or services will that depend on it for connectivity. MAS-Dedicated customers must specifically request a VPN by submitting a case to the IBM Support Community.



* Note: Only one case is needed for VPN setup and can cover configuration for multiple environments (DEV, TEST, PROD, etc).
* Note: It is important to bear in mind a VPN may not necessarily be needed to establish certain types of connectivity. Some integration types can run over HTTPS and/or rclone and may not require a VPN.
* Note: Currently MAS on AWS does not support NAT at MAS side in Site-to-Site VPN







 Maximo Mobile 

For questions related to use of Maximo Mobile in MAS-Dedicated Manage, please refer to the link below. [https://www.ibm.com/docs/en/maximo-manage/8.0.0?topic=managing-maximo-mobile](https://www.ibm.com/docs/en/maximo-manage/8.0.0?topic=managing-maximo-mobile)

Once on the resulting page, select the desired version of Maximo Mobile from the drop-down 'Change version' in the top left corner.
Input container 

The Input container is a collection used by both the Mapping and (Origin) Path classes. It provides a consistent set of input attributes for both classes.



* vendorName: The name of a valid IBM Cloud® CDN provider.
* oldPath: Used by updateOriginPath(). This property stores the name of the current, or 'old', path.



The following attributes are common to the Mapping and (Origin) Path classes:



* originType: Type of the origin host, currently HOST_SERVER or OBJECT_STORAGE.
* origin: Origin server address (either the hostname or the IPv4 address of the origin server), the endpoint from which to fetch content, or the name of the bucket where content is stored. Must be fewer than 511 characters.
* httpPort: Number of the port used for HTTP protocol. Akamai has certain limitations on port numbers for HTTP and HTTPS ports. See the [FAQ](https://cloud.ibm.com/docs/CDN?topic=CDN-faqsare-there-any-restrictions-on-what-port-numbers-are-allowed) for a list of allowed port numbers.
* httpsPort: Number of the port used for HTTPS protocol. Akamai has certain limitations on port numbers for HTTP and HTTPS ports. See the [FAQ](https://cloud.ibm.com/docs/CDN?topic=CDN-faqsare-there-any-restrictions-on-what-port-numbers-are-allowed) for a list of allowed port numbers.
* status: The status of the mapping or path. Status can be CNAME_CONFIGURATION, SSL_CONFIGURATION, RUNNING, STOPPED, DELETED, or ERROR.
* path: Path from which the cached content is served. The default path is /* When used by the updateOriginPath API, this attribute refers to the new path to be added.
* performanceConfiguration: Specifications for the performance configuration of the mapping. We support the following performance configurations:



* General web delivery: The default performance option to optimize the general web page contents, such as the HTML, pictures, CSS, JS files.
* Operating System: VMware ESXi 5.5 ('No Operating System' if you are using [Installing VMware vSphere ESXi via Remote Console and Virtual Media](https://cloud.ibm.com/docs/vmware?topic=vmware-installing-vsphere-esxi)
* Hard disk: Disks 1 & 2: 500 GB SATA in RAID 1
* Public Bandwidth: Private Network Only > 0 GB bandwidth
* Uplink Port Speeds: 10 Gbps Redundant Private Network Uplinks



3. Click Continue Your Order.







 Completing configuration 

Now, you have ESXi hosts in your shopping cart. For the devices to provision correctly, you need to assign the public (if applicable) VLAN, private VLAN, host name, and domain to the devices.



1. Assign the following VLANs and create host names for the devices:



* ESXi hosts – Backend VLAN: (1101)
* Backend VLAN: (1101)
* Frontend VLAN: (2101)



2. Select your payment method, agree to the terms and conditions, and click Finalize Your Order. Important: Do not proceed to Step 5 until the servers are provisioned and are accessible via VPN or virtual server that was ordered in the previous step.









 Step 5 Trunking VLANs on BCS Switches 

By default, ports are placed on the backend customer switches (that is, private network switch in a pod, such as a Backend Customer Switch (BCS)) in access mode. As a result, you need to trunk the ports that are attached to the ESXi hosts so the hosts can access storage and so the VMs can communicate on the private network.

Before you open the ticket to trunk the VLANs, you need to determine which network interfaces are on the private network. To determine the interface, go to the Device Details for each ESXi server and go to Network > Private. For this environment, eth0 and eth2 are the private network adapters.

In addition to trunking of the VLANs for the ESXi hosts, you must also unbond the NICs for the management and capacity hosts.
* The node of the SG gateway, which can be found in the configuration of the gateway. Since each gateway will not be on the same node, please confirm the hostname of the node every time you create the gateway



* Port 443 for gateway authentication when Secure Gateway Client start up



* US South: sgmanager.us-south.securegateway.cloud.ibm.com
* US East: sgmanager.us-east.securegateway.cloud.ibm.com
* United Kingdom: sgmanager.eu-gb.securegateway.cloud.ibm.com
* Germany: sgmanager.eu-de.securegateway.cloud.ibm.com
* Sydney: sgmanager.au-syd.securegateway.cloud.ibm.com





Ensure you check or modify additional firewall and IP Table rules that might apply. However, we do not recommend setting rules by IP, rules should be set specific to host name and port as the IPs for gateway authentication and SG gateway are controlled by IBM Cloud and are subject to change.





 Determining Hardware Requirements 

The specifications of the machine running the Secure Gateway Client is largely dependent on the traffic that will be passing through each connection. Each client instance is an individual process that provides up to 250 concurrent connections. To estimate an average maximum that the machine would need to support, determine the average size of a transaction across the client (both request and response) and then scale that to 250 concurrent transactions. Given that this number has combined both request and response sizes, the client should not exceed this memory footprint. For more precise estimates, a mixture of request sizes and response sizes should be used to better simulate a real-world transaction scenario.

For running a single instance of the Secure Gateway Client, we suggest a minimum of 2 cores and 4 GB of memory.

For HA scenarios that will be running multiple instances of the client on the same machine, we suggest a minimum of 4 cores and 8 GB of memory.
For more information about how applications use wallets, see the [wallet](https://hyperledger-fabric.readthedocs.io/en/release-2.2/developapps/wallet.html) topic in the Fabric Documentation. The wallets that are used by the Fabric SDKs are different from the wallet in the IBM Blockchain Platform console. The identities that are stored in your console wallet cannot be directly used by the SDK.

The original sample uses the addToWallet.js file to create a file system wallet using certificates from the fabric samples folder. We are going to create a new file that uses the SDK to generate a client-side certificate and store them directly inside a new wallet.

Choose the CA of the organization you want to use to operate the tutorial as magnetocorp. For example, you can use Org1 if you have completed the Build a network tutorial. Use the CA to [create an application identity](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-appibp-console-app-identities). Save the enroll ID and secret.

Use your console to [download your connection profile](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-appibp-console-app-profile). Save the connection profile to your local file system and rename it connection.json. Then, issue the following command from the magnetocorp/application directory to move the connection profile to a directory where it will be referenced by future commands.

mv $HOME/<path_to_creds>/connection.json ../gateway/connection.json

Save the following code block as enrollUser.js in the /magnetocorp/application directory:

'use strict';

const FabricCAServices = require('fabric-ca-client');
const { FileSystemWallet, X509WalletMixin } = require('fabric-network');
const fs = require('fs');
const path = require('path');
Failover options 

This topic explains some actions you can take to increase the availability of Watson Assistant for your organization.



 Introduction 

IBM Watson® Assistant instances are deployed across multizone regions (MZRs) in all data centers (except Seoul, Korea) and can withstand the loss of any individual zone within an MZR. However, regional outages can occur and while IBM strives to keep these to a minimum, you may want to consider moving traffic to a different region for your business-critical applications.

To achieve this, you should have a copy of your Watson Assistant instance in a different MZR (for example, have your assistant deployed in US East and US South). To do this, you must purchase a second service instance of Watson Assistant, and second instances of the necessary assistants and skills need to be instantiated. You must implement change management controls to synchronize the changes between the two regions. Watson Assistant and Speech services have APIs available to export and import the definitions.

With two instances, there are two topologies to consider:



* Active/active: Both instances always serving traffic with the load sprayed between the two.
* Active/passive: One instance is active and the passive site only receives traffic in the event of a failover.



There are pros and cons to both approaches, and considerations specific to Watson Assistant are detailed in the sections that follow.





 Considerations 

Watson Assistant instances in one region are unaware of instances in a second region, which can affect some features and capabilities in Watson Assistant.



 Analytics 

Watson Assistant analytics provide overview statistics on the number of interactions with users and containment rates. Analytics doesn't cumulate statistics across regions. With an active/passive topology, this approach to analytics should be sufficient. However, using an active/active topology likely requires using [webhooks](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-webhook-overview) to gather interaction data, and build custom data warehouses and reports to understand total usage.





 Session history for web chat and the v2 api 

Session history allows your web chats to maintain conversation history and context when users refresh a page or change to a different page on the same website.
16-year-old learner

The syntax n-year-old x is a pattern that typically represents a person. You can define a regular expression rule to find phrases that match the n-year-old x pattern, and annotate them as PERSON entity mentions.





 Regular expression best practices 

Although the regex tool that is included in the rule editor recognizes expressions that follow the java.util.regex.Pattern syntax, the entire syntax is not supported. When using the regex tool, consider the following best practices:



* Rules match only on token boundaries. You can't write rules that match a subsequence of a token. For more information, see [Tokenizers](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-create-projectwks_tokenizer).
* Keep your regular expressions simple and clean.
* Consider using dictionaries instead of regular expressions. Although you might think of a clever rule that can capture several expressions, in general, dictionary matching is faster than rules matching. Also, dictionaries are easier to maintain.
* Instead of relying completely on regular expressions to match tokens, it's best to use a combination of dictionaries, regular expressions, and rules. For example, consider the scenario of matching a phone number in a sentence such as My mobile is 123-456. You might be able to write a rule that uses a regular expression to match that sentence. But in this case, the recommended method is to add a dictionary to find words such as mobile and phone, write a simple regular expression that captures possible phone number sequences, and then create a rule to scan for a sequence of patterns, such as dictionary term+text+regex as shown in the example sentence, My mobile is 123-456.
* Avoid unnecessary use of lookahead and lookbehind ((?=ABC)). In many cases, you can achieve the same result by using a combination of regular expressions and rules.
16-year-old learner

The syntax n-year-old x is a pattern that typically represents a person. You can define a regular expression rule to find phrases that match the n-year-old x pattern, and annotate them as PERSON entity mentions.





 Regular expression best practices 

Although the regex tool that is included in the rule editor recognizes expressions that follow the java.util.regex.Pattern syntax, the entire syntax is not supported. When using the regex tool, consider the following best practices:



* Rules match only on token boundaries. You can't write rules that match a subsequence of a token. For more information, see [Tokenizers](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-create-projectwks_tokenizer).
* Keep your regular expressions simple and clean.
* Consider using dictionaries instead of regular expressions. Although you might think of a clever rule that can capture several expressions, in general, dictionary matching is faster than rules matching. Also, dictionaries are easier to maintain.
* Instead of relying completely on regular expressions to match tokens, it's best to use a combination of dictionaries, regular expressions, and rules. For example, consider the scenario of matching a phone number in a sentence such as My mobile is 123-456. You might be able to write a rule that uses a regular expression to match that sentence. But in this case, the recommended method is to add a dictionary to find words such as mobile and phone, write a simple regular expression that captures possible phone number sequences, and then create a rule to scan for a sequence of patterns, such as dictionary term+text+regex as shown in the example sentence, My mobile is 123-456.
* Avoid unnecessary use of lookahead and lookbehind ((?=ABC)). In many cases, you can achieve the same result by using a combination of regular expressions and rules.
Migrating legacy configurations to the current vSRX architecture 

Migrating IBM Cloud® Juniper vSRX configurations from the legacy to the current architecture requires careful consideration.

vSRX 18.4 deployments leverage the current architecture in most cases. This includes the vSRX 18.4 1G SR-IOV offering. The older vSRX 18.4 1G Standard offering is based on Linux Bridging and has different network configurations on the Ubuntu host, the KVM hypervisor, and in the vSRX configuration. The host and KVM settings do not require any special migration steps, as the automation process handles the configuration changes. However, if you want to import the vSRX configuration from the legacy architecture into the current vSRX configuration, you likely need to refactor some of the configuration.



 Migrating 1G vSRX standalone configurations 

There are some steps you potentially need to convert vSRX configuration settings on a Standalone 18.4 1G Public+Private Linux Bridge (legacy architecture) instance to a Standalone 18.4 1G Public+Private SR-IOV (current architecture) instance.

You can find a sample default configuration for SR-IOV based current architecture [in this topic](https://cloud.ibm.com/docs/vsrx?topic=vsrx-understanding-the-vsrx-default-configurationdefault-configuration-of-a-sample-standalone-vsrx-gateway).

The following is a sample default configuration for the Linux Bridge (legacy architecture). The example shows vSRX instances that were provisioned in different Datacenter pods. As a result, the transit VLAN’s (native-vlan-id) are different.

 Last commit: 2020-04-16 22:48:33 UTC by root
version 18.4R1-S1.3;
system {
login {
class security {
permissions [ security-control view-configuration ];
}
user admin {
uid 2000;
class super-user;
authentication {
Ideally, save the response code statistics in an external persistence store. This shared store can aggregate response code results from all deployed instances of a your application and provide the greatest fidelity in determining if a failover should be triggered.

Alternatively, response codes can be aggregated and evaluated in memory for a given instance of your application. As only a fraction of traffic is contributing to the failover decision, this could lead to different behavior with respect to how often the failover decision is acted upon.

With either aggregation approach, exceeding a defined threshold could trigger a failover. Common approaches for determining a failover include:



* Percentage-based: greater than X% of requests return a non-200 response code
* Consecutive-based: X calls in a row return a non-200 response code
* Limit-based: X calls return a non-200 response in a given timeframe



To avoid an unnecessary failover between regions, make sure a robust retry mechanism is present when calling the /message endpoint.





 Failover for v1 and v2 stateless API 

For a successful failover, ensure the following:



* Training data changes should be synchronized across regions. Avoid pushing changes delayed over a large window of time (such as days) to mitigate risk of algorithm changes being deployed by Watson Assistant in between regions being updated.
* The same IBM Cloud account should be used for the service instances across regions to maintain a single overall bill for services.
* The client applications should support:



* Watson Assistant API hostname
* Service instance credentials
* v1: workspace_id
* v2: assistant_id





Although it does not affect the runtime flow of calling /message, if you are using fine-grained access control using IBM Access Control (IAM), make sure the IAM policies are appropriately synchronized across the regions.

Note that IAM is a global service, but the custom resources (assistants and skills) used by Watson Assistant access control means each region, which has specific resources, requires specific policies.

For an active/passive topology, some form of a [circuit break pattern](https://martinfowler.com/bliki/CircuitBreaker.html) can be used. A single service instance in a given region is used exclusively unless errors are detected.