vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Introduction to Quantum-safe Cryptography in TLS 

You can use a quantum safe enabled TLS connection to send requests to a IBM® Key Protect for IBM Cloud® service endpoint.



 What is Quantum Safe Cryptography? 

Quantum safe cryptography, also known as post quantum cryptography, is a new generation of the public-key cryptographic system that is undergoing NIST evaluation. These new quantum cryptographic algorithms are based on hard mathematical problems that based on current research, even large quantum computers cannot break.

When these quantum cryptographic algorithms are used for TLS communication, the security of the public key exchange between the client and server are expected to have higher security levels than the current RSA and ECC algorithms. However, NIST hast not standardized the algorithms and until then, Key Protect has adopted a hybrid method that combines both Quantum Safe and current ECC algorithms to protect in-transit data.





 Why is Quantum Safe TLS important? 

As quantum computing continues to evolve and advance, a large quantum computer will be able to run a ["SHOR" algorithm](https://en.wikipedia.org/wiki/Shor%27s_algorithm) that can break the current TLS communication algorithms (RSA/ECC) in a matter of minutes. While large quantum computers are not available today, any TLS data-in-transit that has been snooped and stored can be breached when these large quantum computers are made available. Data has a long shelf life so it is critical that Key Protect supports quantum safe cryptographic algorithms to secure TLS communications.

To keep your in-transit data resilient, Key Protect has introduced the ability to use a quantum safe enabled TLS connection to ensure that your data is secure during the key exchange process.





 What are the considerations of Quantum Safe Cryptography? 

Before configuring your service to send requests to Key Protect through a quantum safe enabled Key Protect service endpoint, please keep in mind the following considerations:



* The National Institute for Standards and Technology (NIST) is in the process of [standardizing quantum safe algorithms](https://csrc.nist.gov/Projects/Post-Quantum-Cryptography). NIST is currently evaluating candidate approaches to quantum safe cryptography and isn't expected to complete the standardization process until after 2023.
With this configuration, MinIO functions fully in read/write mode if more than half, meaning three or more, of the pods are available. Its function is degraded to read-only mode if only half (two) of the pods are available.

MinIO pods are named ${release-name}-clu-minio-[0-9]. CLU, which stands for Conversational Language Understanding, is included in the pod names to associate the MinIO pods with the language understanding pipeline. It is only the pipeline microservices, such as NLU, Master, TAS, ED-MM, and the training pods that use MinIO.





 PostgreSQL data stores 

The Postgres data store is based on stolon, which is a cloud-native PostgreSQL manager for PostgreSQL high availability. (For more information, see the [GitHub sorintlab repo](https://github.com/sorintlab/stolon).) The Postgres store consists of the following kinds of pods:



* keeper: These pods run the PostgreSQL database. There are three keeper pods. One of the three is selected as the coordinator keeper. The coordinator keeper handles all of the SQL queries. The remaining pods are on standby and their state is updated by the coordinator keeper pod.

The keeper pod names follow the convention of ${release-name}-store-postgres-keeper-. If the release name is long, the pod names might be shortened to something like ${release-name prefix}-[a-f0-9]{4}-st-a617-keeper-.

The ${release-name} is watson-assistant. The shortened name is watson-ass.
* proxy: These pods are the entry point that is used by the Store microservice. The proxy pods route traffic to the coordinator keeper pod.
* sentinel: These pods are the ones that decide which of the keepers is the coordinator.



To manage the PostgreSQL cluster, use stolonctl commands inside the keeper pods.
5. Click the play button on DEPLOY stage.
6. In a browser tab paste the dev.INGRESS_SUBDOMAIN of the cluster. The message from the application should be returned: Welcome to IBM Cloud DevOps with Docker, Kubernetes and Helm Charts. Lets go use the Continuous Delivery Service.
7. Switch back to the pipeline tab.







 Step 3: Modify the application and deploy the updates 



1. Follow the breadcrumbs on the upper left of the screen and click on the first entry after of <your-initials>-mynodestarter after Toolchains.
2. Click the link under the Repositories tile, a new browser tab will open to the repository.
3. Click on the utils.js file and then click on Open in Web IDE/Edit drop down and choose EDIT then click EDIT.
4. Make a simple change, for example change "Welcome to" to something else.
5. Enter a commit message: my first changes and click on Commit changes.
6. Return to the previous tab showing the toolchain.
7. Click on the Delivery Pipeline tile named ci-pipeline.
8. Notice a new BUILD has started.
9. Wait for the DEPLOY stage to complete.
10. After the DEPLOY stage completes open a new tab and paste in the dev.INGRESS_SUBDOMAIN of the cluster.



If you don't see your application updating, confirm all the steps passed and review their respective logs.

Note: If you prefer to work locally for making and viewing updates to the application. Once your changes are pushed to the repository they will also trigger a build in the Delivery Pipeline.





 Step 4: Deploy to a production environment 

In this section, you will complete the deployment pipeline by deploying the application to development and production environments respectively.

There are [different options](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applications) to handle the deployment of an application to multiple environments. In this tutorial, you will deploy the application to two different namespaces.
App Configuration concepts 

Learn about App Configuration concepts like service instance, targeting definition, and feature flag.

Zoom

![App Configuration Overview](https://cloud.ibm.com/docs-content/v1/content/f3dada89f147af3b88388a2218ddbf64b3c41e5f/app-configuration/images/ac-overview.png)

Figure 1. App Configuration overview



 Service instance 

An App Configuration service instance is your copy of the App Configuration application on the IBM Cloud. You create an instance from the tile in the IBM Cloud catalog. Now you have access to the App Configuration dashboard and all the functions that come with the selected pricing plan.





 Environment 

App Configuration environments are sets of configuration values that are applied to the environments you run and manage in your infrastructure. For example, your software development process might involve three environments: development, staging, and production. Configuration values for all three can be present in a single instance of App Configuration. All configuration keys (names) automatically replicate across all environments inside App Configuration, but the values for each key are specific to each environment.





 Collection 

Use collections to group feature flags and properties in any way that is meaningful to you. Often a collection is used to represent all configuration values for a particular application. Feature flags and properties can belong to more than one collection for cases where you want to share a common configuration value across apps or sets of infrastructure.





 Feature flags 

Feature flags are configuration parameters that you want to turn on and off quickly or frequently. They can be used to set the state of your application. Within your application, the isEnabled() method of the App Configuration SDK is used to activate conditional blocks of code to turn features on and off based on the state of a feature flag. Use feature flags to dark launch features into production and then switch them on only for selected users or roll them out to your users selectively and independently from deployments. Each feature flag must belong to a collection.





 Properties 

Properties are configuration parameters that don't change often, but that still need centralized management.
Liberty for Java 

IBM® Cloud Foundry is deprecated and no longer supported as of 1 June 2023. For more information, see the [deprecation details](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-deprecationdep_details).

Liberty for Java apps on IBM Cloud® are powered by the liberty-for-java buildpack. The liberty-for-java buildpack provides a complete runtime environment for running Jakarta EE, Eclipse MicroProfile, Java EE, and OSGi apps on top of WebSphere Liberty. It supports popular frameworks like Spring and includes the IBM JRE. Liberty enables rapid app development that is well suited to the cloud.



  Detection 

The Liberty buildpack is used when the following kinds of apps are deployed:



*  [WAR files](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-options_for_pushingstand_alone_apps)
*  [EAR files](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-options_for_pushingstand_alone_apps)
*  [Liberty server directory](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-options_for_pushingserver_directory)
*  [Liberty packaged server](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-options_for_pushingpackaged_server)
*  [Java main](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-options_for_pushingjava_main)
*  [Distzip](https://github.com/cloudfoundry/ibm-websphere-liberty-buildpack/blob/master/docs/container-distZip.md)







  Starter app 

IBM Cloud provides several Liberty starter apps. The Liberty starter apps are simple Liberty apps that provide a template that you can use. You can experiment with the starter apps, and make and push changes to the IBM Cloud environment.
Separately maintained input configurations, ensure reusable blueprint templates can be configured at deploy time to create customized dev, stage and prod pipelines, or repeatable application deployments.

This modular approach to composition and configuration also eases the task of maintaining and updating large environments. Blueprint operations update environments on request through configuration of module versions, rather than by code change. IBM module libraries are regularly refresh and upgrade version to maintain platform compatibility and meet current compliance requirements. Module [semantic version](https://semver.org/) identifies the scope of any changes, allowing environments to be automatically refreshed with minor patches and revisions, while maintaining user control over major feature enhancements.





 Features 

Blueprints is built around [IaC best practices](https://cloud.ibm.com/docs/schematics?topic=schematics-infrastructure-as-codeiac-best-practices) to manage the lifecycle of large cloud environments. It provides cradle-to-grave management for modular environments. Modular and parameterized configuration support for reuse. Versioned deployments to control change to environments, as templates and modules are updated to meet new requirements and remain current, and compliant.

These features are illustrated under the four headings below.

Zoom

![Schematics Blueprints feature overview](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics//images/new/bp-features.svg)

Schematics Blueprints feature overview

Schematics Blueprints complements Terraform with IaC based environment management capabilities:



* [Modular composition](https://cloud.ibm.com/docs/schematics?topic=schematics-blueprint-terraform): Build infrastructure architectures from an eco-system of reusable IBM Cloud automation modules written in Terraform
However, you must to ensure that your control plane worker nodes are configured for high availability. The control plan worker nodes can ensure that the workloads that run in your location have enough compute capacity, even if compute hosts become unavailable. The time to recover a location or cluster is dependent on the size of the location or cluster and the network latency between IBM Cloud and your host infrastructure.





 High availability of the Satellite control plane worker nodes 

The Satellite control plane worker nodes run on the compute infrastructure that you add to your Satellite location. Your compute hosts can be in an on-premises data center, in public cloud providers, or in edge computing environments.

Your control plane worker nodes run the Satellite Link connector component that establishes a secure connection back to IBM Cloud. The link connector component is the main gateway for any communication between your Satellite location and IBM Cloud. Without this connection, your location workloads continue to run, but you cannot make any configuration changes to your location, roll out updates with Satellite Config, or change IBM Cloud services that are deployed to the location.

Because you manage the compute infrastructure for your Satellite location, you must make sure that your compute hosts are set up highly available. A high availability setup ensures that the Satellite control plane continues to run, even if your compute hosts experience a power, networking, or storage outage.

For more information, see the [Basic setup](https://cloud.ibm.com/docs/satellite?topic=satellite-hasatellite-basic-setup) and [High availability setup](https://cloud.ibm.com/docs/satellite?topic=satellite-hasatellite-ha-setup).





 High availability of IBM Cloud services 

Every IBM Cloud service that you run in your Satellite location, such as Red Hat OpenShift on IBM Cloud, comes with a set of options for how to increase service availability. Make sure to review the documentation of each service to find supported options.







 Basic control plane worker setup 

The following image shows a basic Satellite location control plane worker node setup. This setup ensures that your Satellite location control plane has sufficient compute capacity to run basic Satellite workloads and that your control plane continues to run, even if one compute host becomes unavailable.

Zoom

![Default setup for the Satellite control plane.]
The alternative to data sources, is to make the passing of resource information between environments and workspaces explicit. Resource dependencies between workspaces are externalized at the workspace level. Here an orchestration framework performs dependency management, determining execution order and the passing of resource data between workspaces. This is the approach to scaling adopted by open source solutions like [Terragrunt](https://terragrunt.gruntwork.io/){: external) and other IaC automation frameworks, including Schematics Blueprints.

Schematics Blueprints uses an orchestration framework to enable scaling that allows complex infrastructures to composed from smaller deployable modules. The framework allows a group of discrete modular environments to be deployed and managed by a user as a whole. A blueprint template defines the composition and structure of the larger solution environment by defining dependencies between modules and deployed modular environments. The modules specify their dependencies as inputs, that are satisfied at execution time by the orchestrator.

This design principle for clearly defined interfaces between IaC modules follows the standard programming paradigm for reusable modules. The use of data-sources is not encouraged with blueprints as this exposes the internal module implementation and creates implementation specific dependencies between modules. Dependencies which are difficult to manage using semantic versioning.

The blueprint approach to module composition by Schematics Blueprints builds on the [IBM module authoring guidelines](https://terraform-ibm-modules.github.io/documentation//implementation-guidelines). These guidelines support composition though well defined module input and output definitions for passing resource dependency data that are compatible across modules. The IBM Cloud reusable Terraform modules in the [terraform-ibm-modules](https://github.com/terraform-ibm-modules) GitHub repo and the Terraform registry adhere to these guidelines to support composition.

The use of blueprint templates to compose and deploy large-scale environments from modules is discussed in more detail in these sections:



* [Understanding blueprint templates and configuration](https://cloud.ibm.com/docs/schematics?topic=schematics-blueprint-templates)
The report has all of the same data that is used to build the charts, but it is more efficient than gathering the information through the graphical interface.





 Leverage Envizi ESG reporting 

IBM Envizi is a robust data management foundation that is designed to create a single, trusted data source for all your ESG reporting and opportunity identification. Use ESG reporting to meet compliance and reporting requirements. For more information, see [IBM Envizi ESG Suite](https://www.ibm.com/products/envizi).

Envizi integration currently requires creation of a custom connector. Reach out to your IBM Cloud representative for more information.





 Sunset underutilized components 

Cloud services have the characteristic that they are able to scale, if you find that you are no longer needing the additional capacity, it is a good practice to scale down the environments.

Lab environments might consume large amounts of infrastructure and are generally under a specific subaccount. These environments should be temporary, and when they cease to be used, should be removed.

Some services are underutilized because they are deployed for every department. This might be needed to support compliance requirements (like data locality), but should be reviewed to identify in which cases they can be merged to increase the utilization, as this is more efficient than having additional environment deployments.
To access them, you must [create a source list](https://cloud.ibm.com/docs/satellite?topic=satellite-link-endpoint-secure) for your endpoint to be accessible from other sources. Location One per Satellite-enabled IBM Cloud service in your location 



These endpoints are used to manage and update your location and are enabled by default. If you disable any of these endpoints, your client services that are running on your Satellite location can be negatively impacted. To avoid issues, do not disable these endpoints.

For more information about Satellite Link endpoints and what kinds of access IBM Cloud has to your Satellite location, see [Connecting Satellite locations with external services using Link endpoints](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud).
CP-6 (1) - Separation from Primary Site 



  Control requirements 

CP-6 (1) - 0
:   The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check that any Cloud Object Storage buckets used by Activity Tracker Event Routing are configured as cross-region
*  Check that Hyper Protect Crypto Services has failover units in at least 2 different regions that are Financial Services Validated







  NIST supplemental guidance 

Threats that affect alternate storage sites are typically defined in organizational assessments of risk and include, for example, natural disasters, structural failures, hostile cyber attacks, and errors of omission/commission. Organizations determine what is considered a sufficient degree of separation between primary and alternate storage sites based on the types of threats that are of concern. For one particular type of threat (i.e., hostile cyber attack), the degree of separation between sites is less relevant.
To list the cluster's VPC ID, run ibmcloud oc cluster get -c <cluster_name_or_ID>. If this option is not provided, then the worker pool defaults to the VPC ID of existing worker pools in the cluster.

-l, --label KEY1=VALUE1
: Optional: Apply key-value labels to each worker node in the worker pool. To specify multiple labels, use multiple options, such as -l key1=value1 -l key2=value2.

--entitlement cloud_pak
: Include this option only if you use this cluster with an [IBM Cloud Pak](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_cloud_paks) that has a Red Hat OpenShift entitlement. When you specify the number of workers (--size-per-zone) and flavor (--flavor), make sure to specify only the number and size of worker nodes that you are entitled to use in [IBM Passport Advantage](https://www.ibm.com/software/passportadvantage/index.html). After creation, your worker pool does not charge you the Red Hat OpenShift license fee for your entitled worker nodes. Do not exceed your entitlement. Keep in mind that your OpenShift Container Platform entitlements can be used with other cloud providers or in other environments. To avoid billing issues later, make sure that you use only what you are entitled to use. For example, you might have an entitlement for the OCP licenses for two worker nodes of 4 CPU and 16 GB memory, and you create this worker pool with two worker nodes of 4 CPU and 16 GB memory. You used your entire entitlement, and you can't use the same entitlement for other worker pools, cloud providers, or environments.

--kms-account-id ID
: Optional: The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--kms-instance KMS_INSTANCE_ID
Logging activity with a webhook 

Plus

Enterprise

You can log activity by making a call to an external service or application every time a customer submits input to the assistant.

A webhook is a mechanism that allows you to call out to an external program based on events in your program.

This feature is available only to Plus and Enterprise plan users.

The Plus plan allows no more than 5 log webhooks per instance. This limit does not apply to Enterprise plan instances.

Add a log webhook to your assistant if you want to use an external service to log Watson Assistant activity. You can log two kinds of activity:



* Messages and responses: The log webhook is triggered each time the assistant responds to customer input. You can use this option as an alternative to the built-in analytics feature to handle logging yourself. (For more information about the built-in analytics support, see [Review your entire assistant at a glance](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-analytics-overview).)

If you are using a custom channel, note that the log webhook works with the v2 /message API only (stateless and stateful). For more information, see the [API reference](https://cloud.ibm.com/apidocs/assistant/assistant-v2message). All built-in channel integrations use this API.
* Call detail records (CDRs): The log webhook is triggered after each telephone call a user makes to your assistant using the phone integration. A Call Detail Record (CDR) is a summary report that documents the details of a telephone call, including phone numbers, call length, latency, and other diagnostic information. CDR records are only for assistants that use the phone integration.



The log webhook does not return anything to your assistant.

For environments where private endpoints are in use, keep in mind that a webhook sends traffic over the internet.



 Defining the webhook 

You can define one webhook URL to use for logging every incoming message or CDR event.

The programmatic call to the external service must meet these requirements: