vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: The Speech services operator now automatically installs the required License Server when it installs the Speech services. You no longer need to install the License Server from the IBM Cloud Pak for Data foundational services, and you no longer need to use additional YAML content to create an OperandRequest with the necessary bindings.

Removal of steps specific to PostgreSQL EnterpriseDB server
: The previous version of the documentation included steps for the PostgreSQL EnterpriseDB server that were specific to the Speech services. These steps were documented in the topics Upgrading Watson Text to Speech (Version 4.0) and Uninstalling Watson Text to Speech. These additional steps are no longer necessary and have been removed from the documentation.

RabbitMQ datastore is now used only by the sttAysnc component
: The RabbitMQ datastore was previously used by components of both Speech services, Speech to Text and Text to Speech. It now handles non-persistent message queuing for the Speech to Text asynchronous HTTP component (sttAsync) only. It is used only if the sttAsync component is installed and enabled.

New Belgian Dutch and Czech neural voices
: Two new neural voices are now available:



* Belgian Dutch: A new male Belgian Dutch (Flemish) voice, nl-BE_BramVoice.
* Czech: A new language, Czech, with a new female voice, cs-CZ_AlenaVoice.



You can install the new voices along with all neural voices by setting the voiceType property of the custom resource to neuralVoices.



* For more information about using the custom resource to install voices, see [Installing Watson Text to Speech](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=speech-installing-watson-text).
* For more information about all available languages and voices, see [Languages and voices](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-voices).



Defect fix: Update SSML documentation
: Defect fix: The SSML documentation was updated to correct the following errors:



* The examples of the <break> element are now correct.
AC-6 - Least Privilege 



 Control requirements 

AC-6 - 0
: The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.





 Additional IBM Cloud for Financial Services specifications 



* Individual users are not permitted to interact with system-to-system service accounts.







 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Access management in IBM Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-access-management)
* [Consumer accounts for application provider workloads](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-consumer)
* [Organizing IBM Cloud accounts and resources](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organization)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether permissions for service ID creation are limited and configured in IAM settings for the account owner
* Check whether permissions for API key creation are limited and configured in IAM settings for the account owner
* Check whether permissions for API key creation are limited and configured in IAM settings for the account owner
* Check whether App ID Cloud Directory users aren't able to update their own accounts
* Check whether user list visibility restrictions are configured in IAM settings for the account owner
* Check whether IAM roles are used to create IAM policies for IBM resources
* Check whether IAM users are attached to at least one access group
* Check whether Cloud Object Storage public access is disabled in IAM settings (not applicable to ACLs managed using S3 APIs)







 NIST supplemental guidance 

Organizations employ least privilege for specific duties and information systems.
Then click the Add file button to select the JSON that represents the ordering service.
4. Click Add ordering service.









 Step three: Join your peer to the channel 

Your peer can now be joined to channel1.



1. If you are not already there, navigate to the Channels tab in the left navigation. There will not be any channel tiles visible yet.
2. Click the Join channel button to launch the side panels.
3. Select Ordering Service and click Next.
4. Enter channel1 and click Next.
5. Select which peers you want to join the channel. For purposes of this tutorial, click Peer Org2. Leave the tab for Make anchor peer selected. It is a best practice for each organization to have at least one anchor peer on each channel, as anchor peers bootstrap the inter-organizational communication that is necessary for [Private Data](https://hyperledger-fabric.readthedocs.io/en/release-2.2/private-data/private-data.html) and [Service Discovery](https://hyperledger-fabric.readthedocs.io/en/release-2.2/discovery-overview.html) to work. While it is only necessary to have one anchor peer on each channel, it does not hurt to make all peer anchor peers. The only downside will be a short term increase in the stress on your communication layer when new organizations join their peers to the channel, as these peers are designed to contact every anchor peer in every organization to find out about the peers belonging to that organization. Note that you can also make a peer an anchor peer later through the Channels tab.
6. Click Join channel.



In these tutorials, we create all of our peers using default options, which means that every peer uses CouchDB. As a result, you don't have to worry about a conflict between the database type used by your peer and any other peers on the channel. However, in a production scenario, a best practice will be to ensure that the peer you are joining to this channel uses the same database type as other peers on the channel.
Regarding SAP BW/4HANA, the IBM Cloud® for SAP portfolio documentation refers to SAP HANA and SAP NetWeaver installations as using SAP-certified Cloud Infrastructure-as-a-Service options for running SAP BW/4HANA deployment to Cloud IaaS.



 Additional decisions for implementation and maintenance 

The project implementation and maintenance/support of SAP BW/4HANA selects from the list of SAP Partners:



* Project implementations



* A Global Systems Integrator (GSI) for SAP
* A Managed Services Provider (MSP) for SAP



* Maintenance/support



* An Application Management Services provider (AMS) for SAP
* A Managed Services Provider (MSP) for SAP





A list of all SAP Partners is maintained on the [SAP Partner Finder tool](https://www.sap.com/partner/find/search-tool.html). The list has more information about SAP Partners, including:



* Partnership category (for example, Consulting & Implementation Services)
* Partnership level (for example, Platinum, Gold, Silver)



Awards for these SAP Partners are shown on the [SAP Partners information page](https://www.sap.com/partner/find.html).

These choices particularly affect how your SAP BW/4HANA on Cloud IaaS is deployed, operated, and maintained. For example, a GSI has exceeding depth of experience in implementation, functional configuration and development - with the flexibility to create a bespoke solution for the business requirements. However, the GSI has less experience in maintenance. Conversely, an MSP has more restrictions on the implementation to ensure more successful maintenance.

Given the division of skills in traditional on-premises data center implementations of SAP workloads during previous decades, there were multiple tasks handled by the Data Center Provider. It is suggested to consider the skills of your SAP Partners in the following areas because the Cloud Service Provider is not responsible for those activities previously fullfilled by the Data Center Provider:



* Cloud account and IAM setup
* Networking setup (including security)
* Storage setup
* Infrastructure sizing for SAP
* OS configuration (including security)
Organize by department 

If your organization has global teams that share a budget, you can model your enterprise structure after their departments. With this structure, you can view usage costs that are aggregated for each department.

Zoom

![A four-tier enterprise that groups accounts according to department in an organization. For example, account groups are named Marketing, Development, and Sales. The account groups contain accounts for teams within those departments. For example, the Sales account group contains accounts for Direct, Online, and Enablement.](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/images/enterprise-by-dept.svg)

Figure 4. An enterprise that is organized by department





 Organize by geography 

Or, if your organization has separate budgets by geography, you can structure your enterprise to group costs for each geographical entity.

Zoom

![A four-tier enterprise that groups accounts according to geography. For example, account groups are named Americas, Europe, and Asia-Pacific. The account groups contain accounts for countries within those locations. For example, the Asia-Pacific account group contains accounts for China, Japan, and India.](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/images/enterprise-by-geo.svg)

Figure 5. An enterprise that is organized by geography







 Educational institutions 

Educational institutions might want to provide IBM Cloud accounts to their students so that they can learn valuable skills through hands-on projects that use IBM Cloud services. For these institutions, such as traditional universities or online learning platforms, you can group accounts by department or subject area, then create accounts for each course.

Within each account, students can create resources to build their projects and collaborate with other students in the account. The university has a complete view of the costs of each department and course.

Zoom
The following table shows the available locations for the 25 Gb uplink speed.



Asia-Pacific

Europe

NA East



Table 1. Available locations for 25 Gb uplink speed

 Geography Data center Pod 

 Asia-Pacific TOK02 02 
 Asia-Pacific TOK04 01 
 Asia-Pacific TOK05 01 







 VLANs 

Network settings are based on your selection of either Order new VLANs or Select existing VLANs.

One public VLAN and two private VLANs are required for your instance order. The two private VLANs are trunked into each IBM Cloud bare metal server.



 Order new VLANs 

Select to order one new public VLAN and two new private VLANs.





 Select existing VLANs 

Depending on the IBM Cloud data center that you selected, existing public and private VLANs might be available.

When you select to reuse existing public and private VLANs, specify the VLANs and subnets:



* Public VLAN is for public network access. If you select the Allocate a new one option for this field, a new public VLAN is allocated automatically. This field is only available on the Public and private network tab.
* Public primary subnet is assigned to physical hosts for public network access. If you select the Auto assigned option for this field, a new public primary subnet is selected automatically, and a new one is created if necessary. This field is only available on the Public and private network tab.
* Private VLAN is for connectivity among the data centers and services within the IBM Cloud. If you select the Allocate a new one option for this field, a new private VLAN is allocated automatically.
* Private primary subnet is assigned to physical hosts for management traffic. If you select the Auto assigned option for this field, a new private primary subnet is selected automatically, and a new one is created if necessary.
* Secondary private VLAN is for VMware features such as vSAN. You can select an existing secondary private VLAN or select to allocate a new one.



Ensure that the firewall configuration on the selected VLANs does not block the management data traffic.
Adding an SSH key 

You can add SSH keys to your account if you are an authorized user. Each account can have up to 100 SSH keys at any time. SSH keys are most often used in the [OS reload process](https://cloud.ibm.com/docs/software?topic=software-reloading-the-osreloading-the-os) and can also be used when you provision a new device.



 Before you begin 

First, generate your public SSH key, go to the device menu, and makre sure that you have the correct account permissions to complete the tasks.



* [Generate the public SSH key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keyslocating-ssh-keys).
* Go to your console's device menu. For more information, see [Navigating to devices](https://cloud.ibm.com/docs/infrastructure/ssh-keys?topic=virtual-servers-navigating-devices).
* Make sure that you have any necessary account permissions and device access. Only the account owner, or a user with the Manage Users Classic infrastructure permission, can adjust the permissions.



For more information about permissions, see [Classic infrastructure permissions](https://cloud.ibm.com/docs/iam?topic=iam-infrapermissioninfrapermission) and [Managing device access](https://cloud.ibm.com/docs/vsi?topic=virtual-servers-managing-device-access).





 Adding an SSH key to your account 

Complete the following steps to add an SSH key to your account.



1. From the Devices menu, select Manage > SSH Keys.
2. Click Add.
3. Click Browse to locate the public key file or enter it manually in the Key Contents text box.
4. Enter a short name for the SSH Key in the Label field.
5. Enter any applicable notes in the Notes field, if necessary.
6. Click Add to add the SSH key.







 Next steps
Managing your IBM Cloud environment and preparing it to run SAP workloads includes provisioning compute, storage and network, securing the server, downloading and installing your SAP software and applications, and testing connectivity to your environment by using resources from IBM Cloud® for SAP.

Confirm with an administrator that you are assigned the permissions that are required to check current all authorizations. For more information about the required roles and permissions, see [Access management in IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-cloudaccess).

The following example for VPC Infrastructure, shows how to check the current authorizations:



1. Select Manage > Access (IAM).
2. Click Users and select your username. Names are in given name alphabetical order.
3. Click Access Policies and click the number next to the Role to see the currently assigned roles and the allowed actions.
4. Click Roles.
5. Click 'View the roles for' and select Virtual Servers for VPC. This selection shows the available Roles and allowed actions for a Virtual Servers for VPC. An Administrator can apply these roles to you or alter them to provide authorization for the necessary actions.
We provide a set of example [Calico public network policies](https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies/public-network-isolation) that further restrict public/private network traffic on cluster workers. These policies allow the traffic that is necessary for the cluster to function, and block certain other traffic.

These policies are not meant to block everything, nor do they necessarily meet any compliance requirements on their own. They are intended as a starting point and must be edited to meet your unique use cases. For more information, see the [README](https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies).

Whenever new locations for IBM Cloud Kubernetes Service and other IBM Cloud are enabled, the subnets for these locations are added to the Calico policies. Be sure to [watch the GitHub repository](https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies/public-network-isolation) for any updates to these policies.



 Applying public network policies 

Before you begin, [install and configure the Calico CLI, and set the context for your cluster to run Calico commands](https://cloud.ibm.com/docs/containers?topic=containers-network_policiescli_install).



1. Clone the IBM-Cloud/kube-samples repository.

git clone https://github.com/IBM-Cloud/kube-samples.git
2. Change directories to the public policy directory for the region that your cluster is in. Example command for a cluster in US South:

cd <filepath>/IBM-Cloud/kube-samples/calico-policies/public-network-isolation/us-south
3. Review each policy for any changes you might need to make.
When the migration is complete, use the noted UUID to map the disk information to re-create the disk naming order and the SCSI ID if necessary. This information can be useful for troubleshooting when an Oracle instance has many virtual disks that are mapped.
4. Remove the virtual disks from all cluster VMs except the one deemed primary.
5. Remove the multi writer-flag from the primary cluster VM (the only one that owns the cluster disks).
6. Power on the primary cluster, if required for minimal downtime.
7. Migrate all cluster nodes with vMotion. Migrate the primary cluster first. Migrate all other nodes after they are powered off.
8. When the primary disk owning node completes migration, power it off.
9. If required, remap the disk order with the proper disk UUID and scsi ID. Remapping is not required for the application to function.
10. Re-enable the multi-writer flag on the primary node.
11. Start the primary node and verify operation.
12. Map disk or enable multi-writer flag on all other cluster VMs and power them on.
13. Verify other cluster operation.







 General VMs 

After confidence is built around the function of HCX, bulk migration must be employed. Bulk migration is necessary for redundant applications. For example, web servers and where many 100s or 1000s of VMs are to be migrated.





 VMs that use direct attached NAS 

NFS is typically employed for use to share data across many servers, such as web server content. iSCSI can be employed across VM nodes that consist of an application cluster such as email or RDBMS and is typically more latency sensitive than NFS.

In either case, if latency can be kept low to the IBM Cloud data center (< 7 ms for iSCSI and whatever the application tolerates for NFS) and allowing that the application can operate with bandwidth of 1 Gbps or less, then the NAS network can be stretched with HCX into an IBM Cloud location. Afterward, the VMs can be migrated or vMotioned with HCX.
* HTML files are converted to JSON using the html options, and the resulting JSON is converted using the json options.
* JSON files are converted using the json options.



If you configure your collection using [Smart Document Understanding](https://cloud.ibm.com/docs/discovery?topic=discovery-sdu), the PDF and Word conversion settings listed are not used, so changing these conversion settings are ignored.

These options are described in the following sections. After conversion completes, [enrichment](https://cloud.ibm.com/docs/discovery?topic=discovery-configrefenrichment) and [normalization](https://cloud.ibm.com/docs/discovery?topic=discovery-configrefnormalization) are performed before the content is stored.



 PDF 

If you configure your collection using [Smart Document Understanding](https://cloud.ibm.com/docs/discovery?topic=discovery-sdu), the PDF and Word conversion settings listed are not used, so changing these conversion settings are ignored.

The pdf conversion object defines the conversion from PDF to HTML and has the following structure:

"pdf": {
"heading": {
"fonts": [
{
"level": 1,
"min_size": 24,
"max_size": 80,
"bold": false,
"italic": true,
"name": "arial"
},
{
"level": 2,
"min_size": 18,
"max_size": 24,
"bold": true,
"italic": false,
"name": "ariel"
}
]
}
},
Show more

When converting PDF files, headings in those files can be identified and converted into an appropriate HTML "h" tag by identifying the size, font, and style of each heading level. Heading levels can be specified multiple times, if necessary, to correctly identify all relevant sections.
The policy allows access to the IP addresses for IBM Cloud Container Registry, and if the services are available in the region, IBM Log Analysis and IBM Cloud Monitoring. To access other IBM Cloud services, you must manually add the subnets for those services to this policy.

calicoctl apply -f allow-public-services.yaml
calicoctl apply -f allow-public-services-pods.yaml
6. Verify that the policies are applied.

calicoctl get GlobalNetworkPolicies -o yaml
7. Optional: If you must allow traffic that is not specified by these policies, [create and apply Calico policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies) to allow this traffic. For example, if you use any in-cluster webhooks, you must add policies to ensure that the webhooks can make the required connections. You also must create policies for any non-local services that extend the Kubernetes API. You can find these services by running kubectl get apiservices.







 Applying private network policies 

We provide a set of example [Calico private network policies](https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies/private-network-isolation) that further restrict public/private network traffic on cluster workers. These policies allow the traffic that is necessary for the cluster to function, and block certain other traffic.

These policies are not meant to block everything, nor do they necessarily meet any compliance requirements on their own. They are intended as a starting point and must be edited to meet your unique use cases. For more information, see the [README](https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies).

Whenever new locations for IBM Cloud Kubernetes Service and other IBM Cloud are enabled, the subnets for these locations are added to the Calico policies.
5.1.3 Minimize wildcard use in Roles and ClusterRoles Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 
 5.1.4 Minimize access to create pods Not Scored 1 Pass Shared 
 5.1.5 Ensure that default service accounts are not actively used. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 
 5.1.6 Ensure that Service Account Tokens are only mounted where necessary Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 







 5.2 Pod Security Policies 



Section 5.2 Pod Security Policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.2.1 Minimize the admission of privileged containers Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 
 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 
 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared