vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Figure 2. Financial Services Validated components in the Satellite reference architecture



* Satellite components that run in IBM Cloud are validated to the same IBM Cloud Framework for Financial Services controls as any other Financial Services Validated product.
* Satellite components and IBM Cloud services that run in your on-premises environment that do not have a dependency on your configuration or underlying internal network and infrastructure components, are also validated to the applicable controls that were validated for these components in IBM Cloud.
* On-premises infrastructure and your on-premises workloads are your responsibility and are not validated by IBM. You are responsible for managing infrastructure and physical controls and controls that are related to deployment, configuration, and management of your workloads.



Several [Satellite-enabled services](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services) can run in your Satellite location. However, only Red Hat OpenShift on IBM Cloud is Financial Services Validated. So, the others are not yet part of this reference architecture.







 Containers 



 Red Hat OpenShift on IBM Cloud 

You use [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-roks-overview) to run your application workloads in your Satellite location. Red Hat OpenShift on IBM Cloud is a managed offering to create your own Red Hat OpenShift on IBM Cloud cluster of compute hosts to deploy and manage containerized apps on IBM Cloud. Red Hat OpenShift on IBM Cloud provides intelligent scheduling, self-healing, horizontal scaling, service discovery and load balancing, automated rollouts and rollbacks, and secret and configuration management for your apps. Combined with an intuitive user experience, built-in security and isolation, and advanced tools to secure, manage, and monitor your cluster workloads, you can rapidly deliver highly available and secure containerized apps in the public cloud.





 IBM Cloud Container Registry 

Use [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview) to store and access private container images. Container Registry provides a multi-tenant, highly available, scalable, and encrypted private image registry that is hosted and managed by IBM®.
OpenShift Container PlatformControl Plane Operator v4.6.0-20210816 v4.6.0-20210917 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.6.0+20210917). 
 Red Hat OpenShift on IBM Cloud Metrics Server v4.6.0-20210816 v4.6.0-20210917 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.6.0+20210917). 
 Red Hat OpenShift on IBM Cloud toolkit 4.6.0+20210816 4.6.0+20210917 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.6.0+20210917). 







 Change log for worker node fix pack 4.6.45_1557_openshift, released 27 September 2021 

The following table shows the changes that are in the worker node fix pack patch update 4.6.45_1557_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.6.44_1555_openshift

 Component Previous Current Description 

 Disk identification N/A N/A Enhanced the disk identification logic to handle the case of 2+ partitions.
When you specify the number of workers (--workers) and flavor (--flavor), make sure to specify only the number and size of worker nodes that you are entitled to use in [IBM Passport Advantage](https://www.ibm.com/software/passportadvantage/index.html). After your cluster is created, you are not charged the Red Hat OpenShift license fee for the entitled worker nodes in the default worker pool. Do not exceed your entitlement. Keep in mind that your OpenShift Container Platform entitlements can be used with other cloud providers or in other environments. To avoid billing issues later, make sure that you use only what you are entitled to use. For example, you might have an entitlement for the OCP licenses for two worker nodes of 4 CPU and 16 GB memory, and you create this worker pool with two worker nodes of 4 CPU and 16 GB memory. You used your entire entitlement, and you can't use the same entitlement for other worker pools, cloud providers, or environments.

--sm-group GROUP
: The secret group ID of the Secrets Manager instance where your secrets are persisted. To get a secret group ID, see the [Secrets Manager CLI reference](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-groups-command).

--sm-instance INSTANCE
: The CRN of the Secrets Manager instance. To get the CRN of an instance, run ibmcloud oc ingress instance ls --cluster CLUSTER.
8. Verify that the creation of the cluster was requested. For virtual machines, it can take a few minutes for the worker node machines to be ordered, and for the cluster to be set up and provisioned in your account. Bare metal physical machines are provisioned by manual interaction with IBM Cloud infrastructure, and can take more than one business day to complete.

ibmcloud oc cluster ls

When the provisioning of your Red Hat OpenShift master is completed, the State of your cluster changes to normal.
Financial services use cases for IBM Cloud 

These use cases highlight how workloads on Red Hat® OpenShift® on IBM Cloud® can take advantage of high availability, high-performance compute, easy spin-up of clusters for faster development, and AI from IBM Watson®.



 Mortgage company trims costs and accelerates regulatory compliance 

A Risk Management VP for a residential mortgage company processes 70 million records a day, but the on-premises system was slow and also inaccurate. IT expenses soared because hardware quickly went out of date and wasn't utilized fully. While they waited for hardware provisioning, their regulatory compliance slowed.



 Context 

To improve risk analysis, the company looked to Red Hat OpenShift on IBM Cloud and IBM Cloud Analytic services to reduce costs, increase worldwide availability, and ultimately accelerate regulatory compliance. With Red Hat OpenShift on IBM Cloud in multiple regions, their analysis apps can be containerized and deployed across the globe, improving availability and addressing local regulations. Those deployments are accelerated with familiar open source tools, already part of Red Hat OpenShift on IBM Cloud.

They started by containerizing the analysis apps and putting them in the cloud. In a flash, their hardware headaches went away. They were able to easily design Kubernetes clusters to fit their high-performance CPU, RAM, storage, and security needs. And when their analysis apps change, they can add or shrink compute without huge hardware investments. With the Red Hat OpenShift on IBM Cloud horizontal scaling, their apps scale with the growing number of records, resulting in faster regulatory reports. Red Hat OpenShift on IBM Cloud provides elastic compute resources around the world that are secure and capable.

Now those apps receive high-volume data from a data warehouse on IBM Cloudant. Cloud-based storage in IBM Cloudant ensures higher availability than when it was locked in an on-premises system. Since availability is essential, the apps are deployed across global data centers: for DR and for latency too.

They also accelerated their risk analysis and compliance. Their predictive and risk analytics functions, such as Monte Carlo calculations, are now constantly updated through iterative agile deployments. Container orchestration is handled by a managed Kubernetes so that operations costs are reduced too.
Single zone location for Red Hat OpenShift clusters
: The following locations are now supported. For more locations, see [Single and multizone locations in Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zones).



* Oslo, Norway
* San Jose, California, US









 September 2019 



 24 September 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 0.4.31](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog).

Ingress ALB change log
: Updated the ALB [nginx-ingress image to build 566](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 19 September 2019 

Sending custom Ingress certificates to legacy clients
: Added [steps](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotations) for ensuring that your custom certificate, instead of the default IBM-provided certificate, is sent by the Ingress ALB to legacy clients that don't support SNI.





 17 September 2019 

New! Single zone location for Red Hat OpenShift clusters
: The following locations are now supported. For more locations, see [Single and multizone locations in Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zones).



* Amsterdam, the Netherlands
* Hong Kong SAR of the PRC, China
* Mexico City, Mexico
* Milan, Italy







 16 September 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the release of version 0.4.23.

IBM Cloud Activity Tracker events
OpenShift Container Platform 4.7.23 4.7.30 See the [OpenShift Container Platform release notes](https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.htmlocp-4-7-30). 
 OpenShift Container PlatformControl Plane Operator v4.7.0-20210816 v4.7.0-20210917 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0+20210917). 
 Red Hat OpenShift on IBM Cloud Metrics Server v4.7.0-20210816 v4.7.0-20210917 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0+20210917). 
 Red Hat OpenShift on IBM Cloud toolkit 4.7.0+20210816 4.7.0+20210917 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0+20210917). 







 Change log for worker node fix pack 4.7.31_1533_openshift, released 27 September 2021 

The following table shows the changes that are in the worker node fix pack patch update 4.7.31_1533_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.7.29_1531_openshift

 Component Previous Current Description 

 Disk identification N/A N/A Enhanced the disk identification logic to handle the case of 2+ partitions.
For example, your apps might use an operator from the OperatorHub that runs a container from an image in the internal registry. You are responsible for your usage of these components, but IBM provides updates for them in the worker node patch updates that you choose to apply.

In OpenShift Container Platform 4, many components are configured by a corresponding operator for ease of management. The following table discusses these operators and components together, to focus on the main functionality the component provides to the cluster.

Single tenancy
: The worker nodes and all worker node components are dedicated only to you, and are not shared with other IBM customers. However, if you use worker node virtual machines, the underlying hardware might be shared with other IBM customers depending on the [level of hardware isolation](https://cloud.ibm.com/docs/openshift?topic=openshift-planning_worker_nodesvm) that you choose.

Operating System
: Worker nodes run on the Red Hat Enterprise Linux 7 or Red Hat Enterprise Linux 8 operating system.



* For cluster version 4.10 and later, only RHEL 8 is supported.
* For cluster version 4.9, you can choose RHEL 7 or RHEL 8, however the default operating system is RHEL 7.
* For cluster versions 4.8 and earlier, only RHEL 7 is supported.



CRI-O container runtime
: Your worker nodes are installed with [CRI-O](https://cri-o.io/) as the container runtime interface. For more information, see [Container runtime](https://cloud.ibm.com/docs/openshift?topic=openshift-securitycontainer-runtime).

Projects
: Red Hat OpenShift organizes your resources into projects, which are Kubernetes namespaces with annotations, and includes many more components than community Kubernetes clusters to run Red Hat OpenShift features such as the catalog. Select components of projects are described in the following rows. For more information, see [Working with projects](http://docs.openshift.com/container-platform/4.11/applications/projects/working-with-projects.html).
In your allowlist, you must also add the CIDRs of the Red Hat OpenShift on IBM Cloud control plane for the zones in the region where your cluster is located so that Red Hat OpenShift on IBM Cloud can create or access components such as Ingress ALBs or the Red Hat OpenShift web console, which requires all control plane IP addresses.

Before you begin, the following steps require you to change the IAM allowlist for the user whose credentials are used for the cluster's region and resource group infrastructure permissions. If you are the credentials owner, you can change your own IAM allowlist settings. If you are not the credentials owner, but you are assigned the Editor or Administrator IBM Cloud IAM platform access role for the [User Management service](https://cloud.ibm.com/docs/account?topic=account-account-services), you can update the restricted IP addresses for the credentials owner.



1. Identify what user credentials are used for the cluster's region and resource group infrastructure permissions.



1. Check the API key for a region and resource group of the cluster.

ibmcloud oc api-key info --cluster <cluster_name_or_ID>

Example output

Getting information about the API key owner for cluster <cluster_name>...
OK
Name Email
<user_name> <name@email.com>
2. Check if the infrastructure account for the region and resource group is manually set to use a different IBM Cloud infrastructure account.

ibmcloud oc credential get --region <us-south>

Example output if credentials are set to use a different account. In this case, the user's infrastructure credentials are used for the region and resource group that you targeted, even if a different user's credentials are stored in the API key that you retrieved in the previous step.

OK
Infrastructure credentials for user name <1234567_name@email.com> set for resource group <resource_group_name>.

Example output if credentials are not set to use a different account. In this case, the API key owner that you retrieved in the previous step has the infrastructure credentials that are used for the region and resource group.

FAILED
Because the private keys are never stored by IBM, every peer and ordering node includes a gRPC web proxy that allows the console to communicate with each node by using the keys in the wallet. 
 RBAC Role based access control. The IBM Blockchain Platform configures [Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) in the cluster which is required to manage blockchain components in the cluster. 







 IBM Blockchain Platform on Red Hat OpenShift Architecture 

Zoom

![OCP Sample network structure](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/redhatopenshift.svg)

Figure 2. Architecture diagram of IBM Blockchain Platform on Red Hat OpenShift in IBM Cloud

A single instance of the console, also known as Operational Tooling, is created for each IBM Blockchain Platform service instance. When a peer, ordering node, or CA is deployed by using the console, it is deployed into the Red Hat OpenShift Cluster Service Instance.



Table 4. Components that reside in the IBM Blockchain Platform Kubernetes Cluster

 IBM Blockchain Platform Red Hat OpenShift Cluster Description 

 Operational Tooling Also known as the console, this is your central user interface for operating all of your blockchain components. With this console you can now create CA, peer, and ordering nodes, create channels and use smart contracts. The console is deployed in an IBM-owned cluster. There is no charge for this tooling or the Kubernetes cluster on IBM Cloud where it runs. 





 OpenShift cluster Description 

 Operator A Kubernetes operator that is used to deploy the console. 
 Routes An OpenShift route is a way to expose a service by giving it an externally reachable hostname. 
 Proxy The IBM Blockchain Platform proxy is responsible for routing traffic to the correct peer, CA and ordering nodes by using host header routing. 
 Peers, CAs, Ordering nodes These are the nodes that are created.
[Organization of Red Hat OpenShift on IBM Cloud locations](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs_regions_hierarchy.png)

Figure 1. Organization of Red Hat OpenShift on IBM Cloud locations



Organization of Red Hat OpenShift on IBM Cloud locations.

 Type Example Description 

 Geography North America (na) An organizational grouping that is based on geographic continents. 
 Country Canada (ca) The location's country within the geography. 
 Metro For example, Dallas (dal). The name of a city where 1 or more data centers are located. A metro might have a multizone region, such as Dallas, or might have a single zone region, such as Milan. If you create a cluster in a multizone region, the Kubernetes master and worker nodes can be spread across zones for high availability. 
 Data center (zone) Dallas 12 (dal12) A physical location of the compute, network, and storage infrastructure and related cooling and power that host cloud services and applications. In a region, clusters can be spread across data centers, or zones, in an multizone architecture for high availability. Zones are isolated from each other, which ensures no shared single point of failure. 







 Classic multizone regions 

If you create a classic cluster in a multizone region, the replicas of your highly available Kubernetes master are automatically spread across the data centers (zones). You have the option to spread your worker nodes across zones to protect your apps from a zone failure. To determine whether a location has a multizone region, your can run ibmcloud oc locations and look for the value in the Multizone Metro column.



Available multizone metro locations for classic clusters in Red Hat OpenShift on IBM Cloud.

 Geography Country Metro Region Zones 

 Asia Pacific Australia Sydney au-syd syd01, syd04, syd05 
 Asia Pacific Japan Osaka jp-osa osa21, osa22, osa23
* The CLI tools including the IBM Cloud CLI, the Containers service CLI plug-in, and the CBR plug-in. For more information, see [Getting started with the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
* A Red Hat OpenShift on IBM Cloud cluster. For more information, see [Creating clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-clusters).
* Review the [What are context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis) docs to get an understanding of network zones and rules.
* Review the [Protecting Red Hat OpenShift on IBM Cloud resources with context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr) docs to understand how you can leverage CBR for your Red Hat OpenShift on IBM Cloud resources.
* Review the [limitations for using CBR with Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=clicbr-limitations).







 Step 1: Creating your network zone 

[Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).



1. Run the following example command to create a network that includes only one client IP that you want to use.

ibmcloud cbr zone-create --addresses 129.XX.XX.XX --description "Allow only client IP" --name allow-client-ip
2. Verify the network zone was created.

ibmcloud cbr zones







 Step 2: Creating your CBR rule 



1. After you create your network zone (allowlist), create a CBR rule and add the network zone you created in the previous step. The following example creates a rule that uses the cluster API type.
* Do not create CNAME entries because the Red Hat® OpenShift® certificates are keyed to the DNS returning the IP address only and not a referral to the base hostname. Use the following format for DNS naming standards: HostName.ClusterName.SubDomain.DomainName



* HostName - Name of the virtual machine or host, for example, control-plane-0
* ClusterName - Red Hat OpenShift cluster name, for example, ocp
* SubDomain - Subdomain of the IBM Cloud for VMware Solutions deployment, for example, dallas
* DomainName - Domain name of the IBM Cloud for VMware Solutions Deployment, for example, ibm.local





For example, the FQDN would be, control-plane-0.ocp.dallas.ibm.local.

The following table is for an example deployment. Use your own values.



Table 1. DNS records for OpenShift implementation

 DNS Description DNS Example Name DNS Example IP address 

 DNS Reverse Lookup for Red Hat OpenShift VXLAN 192.168.133.0/24 
 DNS Reverse Lookup for Red Hat OpenShift IBM Cloud Subnet 10.208.242.128/26 
 Bastion Host bastion.ocp.dallas.ibm.local 192.168.133.8 
 bootstrap-0 Host bootstrap-0.ocp.dallas.ibm.local 192.168.133.9 
 control-plane-0 Host control-plane-0.ocp.dallas.ibm.local 192.168.133.10 
 control-plane-1 Host control-plane-1.ocp.dallas.ibm.local 192.168.133.11 
 control-plane-2 Host control-plane-2.ocp.dallas.ibm.local 192.168.133.12 
 compute-0 Host compute-0.ocp.dallas.ibm.local 192.168.133.13 
 compute-1 Host compute-1.ocp.dallas.ibm.local 192.168.133.14 
 compute-2 Host compute-2.ocp.dallas.ibm.local 192.168.133.15
For instance, for more low-level access to IBM Quantum systems?

We continue to evaluate the use of quantum hardware and expand the set of primitives to meet common needs. However, the Qiskit Runtime in IBM Cloud® is meant to serve algorithm or application development. If you require lower-level access, then your needs would be better served by the IBM Quantum channel.
* Can a Qiskit Runtime service instance be shared between users?

Qiskit Runtime supports IBM Cloud® Identity and Access Management (IAM). With IAM, the user who deployed the service can enable users and groups to access the service. The user who deployed the service gets charged for the usage of all users who are enabled for that service instance.
* How long does it take to deploy Qiskit Runtime in IBM Cloud®?

The service can be deployed in about 10 seconds and can be used immediately after it appears in the IBM Cloud® account resource list.
* How can I access IBM Quantum systems after the Qiskit Runtime service is deployed in IBM Cloud?

Make sure to use the Standard plan when you deploy a service instance of Qiskit Runtime, as described in the [Getting started guide](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-get-started).
* What programing languages can I use to program against the primitives?

The Cloud service API is programming language independent. However, Qiskit provides a comprehensive framework for quantum computing. Qiskit uses and supports Python.
* Why can't I run my uploaded custom program?

Running, adding, or changing custom programs are not supported on IBM Cloud Qiskit Runtime. If you used this function previously, you can instead use code that calls primitives. To get performance benefits comparable to uploaded programs, you can use use sessions, which are a service aware context manager that minimizes artificial queuing latency inside an iterative workload.



Red Hat OpenShift for HPC



* What locations are available for deploying VPC resources?