vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Accessing the public internet 

The IBM Cloud Framework for Financial Services does not recommend connecting to hosts on the public internet nor accepting connections from the public internet. When it is necessary to do so, you need to use either public gateways or floating IP addresses.



 Public gateways and floating IP addresses 

A public gateway enables a subnet and all its attached virtual server instances to connect to the internet. Subnets are private by default. After a subnet is attached to the public gateway, all instances in that subnet can connect to the internet. Although each zone has only one public gateway, the public gateway can be attached to multiple subnets.

Floating IP addresses are IP addresses that are provided by the system and are reachable from the public internet.

If you are an application provider from a technology vendor interested in becoming [IBM Cloud for Financial Services Validated](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutbecoming-fs-validated) and want to enable outbound connectivity to the internet, then you will need to make sure you document the data flows and provide evidence that shows how any consumer data that might be leaving the boundary is secured. Similarly, for inbound connectivity, you will need to provide evidence demonstrating how your infrastructure cannot be compromised.

See [External connectivity](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpcexternal-connectivity) for more details on public gateways and floating IP addresses.





 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control
About SSL certificates 

IBM Cloud® offers yearly and bi-yearly SSL certificates for customers that offer various benefits, including:



*  Gull authentication for business identity and domain ownership verification
*  40- to 256-bit encryption on all online transactions
*  Daily website malware scanning to ensure that both your site and your customers are protected



If you are running multiple domains, an SSL certificate can be purchased for each domain.

Within the IBM Cloud console, all SSL certificates ordered through IBM Cloud can be managed from the SSL Orders screen. This screen tracks all orders, including the common name, certificate type, and expiration date of the certificate but does not contain any certificate-specific details such as the certificate itself or the Private Key. From this screen, current and expired SSL certificates can be renewed under their pre-existing terms, and fulfillment emails can be requested to receive the SSL certificate details if they are lost. All requests that are made from the SSL Orders screen are routed to the appropriate certificate authority for the SSL certificate, which fulfills the requests as necessary. Because IBM Cloud does not possess the SSL certificate details, IBM Cloud is unable to provide any additional information about the certificate.

In addition to managing SSL certificates ordered through IBM Cloud, you can import SSL certificate data to the IBM Cloud console to use the data with the various products and services. All interactions with imported SSL certificates take place on the SSL certificates screen within the IBM Cloud console. You can manually import, edit, and export SSL certificate details that are present on this screen. In addition, SSL certificates can be deleted at any time. As with the SSL Orders screen, IBM Cloud doesn't control, track, or record this information, as it is considered one of the most confidential pieces of information that you possess. SSL certificate details that are stored on this screen are used only with an account's products or services when you set them up.
5.1.1 Ensure that the cluster-admin role is only used where required. Not Scored 1 Pass Shared 
 5.1.2 Minimize access to secrets. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared 
 5.1.3 Minimize wildcard use in Roles and ClusterRoles. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared 
 5.1.4 Minimize access to create pods. Not Scored 1 Pass Shared 
 5.1.5 Ensure that default service accounts are not actively used. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared 
 5.1.6 Ensure that Service Account Tokens are only mounted where necessary. Not Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared 







 5.2 Pod Security Policies 



Section 5.2 Pod Security Policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.2.1 Minimize the admission of privileged containers. Not Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared 
 5.2.2 Minimize the admission of containers wanting to share the host process ID namespace. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared
Note that null can be a valid value if the array element you are comparing it against might contain it. For example, if the population name and value pair for Tokyo is "population":null, and the comparison expression is "city.population == $population_min", then null would be a valid value for the $population_min context variable.

You can use a dialog node response expression like this:

The cities with more than $population_min people include <? T(String).join(", ",($cities.filter("city", "city.population > $population_min")).) ?>.name]

The resulting response is: The cities with more than 5000000 people include Tokyo, Beijing.





 Filter example 3 

In this example, an entity name is used as the comparison_value. The user input is, What is the population of Tokyo? The arbitrary temporary variable name is y. You created an entity named @city that recognizes city names, including Tokyo.

$cities.filter("y", "y.name == @city")

The expression returns the following array:

[!
{
"name":"Tokyo",
"population":9273000
}
]

You can use a collection project to get an array with only the population element from the original array, and then use the get method to return the value of the population element.

The population of @city is: <? ($cities.filter("y", "y.name == @city").) ?>.population]

The expression returns: The population of Tokyo is 9273000.







 JSONArray.get(Integer) 

This method returns the input index from the JSONArray.

For this Dialog runtime context which is set by a previous node or external application:

{
"context": {
"name": "John",
"nested": {
"array": [! "one", "two" ]
}
}
}

Dialog node or response condition:
Move on 





If you add more slots later, you must edit these conditions to account for the associated context variables for the additional slots. If you do not include a confirmation slot, you can specify !all_slots_filled only, and it would remain valid no matter how many slots you add later.





 Step 6: Reset the slot context variable values 

You might have noticed that before each test, you must clear the context variable values that were created during the previous test. You must do so because the node with slots only prompts users for information that it considers to be missing. If the slot context variables are all filled with valid values, no prompts are displayed. The same is true for the dialog at run time. You must build into the dialog a mechanism by which you reset the slot context variables to null so that the slots can be filled anew by the next user. To do so, you are going to add a parent node to the node with slots that sets the context variables to null.



1. From the tree view of the dialog, click the More![More icon](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon on the node with slots, and then select Add node above.
2. Specify reservation as the condition for the new node. (This is the same condition that is used by the node with slots, but you will change the condition for the node with slots later in this procedure.)
3. Click the Options![More icon](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon next to the node response, and then click Open JSON editor. Add an entry for each slot context variable that you defined in the node with slots, and set it equal to null.

{
"context": {
"date": null,
In the Image source field, add https://www.ibmlearningcenter.com/wp-content/uploads/2018/02/IBM-Learning-Center-Food4.jpg.
2. Move the image response type up, so it is displayed in the response before the text is displayed. Click the Move up arrow to reorder the two response types.

![Shows the image response type listed before the text response type.](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/gs-ass-image-response-type.png)
3. Click ![Close](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/close.png) to close the edit view.







 Test the about_restaurant dialog node 

Test the intent by checking whether user utterances that are similar to, but not exactly the same as, the examples you added to the training data have successfully trained your assistant to recognize input with an about_restaurant intent.



1. Click the ![Try it](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/ask_watson.png) icon to open the Try it out pane.
2. Enter, I want to learn more about your restaurant.

Your assistant indicates that the about_restaurant intent is recognized, and returns a response with the image and text that you specified for the dialog node.

![Shows the Try it out pane recognizing the #about_restaurant intent and showing the image and text response.]
* What is the difference between the initialization block and the parameters block in Git tool integration Terraform resources?

In a Git tool integration Terraform resource, the initialization block consists of arguments that control how the tool integration prepares and binds itself to a specific target repo. If you change any of the arguments in the initialization block, Terraform deletes the tool integration from the toolchain and creates a replacement tool integration. All of the arguments in the initialization block are annotated with the Terraform behavior Forces new resource.

By contrast, arguments in the parameters block influence how the tool integration works after it is initialized. If an argument is not annotated with Forces new resource and you change the argument, Terraform applies the change to the existing tool integration. It does not delete and re-create the tool integration.

If you change any resource argument that is annotated with Forces new resource, Terraform deletes and re-creates the resource, irrespective of the block that contains the argument.

For more information about the Git tool integration Terraform resources, see the following Terraform Registry documentation:



* [ibm_cd_toolchain_tool_bitbucketgit](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cd_toolchain_tool_bitbucketgit)
* [ibm_cd_toolchain_tool_githubconsolidated](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cd_toolchain_tool_githubconsolidated)
* [ibm_cd_toolchain_tool_gitlab](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cd_toolchain_tool_gitlab)
* [ibm_cd_toolchain_tool_hostedgit](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cd_toolchain_tool_hostedgit)



* What type of authentication should I use to access GitHub repos from my toolchain?
To complete the process of adding the node to a system channel, you need to add it to the consenter set of the system channel.







 Add the OS3-Region2 node to the orderer system channel 

If your cluster does not use a system channel, skip this step. To verify if a cluster uses a system channel, click the cluster tile and check the Orderer Type.

Just as when we performed these steps in the console in Region 1, a new tile with the name of OS3-Region2 appears on the Multiregion Ordering Service page with the label "Requires attention". Again, this state reflects the fact that, while the node creation process has been successful, the node is not yet part of the consenter set of the system channel. The node must be added to the system channel before it can be added to any of the application channels.

Click the node to open it and then click Add node to ordering service. After the node has been added to the ordering service, this third node is now part of the system channel.

Wait until the OS3-Region2 node tile status turns green before proceeding to the next section.





 Export the ordering node 

After this third ordering node has started successfully as indicated by the green status indicator on its tile, we need to export the node so that later it can be imported into the ordering service in the Region 1 and Region 3 consoles.

Open the new ordering node and click Export![export icon](https://cloud.ibm.com/docs-content/v1/content/icons/download.svg) to download the configuration to a OS3-Region2_orderer.json file on your local system. Share this file with the operators of the consoles in Region 1 and Region 3 so they can import it into their ordering service in the last step of this tutorial.







 Step 3: Add two new ordering nodes in Region 3 

In this section, we largely repeat the instructions performed in Region 2. The major difference is that Region 3 will contain two ordering nodes, highlighted in yellow in the following diagram, whereas in Region 2 there is only one ordering node. Along with the two nodes in Region 1 and one node from Region 2, this configuration will complete the recommended minimum number of five ordering nodes for a production ordering service.

Zoom

!
Tutorial: Improving a node with slots 

In this tutorial, you will enhance a simple node with slots that collects the information necessary to make a restaurant reservation.



 Learning objectives 

By the time you finish the tutorial, you will understand how to:



* Test a node with slots
* Add slot response conditions that address common user interactions
* Anticipate and address unrelated user input
* Handle unexpected user responses





 Duration 

This tutorial will take approximately 2 to 3 hours to complete.





 Prerequisite 

Before you begin, complete the [Adding a node with slots to a dialog](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-tutorial-slots). You must complete the first slots tutorial before you begin this one because you will build on the node with slots that you create in the first tutorial.







 Step 1: Improve the format of the responses 

When the date and time system entity values are saved, they are converted into a standardized format. This standardized format is useful for performing calculations on the values, but you might not want to expose this reformatting to users. In this step, you will reformat the date (2017-12-29) and time (17:00:00) values that are referenced by the dialog.



1. To reformat the $date context variable value, click the Edit response![Edit response](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/edit-slot.png) icon for the @sys-date slot.
2. From the More![More icon](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kabob.png) menu, select Open JSON editor, and then edit the JSON that defines the context variable.
How can I run Terraform files sequentially based on the results in IBM Cloud Schematics? 

You can use [module blocks](https://developer.hashicorp.com/terraform/language/modules/syntax) which is a container for multiple resources that are used together. The Terraform configuration has at least one module known as its root module, which consists of the resources defined in the .tf files of the main working directory. For more information, about reusing configuration through modules, see [terraform-ibm-modules](https://github.com/terraform-ibm-modules/).





 Can I always set Terraform to use the latest or default version? 

Yes, in the payload or JSON file, if the value for the type and template_type parameter is not declared, at runtime the default Terraform version is considered. For more information, refer to [specifying version constraints for the Terraform](https://cloud.ibm.com/docs/schematics?topic=schematics-version-constraintsversion-constraints-terraform). You can specify the Terraform version in the payload by using the type or template_type parameter. However, check whether the version value for the type and template_type contains the same version.





 If I set "type”: = “terraform_v1.0" in the JSON file as shown in the code block, will Terraform version 1.0 continue to use even if Terraform version 2.0 or higher are released? 

 {: codeblock}
//Sample JSON file
{
"name": "<workspace_name>",
"type": "terraform_v1.0",
"resource_group": "<resource_group>",
"location": "",
"description": "<workspace_description>",
"template_repo": {
"url": "http://xxxxx.git",
"branch": "main"
},
"template_data": [{
"folder": "",
"type": "terraform_v1.0"
* How can I run Terraform files sequentially based on the results in IBM Cloud Schematics?

You can use [module blocks](https://developer.hashicorp.com/terraform/language/modules/syntax) which is a container for multiple resources that are used together. The Terraform configuration has at least one module known as its root module, which consists of the resources defined in the .tf files of the main working directory. For more information, about reusing configuration through modules, see [terraform-ibm-modules](https://github.com/terraform-ibm-modules/).
* Can I always set Terraform to use the latest or default version?

Yes, in the payload or JSON file, if the value for the type and template_type parameter is not declared, at runtime the default Terraform version is considered. For more information, refer to [specifying version constraints for the Terraform](https://cloud.ibm.com/docs/schematics?topic=schematics-version-constraintsversion-constraints-terraform). You can specify the Terraform version in the payload by using the type or template_type parameter. However, check whether the version value for the type and template_type contains the same version.
* If I set "type”: = “terraform_v1.0" in the JSON file as shown in the code block, will Terraform version 1.0 continue to use even if Terraform version 2.0 or higher are released?

 {: codeblock}
//Sample JSON file
{
"name": "<workspace_name>",
"type": "terraform_v1.0",
"resource_group": "<resource_group>",
"location": "",
"description": "<workspace_description>",
"template_repo": {
"url": "http://xxxxx.git",
"branch": "main"
},
"template_data": [{
"folder": "",
Code Engine creates and manages this secret for you.

What types of services can I bind?
: You can add any type of IBM Cloud service that is enabled for IBM Cloud Identity and Access Management (IAM) and that uses service credentials to your application or job. To find a list of supported IBM Cloud services, see the [IBM Cloud catalog](https://cloud.ibm.com/catalog).

I already have service credentials for an IBM Cloud service instance. Can I use these credentials with Code Engine service bindings?
: Yes, you can bind a service instance to Code Engine workloads by using existing service credentials. From the console, you can use existing credentials that are already used in a service binding. To use existing service credentials from the CLI, specify the --service-credential option in the [ibmcloud ce application bind](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-bind), [ibmcloud ce job bind](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-job-bind) command, or the [ibmcloud ce function bind](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-function-bind) and provide the name of your service credentials.

What access is required to create service bindings?
: Each Code Engine project must be configured with a set of [IAM Access policies](https://cloud.ibm.com/docs/account?topic=account-userroles), which authorizes Code Engine service bindings to view service instances and to view and create service credentials in your account. IAM policies are provided to Code Engine service binding with a service ID. For more information, see [Configuring access for service bindings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configure-bindaccess).

Is there a way to configure service binding operations for all users in a project?
: Yes!
You can label Coach bag as a mention of the @product entity.

For training purposes, the term you annotated, Coach bag, is added as a value of the @product entity.

At run time, your assistant evaluates terms based on the context in which they are used in the sentence only. If the structure of a user request that mentions the term matches the structure of an intent user example in which a mention is labeled, then your assistant interprets the term to be a mention of that entity type. For example, the user input might include the utterance, I want to buy a Gucci bag. Due to the similarity of the structure of this sentence to the user example that you annotated (I want to buy a Coach bag), your assistant recognizes Gucci bag as a @product entity mention.

When a contextual entity model is used for an entity, your assistant does not look for exact text or pattern matches for the entity in the user input, but focuses instead on the context of the sentence in which the entity is mentioned.

If you choose to define entity values by using annotations, add at least 10 annotations per entity to give the contextual entity model enough data to be reliable.



To learn more about contextual entities, [read this blog post](https://medium.com/ibm-watson/contextual-entities-with-ibm-watson-assistant-f41b2e0ca82e).







 Creating entities 



1. Open your dialog skill and then click the Entities tab.

v1.3: Click the Entities tab.

You can also click System entities to select from a list of common entities, provided by IBM, that can be applied to any use case. See [Enabling system entities](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-entitiesentities-enable-system-entities) for more detail.
2. Click Create entity.
3. In the Entity name field, type a descriptive name for the entity.

The entity name can contain letters (in Unicode), numbers, underscores, and hyphens. For example:



* @location
* @menu_item
* @product