vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Setting up full tunnel client-to-site VPN that uses F5 BIG-IP 

One of the approaches for [enabling connectivity to the management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management) is with a client to site full tunnel VPN. Application providers who want to use this option must deploy their own solution. This tutorial shows one approach that uses [F5 BIG-IP Virtual Edition](https://www.f5.com/trials/big-ip-virtual-edition) that can be used to meet IBM Cloud Framework for Financial Services requirements.

The following diagram shows a deployment of the VPC reference architecture with a BIG-IP full tunnel VPN deployment.

Zoom

![IBM Cloud for Financial Services reference architecture with BIG-IP full Tunnel VPN host](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/f5-bigip/vpc-single-region-edge.svg)

Figure 1. Single-region IBM Cloud for Financial Services reference architecture for VPC with BIG-IP full tunnel VPN host



 Objectives 

The objective of this tutorial is to create a full VPN tunnel host that uses BIG-IP that provides the following functions:



* LDAP authentication
* Access only to resources on the bastion subnet, including the bastion host



BIG-IP currently cannot be integrated with App ID for authentication. Work is ongoing with the BIG-IP team to identify a solution.



 Before you begin 

The following items are needed to deploy and configure the reference architecture with a full tunnel VPN provided by BIG-IP:



* [Provisioned and licensed BIG-IP](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-f5-tutorial)
* Configured LDAP









 Step 1: Enable license modules on the BIG-IP 



1.
Sequence A set of actions can be chained together into a [sequence](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-sequences) without having to write any code. A sequence is a chain of actions, invoked in order, where the output of one action is passed as input to the next action. By creating a sequence, you can combine existing actions together for quick and easy reuse. A sequence can then be invoked just like an action, through a REST API or automatically in response to events. 
 Event Examples of events include changes to database records, IoT sensor readings that exceed a certain temperature, new code commits to a GitHub repository, or simple HTTP requests from web or mobile apps. Events from external and internal event sources are channeled through a trigger, and rules allow actions to react to these events. 
 Trigger [Triggers](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-triggers) are a named channel for a class of events. A trigger is a declaration that you want to react to a certain type of event, whether from a user or by an event source. 
 Rule A [rule](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-rules) associates a trigger with an action. Every time the trigger fires, the rule uses the trigger event as input and invokes the associated action. With the appropriate set of rules, it's possible for a single trigger event to invoke multiple actions, or for a single action to be invoked as a response to events from multiple triggers. 
 Feed A [feed](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-triggerstriggers_feeds) is a convenient way to configure an external event source to fire trigger events that can be consumed by Cloud Functions. For example, a Git feed might fire a trigger event for every commit to a Git repository. 
 Package Integrations with services and event providers can be added with packages.
Deploying entities with a manifest file 

You can use IBM Cloud® Functions to describe and deploy all your namespace entities by using a manifest file that is written in YAML. You can use this file to deploy all your Functions [Packages](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-pkg_ov), [Actions](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions), [Triggers](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-triggers), and [Rules](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-rules) with a single command.

The manifest file describes the set of entities you would like to deploy and undeploy as a group. The manifest file contents must adhere to the [OpenWhisk deployment YAML specification](https://github.com/apache/openwhisk-wskdeploy/tree/master/specificationpackage-specification). Once defined, you can use your manifest file to deploy or redeploy a group of Functions entities into the same or different Functions namespace. You can use the Functions plug-in commands ibmcloud fn deploy and ibmcloud fn undeploy to deploy and undeploy the Functions entities that are defined in your manifest file.



 Creating the Hello World API example 

This example takes some simple Node.js code helloworld.js, creates a web action hello_world inside a package hello_world_package and defines a REST API for this action.



1. Create a helloworld.js file with the following code.

function main() {
return {body: 'Hello world'};
}

The deployment manifest file defines the following variables.



* The package name.
* The action name.
* The action annotation that indicates it is to be a web action.
* The action code file name.



2. Create the hello_world_manifest.yml file.

packages:
For example, if one action times out, the entire sequence is exited with that failure.





 Trigger rate limits 

Triggers are subject to a firing rate per minute as documented in the following table.



Table 3. Default limits for triggers

 Limit Description Default Min Max 

 minuteRate The rate limit N is set to 5000 and limits the number of triggers that a user can fire in 1-minute windows. You cannot change the trigger limit when a trigger is created. A CLI or API call that exceeds this limit receives an error code corresponding to HTTP status code 429: TOO MANY REQUESTS. This limit value is fixed, but can be increased if a business case can justify higher safety limit values. Check the section [Increasing fixed limits](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-limitslimits_fixed) for detailed instructions on how to increase this limit. 5000* 5000* 5000* 







 Increasing fixed limits 

Limit values that end with an asterisk () are fixed, but can be increased if a business case can justify higher safety limit values. If you would like to increase the limit value, contact IBM support by opening a ticket directly from the IBM [Cloud Functions web console](https://cloud.ibm.com/functions).



1. Select Support.
2. Select Add Ticket from the drop-down menu.
3. Select Technical for the ticket type.
4. Select Functions for Technical area of support.







 Cloud Functions entities 

The following sections describe system details about Cloud Functions.



 Namespaces and packages 

Cloud Functions actions, triggers, and rules belong in a namespace, and sometimes a package.

Packages can contain actions and feeds. A package cannot contain another package, so package nesting is not allowed. Also, entities do not have to be contained in a package.

You can create new IAM-based namespaces by running ibmcloud fn namespace create. Cloud Foundry-based namespaces are made from a combination of an org and space name.
SAP S/4HANA 

SAP S/4HANA is the leading enterprise resource planning (ERP) software that is designed for the largest Enterprises, in any country worldwide within any industry, with extensive business processes and customization.

ERP software integrates all business management and operations into one cohesive application to coordinate business execution, such as accounting and financials, purchasing and inventory, sales and customer relationships. An ERP can be considered a hub of all business operations. Various applications and all parts of the business can be connected into ERP, from the factory to the headquarters. The ERP software as a whole can have many add-on components (functional and industry) that provide different business functions for different lines of businesses and industries.

SAP S/4HANA is a major release of ERP software from SAP designed to run with the SAP HANA database exclusively. Previous major releases of ERP from SAP, known as SAP ECC and SAP R/3, could use various relational database vendors.

SAP S/4HANA acts as the "Digital Core" for large enterprises with upgraded UX, business workflows, and technology upgrades, to enable as many extensions as possible using Cloud Native technologies.

For more information, see [SAP S/4HANA](https://www.sap.com/products/s4hana-erp.html)

IBM Cloud® for SAP infrastructure options are certified to SAP NetWeaver application server and SAP HANA database server, which run the SAP S/4HANA business application.



 Preface: variants of SAP S/4HANA 

The SAP S/4HANA business application has multiple variants, each with different functional and customization levels, which are available as different operational models. The model that you select affects the SAP S/4HANA deployment.

Primarily the software operational models are grouped into two categories:



* SAP S/4HANA "AnyPremise"(formerly "On-Premise" Edition), which is the same software installation and hosting by the business or a business’s subcontractors. This option provides the business full control over the functions and deployment of the software, but with more deployment effort and management overheads to keep the SAP Systems running.
* SAP S/4HANA Cloud SaaS, which is the same software but installed and hosted by SAP along with SAP Partner subcontractors.
For a user to monitor data within the context of a team, you must grant the user a policy for the IBM Cloud Monitoring Workload Protection service. The policy specifies the team and the service permissions for the user so the user can work with the data in scope for that team.

The following table shows the user roles that you can grant a user to work with the IBM Cloud Monitoring Workload Protection service:



Table 1. List of user roles

 User role IAM service role 

 ROLE_USER reader 
 ROLE_ADVANCED_USER writer 
 ROLE_ADMIN manager 



The following table shows the team roles that you can grant users to work within the context of a team in a IBM Cloud Monitoring Workload Protection instance:



Table 2. List of team roles

 Team role IAM service role Team 

 ROLE_TEAM_READ reader Custom team 
 ROLE_TEAM_EDIT writer Custom team 
 ROLE_TEAM_ADMIN manager Custom team 
 ROLE_TEAM_SECURE_MANAGER manager Secure operations 



You can define in the IBM Cloud Monitoring Workload Protection UI more teams to define different levels of access to data per team and set of users.

To grant a user access to 1 or more teams, an administrator must grant the user a policy for each team that the user needs access to. By using individual policies for each team, administrators can define different service access and permissions levels to work with data in the monitoring instance.

For example, a user that needs to work in a team requires the following policies:



* A policy with a platform role viewer to allow the user to see monitoring instances in the IBM Cloud.
* A policy to grant the user access to 1 team. The service role determines the permissions of the user to work with data that is in scope for the team.



Complete the following steps to grant a user or service ID permissions to work with the IBM Cloud Monitoring Workload Protection service within the context of a team:



 Prerequisites 

Your user ID needs administrator platform permissions to manage the IBM Cloud Monitoring Workload Protection service. The account owner can grant user access to the account for the purposes of managing user access and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).
where Equals(ToLowerCase(C.company), ToLowerCase(N2C.name))

If the input object is null, the function returns null.







 The create function statement 

To perform operations on extracted values that are not supported by AQL, you can define custom functions to use in extraction rules called user-defined functions (UDFs).

AQL supports user-defined scalar functions and user-defined table functions. Java™ and PMML are the only supported implementation language for UDFs. A scalar function returns a single scalar value, and a table function returns one or more tuples, in other words, a table.

You implement user-defined functions (UDFs) by following four steps:



1. Implementing the function

AQL supports user-defined functions (UDFs) that are implemented in Java or PMML.
2. Declaring it in AQL.

You can make the user-defined scalar functions and machine learning models from PMML files available to AQL by using the create function statement.
3. Using it in AQL.

User-defined functions work with AQL statements and clauses.
4. Debugging the UDF.

Because Java based user-defined functions (UDFs) are implemented as public methods in Java classes, you debug your UDFs in the same way that you debug your Java programs.







 Implementing user-defined functions 

AQL supports user-defined functions (UDFs) that are implemented in Java™ or PMML.

This section specifically focuses on UDFs that are implemented in Java. For UDFs implemented in PMML, the machine learning model is stored inside the PMML XML file. Refer to the documentation of PMML for how to create these models: [[http://dmg.org/pmml/v4-1/GeneralStructure.html](http://dmg.org/pmml/v4-1/GeneralStructure.html)]

You can implement a Scalar UDF as a public method in a Java class.
Creating web actions 

When you create an IBM Cloud® Functions web action, the result is a URL that can be used to trigger the action from any web app.

The IBM Cloud® Functions web actions API endpoint changed. To align with other customer services, a new functions.appdomain.cloud API endpoint is available for web actions. The API endpoint functions.cloud.ibm.com is still active, but now returns response data as content type text/plain instead of text/html. Other content types are not changing. Migrate your web actions to use the new API endpoint. The previous endpoints are deprecated and will be deactivated at some point.



 Why use web actions instead of standard actions? 

Run web actions anonymously
: Web action activations are associated with the user that created the action, rather than the caller of the action. Usually, for API calls to apps such as GitHub, you would include a username and token with the API call for either a specific user or a functional ID. When you use a web action, those kinds of credentials are not required. A web action is accessible through a REST interface without the need for credentials.
: Though you are not required to use credentials with web actions, you can implement your own authentication and authorization, or OAuth flow. To configure a web action with credentials, see [Securing web actions](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_secure).

Use any type of HTTP request
: By default, actions accept only POST requests, but web actions can be invoked through any of these HTTP methods: GET, POST, PUT, PATCH, and DELETE, as well as HEAD and OPTIONS.

Trigger a web action from anywhere
: When you create an IBM Cloud® Functions web action, you generate a URL to invoke that action from any web-based app. Actions that are not web actions require authentication and must respond with a JSON object.
Create a providers file to configure your endpoint URLs, cloud regions, or other settings before Terraform can use them, so that Terraform can install and use them in the [provider configuration](https://developer.hashicorp.com/terraform/language/providers/configuration) file that is named provider.tf. Use this file to configure the IBM Cloud Provider plug-in with the IBM Cloud API key from your terraform.tfvars file. The plug-in uses this key to access IBM Cloud and to work with your IBM Cloud service. To access a variable value from the terraform.tfvars file, you must first declare the variable in the provider.tf file and then reference the variable by using the var.<variable_name> syntax .

Example of provider.tf file

variable "ibmcloud_api_key" {}
variable "region" {}

provider "ibm" {
ibmcloud_api_key = var.ibmcloud_api_key
region = var.region
}

Classic infrastructure, Functions, Power Systems: Additional parameters are required when configuring the IBM Cloud Provider plug-in. To find sample configurations for these services, see [Specifying the provider block](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-provider-referenceprovider-example).







 Step 3: Testing your configuration 

Now that you configured the IBM Cloud Provider plug-in for your resource you can start using Terraform on IBM Cloud to initialize, execute plan and apply commands to provision the resource. For more information, about Terraform commands to test your configuration, see [Provisioning IBM Cloud resources](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-manage_resourcesprovision_resources).
Speech to Text 

The installable IBM Watson® Speech to Text service provides an [API](https://www.ibm.com/watson/developercloud/speech-to-text/api/v1/curl.html) that uses IBM's speech-recognition capabilities to produce transcripts of spoken audio.

The Watson packages are deprecated. Please use the [Watson SDKs](https://cloud.ibm.com/docs/watson?topic=watson-using-sdks) to perform Watson related functionality. For more information about which Watson SDK is included in the available runtimes, see the [Functions runtime](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-runtimes) documentation.

This service can transcribe speech from various languages and audio formats. It addition to basic transcription, the service can produce detailed information about many aspects of the audio. For most languages, the service supports two sampling rates, broadband and narrowband. It returns all JSON response content in the UTF-8 character set. For more information about the service, see [Speech to Text](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-about).

The Speech to Text package contains the following entities. Click the entity name for more information in the Speech to Text API reference.



Table 1. Speech to text package entities

 Entity Type Parameters Description 

 [speech-to-text-v1](https://cloud.ibm.com/apidocs/speech-to-text) Package username, password, iam_access_token, iam_apikey, iam_url, headers, headers[X-Watson-Learning-Opt-Out], url Work with the Speech to Text V1 service.
<ScoreDistribution value="Iris-virginica" recordCount="34" confidence="0.971428571428571"/>
</Node>
</Node>
</Node>
</TreeModel>
</PMML>
Show more







 Using user-defined functions 

User-defined functions work with AQL statements and clauses.

User-defined scalar functions work with AQL statements and clauses, similar to built-in functions. Specifically, scalar UDFs can be used in the select, where, having, group by, and order by clauses in the same way as built-in scalar functions, such as GetBegin and LeftContext. User-defined scalar functions that return a Boolean type can be used as predicates in where and having clauses.

User-defined table functions (table UDFs) can be used within the from clause of a select statement or an extract statement.



 Examples 

Example 1: Using scalar UDFs implemented in Java with scalar values as input

This example demonstrates how to use the udfCombineSpans and udfSpanGreaterThan functions that are declared in [Declaring user-defined functions](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-annotation-query-language-referenceaql-user-def-dec).

create function udfCombineSpans(p1 Span, p2 Span)
return Span like p1
external_name 'udfjars/udfs.jar:com.ibm.test.udfs.MiscScalarFunc!combineSpans'
language java
deterministic
return null on null input;

create function udfSpanGreaterThan(span Span, size Integer)
return Boolean
external_name 'udfjars/udfs.jar:com.ibm.test.udfs.MiscScalarFunc!spanGreaterThan'
language java
deterministic;

-- identify occurrences of given names in the document
create dictionary FirstNamesDict from file 'firstNames.dict';
* SAP S/4HANA "AnyPremise"(formerly "On-Premise" Edition), which is the same software installation and hosting by the business or a business’s subcontractors. This option provides the business full control over the functions and deployment of the software, but with more deployment effort and management overheads to keep the SAP Systems running.
* SAP S/4HANA Cloud SaaS, which is the same software but installed and hosted by SAP along with SAP Partner subcontractors. This model provides the business with less control over the software functions and deployment, but with less deployment effort and management overheads to keep the SAP Systems running.



Within each of the software operational models, multiple software deployment options are available:



* SAP S/4HANA "AnyPremise” Edition (formerly "On-Premise" Edition)



* Deployment to existing Traditional On-Premises data center
* Deployment to Cloud IaaS



* SAP S/4HANA Cloud SaaS



* SAP S/4HANA Public Cloud Extended (EX) Edition, SaaS provided by SAP along with SAP Partner subcontractors
* SAP S/4HANA Public Cloud Essentials (ES) Edition, SaaS provided by SAP along with SAP Partner subcontractors
* SAP S/4HANA Private Cloud, SaaS extension of SAP HANA Enterprise Cloud (HEC) provided by SAP along with SAP Partner subcontractors





More information on the variants of SAP S/4HANA software is available from SAP. A concise explanation on the variants of SAP S/4HANA is available from SAP America, see [SAP Community Blogs - Product Information - SAP S/4HANA Cloud Deployment Options (June 17, 2019)](https://blogs.sap.com/2019/06/17/sap-s4hana-cloud-hosting-options).

Regarding SAP S/4HANA, the IBM Cloud® for SAP portfolio documentation refers to SAP HANA and SAP NetWeaver installations as using SAP-certified Cloud Infrastructure-as-a-Service options for running SAP S/4HANA "AnyPremise" deployment to Cloud IaaS. All further descriptions in the following sections refer to SAP S/4HANA "AnyPremise".



 Additional decisions for implementation and maintenance
/whisk.system/cos/changes Feed This feed responds to changes to an IBM Cloud Object Storage bucket and fires a Cloud Functions trigger. When you create a trigger using this feed, you can specify [these parameters](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-pkg_obstoragepkg_obstorage_ev_ch_ref_trig) using the --param flag. 







 IBM Cloud Object Storage trigger parameters 

The /whisk.system/cos/changes feed supports the following parameters.



Table 3. cos changes package parameters

 Parameter Description 

 bucket (Required) The name of of your IBM Cloud Object Storage bucket. This parameter is required to configure the changes feed. The bucket must be in the same region as your Cloud Functions namespace. The bucket must also be configured for regional resiliency. 
 endpoint (Optional). The endpoint parameter is the endpoint of your bucket. When not specified, this parameter is set to the schemeless private regional endpoint of your bucket. Example regional us-south private schemeless endpoint: s3.private.us-south.cloud-object-storage.appdomain.cloud. Example regional us-south private endpoint with https:// scheme: https://s3.private.us-south.cloud-object-storage.appdomain.cloud. For more information, see the [Regional endpoints](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-region) table for IBM Cloud Object Storage. 
 prefix (Optional). The prefix parameter is the prefix of the IBM Cloud Object Storage objects. You can specify this flag when creating your trigger to filter trigger events by object name prefix. 
 suffix (Optional). The suffix parameter is the suffix of your IBM Cloud Object Storage objects. You can specify this flag when creating your trigger to filter trigger events by object name suffix. 
 event_types (Optional). The event_types is the type of bucket change that fires the trigger.