vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Accessing external resources from the Satellite location 

In general, the IBM Cloud Framework for Financial Services does not recommend connecting to hosts on the public internet nor accepting connections from the public internet. When it is necessary to do so, you need to use proper facilities, such as load balancers, public gateways, or proxy servers, that usually would be deployed outside of the Satellite location network.

However, deployment of Satellite hosts requires connection to certain external resources to enable the attachment and assignment processes for the hosts as well as ongoing operation of Satellite control plane and workload clusters. These connections need to be properly configured, monitored, and audited.



 External resources for control plane hosts 

Control plane hosts require the following non-HTTP connectivity:



* Red Hat NTP service (unless configured with local or private NTP pool)
* Control plane master connections (TCP ports 30000 - 32767)



The connectivity to the following endpoints must also be allowed, but can be potentially facilitated through an HTTP or HTTPS proxy for flow control and auditing:



* Satellite Link tunnel server endpoint
* IBM Cloud general APIs and Container services
* IAM REST APIs
* LaunchDarkly service
* Object Storage for etcd backup
* Attachment / assignment endpoint
* Satellite Config and Link APIs
* RHEL container registry
* IBM Cloud Container Registry
* IBM Cloud monitoring and log analysis



For more information, see [host networking requirements](https://cloud.ibm.com/docs/satellite?topic=satellite-reqs-host-networkreqs-host-network-firewall-outbound).





 External resources for workload hosts 

Workload hosts require the following non-HTTP connectivity:



* Red Hat NTP service (unless configured with local or private NTP pool)



The connectivity to the following endpoints must also be allowed, but can be potentially facilitated through an HTTP or HTTPS proxy for flow control and auditing:



* IBM Cloud general APIs and Container services
* IAM REST APIs
* LaunchDarkly service
* Attachment / assignment endpoint
* Satellite Config and Link APIs
* IBM Cloud Container Registry
* RHEL container registry
* IBM Cloud monitoring and log analysis
If you're using the CLI or API to assign access, use insight-specialist-ltd--msp-human-intelligence for the service name.

Platform roles

Actions



Table 79. Platform roles - Human Intelligence
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Cloud Internet Services 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use internet-svcs for the service name.

Service roles

Actions



Table 80. Service roles - Cloud Internet Services
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the service role name and the column headers identify the specific information available about each role.

 Role Description 

 Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 
 Reader As a reader, you can perform read-only actions within a service such as viewing service-specific resources. 
 Writer As a writer, you have permissions beyond the reader role, including creating and editing service-specific resources. 







 Internet of Things Platform 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use iotf-service for the service name.

Platform roles

Actions



Table 81. Platform roles - Internet of Things Platform
Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Quantum Services 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use quantum-computing for the service name.

Service roles

Actions



Table 135. Service roles - Quantum Services
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the service role name and the column headers identify the specific information available about each role.

 Role Description 

 Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 
 Reader As a reader, you can perform read-only actions within a service such as viewing service-specific resources. 
 Writer As a writer, you have permissions beyond the reader role, including creating and editing service-specific resources. 







 Raxak Protect 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use raxak-protect for the service name.

Platform roles

Actions



Table 136. Platform roles - Raxak Protect
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 







 Robin CNS
You can set policies about who can create an instance at the platform level, and then use the service roles to manage interaction with the instance itself. As the creator of an instance, you do not need to set any IAM policies to view or work with your App Configuration entities.

For complete IAM documentation, see [Managing access](https://cloud.ibm.com/docs/account?topic=account-cloudaccess) in IBM Cloud.

Review the platform and service roles available and the actions that are mapped to each to help you assign access. If you're using the API to assign access, use apprapp for the service name.

Platform roles

Service roles

Actions



Table 1. Platform roles - App Configuration
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Viewer As a viewer, you can view service instances, but you can't modify them. 
 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Operator As an operator, you can perform platform actions that are required to configure and operate service instances, such as viewing a service's dashboard. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies.
Viewer As a viewer, you can view service instances, but you can't modify them. 







 Discovery 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use discovery for the service name.

Service roles

Actions



Table 51. Service roles - Discovery
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the service role name and the column headers identify the specific information available about each role.

 Role Description 

 Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 
 Reader As a reader, you can perform read-only actions within a service such as viewing service-specific resources. 
 Writer As a writer, you have permissions beyond the reader role, including creating and editing service-specific resources. 







 Dizzion DaaS 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use dizziondaas for the service name.

Platform roles

Actions



Table 52. Platform roles - Dizzion DaaS
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 DNS Services 

Review the available platform and service roles and the actions mapped to each to help you assign access.
Table 68. Platform roles - Hyper Protect Crypto Services
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Hyper Protect DBaaS for MongoDB 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use hyperp-dbaas-mongodb for the service name.

Service roles

Actions



Table 69. Service roles - Hyper Protect DBaaS for MongoDB
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the service role name and the column headers identify the specific information available about each role.

 Role Description 

 Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 
 Reader As a reader, you can perform read-only actions within a service such as viewing service-specific resources. 
 Writer As a writer, you have permissions beyond the reader role, including creating and editing service-specific resources. 







 Hyper Protect DBaaS for PostgreSQL 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use hyperp-dbaas-postgresql for the service name.

Service roles

Actions



Table 70. Service roles - Hyper Protect DBaaS for PostgreSQL
To view these credentials in the UI, click your service instance, select Service Credentials in the left navigation pane, then click the View Credentials link located next to one of the service credentials listed in the table:

Zoom

![Service credentials diagram.](https://cloud.ibm.com/docs-content/v1/content/e0c3acba1296ff980e76d5db456d53adefaabba4/EventStreams/schema_registry8.png)

Kafka credentials block

You need the value of kafka_http_url, which is also the URL of the Schema Registry, and the value of apikey that you can use as the credential for authenticating with the Schema Registry.

You can also authenticate by using an API key that was granted from a service ID, providing the service ID has a policy that permits it at least “reader” role access to the Event Streams instance. This approach is more flexible and is a better choice if you are granting access to multiple other people or teams. See the [Managing access to your Event Streams resources](https://cloud.ibm.com/docs/services/EventStreams?topic=eventstreams-security) help topic for more details.

The curl command to use is as follows (where $APIKEY is substituted with your API key, and $URL is substituted with the URL from the Kafka HTTP URL property of the service credentials):

curl -i -u token:$APIKEY $URL/artifacts

Assuming you did not already use the Schema Registry, you should see the following output that indicates that no schemas are stored in the registry.

HTTP/1.1 200 OK
Date: Thu, 16 Jan 2020 15:45:26 GMT
Content-Type: application/json
Content-Length: 11
Connection: keep-alive
[]





 Schema Registry REST endpoints 

The REST API offers four main capabilities:



1. Creating, reading, and deleting schemas.
2. Creating, reading, and deleting individual versions of a schema.
3.
If allowinglisting is not used, then the cloud service does not restrict incoming connections to a specific IP addresses.

IP Allowinglist is a best practice, even if your cloud service is enabled only for private endpoints. Doing so adds additional level of security so only specific IPs on the private backbone are allowed to connect.

As shown in the figure below, its important to understand that each zone in a VPC is assigned a CSE Source Address IP, and it is this IP that is visible to the backend cloud service. As such, when defining the Allowlisted IPs, you must use these IPs and NOT the IPs of your IKS Worker Nodes.

![Architecture](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/kubernetes-on-vpc/images/connectivity/cse.png)

![Architecture](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/kubernetes-on-vpc/images/connectivity/postgresql-allowlist.png)

To obtain the CSE Source Address IPs, view the details of the VPC which contains your IKS Cluster:

![Architecture](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/kubernetes-on-vpc/images/connectivity/vpc-overview.png)
Alternatively, you can also create and manage service bindings to specific apps and jobs from the specific Code Engine app or job page in the console. To work with service bindings within the context of your app or job, go to the Service bindings tab for your specific app or job.





 Binding a service instance with a new service access secret (with an existing credential) 

Suppose you want to create a service binding to bind a service instance to an app or job with a new service access secret that uses an existing service credential. The existing service credential might have been automatically generated by Code Engine, or the service credential might have been manually. For this example, create a service binding for the myjob job, with a new service access secret that uses an existing service credential.



1. After your project is in Active status, click the name of your project on the [Code Engine Projects page](https://cloud.ibm.com/codeengine/projects).
2. From the Overview page, click Service bindings.
3. From the Service bindings page, click Create to create the binding.
4. Select the IBM service instance that you want to bind to your Code Engine app or job.
5. Select the Code Engine app or job that you want to bind to the service instance; for example, choose the myjob job.
6. Specify the service access secret to use with this binding. The service access secret stores the credential for the service binding. Notice that any previously defined service credential for your specific service instance, which is not associated with the app or job that you selected, is listed. If no service access secret currently exists, then you are creating a new secret. If a service access secret does exist, to create a new service access secret with a new service credential for this binding, select New secret. Complete the following steps.



1. Select the Role for the service instance credential.
2. Expand Advanced options.
3. Select the service credential to use with this service access secret.
4. (optional) Specify a custom prefix for the service binding.
Refresh your browser to see the template objects.



After you deploy the template, it might take a while for the parsing templates to be enabled. The new indexed fields that are included with the parsing templates are needed for the template to filter and display data.







 Predefined views 

Use these views to gain insight on your VMware environment.



Table 1. Predefined devops views

 View name Description 

 [DevOps] AuthRequest for serviceID (applmgmt-audit) Use this view to review logs that report on authentication requests for the serviceID to the VMware Appliance Management Service. 
 [DevOps] AuthResponse (applmgmt-audit) Use this view to review logs that report on authentication responses to the VMware Appliance Management Service. 
 [DevOps] AuthResult for serviceID (applmgmt-audit) Use this view to review logs that report on authentication results for the serviceID to the VMware Appliance Management Service. 
 [DevOps] AuthStatus (applmgmt-audit) Use this view to review logs that report on authentication status to the VMware Appliance Management Service. 
 [DevOps] Core and Inventory Disk Exhaustion Use this view to detect when the `/storage/log partition is reaching maximum capacity. 
 [DevOps] Logged in Use this view to monitor users that log in. 
 [DevOps] Logged out Use this view to monitor users that log out. 
 [DevOps] Reconfigure a VCenter host Use this view to monitor VCenter hosts that have been reconfigured. 
 [DevOps] Reconfigure VM Use this view to monitor VMs that have been reconfigured. 
 [DevOps] Session auth request (applmgmt-audit) Use this view to review logs that report on session authorization requests to the VMware Appliance Management Service. 
 [DevOps] User Password Authentication request (applmgmt-audit) Use this view to review logs reporting on user password authorization requests.
When you use the service-binding command, new service credentials are automatically created for your service instance and assigned the IAM Writer service access role for IAM-enabled services. If you want to use an existing service key that you created earlier, use this option. If you define a service key, you can't set the --role option at the same time because your service keys are already created with a specific IAM service access role.

--role IAM_SERVICE_ROLE
: The IBM Cloud IAM role that you want the service key to have. This value is optional and can be used for IAM-enabled services only. If you don't set this option, your service credentials are automatically created and assigned the IAM Writer service access role. If you want to use existing service keys by specifying the --key option, don't include this option. To list available roles for the service, run ibmcloud iam roles --service <service_name>. The service name is the name of the service in the catalog, which you can get by running ibmcloud catalog search.

--service SERVICE_INSTANCE
: Required: The name of the IBM Cloud service instance that you want to bind. To find the name, run ibmcloud service list for Cloud Foundry services, and ibmcloud resource service-instances for IAM-enabled services.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster service bind command 

ibmcloud ks cluster service bind --cluster my_cluster --namespace my_namespace --service my_service_instance







 ibmcloud ks cluster service ls 

Virtual Private Cloud

Classic infrastructure

List the services that are bound to one or all the Kubernetes namespace in a cluster. If no options are specified, the services for the default namespace are displayed.

ibmcloud ks cluster service ls --cluster CLUSTER [--namespace KUBERNETES_NAMESPACE] [--all-namespaces] [--output json] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:
* Check whether you are using the [required browser software](https://cloud.ibm.com/docs/overview?topic=overview-prereqs-platform) for IBM Cloud.
* Have an SSH key pair ready, which you need for creating and connecting to your virtual server instance. Read [Generating SSH keys](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-generate_ssh) for more information.







 Provisioning a Hyper Protect Virtual Servers instance 

You create a virtual server instance in a few steps from the user interface on the Hyper Protect Virtual Servers page. Read [Provisioning a virtual server](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-provision) for detailed information.





 Retrieving virtual server information 

After you created an instance of Hyper Protect Virtual Servers, you can check the detailed information of your virtual server. Read [Retrieving information about a virtual server](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-retrieve-info-vs) for more information.





 Connecting to a new virtual server 

From your client workstation, you can connect to a virtual server that exists on IBM Cloud with its public IP address and your corresponding private SSH key. Read the information in [Connecting to a new virtual server](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-connect_vs).





 Managing user access 

Access to the management of Hyper Protect Virtual Servers service instances is controlled by IBM Cloud Identity and Access Management (IAM) but the servers use standard Ubuntu user-access management. You can find more information [here](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-manage_access).





 Securing your data 

To securely manage your data when you use Hyper Protect Virtual Servers, you must know what data is stored and encrypted and how to delete any personal data.