vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Accelerate delivery of static files using a CDN 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial walks you through how to host and serve website assets (images, videos, documents) and user generated content in a IBM Cloud Object Storage, and how to use a [IBM® Content Delivery Network (CDN)](https://cloud.ibm.com/catalog/infrastructure/cdn-powered-by-akamai) for fast and secure delivery to users around the world.

Web applications have different types of content: HTML content, images, videos, cascading style sheets, JavaScript files, user-generated content. Some contents change often, others not so much, some are accessed very often by lot of users, others occasionally. As the audience for the application grows, you may want to offload serving these contents to another component, freeing resources for your main application. You may also want to have these contents served from a location close to your application users, wherever they are in the world.

There are many reasons why you would use a Content Delivery Network in these situations:



* the CDN will cache the content, pulling the content from the origin (your servers) only if it is not available in its cache or if it has expired;
* with multiple data centers across the world, the CDN will serve the cached content from the closest location for your users;
* running on a different domain than your main application, the browser will be able to load more contents in parallel - most browsers have a limit in the number of connections per hostname.





 Objectives 



* Upload files to an IBM Cloud Object Storage bucket.
* Make content globally available with a Content Delivery Network (CDN).
* Expose files by using a static website application.



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution3/Architecture.png)

Figure 1.
Creating backup policies and plans with Terraform 

You can use Terraform to create backup policies and plans.

To use Terraform, download the Terraform CLI and configure the IBM Cloud Provider plug-in. For more information, see [Getting started with Terraform](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started).

VPC infrastructure services use a regional specific based endpoint, which targets to us-south by default. If your VPC is created in another region, make sure to target the right region in the provider block in the provider.tf file.

See the following example of targeting a region other than the default us-south.

provider "ibm" {
region = "eu-de"
}



 Creating a backup policy with a plan with Terraform 

To create a backup policy, use the ibm_is_backup_policy resource. The following example defines a backup policy with the name my-backup-policy-v1. And the new policy applies to resources that have the dev:test tag.

resource "ibm_is_backup_policy" "example" {
match_user_tags = ["dev:test"]
name = "my-backup-policy-v1"
}

For more information about the arguments and attributes, see [ibm_is_backup_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_backup_policy).





 Creating a plan for an existing backup policy with Terraform 

To create a backup plan, use the ibm_is_backup_policy_plan resource. The following example defines a plan within the my-backup-policy-v1 policy. The new plan is called not-just-another-plan and it initiates backup jobs every morning at 01:05.

resource "ibm_is_backup_policy_plan" "example" {
backup_policy_id = ibm_is_backup_policy.example.id
cron_spec = "05 01 * * "
name = "my-backup-plan"
For example, IBM Cloud VPC public gateway can be used when downloading vCenter updates from Vmware.

You have the option to use NSX-T for your VMware Virtual Machines and an overview for a NSX-T based deployment is show below. NSX-T deployment starts with provisioning Bare Metal Servers for VPC VLAN interfaces for each NSX-T component attched to IBM Cloud VPC subnet. Then you deploy NSX-T on the VMware cluster and add transport nodes to the solution. In the last step, you create NSX-T Tier 0 logical router (also known as T0 gateway) to provide routed north-south traffic between NSX-T overlay networks and IBM Cloud VPC.

Zoom

![NSX-T based VMware Solution in IBM Cloud VPC](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution63-ryo-vmware-on-vpc/Self-Managed-Simple-20210924v1-NSX-self-managed.svg)

Figure 2. NSX-T based VMware Solution in IBM Cloud VPC

If you want to use NSX-T in IBM Cloud VPC, review [VMware Solution Architectures for IBM Cloud VPC](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-overview) first. Then proceed with the following steps.



1. OPTIONAL - NSX-T: [Provision Bare Metal Servers for VPC network interfaces for NSX-T](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-nsx-t-vlannics)
2.
For more information about building images, see [Building a container image](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-image).





 Referencing an SSH secret in a build with the CLI 

To use an SSH secret in a build, use the --git-repo-secret option when you run the build create or the build update command. An SSH secret is also used as a Git repository access secret.

If you have an existing build, then you can update it by using the [build update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-build-update) command,

ibmcloud ce build update --name mybuild --git-repo-secret myrepossh

If you want to create a new build, then see [Creating a build configuration with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-imagebuild-create-cli).







 Next steps for Git repository access 

After you create your SSH secret to access a Git repository, you can [build images](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-build) from source code in your private repository. Specify your SSH secret when you run the build create command with the --git-repo-secret option.
ibmc-s3fs-flex-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-flex-perf-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-flex-perf-regional ibm.io/ibmc-s3fs 8m
ibmc-s3fs-flex-regional ibm.io/ibmc-s3fs 8m
ibmc-s3fs-standard-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-standard-perf-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-standard-perf-regional ibm.io/ibmc-s3fs 8m
ibmc-s3fs-standard-regional ibm.io/ibmc-s3fs 8m
ibmc-s3fs-vault-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-vault-regional ibm.io/ibmc-s3fs 8m
2. Choose a storage class that fits your data access requirements. The storage class determines the [pricing](https://cloud.ibm.com/objectstorage/create) for storage capacity, read and write operations, and outbound bandwidth for a bucket. The option that is correct for you is based on how frequently data is read and written to your service instance.



* Standard: This option is used for hot data that is accessed frequently. Common use cases are web or mobile apps.
* Vault: This option is used for workloads or cool data that are accessed infrequently, such as once a month or less. Common use cases are archives, short-term data retention, digital asset preservation, tape replacement, and disaster recovery.
* Cold: This option is used for cold data that is rarely accessed (every 90 days or less), or inactive data. Common use cases are archives, long-term backups, historical data that you keep for compliance, or workloads and apps that are rarely accessed.
You can also use data skipping when querying geospatial data sets using [geospatial functions](https://www.ibm.com/support/knowledgecenter/en/SSCJDQ/com.ibm.swg.im.dashdb.analytics.doc/doc/geo_functions.html) from the [spatio-temporal library](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-geospatial-geotemporal-lib).



* To benefit from data skipping in data sets with latitude and longitude columns, you can collect the min/max indexes on the latitude and longitude columns.
* Data skipping can be used in data sets with a geometry column (a UDT column) by using a built-in [Xskipper plugin](https://xskipper.io/api/indexing/plugins).



The next sections show you to work with the geospatial plugin.



 Setting up the geospatial plugin 

To use a plugin, load the relevant implementations using the Registration module:



* For Scala:

import com.ibm.xskipper.stmetaindex.filter.STMetaDataFilterFactory
import com.ibm.xskipper.stmetaindex.index.STIndexFactory
import com.ibm.xskipper.stmetaindex.translation.parquet.{STParquetMetaDataTranslator, STParquetMetadatastoreClauseTranslator}
import io.xskipper._

Registration.addIndexFactory(STIndexFactory)
Registration.addMetadataFilterFactory(STMetaDataFilterFactory)
Registration.addClauseTranslator(STParquetMetadatastoreClauseTranslator)
Registration.addMetaDataTranslator(STParquetMetaDataTranslator)
* For Python:

from xskipper import Xskipper
from xskipper import Registration
MP-7 - Media Use 



  Control requirements 

MP-7 - 0
:   The organization [IBM Assignment: Selection: restricts; prohibits] the use of [IBM Assignment: Assignment: organization-defined types of information system media] on [IBM Assignment: Assignment: organization-defined information systems or system components] using [IBM Assignment: Assignment: organization-defined security safeguards].





  NIST supplemental guidance 

Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. This control also applies to mobile devices with information storage capability (e.g., smart phones, tablets, E-readers). In contrast to MP-2, which restricts user access to media, this control restricts the use of certain types of media on information systems, for example, restricting/prohibiting the use of flash drives or external hard disk drives. Organizations can employ technical and nontechnical safeguards (e.g., policies, procedures, rules of behavior) to restrict the use of information system media. Organizations may restrict the use of portable storage devices, for example, by using physical cages on workstations to prohibit access to certain external ports, or disabling/removing the ability to insert, read or write to such devices. Organizations may also limit the use of portable storage devices to only approved devices including, for example, devices provided by the organization, devices provided by other approved organizations, and devices that are not personally owned. Finally, organizations may restrict the use of portable storage devices based on the type of device, for example, prohibiting the use of writeable, portable storage devices, and implementing this restriction by disabling or removing the capability to write to such devices.
To avoid billing issues later, make sure that you use only what you are entitled to use. For example, you might have an entitlement for the OCP licenses for two worker nodes of 4 CPU and 16 GB memory, and you create this worker pool with two worker nodes of 4 CPU and 16 GB memory. You used your entire entitlement, and you can't use the same entitlement for other worker pools, cloud providers, or environments.

--skip-advance-permissions-check
: Optional: Skip [the check for infrastructure permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cliinfra_permissions_get) before creating the cluster. Note that if you don't have the correct infrastructure permissions, the cluster creation might only partially succeed, such as the master provisioning but the worker nodes unable to provision. You might skip the permissions check if you want to continue an otherwise blocked operation, such as when you use multiple infrastructure accounts and can handle the infrastructure resources separately from the master, if needed later.

--kms-account-id ID
: Optional: The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--kms-instance KMS_INSTANCE_ID
: Optional: Include the ID of a key management service (KMS) instance to use to encrypt the local disk on the worker nodes in the default worker pool. To list available KMS instances, run ibmcloud oc kms instance ls. If you include this option, you must also include the --crk option. Before you can use KMS encryption, you must create a KMS instance and set up the required service authorization in IAM. See [Managing encryption for the worker nodes in your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption).

--crk ROOT_KEY
: Optional: Include the ID of the root key in the KMS instance to use to encrypt the local disk on the worker nodes in the default worker pool.
* [SAP Web Dispatcher](https://help.sap.com/saphelp_snc700_ehp01/helpdata/en/f9/e2350eca7f4a109eb0a7bc63135e27/frameset.htm) & Work Process (DIA,BTC,UPD,SPOOL) - The SAP Web Dispatcher lies between the internet and your SAP system. The SAP Web Dispatcher is the entry point for HTTP and HTTPs requests into your system, which consists of one or more SAP NetWeaver application servers. As a “software web switch”, the SAP Web dispatcher can reject or accept connections. When it accepts a connection, it balances the load to ensure an even distribution across the servers. The SAP Web Dispatcher contributes to security and also balances the load in your SAP system.

You can use the SAP Web Dispatcher in ABAP and Java systems, in pure Java systems, and in pure ABAP systems.
* [SAP Gateway Service](https://help.sap.com/saphelp_snc700_ehp01/helpdata/en/f9/e2350eca7f4a109eb0a7bc63135e27/frameset.htm) - The SAP Gateway carries out RFC services within the SAP world, which are based on [TCP/IP](https://help.sap.com/saphelp_snc700_ehp01/helpdata/en/35/26b431afab52b9e10000009b38f974/content.htm). These services enable SAP Systems and external programs to communicate with one another. RFC services can be used either in the ABAP program or for the external programs that use the interfaces. RFC can be used between processes of an instance or a system, or between systems.
To return to using public endpoints for the agent, type the following command:

kubectl patch workeragent {WORKER_NAME} --type='merge' -p '{"spec": {"apiUrl":"https://private-worker-service.{REGION}.devops.cloud.ibm.com"}}'







 Configuring the Delivery Pipeline Private Worker to use Satellite link endpoints 

By default, private workers use public endpoints for communication. A cluster administrator can update the private worker configuration to use Satellite link endpoints so that communication between the private worker and the Continuous Delivery service goes through Satellite link endpoints.



1. [Create a cloud Satellite link endpoint](https://cloud.ibm.com/docs/satellite?topic=satellite-link-cloud-create) for the IBM Cloud® Continuous Delivery service and set FQDN and Service indication name to use the following value:

private-worker-service.{REGION}.devops.cloud.ibm.com

Where {REGION} is the location of the toolchain's pipeline.
2. Create a configmap in the private worker namespace that maps the public endpoints to the Satellite link endpoints:

apiVersion: v1
kind: ConfigMap
metadata:
name: pipelineworker-url-map
data:
iam.cloud.ibm.com: <default IAM satellite link endpoint for your satellite location>
private-worker-service.{REGION}.devops.cloud.ibm.com: <satellite link endpoint created in step 1)>

You can add endpoints to the configmap, such as these [default Satellite link endpoints](https://cloud.ibm.com/docs/satellite?topic=satellite-default-link-endpoints).







 Updating the Delivery Pipeline Private Worker installation 

If the private worker is reported as inactive, you must update the installation.

To view the version of your private worker, type one of the following commands:



* IBM Cloud Kubernetes Service: kubectl -n tekton-pipelines describe deploy private-worker-agent | grep Image
Using key rings 

[Key rings](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys) are a way to create a group of keys for a target group of users that require the same IAM access permissions. This allows an account admin to easily tailor the keys they own to the users who manage them and is therefore less error prone than manually updating the permissions of each key and user.





 Rotating your keys 

You should [rotate your root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotation) (that is, to create a new version of the key) on a regular basis. Regular rotations reduce what is known as the "cryptoperiod" of the key, and can also be used in specific cases such as personnel turnover, process malfunctions, or the detection of a security issue.

Root keys can be rotated manually or, if the key was created using Key Protect, on a schedule set by the owner of the key. The [option you choose](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) depends on your preferences and the needs of your use case.

For more information about rotating keys, check out [Bringing your encryption keys to the cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keys).





 Creating your own key material 

While it is comparatively simple to [Base64-encode key material](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keyshow-to-encode-root-key-material), it is important to follow [NIST guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf) when creating your own key material. Improperly created key material can make your keys more susceptible to being compromised.
This documentation is for the classic Watson Assistant experience. To see the documentation for the new Watson Assistant, please go [here](https://cloud.ibm.com/docs/watson-assistant).



 Time zones supported by system entities 

The following list of supported time zones can be used with the time zone functions for the [@sys-date and @sys-time entities](https://cloud.ibm.com/docs/assistant?topic=assistant-system-entitiessystem-entities-sys-date-time).



Supported time zones

 Time zone Time zone 

 Africa/Abidjan Africa/Accra 
 Africa/Addis_Ababa Africa/Algiers 
 Africa/Asmara Africa/Asmera 
 Africa/Bamako Africa/Bangui 
 Africa/Banjul Africa/Bissau 
 Africa/Blantyre Africa/Brazzaville 
 Africa/Bujumbura Africa/Cairo 
 Africa/Casablanca Africa/Ceuta 
 Africa/Conakry Africa/Dakar 
 Africa/Dar_es_Salaam Africa/Djibouti 
 Africa/Douala Africa/El_Aaiun 
 Africa/Freetown Africa/Gaborone 
 Africa/Harare Africa/Johannesburg 
 Africa/Juba Africa/Kampala 
 Africa/Khartoum Africa/Kigali 
 Africa/Kinshasa Africa/Lagos 
 Africa/Libreville Africa/Lome 
 Africa/Luanda Africa/Lubumbashi 
 Africa/Lusaka Africa/Malabo 
 Africa/Maputo Africa/Maseru 
 Africa/Mbabane Africa/Mogadishu 
 Africa/Monrovia Africa/Nairobi 
 Africa/Ndjamena Africa/Niamey 
 Africa/Nouakchott Africa/Ouagadougou 
 Africa/Porto-Novo Africa/Sao_Tome 
 Africa/Timbuktu Africa/Tripoli 
 Africa/Tunis Africa/Windhoek 
 America/Adak America/Anchorage 
 America/Anguilla America/Antigua 
 America/Araguaina America/Argentina/Buenos_Aires 
 America/Argentina/Catamarca America/Argentina/ComodRivadavia 
 America/Argentina/Cordoba America/Argentina/Jujuy
If you delete a VPC subnet that your cluster used, any VPC NLBs that use IP addresses from the subnet might experience issues, and you might be unable to create new load balancers.





 Setting up an NLB using port range 

Port ranges can be used in public NLBs when there is a need to host a service from a single host name that has multiple backend applications, each listening on a separate port number. To use port ranges in your Kubernetes cluster, some manual configuration must be performed. First, the ibm-load-balancer-cloud-provider-vpc-port-range option must be set. It can include one or multiple ranges, each delimited by a comma. The spec.ports.port value must also be set to the minimum value in the port range.

In the following example, a port range of 30000-30010 is used.

Nodeport services must be manually created for each deployment in which the NLB service forwards the request. The port number of each of these Nodeport services must be within the port range that is configured in the NLB service.

In the following example diagram, a Nodeport service with port 30000 is created for Deployment 1 while a Nodeport service with port 30001 is created for Deployment 2.

The user makes a request to port 30001 of the NLB containing the port range. This request is directed to the VPC NLB service that directs the request to the Nodeport service in the cluster that is also listening on port 30001, which in this case is for Deployment 2. The Nodeport service then directs the request to the target port of the selected pods of Deployment 2.

Zoom

![VPC NLB that uses port range.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift//images/nlb-port-range.svg)

Figure 3. VPC NLB with port range

Create an NLB that uses a port range by using the following example.
CM-10 (1) - Open Source Software 



  Control requirements 

CM-10 (1) - 0
:   The organization establishes the following restrictions on the use of open source software: [Assignment: organization-defined restrictions].





  Additional IBM Cloud for Financial Services specifications 

The organization must establish the following restrictions on the use of open source software:



*  All open source software must have an owner defined within the organization. -The owner must certify that software was obtained from a trusted source and has gone though both static and dynamic vulnerability scans.
*  All open source software must be identified in the configuration baseline of the application.
*  Unapproved open source software must never be used.







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities







  NIST supplemental guidance 

Open source software refers to software that is available in source code form. Certain software rights normally reserved for copyright holders are routinely provided under software license agreements that permit individuals to study, change, and improve the software. From a security perspective, the major advantage of open source software is that it provides organizations with the ability to examine the source code. However, there are also various licensing issues associated with open source software including, for example, the constraints on derivative use of such software.