vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Evaluating gates (deprecated) 

You can evaluate gates by using idra (deprecated) to integrate your Delivery Pipeline with IBM Cloud® DevOps Insights. DevOps Insights gates check whether your test results comply with a defined policy. If the policy is not met, the DevOps Insights gate fails by default. You can also configure gates to act in an advisory role to allow pipeline progression even after failure.



  Before you begin 

Before you evaluate gates, you must publish your test results. For more information, see [Publishing test results by using idra (deprecated)](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-publish-test-idra).

Create a policy with rules. For more information, see [Defining policies and rules](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-defining-policies-rules).





  Defining gates (deprecated) 

Place gates before build promotion to ensure that it's safe to promote from one environment to another.

After you create the policy, you can use the following script for gate evaluation:

 Add user api key to stage environment variable as a secured property
export LOGICAL_APP_NAME="SampleApp"
export BUILD_PREFIX="master"

 Evaluate DevOps Insights gate
 node 4.x or above is needed
export PATH=/opt/IBM/node-v4.2/bin:$PATH
npm install -g grunt-idra3

idra --evaluategate --policy="$POLICY_NAME"





  Viewing gate evaluation 

You can view the results of the gate evaluation on the Risk Analysis page in DevOps Insights. The Risk Analysis page relies on the presence of a gate after a staging deployment job in your pipeline. Make sure that you have a gate after you deploy to the staging environment, but before you deploy to a production environment. For more information about the Risk Analysis page, see [Your deployment environments](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deployment-environment).
This tutorial presents the setup of Network Address Translation (NAT) masquerade on a Virtual Router Appliance (VRA) to connect to a secured subnet on the IBM Cloud private network. It builds on the Isolating workloads with a secure private network tutorial, adding a Source NAT (SNAT) configuration, where the source address is obfuscated and firewall rules are used to secure out-bound traffic. More complex NAT configurations can be found in the supplemental VRA documentation.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Configure routing for IBM Cloud VPC and NSX-T Logical Routers](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-nsx-t-routing)Configure routing for IBM Cloud VPC and NSX-T Logical Routers Solution tutorial

In this tutorial, a Bare Metal Servers for VPC VLAN interfaces will be created for your NSX-T Tier 0 logical router external uplinks. Tier 0 logical router or Gateway will be connected to one or more the IBM Cloud VPC subnets. When the interfaces are created, IP routing is configured between IBM Cloud VPC and the NSX-T overlay networks. This phase is optional, if you plan to use NSX-T for your Virtual Machine networking.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Continuous Deployment to Kubernetes](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-continuous-deployment-to-kubernetes)Continuous Deployment to Kubernetes Solution tutorial

This tutorial walks you through the process setting up a continuous integration and delivery pipeline for containerized applications running on the Kubernetes Service. You will learn how to set up source control, then build, test and deploy the code to different deployment stages. Next, you will add integrations to other services like Slack notifications.
Security and Compliance 



 Protection Against Unauthorized Access 

IBM Cloud® Messages for RabbitMQ use the following methods to protect data in transit or in storage.



* All Messages for RabbitMQ connections use TLS/SSL encryption for data in transit. The current supported version of this encryption is TLS 1.2.
* Access to the Account, Management Console UI, and API is secured via [Identity and Access Management (IAM)](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=cloud-databases-iam).
* Access to the database is secured through the standard access controls provided by the database. These access controls are configured to require valid database-level credentials that are obtainable only through prior access to the database or through our Management Console UI or API.
* All Messages for RabbitMQ disk is provided on storage encrypted with LUKS using AES-256. The default keys are managed by [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about). Bring-your-own-key (BYOK) for encryption is also available through [Key Protect Integration](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=cloud-databases-key-protect).
* IP allowlisting - All deployments support [allowlisting IP addresses](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=cloud-databases-allowlisting) to restrict access to the service.
* Public and Private Networking - Messages for RabbitMQ is integrated with [Service Endpoints](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=cloud-databases-service-endpoints). You can select whether to use connections over the public network, the IBM Cloud internal network, or both.
* Dedicated Cores - Allocating dedicated cores to your deployment introduces hypervisor-level isolation to your database instance, using isolated virtual machines to ensure your data processing remains separated from other customers. It also provides a guaranteed minimum amount of CPUs to your deployment.
Within the context of a project, you can easily deploy infrastructure resources from approved, compliant IBM Cloud or private catalog offerings by using a deployable architecture. By using a predefined deployable architecture, you can be sure that you are meeting the compliance standards that the architecture is associated with. Or, you can onboard your own and specify the controls within Security and Compliance Center that your architecture is compliant with.

Before you deploy an architecture, a validation check is run on your configuration for both compliance and risk so that you can address any issues that are found. You can view the logs through the IBM Cloud® Schematics service to determine which resources are affected and consider whether to fix or override the flagged issue and move forward.

After your infrastructure is deployed and your [DevSecOps toolchains](https://cloud.ibm.com/docs/devsecops-alm?topic=devsecops-alm-devsecops-alm-overview) are configured, you're ready to deploy your app by using the DevSecOps continuous integration and continuous deployment pipelines. These pipelines can help your enterprise to shift left and reduce the possibility of human error or introduction of new vulnerabilities before code ever reaches production to help mitigate any major security or financial risks.

Zoom

![A visual representation of a process that includes continuous integration, deployment, and compliance](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/images/cd.svg)

Figure 3. Continuous integration, deployment, and compliance





 Staying compliant 

After you deploy resources that you know are compliant, you can ensure that you remain compliant in two ways. First, by validating your resource configurations with Security and Compliance Center. Security and Compliance Center regularly scans your configurations of the resources in your account to ensure that there hasn't been a drift in compliance.

Zoom

!
* UI
* CLI







 KMS integration for BYOK or KYOK 

IBM Cloud® Schematics integrates to fully manage enterprise-grade key management to manage the lifecycle of your encryption keys that are used in your IBM Cloud resources, services, and applications.



 Launching key management 

By default the data that you store in Schematics Workspaces by using the Enterprise plan is encrypted by using randomly generated keys. If you need to control the encryption keys, you can use the IBM Key Protect to create, import, and manage encryption root keys and standard keys. Then, you can associate those keys with your Schematics resource deployment to encrypt your resources.

You can use your encryption keys from key management services (KMS), IBM Key Protect(BYOK), and IBM Cloud Hyper Protect Crypto Services (KYOK) to encrypt and secure data stored in Schematics. For more information about how to protect sensitive data in Schematics, see [protecting your sensitive data in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datadata-storage).



 Prerequisites 

The key management system will list the instance that are created from your specific location and region. Following prerequisites are followed to perform the KMS activity.



* You should have your KYOK, or BYOK. To create the IBM Key Protect keys, see [create KYOK](https://cloud.ibm.com/catalog/services/key-protect). To create an IBM Cloud Hyper Protect Crypto Services keys, see [create BYOK](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services).
* You need to [add root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keysimport-root-key-gui) to your KYOK, or BYOK instance.
IBM Key Protect 

Use [Key Protect](https://cloud.ibm.com/catalog/services/key-protect) to securely store and apply secrets like API keys, Image Signature, or HashiCorp Vault credentials that are part of your toolchain. You must create a Key Protect Service Instance before proceeding further. If you already created a Key Protect Service Instance as prerequisite, you can link the same in this step.

Zoom

![Key Protect](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops_set-up_key_protect_mgr.png)

Figure 8. Key Protect



* Name: Name of Key Protect instance created by the toolchain. This key protect instance can be accessed by this name during various stages of the toolchain setup.
* Region: Region in which the Key Protect service is located.
* Resource Group: Resource Group that the Key Protect service belongs.
* Service name: Key Protect service name.



To comply with best practices for using HashiCorp Vault, this template includes a Key Protect tool integration to securely manage the HashiCorp Vault Role ID and Secret ID. By storing these HashiCorp Vault secrets in Key Protect as a prerequisite for users to create toolchains, you protect access to HashiCorp Vault, which is the default secrets repo for most consumers.





 IBM Secrets Manager 

Use [Secrets Manager](https://cloud.ibm.com/catalog/services/secrets-manager) to securely store and apply secrets like API keys, Image Signature, or HashiCorp Vault credentials that are part of your toolchain. You must create a Secrets Manager Service Instance before you proceed further. If you created a Secrets Manager Service Instance as prerequisite, you can link the same in this step.

Zoom

!
The individual toolchain integrations can be configured also after the pipeline is created.

Zoom

![DevSecOps CD Toolchain Created](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-cd-toolchain-created.png)

Figure 4. DevSecOps CD Toolchain Created





 Step 5: Explore the CD toolchain 

Now that the CD Toolchain is created, click the cd-pipeline card to open and run the Promotion Pipeline.



 Run the Promotion Pipeline 

Make sure that the [CI Pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-ci-pipeline) ran successfully before you run the Promotion Pipeline.

The Promotion Pipeline creates a Pull Request with the content of the inventory on the Inventory Source Environment (for example: master) branch targeting the Inventory Target Environment branch (for example: staging or prod).



* On the cd-pipeline Dashboard, click Run pipeline, and select the Manual Promotion Trigger. Click Run to trigger the pipeline.
* Wait for the Promotion Pipeline run to complete and check execution log.
* After the Promotion Pipeline finishes successfully, the promote Task log provides a link to the pull Request in the Inventory Repository. The pull request name is of the format promote <Inventory Source Environment> to <Inventory Target Environment>.





1. Open the pull request in your browser with the link provided in the log. Complete the details in the following sections:



* Priority: (mandatory) One of Critical, High, Moderate, Low, Planning
* Change Request assignee: (mandatory) email-id of the assignee
* Additional Description: Description about the changes in the application
* Purpose: Purpose of the changes that are made to the application
* Explanation of Impact: Impact of the change to the application behavior or environment
* Backout Plan: Steps to back out if there is a deployment failure



2. Complete the fields in the Pull Request and save.
Admin@HPCCluster>@HPCCluster> user logoff
Logged off successfully
2. Log in with the user that was added in the previous setp to the LSF cluster by running the following commands:

[root@icgen2host-172-19-1-69 ] su user1lsf
bash-4.4$ egosh user logon -u user1lsf -x welcome@31!
Logged on successfully
bash-4.4$ egosh
user1lsf@HPCCluster> resource list
NAME status mem swp tmp ut it pg r1m r15s r15m ls
icgen2h* ok 14G 0M 74G 2% 0 0 0.1 0 0 1
icgen2h* ok 15G 0M 75G 0% 20339 0 0 0.3 0 0
user1lsf@HPCCluster> ego info
Cluster name : HPCCluster
EGO master host name : icgen2host-172-19-1-69
EGO master version : 3.4
user1lsf@HPCCluster>
3. Assign roles to the new users by running the following commands:

lsfadmin@HPCCluster> user assignrole -u user1lsf -r CONSUMER_USER
Role <Consumer User> is assigned to user <user1lsf>.
lsfadmin@HPCCluster> user list
ACCOUNT PHONE EMAIL DESCRIPTION
----------------------------------------------------------------
Admin
Guest
user2lsf
user1lsf
smith









 Conclusion 

You have now successfully integrated OpenLDAP with IBM Spectrum LSF to provide centralized authentication and directory services, which enable you to use your existing LDAP infrastructure for authentication. You have also enabled secure and streamlined user access to IBM Spectrum LSF.
* [Ordering IBM Cloud Direct Link Dedicated](https://cloud.ibm.com/docs/dl?topic=dl-how-to-order-ibm-cloud-dl-dedicated)
* [Integrating with Virtual Private Endpoint for VPC](https://cloud.ibm.com/docs/dl?topic=dl-vpe-for-ibm-cloud-direct-link)







 VPN for VPC 

An alternative connectivity pattern is to use the VPN for VPC service to securely connect from your private network to the management VPC. VPN for VPC can be used as a static, route-based VPN or a policy-based VPN to set up an IPsec site-to-site tunnel between your VPC and your on-premises private network, or another VPC.

The following diagram shows the VPN for VPC connection pattern.

Zoom

![Application provider on-premises to management VPC by using VPN for VPC](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/network-connectivity/provider-to-management-vpc/vpc-architecture-provider-on-prem-to-management-vpc-VPN.svg)

Figure 2. Application provider on-prem to management VPC using VPN for VPC

For more information, see:



* [About VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn)
* [Creating a VPN gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-gateway)
* [Use a VPC/VPN gateway for secure and private on-premises access to cloud resources](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-site2site-vpn)







 Full tunnel client-to-site VPN
Hyper Protect DBaaS for MongoDB [Securing your connection to Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-service-connection) 
 Hyper Protect DBaaS for PostgreSQL [Securing your connection to Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-service-connection) 
 IBM Cloudant [Available for all dedicated hardware plans deployed after 1 January 2019](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-ibm-cloud-publicdedicated-hardware-plan) 
 Key Protect [Connecting to Key Protect on the IBM Cloud private network](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-private-endpoints) 
 KMIP for VMware on IBM Cloud [KMIP for VMware on IBM Cloud documentation](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerationskmip_standalone_considerations-install) 
 Kubernetes Service [Public and private service endpoints for Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-plan_clustersworkeruser-master) 
 IBM® Log Analysis [IBM Log Analysis service endpoints integration](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpoints) 
 Messages for RabbitMQ [Messages for RabbitMQ service endpoints integration](https://cloud.ibm.com/docs/services/messages-for-rabbitmq?topic=cloud-databases-service-endpoints) 
 IBM Cloud Monitoring [IBM Cloud Monitoring service endpoints integration](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_ingestion)
Databases for PostgreSQL [Databases for PostgreSQL service endpoints integration](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-service-endpoints) 
 Databases for Redis [Databases for Redis service endpoints integration](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-service-endpoints) 
 Db2 on Cloud [Connectivity options](https://cloud.ibm.com/docs/services/Db2onCloud?topic=Db2onCloud-connect_options) 
 Db2® Warehouse on Cloud [Connecting to a private endpoint](https://cloud.ibm.com/docs/services/Db2whc?topic=Db2whc-connect_optionspriv_endpt) 
 Event Notifications [Regions and endpoints](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-regions-endpoints) 
 Event Streams [Restricting network access using the Enterprise plan](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-restrict_access) 
 Hyper Protect Crypto Services [Hyper Protect Crypto Services service endpoints integration](https://cloud.ibm.com/docs/services/hs-crypto?hs-crypto-private-endpoints=hs-crypto-private-endpoints) 
 Hyper Protect DBaaS for MongoDB [Securing your connection to Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-service-connection) 
 Hyper Protect DBaaS for PostgreSQL [Securing your connection to Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-service-connection)
Git Repos and Issue Tracking projects might also be configured with integrations or webhooks to other systems, or equipped with access tokens, deploy tokens, and deploy keys. To review or change the integrations, webhooks, tokens, and keys that might be configured with your project, from the project sidebar, complete the following steps:



1. From the project sidebar, click Settings.
2. Click Integrations to work with your project's integrations with other applications.
3. Click Webhooks to work with your project's webhooks to other systems.
4. Click Access Tokens to work with access tokens that might grant access to your project.
5. Expand Deploy Tokens to work with the deploy tokens that might grant access to your project.
6. Expand Deploy Keys to work with deploy keys that might grant access to your project.



To learn more about working with Git Repos and Issue Tracking, see [Git Repos and Issue Tracking](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-git_working).







 Protecting your data when you use Delivery Pipelines 

Continuous Delivery pipelines run the jobs and steps that you provide. The Continuous Delivery service securely manages the log output and build artifacts that are produced by your pipeline runs. However, Continuous Delivery does not limit or manage the function of your pipeline job or step scripts.

When you develop and configure your pipeline job and step scripts, make sure that your scripts do not run actions that might compromise the confidentiality, integrity, or availability of your resources, or otherwise violate regulatory controls.

To learn more about Delivery Pipelines, see and [Working with pipelines](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipeline_about) and [Working with Tekton pipelines](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-tekton-pipelines).





 Protecting your data when you use Terraform
In the Public Endpoints section, you can view the public URL that IBM Integration Bus on Cloud assigned to your integration flow. Select Show full URL to view the complete URL for that operation.
6. Copy the complete URL for the operation to your clipboard. You need it when you configure the API to work with API Connect. If you enabled Basic Authentication, also note the assigned username and password.





 Integrate the IBM Integration Bus with API Connect. 



1. Import the OpenAPI file that is associated with the REST API project in the IBM Integration Toolkit into the API Connect service.



1. Log in to your API Connect IBM Cloud service.
2. In the API Manager UI navigation list, select Drafts > APIs. The APIs tab opens.
3. Select + Add > Import API from a file or URL. The Import OpenAPI (OpenAPI) window opens.
4. To upload the file that you created from your local file system, select Select File and select the file that you created with IBM Integration Bus. Files with the .json, .yml, and .yaml extensions are supported if they contain a valid OpenAPI definition. Make sure that the option for Add a product is selected. You can optionally publish the product by selecting Publish this product to a catalog.
5. Click Import. A new REST API definition is created, including Paths and HTTP operations. Tip: Cancel the import, refresh your browser, and try importing it again if it takes longer than 1 minute to import. Your session might be expired.



2. Associate the imported API in API Connect with the API in IBM Integration Bus on Cloud.



1. Go to the Dashboard of API Connect.
2. Select Drafts > APIs.
3. Click the REST API that you imported.
4. Select the Assemble tab, and select Create assembly to add the proxy policy.
5. Drag the Proxy policy to the new empty policy to enable it.
6. Paste the URL for your API that you copied from the public Endpoints section of IBM Integration Bus on Cloud.