vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Pull request pipeline success](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/ds_kub_explore_pr_pipeline_success.png)

Figure 9. Pull request pipeline success

To start the continuous integration pipeline, merge the continuous integration merge request in your app repo:



1. Go to the merge request.
2. Merge the request so that your changes are copied to the master branch of your app repo. The continuous integration pipeline is automatically triggered.
3. On the continuous integration Toolchain Overview page, on the Repositories card, click the ci-pipeline repo to start the continuous integration pipeline.
4. After the continuous integration pipeline run succeeds, you can click the pipeline run to explore the completed steps.



Zoom

![Continuous integration pipeline success](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/sat_ci_pipeline_success.png)

Figure 10. Continuous integration pipeline success



 Shift left practice 

In the secure app development world, shift left is a practice that prevents and finds issues such as defects and security vulnerabilities and runs compliance checks early in the software delivery process. Shift left includes the following practices:



* Run checks that can be run on the code or the repo itself and do not need the built image, as early as possible. These checks prevent noncompliant code from being merged into the master branch of the repo. Because evidence is not collected from the pull request pipeline, its goal is to shift compliance checks as far left as possible.
* All checks are run in every pipeline run. If a previous check fails, the pipeline progresses to the next check. To evaluate if you have any failures in your run, check the final step of your pipeline that has a pipeline evaluator.
git@github.com:terraform-ibm-modules/terraform-ibm-cluster.git
5. Go to the examples/secure-roks-cluster directory, and review the [README.md file](https://github.com/terraform-ibm-modules/terraform-ibm-cluster/tree/master/examples/secure-roks-cluster) for more information about how to update any of the template default variables.
6. Run the Terraform commands to initialize, plan, and apply the template. You can monitor the progress from the command line.

terraform init

terraform plan

terraform apply
7. Optional: To clean up the resources that the template created, you can use a Terraform command.

terraform destroy







 Next steps 

The Schematics template helps with the initial creation. After creating the cluster, you are in control for continued cluster management actions, such as [updating the cluster](https://cloud.ibm.com/docs/containers?topic=containers-update), [adding worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-add_workers), updating any of your VPC network options, and using the security integrations to monitor your cluster.

To access your cluster, you must [set up a VPN connection](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-access-wireguard). To read an IBM blog about setting up a VPN connection, see [Setting up a VPN](https://cms.ibm.com/cloud/blog/setting-up-a-vpn-between-ibm-cloud-vpc-and-your-home-office).

To fully [remove](https://cloud.ibm.com/docs/containers?topic=containers-remove) your cluster and the resources created by the secure cluster template, make sure to [destroy your workspace in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-sch-delete-wks&interface=ui).
* Direct Link - Creates a network connection to and from Direct Link 2.0 gateways so that there is a secure connection to on-premises networks and other resources connected to the transit gateway.

If you select Direct Link, you must also log in to the [Direct Link console](https://cloud.ibm.com/interconnectivity/direct-link) (using the same IBM Cloud account) and specify Transit Gateway as the type of network connection for your direct link.



7. Click Add to create a connection.







 Adding a connection from the CLI 



 Before you begin 

Complete these prerequisites to use the Transit Gateway CLI, which is implemented as an IBM Cloud CLI plug-in.



1. Install the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cliinstall-ibmcloud-cli).
2. Install the tg-cli/tg CLI plug-in to the IBM Cloud CLI.

To install:

ibmcloud plugin install tg



If you are going to use the CLI with a Virtual Private Endpoint (VPE), you must set the following variable:

export IBMCLOUD_TG_API_ENDPOINT=private.transit.cloud.ibm.com

For more information, see [Integrating with Virtual Private Endpoint for VPC](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-vpe-for-ibm-cloud-transit-gateway).

To add a connection on the transit gateway from the CLI, enter the following command:

ibmcloud tg connection-create|cc GATEWAY_ID --name NAME --network-type [vpc | directlink | classic] --network-id NETWORK_ID --network-account-id NETWORK-ACCOUNT-ID [--output json] [-h, --help]

Where:



* GATEWAY_ID: ID of the gateway that the new connection will be on.
* --name: Name for the new connection.
* --network-type: Network type of the connection.
* [Configuring a single inbound VPN connection to a multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-vpnmultizone_one_inbound)
* [Configuring an inbound VPN connection in each zone of a multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-vpnmultizone_multiple)



* [Configuring the strongSwan Helm chart](https://cloud.ibm.com/docs/containers?topic=containers-vpnvpn_configure)



* [Step 1: Get the strongSwan Helm chart](https://cloud.ibm.com/docs/containers?topic=containers-vpnstrongswan_1)
* [Step 2: Configure basic IPSec settings](https://cloud.ibm.com/docs/containers?topic=containers-vpnstrongswan_2)
* [Step 3: Select inbound or outbound VPN connection](https://cloud.ibm.com/docs/containers?topic=containers-vpnstrongswan_3)
* [Step 4: Access cluster resources over the VPN connection](https://cloud.ibm.com/docs/containers?topic=containers-vpnstrongswan_4)
* [Step 5: Access remote network resources over the VPN connection](https://cloud.ibm.com/docs/containers?topic=containers-vpnstrongswan_5)
* [Step 6 (optional): Enable monitoring with the Slack webhook integration](https://cloud.ibm.com/docs/containers?topic=containers-vpnstrongswan_6)
* [Step 7: Deploy the Helm chart](https://cloud.ibm.com/docs/containers?topic=containers-vpnstrongswan_7)



* [Testing and verifying strongSwan VPN connectivity](https://cloud.ibm.com/docs/containers?topic=containers-vpnvpn_test)
To obtain payload values in the pipeline definition, specify a Triggerbinding parameter with a value that is derived from the event:

apiVersion: tekton.dev/v1beta1
kind: TriggerBinding
metadata:
name: binding
spec:
params:
- name: somekey
value: $(event.somekey)

Save your changes.
5. In the Environment properties section, click Add and select a property type to define your own environment property. For example, you can define an API_KEY property that passes an API key that is used by all of the scripts in the pipeline to access IBM Cloud resources. You can add the following types of properties:



* Enumeration: A property key with a value that can be selected from a user-defined list of options.
* Secure value: A property key with a single-line value that is secured with AES-128 encryption. This value is displayed by using the asterisk character. Alternatively, you can click the key icon to select a secret from a vault integration (such as IBM Key Protect), if such a tool is available in your toolchain.
* Text value: A property key with a text value that can either be single-line or multi-line. Previously, multi-line values were supported by a separate Text area property type.
* Tool integration: A property key with a value that is resolved at run time from a toolchain tool integration. By default, the value is a JSON string representation of the tool integration. A specific field or subset of the object can be retrieved by providing a value for the optional JSON filter. For example, if a GitHub integration is selected and the JSON filter parameters.repo_url is specified, the value reflects the URL of the Git repo that is configured in the tool integration when the PipelineRun resource runs.



You can access these properties in your Tekton pipeline resources. For more information about these properties, see [Tekton Pipelines environment and resources](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-tekton_environment).
6. Click Save.
The Sauce Labs tool integration supports the following configuration parameters that you can use with the [Toolchain HTTP API and SDKs](https://cloud.ibm.com/apidocs/toolchain) when you [create](https://cloud.ibm.com/apidocs/toolchaincreate-tool), [read](https://cloud.ibm.com/apidocs/toolchainget-tool-by-id), and [update](https://cloud.ibm.com/apidocs/toolchainupdate-tool) tool integrations.

You must specify the tool_type_id property in the request body with the saucelabs value.



Table 1. Sauce Labs tool integration parameters

 Parameter Usage Type Terraform argument Description 

 key required, updatable Password access_key The access key for the Sauce Labs account. You can use a toolchain secret reference for this parameter. For more information about secret references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 username required, updatable String username The username of the Sauce Labs account. 







 Learn more about Sauce Labs 

To learn more about Sauce Labs, see the [Sauce Labs article](https://www.ibm.com/garage/method/practices/deliver/tool_sauce_labs/) on the IBM Cloud Garage Method.
For example, if your team URL is https://team.slack.com, the host name is team.
3. Click Create Integration.

If the Slack channel and team that you specified cannot be reached, the Setup Failed error is displayed on the Slack card. Hover over the Setup Failed message and click Reconfigure. Make sure that you are using valid configuration parameters for the Slack webhook URL, Slack channel, and URL host name for your Slack team. Update the settings as required, and click Save Integration.
4. On your Toolchain's Overview page, on the Third-Party tools card, click Slack. You can view all of the activity for your toolchain in the configured Slack channel.





 Configuring Slack by using the API 

The Slack tool integration supports the following configuration parameters that you can use with the [Toolchain HTTP API and SDKs](https://cloud.ibm.com/apidocs/toolchain) when you [create](https://cloud.ibm.com/apidocs/toolchaincreate-tool), [read](https://cloud.ibm.com/apidocs/toolchainget-tool-by-id), and [update](https://cloud.ibm.com/apidocs/toolchainupdate-tool) tool integrations.

You must specify the tool_type_id property in the request body with the slack value.



Table 1. Slack tool integration parameters

 Parameter Usage Type Terraform argument Description 

 api_token required, updatable Password webhook The incoming webhook that Slack uses to receive events. You can use a toolchain secrets reference for this parameter. For more information about secrets references, see [Protecting your sensitive data in IBM Cloud](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 channel_name required, updatable String channel_name The Slack channel to post notifications to. 
 pipeline_fail optional, updatable, Default: true Boolean pipeline_fail Generates pipeline failed notifications.
Release notes for DevSecOps 

Use the release notes to learn about the latest changes to IBM Cloud DevSecOps.



 31 January 2023 



* Validation of inventory promotion pull request - Provides evidence aggregation and summarization for the new state into which the inventory enters when the promotion PR is merged. Aggregation involves evidence collection and summarization from all the CI pipelines responsible for the inventory updates. The feature gives an early validation of the inventory promotion before the PR is merged to the target branch (environment). Based on the status of the PR, you can either move ahead with the promotion (when all the evidence results are GREEN), or fix the evidence (when the evidence is marked in RED) in the CI Pipelines before proceeding with promotion PR merge. For more information, see [Promotion pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-promotion-pipeline).
* Support for Git submodule clone - Enhances the ability of the CI Pipeline to clone the Git submodules for the application repositories that reference submodules. For more information, see [Configuring cloning of git submodules](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-clone-submodules).
* Prevent CI Pipeline from updating inventory for a RED build - Gives the ability to detect failure within the CI pipeline and prevent the pipeline from updating the Inventory. For more information, see [Continuous integration parameters](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parm).







 07 December 2022 

DevSecOps Continuous Integration for Infrastructure as Code is available as a Toolchain template in the Toolchain catalog. For more information, see [Develop and deploy secure IaC with DevSecOps practices](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-tutorial-iac).





 30 November 2022
[Network topology: Integrating with a transit gateway](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-server-use-case-tgw-integration.png)

Figure 4. Network topology: Integrating with a transit gateway

When you integrate the client-to-site VPN server with the transit gateway, you must add one or more VPN routes with the destination set to the CIDR of the subnet in other VPCs or classic networks, and set the route action to translate. For more information, see [Managing VPN routes](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-routes).





 Use case 4: Integrating with a site-to-site VPN gateway 

Integrate with a site-to-site VPN gateway if you want to access your on-premises private network at the same time as when you connect to IBM VPCs. This use case removes the requirement to maintain multiple VPN servers simultaneously. You can access your on-premises private network from a client-to-site VPN server directly.

Zoom

![Network topology: Integrating with a site-to-site VPN gateway](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-server-use-case-vpn-gateway.png)

Figure 5. Network topology: Integrating with a site-to-site VPN gateway







 Related links 



* [Quotas](https://cloud.ibm.com/docs/vpc?topic=vpc-quotasvpn-server-quotas)
Managing your Secure Gateway Service 



 Secure Gateway Dashboard 

From your Secure Gateway dashboard, you can quickly see the following details:



* The inbound data flow across all your gateways in the past 12 hours.
* The outbound data flow across all your gateways in the past 12 hours.
* A graph displaying the past 12 hours of usage on a per gateway basis.
* Your existing gateways, their current status, and the number of destinations they contain.



![Secure Gateway Dashboard with Usage](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/dashboardUsage.png?raw=true)



 Service Profile 

By clicking the Profile button ![Profile Button](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/profileIcon.png?raw=true), you can see:



 Field Description 

 Plan Level Your currently selected service plan. 
 Gateway Limit The number of gateways you can have before being charged for extra gateways. 
 Client Limit The number of clients you can connect to any single gateway. 
 Destination Limit The number of destinations any single gateway can contain. 
 Data Limit The amount of data transfer (in GB) that your plan supports before being charged for a data overage. 
 Gateway Overages The current number of gateway overages you are being charged for. 
 Data Overages The number of data overages incurred for the current month's billing cycle. 







 Gateway Info Panel 

By clicking the Settings button ![Setting Button](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/settingIcon.png?raw=true) on any of the gateway tiles, you can see:
5. Implement the subflows for your REST API, which are the REST operations that you want to include.



2. Add the REST API project to a new or existing broker archive (BAR) file of the IBM Integration Bus.
3. Deploy the BAR file to IBM Integration Bus on Cloud.



1. Log in to IBM Integration Bus on Cloud by using your IBMid, if you are not already logged in. Sign up for an account if you do not have one.
2. Click Add Integration > Upload BAR file.
3. Select the BAR file that you created for your REST API project. You can find the location of your BAR file by right-clicking it in the IBM Integration Toolkit and viewing its properties.
4. Select Save.
5. Select Refresh listing to update the screen.
6. Verify that the BAR file was successfully uploaded by viewing the API Integration Flow for the API in the Integrations window of the IBM Integration Bus on Cloud.



4. Start the integration flow by selecting the start icon ![Start icon](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/images/a_play_button.jpg). The API starts and displays a status of Running.
5. Select the integration from the list of integrations to view information about it. The tree in the Contents menu displays the REST API and the subflows that are associated with it. You can also view information in the other sections. In the Public Endpoints section, you can view the public URL that IBM Integration Bus on Cloud assigned to your integration flow. Select Show full URL to view the complete URL for that operation.
6. Copy the complete URL for the operation to your clipboard. You need it when you configure the API to work with API Connect. If you enabled Basic Authentication, also note the assigned username and password.





 Integrate the IBM Integration Bus with API Connect. 



1.
In the graphical UI, the browser goes to this dashboard when you click the Artifactory tool integration card. 
 mirror_url optional, updatable String mirror_url The URL of your Artifactory virtual repo where you can view your private repos and a cache of the public repos. 
 name required, updatable String name The name of this tool integration. 
 release_url optional, updatable String release_url The URL of your Artifactory release repo. 
 repository_name optional, updatable String repository_name The name of your Artifactory repo where your Docker images are located. 
 repository_url optional, updatable String repository_url The URL of your Artifactory repo where your Docker images are located. 
 snapshot_url optional, updatable String snapshot_url The URL of your Artifactory snapshot repo. 
 token optional, updatable Password token The Access Token for your Artifactory repo. You can use a toolchain secret reference for this parameter. For more information about toolchain secret references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 type required, updatable String type The repo type for your Artifactory tool integration. 
 user_id optional, updatable String user_id The user ID or email address for your Artifactory repo. 







 Learn more about Artifactory 

To learn more about Artifactory, see the [Artifactory article](https://www.ibm.com/garage/method/practices/deliver/tool_artifactory/) on the IBM Cloud Garage Method.
* How do you set up private networks between Intel® Virtual Servers (x86) and Power Systems Virtual Servers?

See the tutorial on [IBM Power Systems Virtual Server integration with x86-based workloads](https://cloud.ibm.com/media/docs/downloads/power-iaas-tutorials/PowerVS_and_x86_Integration_Tutorial_v1.pdf).
* How do you set up customer site access to a private network by using VPN?

For a complete tutorial on site-to-site Virtual Private Network (VPN) connectivity from an on-premise environment to Power Systems Virtual Server, see [IBM Power Virtual Server Virtual Private Network Connectivity](https://cloud.ibm.com/media/docs/downloads/power-iaas-tutorials/PowerVS_VPN_Tutorial_v1.pdf). For more information on VPN, see [Managing VPN connections](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-VPN-connections).
* What firewall options are there around VPN connectivity?

You must set your own firewall in your IBM Cloud account.
* How do you connect a server instance between two data centers (DAL13 to WDC04)?

You can use IBM Cloud Connect to connect two data centers. IBM Cloud Connect is a software-defined network interconnect service that brings secure connectivity to client locations around the world. For more information, see [Connecting Power Systems Virtual Server instances and networks](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-connecting-networks).

IBM Cloud Connect is only available to IBM clients within the US.
* How is network bandwidth billed?

IBM Cloud Classic environment: Inbound bandwidth is unlimited and not charged. Outbound bandwidth is charged per GB tier with bandwidth offered as an allotment for each month. As an example, for your compute instances, 250 GB is included with each monthly virtual server and 20 TB is included with each monthly bare metal server. Extra bandwidth can also be purchased per packages.
In the graphical UI, the browser goes to this dashboard when you click the Nexus tool integration card. 
 mirror_url optional, updatable String mirror_url The URL of your Nexus virtual repo where you can view your private repos and a cache of the public repos. 
 name required, updatable String name The name of this tool integration. 
 release_url optional, updatable String release_url The URL of your Nexus release repo. 
 snapshot_url optional, updatable String snapshot_url The URL of your Nexus snapshot repo. 
 token optional, updatable Password token The password or token for authenticating with the Nexus repo. You can use a toolchain secret reference for this parameter. For more information about secret references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 type required, updatable String type The repo type for your Nexus tool integration. 
 user_id optional, updatable String user_id The user ID or email address for authenticating with your Nexus repo. 







 Learn more about Nexus 

To learn more about Nexus, see the [Nexus article](https://www.ibm.com/garage/method/practices/deliver/tool_nexus) on the IBM Cloud Garage Method.