vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Exposing apps in Satellite clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-sat-expose-apps) and [Ingress traffic configuration](https://docs.openshift.com/container-platform/4.10/networking/configuring_ingress_cluster_traffic/overview-traffic.html).





 Related controls in IBM Cloud Framework for Financial Services 

The following IBM Cloud Framework for Financial Services controls are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control
[Configuration management](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/gs_dashboard-reference.svg) <br>Configuration management Build, update and scale application runtime environments with [Schematics Actions](https://cloud.ibm.com/docs/schematics?topic=schematics-how-it-workshow-to-actions) with Ansible playbooks. You can also use Ansible to automate day-2 operations. [Link](https://cloud.ibm.com/docs/schematics?topic=schematics-getting-started-ansible) 
 ![Software deployment](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/gs_virtual-desktop.svg) <br>Software deployment Use a template from our software catalog to install IBM and Third party software in your IBM Cloud Kubernetes Service or Red Hat OpenShift on IBM Cloud clusters, or in other IBM Cloud resources. [Link](https://cloud.ibm.com/docs/schematics?topic=schematics-get-started-software) 
 ![Large-scale environments](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/gs_scale.svg) <br>Deploy large-scale environments Deploy and manage large-scale environments with [Schematics Blueprints](https://cloud.ibm.com/docs/schematics?topic=schematics-get-started-blueprints). Manage the lifecycle of large and complex application infrastructures, created from reusable Terraform based automation modules. Reuse version templates and modules.
(https://cloud.ibm.com/docs-content/v1/content/ad5f41087138b4b1bb795e3b5b0661ac5a105cbd/codeengine/images/confirm.png) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/ad5f41087138b4b1bb795e3b5b0661ac5a105cbd/codeengine/images/confirm.png) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/ad5f41087138b4b1bb795e3b5b0661ac5a105cbd/codeengine/images/confirm.png) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/ad5f41087138b4b1bb795e3b5b0661ac5a105cbd/codeengine/images/confirm.png) 







 IBM Cloud service roles 

Use the following table to identify the service roles that you can grant a user to run any of the following service actions:



Table 2. IAM service roles and actions

 Actions Manager Writer Reader 

 Create items within a project. ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/ad5f41087138b4b1bb795e3b5b0661ac5a105cbd/codeengine/images/confirm.png) ![Checkmark icon.](https://cloud.ibm.com/docs-content/v1/content/ad5f41087138b4b1bb795e3b5b0661ac5a105cbd/codeengine/images/confirm.png)
Working with service bindings to integrate IBM Cloud services with Code Engine 

Find out how to integrate an IBM Cloud service instance to resources in an IBM Cloud® Code Engine project by using service binding.

Service bindings provide applications and jobs access to IBM Cloud services.

If you are using the CLI to work with service bindings, and you have service bindings that were created with a version of the CLI before CLI 1.27.0, see [considerations](https://cloud.ibm.com/docs/codeengine?topic=codeengine-service-bindingconsiderations-previmpl-binding) for information about replacing service bindings that use the previous implementation. To take advantage of the latest enhancements of the CLI, update to the [latest IBM Cloud Code Engine CLI version](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli_versions).



 What is IBM Cloud Code Engine service binding? 

Binding a service instance to a Code Engine application or job automatically adds credentials for a service instance to the environment variables of the container for your application or the job, or the code bundle of your Function. To see the contents of a service credential, go to the dashboard for the service instance and locate the Service credentials page. Service credentials are shown as a JSON object, which, when bound, are added to the application or job environment.

{
"apikey": "xxxxxxx",
"endpoints": "https://control.cloud-object-storage.cloud.ibm.com/v2/endpoints",
"iam_apikey_description": "Auto-generated for key abcdabcd-abcd-4d8c-78cf-abcdabcdabcd",
"iam_apikey_name": "my-object-storage-codeengine-credential",
"iam_role_crn": "crn:v1:bluemix:public:iam::::serviceRole:Writer",
You can use either application or app in your application commands. To see CLI help for the application commands, run ibmcloud ce app -h.

To manage application revisions, see the [ibmcloud ce revision](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-revision) commands.



 ibmcloud ce application bind 

Bind an IBM Cloud service instance to an application.

ibmcloud ce application bind --name APP_NAME (--service-instance SI_NAME | --service-instance-id SI_ID) [--no-wait] [--prefix PREFIX] [--quiet] [--role ROLE] [--service-credential SERVICE_CREDENTIAL] [--wait] [--wait-timeout WAIT_TIMEOUT]



 Command Options 

--name, -n
: The name of the application to bind. This value is required.

--no-wait, --nw
: Bind the service instance and do not wait for the service binding to be ready. If you specify the no-wait option, the service binding creation is started and the command exits without waiting for it to complete. Use the app get command to check the application bind status. This value is optional. The default value is false.

--prefix, -p
: A prefix for environment variables that are created for this service binding. Must contain only uppercase letters, numbers, and underscores (_), and cannot start with a number. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.

--role, -r
: The name of a service role for the new service credential that is created for this service binding. Valid values include Reader, Writer, Manager, or a service-specific role. The option defaults to Manager or the first role provided by the service if Manager is not supported. This option is ignored if --service-credential is specified. This value is optional.
ibmcloud fn undeploy --manifest hello_world_manifest.yml





 More OpenWhisk deployment examples 

The Functions deployment is based on the OpenWhisk deployment project, which has [multiple deployment manifest examples](https://github.com/apache/openwhisk-wskdeploy/blob/master/docs/programming_guide.mdguided-examples) that can be used within Functions. You can use the ibmcloud fn deploy command instead of wskdeploy.





 Deployment manifest specification 

Functions deployment manifests must adhere to the OpenWhisk deployment manifest specification. Refer to the [OpenWhisk deployment manifest specification documentation](https://github.com/apache/openwhisk-wskdeploy/tree/master/specificationopenwhisk-packaging-specification) for details.
* [Update strategies](https://cloud.ibm.com/docs/containers?topic=containers-update_appupdating_apps)
* [Scaling apps](https://cloud.ibm.com/docs/containers?topic=containers-update_appapp_scaling)
* [Managing rolling deployments to update your apps](https://cloud.ibm.com/docs/containers?topic=containers-update_appapp_rolling)
* [Setting up continuous integration and delivery](https://cloud.ibm.com/docs/containers?topic=containers-update_appapp_cicd)
* [Copying deployments to another cluster](https://cloud.ibm.com/docs/containers?topic=containers-update_appcopy_apps_cluster)







 Setting up a service mesh with Istio 

[Getting started with Istio](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsistio-qs)



* [Step 1: Enable the Istio add-on](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsistio-qs-1)
* [Step 2: Set up the BookInfo sample app](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsistio-qs-2)
* [Step 3: Simulate a phased rollout of BookInfo](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsistio-qs-3)
* [Step 4: Monitor BookInfo with IBM Cloud Monitoring](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsistio-qs-4)
* [Step 5: Secure in-cluster traffic by enabling mTLS](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsmtls-qs)
CM-2 (3) - Retention of Previous Configurations 



  Control requirements 

CM-2 (3) - 0
:   The organization retains [Assignment: organization-defined previous versions of baseline configurations of the information system] to support rollback.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether DevSecOps Toolchain collects software bills of materials (SBOM) to provide transparency in build artifacts
*  Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis







  NIST supplemental guidance 

Retaining previous versions of baseline configurations to support rollback may include, for example, hardware, software, firmware, configuration files, and configuration records.
Cloud Functions CLI 

Run these commands to manage the entities that make up your functions.



 Action commands 

Create, invoke, list, and delete actions.

To see CLI help for the action command, run ibmcloud fn action.



 ibmcloud fn action create 

Create an action.

ibmcloud fn action create ACTION_NAME APP_FILE [--annotation ANNOTATION_KEY ANNOTATION_VALUE] [--annotation-file FILE] [--copy] [--docker DOCKER_HUB_USERNAME/IMAGE_NAME] [--kind LANGUAGE] [--logsize LIMIT] [--main ENTRY_METHOD_NAME] [--memory MEMORY_LIMIT] [--native] [--param KEY VALUE] [--param-file FILE] [--sequence ACTION_NAME, ACTION_NAME] [--timeout LIMIT] [--web yes|true|raw|no|false] [--web-secure SECRET]



 Command options 

--annotationANNOTATION_KEYANNOTATION_VALUE, -aANNOTATION_KEYANNOTATION_VALUE
: Annotations are specified in a KEYVALUE format. To include more than one annotation, specify this option for each annotation. This flag is optional.

--annotation-fileFILE, -AFILE
: A JSON file that contains annotation in a KEYVALUE format. This flag is optional.

ACTION_NAME
: The name of the action. To include the action in a package, enter the name in the format PACKAGE_NAME/ACTION_NAME. This value is required.

APP_FILE
: The path to the app file or package to run as an action. This option is required.

--copy
: Treat the action as the name of an existing action.

--dockerDOCKER_HUB_USERNAME/IMAGE_NAME
: The Docker Hub user name and the name of the Docker image in Docker Hub to run the action. This flag is required for creating actions from Docker images.

--kindLANGUAGE
ibmcloud workload-protection compliance platforms (--instance-id INSTANCE_ID | --instance-name INSTANCE_NAME) [--region REGION] [--output FORMAT] [--quiet]



 Platforms command options 

See the [command options](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-workload-protection-compliance-cliss_compliance_options) for a description of each option.







 ibmcloud workload-protection compliance scope-options 

This command returns a list of available scope options in your IBM Cloud Security and Compliance Center Workload Protection instance.

ibmcloud workload-protection compliance scope-options --framework FRAMEWORK --platform PLATFORM [--version VERSION] (--instance-id INSTANCE_ID | --instance-name INSTANCE_NAME) [--region REGION] [--output FORMAT] [--quiet]



 Compliance scope-options command options 

--framework FRAMEWORK
: The name of a framework in your IBM Cloud Security and Compliance Center Workload Protection instance. Available frameworks can be found using the [ibmcloud workload-protection compliance frameworks command.](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-workload-protection-compliance-cliss_compliance_frameworks)

--platform PLATFORM
: The name of a platform in your IBM Cloud Security and Compliance Center Workload Protection instance. Available platforms can be found using the [ibmcloud workload-protection compliance platforms command.](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-workload-protection-compliance-cliss_compliance_platforms)

--version VERSION
: Returns the scope labels and operators for only the specified version. If not specified, Latest is returned.

See the [command options](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-workload-protection-compliance-cliss_compliance_options) for a description of additional options.







 ibmcloud workload-protection compliance tasks
IBM Cloud services that require actions for data events

 Service Upgrade plan Configure the service More info 

 IBM Cloud® App ID ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) [Monitoring runtime activity](https://cloud.ibm.com/docs/appid?topic=appid-at-eventsat-monitor-runtime-activity) 
 IBM Cloud® Object Storage ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) [Enabling Activity Tracker Event Routing](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-atat-console-enable) 
 IBM® Cloudant® for IBM Cloud® ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/checkmark-icon.svg) [Configuring data events for an IBM Cloudant instance](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-at_eventsat_event_configure) 
 IBM® Event Streams for IBM Cloud® !
Navigating to devices 

Use the [IBM Cloud console](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=virtual-servers-navigating-devicesusing-console) to locate your existing IBM Cloud® devices or provision new ones.



  Using the IBM Cloud console to go to your devices 

The following steps use the IBM Cloud console to go to your devices. For more information about working with the console, see [Navigating the IBM Cloud console](https://cloud.ibm.com/docs/overview?topic=overview-uiui).



1.  Log in to the [IBM Cloud console](https://cloud.ibm.com/) by using your unique credentials.
2.  From the Dashboard, click the menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure > Devices.







  Next steps 

Select the applicable management tasks to work with your virtual server instances.
: ibmcloud cf app AppName

Code Engine
: ibmcloud ce app get -n <APPNAME>
: ibmcloud ce job get -n <JOBNAME>
: ibmcloud ce app events -n <APPNAME>
: ibmcloud ce app logs -n <JOBNAME>
: ibmcloud ce jobrun events -n <JOBRUNNAME>
: ibmcloud ce jobrun logs -n <JOBRUNNAME>

You can also view information about your applications and jobs from the [Code Engine console](https://cloud.ibm.com/codeengine/overview).





 Specifying a buildpack version 

Cloud Foundry
: ibmcloud cf push -b https://github.com/cloudfoundry/nodejs-buildpack.gitv1.6.56

Code Engine
: Not supported





 Next steps 



1. Just starting your migration? Check out [Getting started](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-getstart).
2. [Compare Cloud Foundry terminology with Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-terms).
3. [Try out Code Engine with a local build tutorial](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-local).
4. Does your application use service bindings? Check out [Migrating your service bindings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-bind).
5. Learn about [scaling and traffic management](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-scale).
6. Code Engine equivalents to Cloud Foundry commands (current page)
7. Still have questions?
Navigating to devices 

Use the [IBM Cloud console](https://cloud.ibm.com/docs/ssl-certificates?topic=virtual-servers-navigating-devicesusing-console) to locate your existing IBM Cloud® devices or provision new ones.



  Using the IBM Cloud console to go to your devices 

The following steps use the IBM Cloud console to go to your devices. For more information about working with the console, see [Navigating the IBM Cloud console](https://cloud.ibm.com/docs/overview?topic=overview-uiui).



1.  Log in to the [IBM Cloud console](https://cloud.ibm.com/) by using your unique credentials.
2.  From the Dashboard, click the menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure > Devices.







  Next steps 

Select the applicable management tasks to work with your virtual server instances.
* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-2.3control-requirements)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-2.3scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-2.3nist-supplemental-guidance)



[CM-3 - Configuration Change Control](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-3cm-3)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-3control-requirements)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-3additional-ibm-cloud-for-financial-services-specifications)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-3scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-3nist-supplemental-guidance)



[CM-3 (2) - Test / Validate / Document Changes](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cm-3.2cm-3.2)
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Extend controls<br><br><br><br> * Add new control specification (for example, new components)<br><br><br> ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Major rework of profiles<br><br><br><br> * Support for new profile features<br><br><br> ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Reversion<br><br><br><br> * Publish a new version of the profile<br> * Make the updated profile available for attachments<br><br><br> ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 









 Available pre-defined profiles 

Transform your organization with IBM Cloud and attain a standardized level of security and compliance by using the IBM Cloud profiles.

IBM Cloud profiles have been updated to work in the new api-based architecture.



Table 2. IBM Cloud predefined profiles

 Profile Description Release notes 

 CIS IBM Cloud Foundations Benchmark Secure your IBM Cloud Foundations resources with CIS Benchmarks. [!
* [Configuration options](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-configuration_options)
* [Available versions](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-available_versions)



* [Getting started with ASP.NET Core](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-getting_started-dotnet)
* [Getting started with Swift](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-getting-started-swift)
* [Getting started with Go](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-getting-started-go)
* [Getting started with PHP](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-getting-started-php)
* [Getting started with Python](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-getting-started-python)
* [Getting started with Ruby](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-getting-started-ruby)
* [Getting started with Tomcat](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-getting-started-tomcat)
* [Working with a proxy](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-working_with_proxy)



* Managing your apps



* [Custom Domain update required for Cloud Foundry Applications](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-custom_domain_usage)
[ibm_appid_apm](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/appid_apm)<br> * [ibm_appid_application](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/appid_application)<br> * [ibm_appid_application_roles](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/appid_application_roles)<br> * [ibm_appid_application_scopes](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/appid_application_scopes)<br> * [ibm_appid_applications](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/appid_applications)<br> * [ibm_appid_audit_status](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/appid_audit_status)<br> * [ibm_appid_cloud_directory_template