vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Paste the modified JSON that contains only the parameters that you want to update into the Configuration JSON box. For example, if you only need to update the value for the executetimeout field you would paste this JSON into the Configuration JSON box:

{
"chaincode": {
"executetimeout": "30s"
}
}

The ability to update override settings for a peer configuration is not available for peers that have been imported into the console.









 Ordering node deployment 

When you deploy an ordering node, the following advanced deployment options are available:



* [Number of ordering nodes](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-suggested-ordering-node-configurations) - Decide how many ordering nodes are needed.
* [Deployment zone selection ](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-on-k8s-zone) - In a multi-zone cluster, select the zone where the node is deployed.
* [External Certificate Authority configuration](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-third-party-ca) - Use certificates from a third-party CA.
* [Resource allocation](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-orderer-sizing-creation) - Configure the CPU, memory, and storage for the node.
* [Hardware Security Module](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-cfg-hsm) - Configure the ordering node to use an HSM to generate and store private keys.
You will need to share these four files with the operators of the blockchain console in Region 2 and Region 3.







 Step 2: Add a new ordering node in Region 2 

Now that the ordering service is available, we can add nodes to it from the two other regions.

In this section, we create a third ordering node and then add it to the system channel (if applicable) as highlighted in yellow in the diagram below:

Zoom

![Region 2 ordering node](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/mr-ha-os-region2.png)

Figure 3. Create a third ordering node in Region 2

Because all of the actions in this section are performed from the blockchain console in Region 2, log in to the Region 2 console now.



 Import components 

Before you can use the console in Region 2 to add an ordering node to the ordering service, you need to import the components that you set up in the previous cluster.

After you import a node into your console, you can use it create or manage other components in your console. But it is important to understand that the original node remains physically located in the console in Region 1. This means that if you need to view the logs of an imported node, you would need to do that from the cluster in Region 1 where it resides.



1. Import the CA.



* From the Nodes tab, click Add a Certificate Authority, then Import an existing Certificate Authority.
* Click Add file and browse to the Multiregion OS CA_ca.json file that you exported from the console in Region 1 and click Add Certificate Authority.
* Open the imported Multiregion OS CA tile.
* Click Associate identity.
* Specify the enroll ID and secret we used when we created the CA, admin and adminpw then Associate identity.



2. Import the Ordering service.



* From the Nodes tab, click Add ordering service, then Import an existing ordering service.
"order_id": "320afa89017426b994162ab004ce3383",
"basket": [
{
"product_id": "A56",
"title": "Adele - 25",
"category": "Audio CD",
"price": 8.33,
"tax": 0.2,
"quantity": 2
},
{
"product_id": "B32",
"title": "The Lady In The Van - Alan Bennett",
"category": "Paperback book",
"price": 3.49,
"tax": 0,
"quantity": 2
}
],
"account_id": "985522332",
"delivery": {
"option": "Next Day",
"price": 2.99,
"address": {
"street": "17 Front Street",
"town": "Middlemarch",
"postcode": "W1A 1AA"
}
},
"pretax" : 20.15,
"tax" : 3.32,
"total": 26.46
}
Show more

This document provides enough data for a purchase record to render a summary of an order on a web page, or an email, without fetching more records. Notice key details about the order. In particular, see the following details:



* The basket contains reference IDs (product_id) to a database of products stored elsewhere.
* The basket duplicates some of the product data in this record, enough to record the state of the items purchased at the point of sale.
* The document doesn't contain fields that mark the status of the order. More documents would be added later to record payments and delivery.
* The database automatically generates a document _id when it inserts the document into the database.
* A unique identifier (order_id) is supplied with each purchase record to reference the order later.
* [Creating your ordering service organization CA](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-create-orderer-ca)
* [Associating the CA admin identity](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-orderer-ca-admin)
* [Using your CA to register ordering service node and ordering service admin identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-use-CA-orderer)
* [Creating the ordering service organization MSP definition](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-create-orderer-org-msp)
* [Deploy the ordering nodes](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-create-an-orderer)



* [Step three: Join the consortium hosted by the ordering service](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-add-org)



* [Add the organization to the consortium](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-add-org-consortium)
* [Create a TLS identity](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-create-tls-id)
$ curl -X POST "https://us-south.kms.cloud.ibm.com/api/v2/keys/$KEY_ID/actions/rotate" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key_action+json" -d '{
"payload": "'$KEY_MATERIAL_NEW_2'"
}'
Show more



 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Conflict: Action could not be performed on key: Please see reasons for more details (KEY_ROTATION_NOT_PERMITTED)",
"reasons":
{
"code": "KEY_ROTATION_NOT_PERMITTED",
"message": "This root key has been rotated within the last hour: Only one 'rotate' action per hour is permitted",
"status": 409,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect"
}
]
}
]
}









 34 - This root key was created with user-supplied... 



 Message 

This root key was created with user-supplied key material: Key material is required to perform a 'rotate' action

Reason code: KEY_PAYLOAD_REQ_ERR





 HTTP status code 

400 - Bad Request

The HTTP 400 Bad Request response status code indicates that the server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).

The client should not repeat this request without modification.





 Context 

If a root key was created with a key material (payload), then a key material must be specified to rotate the key.

 step 1 - create a root key and provide a key material
Waiting until postgres is running and responding
psql: error: could not read root certificate file "/tls/ca.crt": Permission denied
- The basic command to postgres failed (retry in 5 sec)
psql: error: could not read root certificate file "/tls/ca.crt": Permission denied
- The basic command to postgres failed (retry in 5 sec)
psql: error: could not read root certificate file "/tls/ca.crt": Permission denied
- The basic command to postgres failed (retry in 5 sec)
..
..

Other pods might have similar permission errors. If you look at the SCCs of the pods, you can see they are not restricted. For example, if you run the oc describe pod wa-etcd-0 |grep scc command, you get an output similar to the following example:

openshift.io/scc: fsgroup-scc

To fix this issue, raise the priority of the restricted SCC so that it takes precedence. To do this, complete the following steps:



1. Run the following command:

oc edit scc restricted
2. Change the priority from null to 1.



Now, new Watson Assistant pods default back to the expected restricted SCC. When you run the oc describe pod wa-etcd-0 |grep scc command, you get an output similar to the following example:

openshift.io/scc: restricted





 Unable to collect logs with a webhook 

The following fix applies to all versions of Watson Assistant 4.0.x. If you're unable to collect logs with a webhook, it might be because you are using a webhook that connects to a server that is using a self-signed certificate. If so, complete the following steps to import the certificate into the keystore so that you can collect Watson Assistant logs with a webhook:



1. Log in to cluster and oc project cpd-instance, which is the namespace where the Watson Assistant instance is located.
2. Run the following command.
After you enroll, you have the necessary certificates to register your component with the TLS CA. Run the following command to register the ordering node or peer: fabric-ca-client register --caname <ca_name> --id.name <name> --id.affiliation org1.department1 --id.type peer --id.secret <password> --tls.certfiles <ca_tls_cert_path>
This command is similar to the one that you used to register the component identity with the CA, except that you need to use the TLS CA name. If you are deploying an ordering node instead of a peer, set --id.type to orderer instead of peer. You must provide this identity a different username and password than the one that you used against your default CA. A real register might look similar to the command below: fabric-ca-client register --caname tlsca --id.affiliation org1.department1 --id.name peertls --id.secret peertlspw --id.type peer --tls.certfiles $HOME/fabric-ca-client/catls/tls.pem
You need to save the "enrollid" and "enrollsecret" from the command above for when you create your configuration file.<-- </section "id="section-ibp-v2-apis-config-register-component-tls" "> --><-- <section "id="section-ibp-v2-apis-config-troubleshooting" "> --> Troubleshooting <-- <section "id="section-ibp-v2-apis-config-enroll-error1" "> --> Problem: Error when running the enroll command When running the Fabric CA client enroll command, it is possible the command fails with the following error: Error: Failed to read config file at '/Users/chandra/fabric-ca-client/ca-admin/fabric-ca-client-config.yaml': While parsing config: yaml: line 42: mapping values are not allowed in this context
Follow these instructions to create the peer or single-node ordering service with certificates from an external CA.



1. On the Nodes tab, click Add peer or Add ordering service.
2. Make sure the option to Create the peer or ordering service is selected. Then click Next.
3. After you enter a display name for the node, select the option to use an external CA.
4. Step through the panels and upload the files corresponding to the certificate and private key you gathered.
5. Ensure you select the peer or ordering service organization MSP definition that you imported into the console from the drop-down list.
6. On the last step when you are asked to associate an identity with your peer or ordering service, you need to click New identity.
7. Specify any value as the Display name for this identity. The display name will be visible in the Wallet after you create the node.
8. In the Certificate field, upload the file that contains the Peer or ordering service admin identity certificate.
9. In the Private key field, upload the file that contains the Peer or ordering service admin identity private key.
10. Review the information on the Summary page and click Add peer or Add ordering service.
11. After you have created the peer or ordering node, you can upload the orderer admin identity to the IBM Blockchain console. On the Wallet tab, click Add identity:



* In the Name field, enter an identity name that is used for your reference only.
* In the Certificate field, upload a file that contains the admin identity's signing certificate (in base64 or PEM format).
* In the Private Key field, upload a file that contains the admin identity's private key (in base64 or PEM format).



After you upload the certificate and private key of the identity to the console, you can use the console associate the identity with the peer or ordering node.







 Option 2: Create a five node ordering service using certificates from an external CA 

When you have a paid Kubernetes cluster on IBM Cloud, you have the additional option of deploying a five node ordering service that uses the Raft consensus protocol.
The 401 response will go away as soon as the next billing cycle begins, which is the first day of the calendar month.
* You are trying to use an instance-level API key that you created in one data center location to connect to a service instance that is hosted from another location. You must create an API key in the same data center location where your service instance is hosted.







 Getting Unable to fetch access token for account message 

The full message is, Assistants could not be loaded at this time. Unable to fetch access token for account.

This message is displayed for a few reasons:



* Your IBM Cloud® refresh tokens might have expired. Log out and then log back in to IBM Cloud to generate fresh tokens.
* Make sure that the IBM ID that you logged in with has access to this service instance. To confirm, you can go to the [IBM Cloud resources list](https://cloud.ibm.com/resources), and then log in with the same IBM ID. You should see this service instance listed as one of your available services.







 Getting Authentication Required or Sign in message 

You are being asked for credentials to access a Watson Assistant service instance that you have been able to access without trouble in the past. You might see, Authentication Required: {service-url} is requesting your username and password. or just a Sign in dialog box with fields for a username and password.

This message can be displayed for service instances that were migrated from Cloud Foundry, but for which access roles were not subsequently updated. After the migration, the service instance owner must update the user permissions to ensure that anyone who needs access to the instance is assigned to the appropriate Platform and Service access roles.

To regain access to the service instance, ask the service instance owner to review your access permissions. Ask to be given at least a service access role of Writer.

After your access roles are fixed, be sure to use the correct web address, the URL of the migrated service instance, to open it.





 I don’t see the Analytics page 

To view the Analytics page, you must have a service role of Manager and a platform role of at least Viewer.
public func onAuthorizationFailure(error: AuthorizationError) {
//Exception occurred
}
}

AppID.sharedInstance.loginWidget?.launchForgotPassword(delegate: delegate())
Show more







 Change details 



1. Configure your Cloud Directory [settings](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directorycd-settings) in the GUI. Both Allow users to sign up to your app and Allow users to manage their account from your app must be set to On.
2. In the Password changed tab of the service dashboard, set Password changed email to
3. Call the login widget to start the change details flow.

class delegate : AuthorizationDelegate {
public func onAuthorizationSuccess(accessToken: AccessToken?, identityToken: IdentityToken?, refreshToken: RefreshToken?, response:Response?) {
//User authenticated, and fresh tokens received
}

public func onAuthorizationCanceled() {
//changed details canceled by the user
}

public func onAuthorizationFailure(error: AuthorizationError) {
//Exception occurred
}
}

AppID.sharedInstance.loginWidget?.launchChangeDetails(delegate: delegate())
Show more







 Change password 



1. Configure your Cloud Directory [settings](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directorycd-settings) in the GUI. Both Allow users to sign up to your app and Allow users to manage their account from your app must be set to On.
2. Place the following code in your app to start the change password flow.

class delegate : AuthorizationDelegate {
public func onAuthorizationSuccess(accessToken: AccessToken?, identityToken: IdentityToken?, refreshToken: RefreshToken?, response:Response?) {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Bad Request: Action could not be performed on key: Please see reasons for more details (KEY_PAYLOAD_REQ_ERR)",
"reasons":
{
"code": "KEY_PAYLOAD_REQ_ERR",
"message": "This root key was created with user-supplied key material: Key material is required to perform a 'rotate' action",
"status": 400,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect",
"target": {
"type": "field",
"name": "payload"
}
}
]
}
]
}









 35 - Unauthorized: The user does not have... 



 Message 

Unauthorized: The user does not have access to the specified resource

Reason code: UNAUTHORIZED_ERR





 HTTP status code 

401 - Unauthorized

The HTTP 401 Unauthorized client error status response code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource.

This status is sent with a WWW-Authenticate header that contains information on how to authorize correctly.

This status is similar to 403, but in this case, authentication is possible.





 Context 

This error message is returned when the user does not have access to a resource.

This example applies an instance policy that limits access to a range of IP addresses. When a request from outside the allowed range is received it returns an error.

 limit access to a range of IP addresses
$ curl -X PUT "https://us-south.kms.cloud.ibm.com/api/v2/instance/policies?policy=allowedIP" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.policy+json" -d '{
"metadata": {
Select your destination and click the Edit icon.
3. Disable Reject unauthorized or upload the correct certificate in Resource Authentication.
4. If you choose to upload certificate, upload the PEM certificate file that is to be used to connect to the on-premises system.





* You can verify your certificate file using following command:

openssl s_client -CAfile <CA> -connect <target_host>:<target_port>

Where: CA is the certificate file you uploaded, target is the on-premise endpoint.









 Connection error message: UNABLE_TO_VERIFY_LEAF_SIGNATURE 



 What is happening 

You are trying to implement on-premises client-side TLS by using the Secure Gateway client and the [Reject unauthorized](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destdest-user-auth) of the destination is enabled, but you receive the following error message.

[ERROR] Connection <connection ID> to destination <target host>:<target port> had error: UNABLE_TO_VERIFY_LEAF_SIGNATURE

Where:
- connection ID is a client assigned connection number.
- target is the on-premise endpoint





 Why it is happening 

The destination you defined is missing a client-side certificate.





 How to fix it 



1. In the IBM Cloud UI, go to the Secure Gateway Dashboard.
2. Select your destination and click the Edit icon.
3. Disable Reject unauthorized or upload the correct certificate in Resource Authentication.
4. If you choose to upload certificate, upload the PEM certificate file that is to be used to connect to the on-premises system.





* You can verify your certificate file using following command:

openssl s_client -CAfile <CA> -connect <target_host>:<target_port>

Where: CA is the certificate file you uploaded, target is the on-premise endpoint.









 How can I interactively load an ACL file in the Docker client? 



 What is happening
* [Import components](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-hadr-mr-osibp-console-hadr-mr-os-region3-import)
* [Add fourth and fifth ordering nodes from Region 3](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-hadr-mr-osibp-console-hadr-mr-os-region2-osn3)
* [Add the ordering nodes to the orderer system channel](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-hadr-mr-osibp-console-hadr-mr-os-region3-system)
* [Export the ordering nodes](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-hadr-mr-osibp-console-hadr-mr-os-region3-export)



* [Update the ordering service in Region 1, Region 2, and Region 3.](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-hadr-mr-osibp-console-hadr-mr-os-update)
* [Next steps](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-hadr-mr-osibp-console-hadr-mr-os-next)



[Building a high availability Certificate Authority (CA)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-ha-caibp-console-build-ha-ca)



* [Configuring CA replica sets](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-ha-caibp-console-build-ha-ca-replica-sets)
Contact [IBM Cloud support](https://cloud.ibm.com/docs/containers?topic=containers-get-help) to verify that you account is set up correctly.





 Permissions error 

Message:

The user does not have the necessary classic infrastructure permissions to add servers

'Item' must be ordered with permission.

The credentials could not be validated.

'<Provider>' infrastructure request not authorized

Description and resolution:

You might not have the required permissions to perform the action in your IBM Cloud infrastructure portfolio, or you are using the wrong infrastructure credentials. See [Setting up the API key to enable access to the infrastructure portfolio](https://cloud.ibm.com/docs/containers?topic=containers-access-creds).





 Firewall error 

Message:

Worker unable to talk to IBM Cloud Kubernetes Service servers. Please verify your firewall setup is allowing traffic from this worker.

Description and resolution:

If you have a firewall, [configure your firewall settings to allow outgoing traffic to the appropriate ports and IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_outbound).

Check whether your cluster does not have a public IP by running ibmcloud ks worker ls --cluster <mycluster>. If no public IP is listed, then your cluster has only private VLANs. * If you want the cluster to have only private VLANs, set up your [VLAN connection](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsprivate_clusters) and your [firewall](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_outbound).