vania-janet/multiturn-rag-retrieval-data huggingface dataset:
An egress route from the VPC-spoke#1 subnet (10.174.0.0/24) destined for VPC-spoke#2 (10.174.2.0/24) that hops through the VPC-hub NLB (10.175.0.4), allows the outbound traffic to reach its destination. A similar egress route is created on VPC-spoke#2, which allows the response to also traverse VPC-hub. For workloads in VPC-spoke#1 zone2, a similar egress route is also created for outbound traffic.

Finally, because the NLB might fail over and require an update to the next hop, an ingress route is created with the source as the transit gateway to ensure that the NLB IP is updated on failover. The NLB can update custom routes only within its VPC (VPC-hub) and can't automatically update routes in the spoke VPCs.

Zoom

![Private hub and spoke with transparent VNF and spoke-to-spoke traffic.](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vnf-hub-spoke-scenario.png)

Figure 1: Private hub and spoke with transparent VNF and spoke-to-spoke traffic.





 Use case 2: Active/Active HA transparent VNF (single, multi-zone region VPC) 

Figure 2 illustrates a transparent, highly available Active/Active Virtual Network Function (VNF). This deployment topology ensures that the network and its services are always on, always accessible, and that active sessions are always maintained without disruption.

Because this VNF is transparent, the client (source) makes a TCP request to the target virtual server instance (destination) at 10.241.66.5 instead of the firewall IP address.

An egress custom route was created to ensure client (10.241.0.6) data packets destined for the target (10.241.66.5) will hop through the NLB.
Unless you have manually updated your connection profile, your application needs to use the [Service Discovery](https://hyperledger-fabric.readthedocs.io/en/release-2.2/discovery-overview.html) feature to learn about the peers it needs to submit the transaction to.

 How to fix it 

Use the following steps to [configure anchor peers on your channel](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-governibp-console-govern-channels-anchor-peers). Also, you should verify that you are submitting the transactions against the correct channel and organization MSP id.





 Why are my node operations fail to operate after I create my peer or ordering service? 

It is possible you may experience an error when managing an existing node. When that occurs, it is often useful to consult the node logs.

 What’s happening 

For example, when you try to operate the node, the action might fail.

 Why it’s happening 

After creating a new peer or ordering service, depending on your cluster storage configuration, it may take a few minutes for the nodes to be ready for operation.

 How to fix it 

Check your Kubernetes dashboard and ensure the peer or node status is Running. Then try your action again. If you are still experiencing problems after the node is up, [check your node logs](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-manage-consoleibp-console-manage-console-node-logs) for errors.





 Why does my peer or ordering node fail to start? 

It is possible to experience this error under a variety of conditions.

 What’s happening 

The peer log includes:

[main] InitCmd -> ERRO 001 Cannot run peer because cannot init crypto, folder “/certs/msp” does not exist

or the ordering node log contains:
[Network topology: Integrating with a site-to-site VPN gateway](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-server-use-case-vpn-gateway.png)

Figure 5. Network topology: Integrating with a site-to-site VPN gateway







 Related links 



* [Quotas](https://cloud.ibm.com/docs/vpc?topic=vpc-quotasvpn-server-quotas)
* [Required permissions](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-authorizations-required-for-api-and-cli-callsvpn-server-authorizations-required-for-api-and-cli-calls)
* [Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-vpn-server)
* [VPC CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencevpn-server-clis)
* [VPC API reference](https://cloud.ibm.com/apidocs/vpc)
* [FAQs for client-to-site VPN servers](https://cloud.ibm.com/docs/vpc?topic=vpc-faqs-vpn-server)
* [Troubleshooting client-to-site VPN servers](https://cloud.ibm.com/docs/vpc?topic=vpc-why-do-i-get-an-authentication-error-user-authentication-failed-when-connecting-to-vpn-server)
Backing up and restoring components and networks 

ATTENTION!! IBM Blockchain Platform SaaS Edition is being replaced by IBM Support for Hyperledger Fabric!! IBM Blockchain Platform SaaS Edition will no longer be supported after July 31, 2023. Customers have been directed to migrate their networks by July 31, 2023. After this date, IBM Blockchain Platform SaaS networks that are not migrated to IBM Support for Hyperledger Fabric will be at risk for potential security vulnerabilities. A migration tool is provided from your console, and the disruption to your network is minimal. See [Migrating to IBM Support for Hyperledger Fabric](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-support) for details.

Users might want to back up their components individually or the network generally for a number of reasons. While it's a best practice to back up components before upgrading them to a new Fabric version, network backups can be useful for cases in which a flawed smart contract causes invalid transactions to be written to the ledger. While a proper development and testing cycle for a smart contract catches these errors, it might be necessary to reinstate a previous version of the network before the invalid transactions were written.

Taking snapshots as described in this topic does not protect against the deletion of a component or entire environment by a user. This is because restoring a deleted component or environment requires more information than is stored in a snapshot. Also, when a component or environment is deleted, the original volumes (which contain things like certificates) and all snapshot data are deleted.



 Overview 

As with anything that is deployed to a Kubernetes-based cluster, backups of components and networks in the IBM® Blockchain Platform are a matter of backing up its [persistent volumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/). These volumes are where ledgers and other types of storage are mounted so they can be used by nodes.

As a result, "backing up" a component or a network is the process of saving a copy of the relevant persistent volumes, while "restoring" a component or network involves bringing up components and pointing them to these saved volumes.
OK
Key's associated resources are synchronized successfully



 Required parameters 



* keyID_or_alias

The ID or alias of the key that you want to sync.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. This is required if the user doesn't have permissions on the default key ring.









 Syncing associated resources with the API 

You can notify associated IBM cloud services of your Key Protect root key's lifecycle event by using the Key Protect API.

You can initiate the renotification of a key lifecycle event by making a POST call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/actions/sync



1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. Initiate a manual data synchronization request by running the following curl command.

$ curl -X POST "https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/actions/sync" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"

Replace the variables in the example request according to the following table.





Table 1. Describes the variables that are needed to initiate a re-notification of a key lifecycle event

 Variable Description 

 region Required.
A VPC can be a building block that encapsulates a corporate division (marketing, development, accounting, ...) or a collection of microservices owned by a DevSecOps team. VPCs can be connected to an on-premises enterprise and each other. This may create the need to route traffic through centralized firewall-gateway appliances. This tutorial will walk through the implementation of a hub and spoke architecture depicted in this high-level view:

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Centralize communication through a VPC Transit Hub and Spoke architecture - Part two](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-transit2)Centralize communication through a VPC Transit Hub and Spoke architecture - Part two Solution tutorial

A layered architecture will introduce resources and demonstrate connectivity. Each layer will add additional connectivity and resources. The layers are implemented in Terraform. It will be possible to change parameters, like number of zones, by changing a Terraform variable. A layered approach allows the tutorial to introduce small problems and demonstrate a solution in the context of a complete architecture.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Configure NAT for Internet access from a private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-nat-config-private)Configure NAT for Internet access from a private network Solution tutorial

This tutorial presents the setup of Network Address Translation (NAT) masquerade on a Virtual Router Appliance (VRA) to connect to a secured subnet on the IBM Cloud private network. It builds on the Isolating workloads with a secure private network tutorial, adding a Source NAT (SNAT) configuration, where the source address is obfuscated and firewall rules are used to secure out-bound traffic. More complex NAT configurations can be found in the supplemental VRA documentation.

!
* Remove support for .NET Core SDK 1.0.0-preview4-004233
* Use ASPNETCORE_URLS environment variable to specify port







 5 May 2017 

Updated Node.js buildpack v3.12
: The SDK for Node.js buildpack v3.12 provides IBM SDK for Node.js versions 0.12.17, 0.12.18, 4.8.0, 4.8.2, 6.10.0 and 6.10.2. The default is now changed from the latest 4.x to latest 6.x, so it is currently 6.10.2. Being a major version change, this could affect apps that are relying on the default. See [Node.js version long-term support and the SDK for Node.js buildpack](https://www.ibm.com/blogs/bluemix/2016/11/node-version-support-and-sdk-buildpack/) for more information about how to avoid any problems.

In addition to the new runtimes, this release contains a buildpack bug fix an issue with the App Management Health Center handler and Node.js versions 6.9.5 and 6.10.0.





 27 April 2017 

Updated Liberty buildpack v3.9-20170419-1403
: The default Liberty runtime version 17.0.0.1 was updated to include [PI77770](https://www.ibm.com/support/pages/node/589019), [PI77605](https://www.ibm.com/support/pages/apar/PI77605), [PI79275](https://www.ibm.com/support/pages/apar/PI79275), and PI77438 fixes.



* The monthly Liberty runtime version was updated to the [2017.3.0.0](https://developer.ibm.com/wasdev/blog/2017/03/14/beta-websphere-liberty-tools-march-2017/) release.
As with anything that is deployed to a Kubernetes-based cluster, backups of components and networks in the IBM® Blockchain Platform are a matter of backing up its [persistent volumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/). These volumes are where ledgers and other types of storage are mounted so they can be used by nodes.

As a result, "backing up" a component or a network is the process of saving a copy of the relevant persistent volumes, while "restoring" a component or network involves bringing up components and pointing them to these saved volumes. For more information, check out [Backing up and restoring components and networks](https://cloud.ibm.com/docs/blockchain?topic=blockchain-backup-restore).





 What benefits are available with the new smart contract lifecycle available on nodes and channels running on Fabric v2.x? 

The new smart contract lifecycle allows channel members to collaborate in the decision making process about smart contracts like never before. Where previously smart contracts were instantiated on a channel by a single channel member and other organizations only had the ability to choose whether to install the smart contract, the new lifecycle allows organizations to propose, approve, and commit smart contracts at an organizational level.

This separation of concerns opens exciting new opportunities for collaborating organizations. For example, different organizations can install smart contracts on their peers that contain only the code relevant to their business role and make minor updates to these smart contracts where necessary, without needing to seek new approvals from other organizations.

For a tutorial on how this process is handled by the console, check out [Deploy a smart contract using Fabric v2.x](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-smart-contracts-v2).

For information about to take advantage of the new lifecycle when writing a smart contract, check out [Writing powerful smart contracts](https://cloud.ibm.com/docs/blockchain?topic=blockchain-write-powerful-smart-contracts).





 How can I check and interpret the status of my components through the Kubernetes command line?
Haproxy 8398d1 8895ad [CVE-2023-0361](https://nvd.nist.gov/vuln/detail/CVE-2023-0361). 
 Containerd 1.6.19 1.6.21 For more information, see the [change log](https://github.com/containerd/containerd/releases/tag/v1.6.21) and [security bulletin for CVE-2023-28642 and CVE-2023-27561](https://www.ibm.com/support/pages/node/7001317). 







 Change log for worker node fix pack 1.24.12_1562, released 29 March 2023 

The following table shows the changes that are in the worker node fix pack 1.24.12_1562. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.24.12_1560

 Component Previous Current Description 

 Ubuntu 20.04 packages 5.4.0-144 5.4.0-139 Downgrading kernel to address [Upstream canonical bug](https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2009325). 







 Change log for master fix pack 1.24.12_1559, released 28 March 2023 

The following table shows the changes that are in the master fix pack 1.24.12_1559. Master patch updates are applied automatically.



Changes since version 1.24.10_1557

 Component Previous Current Description 

 Calico configuration N/A N/A Calico configuration now sets container network sysctl tuning for net.ipv4.tcp_keepalive_intvl to 15, net.ipv4.tcp_keepalive_probes to 6 and net.ipv4.tcp_keepalive_time to 40. 
 Cluster health image v1.3.16 v1.3.17 Updated Go to version 1.19.7 and updated dependencies.
To connect your worker nodes and apps to an on-prem data center, you can configure a [VPN IPSec endpoint with a strongSwan service, a Virtual Router Appliance, or with a Fortigate Security Appliance](https://cloud.ibm.com/docs/containers?topic=containers-vpnvpn).





 Network segmentation and privacy for VPC clusters 

To protect your network and limit the range of damage that a user can do when access to a network is granted, you must make sure that your workloads are as isolated as possible and that you limit the number of apps and worker nodes that are publicly exposed.





 What network traffic is allowed for my VPC cluster by default? 

By default, worker nodes are connected to [VPC subnets](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnets) on the private network only and don't have a public network interface. All public ingress to your worker nodes is blocked. Public egress from your worker nodes is only allowed if the workers are connected to a VPC subnet that has a public gateway.

If your worker nodes must access a public endpoint outside of the cluster, you can attach a [public gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpcpublic-gateway-for-external-connectivity) to the VPC subnet that the worker nodes are deployed to. For example, your VPC cluster can automatically connect to other [IBM Cloud services that support private cloud service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint), such as IBM Cloud Container Registry. However, if you need to access IBM Cloud services that support only public cloud service endpoints, you can attach a public gateway to the subnet so that your pods can send requests over the public network. All egress is permitted for worker nodes on a subnet with an attached public gateway, but all ingress is still blocked.
* Introduced two new configurable flags in addon-vpc-block-csi-driver-configmap configMap to enable/disable and edit the retry interval for Snapshot Creation.



* IsSnapshotEnabled allows users to disable or enable snapshot functionality. By default, this parameter is set to true
* CustomSnapshotCreateDelay allows users to edit the maximum delay (in seconds) for snapshot calls in case the source volume is not found and the volume is not attached. The maximum delay allowed is 15 minutes and the default is 5 minutes.









 Change log for version 5.1.8_1970, released 15 May 2023 



* Updates UBI image to 8.7-1107
* Updates Golang to 1.19.8
* Users must determine token exchange URL based on cluster provider. For Satellite clusters, always use the provided token exchange URL. If the URL is not provided, use public IAM endpoint.
* Resolves the following CVEs:



* [CVE-2023-0361](https://nvd.nist.gov/vuln/detail/CVE-2023-0361), [CVE-2023-24536](https://nvd.nist.gov/vuln/detail/CVE-2023-24536), [CVE-2023-24537](https://nvd.nist.gov/vuln/detail/CVE-2023-24537), [CVE-2023-24538](https://nvd.nist.gov/vuln/detail/CVE-2023-24538)









 Change log for version 5.1.6_1872, released 05 April 2023 



* Updates the storage-secret-sidecar image to v1.2.20.
* Updates Golang to v1.19.7.
* Updates the UBI image to 8.7-1085.1679482090
* Resolves the following CVEs:
IBM Cloud RBAC Operator dc1725a 778ef2b Updated to Go version 1.18.6. 
 Key Management Service provider v2.5.9 v2.5.10 Updated Go dependencies and to Go version 1.19.2. 
 Konnectivity agent and server v0.0.32_363_iks v0.0.33_418_iks Updated Konnectivity to version v0.0.33 and added s390x functionality. See the [Konnectivity release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.0.33). 







 Change log for worker node fix pack 1.22.15_1575, released 25 October 2022 

The following table shows the changes that are in the worker node fix pack 1.22.15_1575. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.22.15_1574

 Component Previous Current Description
Red Hat OpenShift on IBM Cloud Metrics Server and toolkit v4.10.0-20220920 v4.10.0-20221104 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.10.0+20221104). 







 Change log for worker node fix pack 4.10.39_1544_openshift, released 11 November 2022 

The following table shows the changes that are in the worker node fix pack 4.10.39_1544_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.10.39_1543_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A N/A 
 RHEL 8 Packages 4.18.0-372.32.1.el8_6 4.18.0-425.3.1.el8 Worker node kernel & package updates for [CVE-2021-36221](https://nvd.nist.gov/vuln/detail/CVE-2021-36221), [CVE-2022-1708](https://nvd.nist.gov/vuln/detail/CVE-2022-1708), [CVE-2022-27191](https://nvd.nist.gov/vuln/detail/CVE-2022-27191), [CVE-2021-41190](https://nvd.nist.gov/vuln/detail/CVE-2021-41190), [CVE-2022-2990](https://nvd.nist.gov/vuln/detail/CVE-2022-2990), [CVE-2022-29162](https://nvd.nist.gov/vuln/detail/CVE-2022-29162), [CVE-2022-
Also, you cannot configure the blockchain console login authentication to use an LDAP user registry at this time.
* What is the process for rotating certificates on a periodic basis?

Similar to how passwords need to be regularly updated, identity certificates need to be renewed, a process also referred to as "certificate rotation". The platform displays certificate expiration dates for components throughout the console. When a certificate expires, transactions on the network will fail because the identity can no longer be trusted. It is your responsibility to monitor those expiration dates and manage your certificate renewal accordingly. The process varies depending on the type of certificate, when it was generated, and for organization admin certificates, whether Node OU support was enabled on the MSP when the identity was enrolled. The platform attempts to renew the peer and ordering node enrollment certificates 30 days before they expire. See [Managing certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmt) to learn more about the types of certificates that you need to monitor and how to renew them.
* What languages are supported for smart contracts?

The IBM Blockchain Platform supports smart contracts that are written in Node.js, Golang (Go), JavaScript, and Java. The new Hyperledger Fabric programming model currently supports JavaScript, TypeScript, Java, and Go. If you are interested in preserving your existing application code, or by using Fabric SDKs for Go, you can still connect to your IBM Blockchain Platform network by using the lower-level Fabric SDK APIs.
* What version of the IBM Blockchain Platform works with the Ansible collection?

Versions 2.1.3 and 2.5.x of the IBM Blockchain Platform can be used with the Ansible collection to deploy a Hyperledger Fabric network.
* How do I get support for running the IBM Blockchain Platform Ansible playbook?

Ansible is an open source technology and this product is not officially supported by IBM. For support related to the usage of the IBM Blockchain Platform and Ansible playbooks use the [GitHub repository](https://github.com/IBM-Blockchain/ansible-collection/issues).