vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Use cocoa change-request attachment get instead!

Gets a specific Change Task of a Change Request.

Options:

--provider (Optional) Change Management service provider (choices: 'servicenow', 'servicenow-v3', default: 'servicenow')

Required Environment Variables, if you are using ServiceNow v1 or v2 provider:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables, if you are using ServiceNow v3 provider:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

cocoa change-request task get "CHGXXXXXXX" "CTASKXXXXXXX"





 cocoa change-request task list 

This command is deprecated and will be removed in 2.0.0. Use cocoa change-request attachment list instead!

Lists Change Tasks for a Change Request.

Options:

--provider (Optional) Change Management service provider (choices: 'servicenow', 'servicenow-v3', default: 'servicenow')

Required Environment Variables, if you are using ServiceNow v1 or v2 provider:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables, if you are using ServiceNow v3 provider:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

cocoa change-request task list "<insert-change-request-id-here>"





 cocoa change-request task update 

This command is deprecated and will be removed in 2.0.0. Use cocoa change-request attachment update instead!

Updates a Change Task in a specific Change Request.

Options:

--change-request-id The change request the change task belongs to [string] [required]
--change-task-id The change task id to be updated [string] [required]
Your NLBs are successfully rescheduled onto only edge worker nodes.
* If NLB pods are returned, continue to the next step.







6. If NLB pods are still deployed to non-edge nodes, you can delete the pods so that they redeploy to edge nodes. Important: Delete only one pod at a time, and verify that the pod is rescheduled onto an edge node before you delete other pods.



1. Delete a pod. Example for if one of the webserver-lb NLB pods did not schedule to an edge node:

kubectl delete pod ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-wz6dg
2. Verify that the pod is rescheduled onto an edge worker node. Rescheduling is automatic, but might take a few minutes. Example for the webserver-lb NLB that has an external IP address of 169.46.17.2:

kubectl describe nodes -l dedicated=edge | grep "169-46-17-2"

Example output

ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-wz6dg 5m (0%) 0 (0%) 10Mi (0%) 0 (0%)
ibm-system ibm-cloud-provider-ip-169-46-17-2-76fcb4965d-2z64r 5m (0%) 0 (0%) 10Mi (0%) 0 (0%)



7. Retrieve all existing ALBs in the cluster. Review the command output. For each ALB that has a Status of enabled, note the ALB ID and Build.

ibmcloud ks ingress alb ls --cluster <cluster_name_or_ID>

Example output

ALB ID Enabled State Type Load Balancer Hostname Zone Build Status
- name: test-permission
image: nginx
volumeMounts:
- name: cos-vol
mountPath: /test
volumes:
- name: cos-vol
persistentVolumeClaim:
claimName: <pvc_name>
2. Create the test-permission pod.

oc apply -f test-permission.yaml
3. Log in to your pod.

oc exec test-permission -it bash
4. Navigate to your mount path and list the permissions for your files.

cd test && ls -al

Example output

d--------- 1 root root 0 Jan 1 1970 <file_name>
5. Delete the pod.

oc delete pod test-permission
6. Create a configuration file for the pod that you use to correct the permissions of your files and name it fix-permission.yaml.

apiVersion: v1
kind: Pod
metadata:
name: fix-permission
namespace: <namespace>
spec:
containers:
- name: fix-permission
image: busybox
command: ['sh', '-c']
args: ['chown -R <nonroot_userID> <mount_path>/; find <mount_path>/ -type d -print -exec chmod u=+rwx,g=+rx {} ;']
volumeMounts:
- mountPath: "<mount_path>"
name: cos-volume
volumes:
- name: cos-volume
persistentVolumeClaim:
claimName: <pvc_name>
Show more
7. Create the fix-permission pod.

oc apply -f fix-permission.yaml
8. Wait for the pod to go into a Completed state.

oc get pod fix-permission
9. Delete the fix-permission pod.

oc delete pod fix-permission
10.
5.5.1 IBM Cloud Kubernetes Service can optionally [enable image security enforcement](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-image-sec). 
 5.6.2 IBM Cloud Kubernetes Service does not annotate all pods with [seccomp profiles](https://kubernetes.io/docs/concepts/security/pod-security-policy/seccomp). 
 5.6.3 IBM Cloud Kubernetes Service deploys some system components that do not set a [pod or container securityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). 
 5.6.4 IBM Cloud Kubernetes Service deploys some Kubernetes resources to the default names.
5.5.1 IBM Cloud Kubernetes Service can optionally [Enable image security enforcement](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-image-sec). 
 5.6.2 IBM Cloud Kubernetes Service does not annotate all pods with [seccomp profiles](https://kubernetes.io/docs/concepts/security/pod-security-policy/seccomp). 
 5.6.3 IBM Cloud Kubernetes Service deploys some system components that do not set a [Pod or container securityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). 
 5.6.4 IBM Cloud Kubernetes Service deploys some Kubernetes resources to the default names.
Verify that the replication controller has been changed by navigating to Events tab:

Zoom

![Resource Limits](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution55-openshift-microservices/ocp48-dc-events.png)

Resource Limits







 Enable Autoscaler 

Now that resource limits are configured, the pod autoscaler can be enabled.

By default, the autoscaler allows you to scale based on CPU or Memory. Pods are balanced between the minimum and maximum number of pods that you specify. With the autoscaler, pods are automatically created or deleted to ensure that the average CPU usage of the pods is below the CPU request target as defined. In general, you probably want to start scaling up when you get near 50-90% of the CPU usage of a pod. In our case, 1% can be used with the load being provided.



1. Navigate to Administrator perspective Workloads > HorizontalPodAutoscalers, then click Create HorizontalPodAutoscaler.

Zoom

![HPA](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution55-openshift-microservices/ocp48-hpa.png)

HPA

Replace the contents of the editor with this yaml:

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: patient-hpa
namespace: example-health
spec:
scaleTargetRef:
apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
name: patient-health-frontend
minReplicas: 1
maxReplicas: 10
metrics:
- type: Resource
resource:
Set and enable the [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission&interface=ui) for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security set --cluster CLUSTER [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security set command 

ibmcloud ks cluster master pod-security set --cluster mycluster







 ibmcloud ks cluster master pod-security unset 

Virtual Private Cloud

Classic infrastructure

Remove the [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission&interface=ui) configuration for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security unset --cluster CLUSTER [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security unset command 

ibmcloud ks cluster master pod-security unset --cluster mycluster







 ibmcloud ks cluster master private-service-endpoint allowlist 

Manage a private cloud service endpoint allowlist so that authorized users can access your private cloud service endpoint from only the subnets that are specified in the allowlist.



 ibmcloud ks cluster master private-service-endpoint allowlist add 

Virtual Private Cloud

Classic infrastructure
Show more

The spec.podSelector.matchLabels section lists the labels for the Srv1 back-end service so that the policy applies only to those pods. The spec.ingress.from.NamespaceSelector.matchLabels section lists the label for the finance namespace so that ingress is permitted only from services in that namespace.

Traffic can now flow from finance microservices to the accounts Srv1 back end. The accounts Srv1 back end can respond to finance microservices, but can't establish a reverse traffic connection.

In this example, all traffic from all microservices in the finance namespace is permitted. You can't allow traffic from specific app pods in another namespace because podSelector and namespaceSelector can't be combined.
5.6.3 Apply Security Context to Your Pods and Containers Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-411ibm-remediations-and-explanations-411) Shared 
 5.6.4 The default namespace should not be used Scored 2 Pass Shared 







 IBM remediations and explanations 



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 Red Hat OpenShift on IBM Cloud utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 Red Hat OpenShift on IBM Cloud does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 Red Hat OpenShift on IBM Cloud does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.13 Red Hat OpenShift on IBM Cloud supports [Red Hat OpenShift security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) and [Kubernetes pod security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) which are similar to the deprecated [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
You can then get the necessary dependencies to install the Go smart contract on a 2.x peer by issuing the following command that completes the vendoring of the smart contract:

go mod tidy
go mod vendor

See the [Go documentation](https://golang.org/ref/mod) to learn more about what these commands do.

Package Construction

The following example shows the folder structure of a "marbles" smart contract that uses the fabric-chaincode-go shim before the vendoring process:

├── META-INF
│ └── statedb
│ └── couchdb
│ └── indexes
│ └── indexOwner.json
├── marbles_chaincode.go
└── util
└── util.go

And after the vendoring process, the structure is as follows:

├── META-INF
│ └── statedb
│ └── couchdb
│ └── indexes
│ └── indexOwner.json
├── go.mod
├── go.sum
├── marbles_chaincode.go
├── util
│ └── util.go
└── vendor
├── github.com
│ ├── golang
│ │ └── protobuf
│ └── hyperledger
│ ├── fabric-chaincode-go
│ └── fabric-protos-go
├── golang.org
├── google.golang.org
└── modules.txt
Show more

The source directory must be the smart contract name which is "marbles" in this case. Therefore, the import for the util package in the smart contract would be:
import "marbles/util"

After you have completed these steps, you need to repackage your smart contract using the process that is described in [Packaging smart contracts](https://cloud.ibm.com/docs/blockchain?topic=blockchain-develop-vscodepackaging-a-smart-contract).

Fabric-contract-api and fabric-shim node modules must be at v1.4.5 or greater to work with Node version 12.
In Fabric v1.4.x, the Go chaincode shim and protocol buffers (protos) were included with the Fabric distribution and were included in the Go chaincode runtime in the IBM Blockchain Platform. Starting with v2.0, Fabric now provides the chaincode [shim](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-shim) and protos as separate repositories that need to be imported or "vendored" in Go smart contracts before they can be installed on a peer that runs a Fabric v2.x image. To vendor the shim for your Go smart contract, navigate to your smart contract source folder and initialize the Go module by issuing the following command which creates a go.modfile:

go mod init

Add the required imports to go.mod by running the following command:

go test

The go.mod file will resemble:

module mysmartcontract

go 1.14

require (
github.com/hyperledger/fabric-chaincode-go v0.0.0-20200511190512-bcfeb58dd83a
github.com/hyperledger/fabric-protos-go v0.0.0-20200506201313-25f6564b9ac4
)

or if you are using the Go contract-api, it will resemble:

module github.com/hyperledger/fabric-samples/chaincode/fabcar/go

go 1.13

require github.com/hyperledger/fabric-contract-api-go v1.1.0

You can then get the necessary dependencies to install the Go smart contract on a 2.x peer by issuing the following command that completes the vendoring of the smart contract:

go mod tidy
go mod vendor

See the [Go documentation](https://golang.org/ref/mod) to learn more about what these commands do.

Package Construction

The following example shows the folder structure of a "marbles" smart contract that uses the fabric-chaincode-go shim before the vendoring process:
You can use either the [IBM Developer Tooling](https://github.com/IBM-Blockchain/blockchain-vscode-extension/releases/tag/v2.0.0-beta.3) or the [peer lifecycle chaincode package](https://hyperledger-fabric.readthedocs.io/en/release-2.2/commands/peerlifecycle.htmlpeer-lifecycle-chaincode-package) CLI to package your smart contract.

Smart contracts in .cds format cannot be used with the Fabric 2.0 lifecycle. They need to be repackaged into .tgz format. See the [VS Code tutorial](https://cloud.ibm.com/docs/blockchain?topic=blockchain-develop-vscodepackaging-a-smart-contract) for instructions on how to repackage your smart contract.



 Vendoring smart contracts 

If your smart contract uses the [fabric-chaincode-go](https://github.com/hyperledger/fabric-chaincode-go/tree/main/shim) shim or the [Go contract-api](https://github.com/hyperledger/fabric-contract-api-go) you need to repackage the smart contract before it can be installed on a peer that is running a Fabric v2.x image.

Why is vendoring the shim required?

In Fabric v1.4.x, the Go chaincode shim and protocol buffers (protos) were included with the Fabric distribution and were included in the Go chaincode runtime in the IBM Blockchain Platform. Starting with v2.0, Fabric now provides the chaincode [shim](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-shim) and protos as separate repositories that need to be imported or "vendored" in Go smart contracts before they can be installed on a peer that runs a Fabric v2.x image.
Setting up the IBM Cloud Schematics API 

Before you begin using the IBM Cloud® Schematics API to deploy IBM Spectrum Symphony, review and complete the following prerequisites:



1.  Make sure that you have access to an IBM Cloud account and that you generated an IBM Cloud API key to authenticate to IBM Cloud.
2.  If the GitHub repository that hosts the Terraform code is not public, generate a [personal GitHub access token](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) for authentication. If you are using the [public IBM Cloud GitHub repository](https://github.com/IBM-Cloud/hpc-cluster-symphony), you do not need to complete this task.
3.  Install the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli) and login to the IBM Cloud account through the IBM Cloud CLI.
4.  Install Python 3 or a newer version.
5.  Follow the [IBM Cloud Schematics SDK for Python instructions](https://cloud.ibm.com/apidocs/schematics?code=pythonintroduction) to set up and install the IBM Cloud Schematics API by using pip.
6.  Install all of the respective Python application dependencies that your Python code will be using, such as logging, os, yaml, and json, which are required when you use pip3 to run the application.





  Next steps 

After you've reviewed and completed the prerequisites for setting up the API, you are ready to [Create a workspace](https://cloud.ibm.com/docs/hpc-spectrum-symphony?topic=hpc-spectrum-symphony-creating-workspace&interface=api).
github.com/hyperledger/fabric-chaincode-go v0.0.0-20200511190512-bcfeb58dd83a
github.com/hyperledger/fabric-protos-go v0.0.0-20200506201313-25f6564b9ac4
)

or if you are using the Go contract-api, it will resemble:

module github.com/hyperledger/fabric-samples/chaincode/fabcar/go

go 1.13

require github.com/hyperledger/fabric-contract-api-go v1.1.0

You can then get the necessary dependencies to install the Go smart contract on a 2.x peer by issuing the following command that completes the vendoring of the smart contract:

go mod tidy
go mod vendor

See the [Go documentation](https://golang.org/ref/mod) to learn more about what these commands do.

Package Construction

The following example shows the folder structure of a "marbles" smart contract that uses the fabric-chaincode-go shim before the vendoring process:

├── META-INF
│ └── statedb
│ └── couchdb
│ └── indexes
│ └── indexOwner.json
├── marbles_chaincode.go
└── util
└── util.go

And after the vendoring process, the structure is as follows:

├── META-INF
│ └── statedb
│ └── couchdb
│ └── indexes
│ └── indexOwner.json
├── go.mod
├── go.sum
├── marbles_chaincode.go
├── util
│ └── util.go
└── vendor
├── github.com
│ ├── golang
│ │ └── protobuf
│ └── hyperledger
│ ├── fabric-chaincode-go
│ └── fabric-protos-go
├── golang.org
├── google.golang.org
└── modules.txt
Show more
Setting up the IBM Cloud Schematics API 

Before you begin using the IBM Cloud® Schematics API to deploy IBM Spectrum LSF, review and complete the following prerequisites:



1.  Make sure that you have access to an IBM Cloud account and that you generated an IBM Cloud API key to authenticate to IBM Cloud.
2.  If the GitHub repository that hosts the Terraform code is not public, generate a [personal GitHub access token](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) for authentication. If you are using the [public IBM Cloud GitHub repository](https://github.com/IBM-Cloud/hpc-cluster-lsf), you do not need to complete this task.
3.  Install the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli) and login to the IBM Cloud account through the IBM Cloud CLI.
4.  Install Python 3 or a newer version.
5.  Follow the [IBM Cloud Schematics SDK for Python instructions](https://cloud.ibm.com/apidocs/schematics?code=pythonintroduction) to set up and install the IBM Cloud Schematics API by using pip.
6.  Install all of the respective Python application dependencies that your Python code will be using, such as logging, os, yaml, and json, which are required when you use pip3 to run the application.





  Next steps 

After you've reviewed and completed the prerequisites for setting up the API, you are ready to [Create a workspace](https://cloud.ibm.com/docs/ibm-spectrum-lsf?topic=ibm-spectrum-lsf-creating-workspace&interface=api).
├── marbles_chaincode.go
├── util
│ └── util.go
└── vendor
├── github.com
│ ├── golang
│ │ └── protobuf
│ └── hyperledger
│ ├── fabric-chaincode-go
│ └── fabric-protos-go
├── golang.org
├── google.golang.org
└── modules.txt
Show more

The source directory must be the smart contract name which is "marbles" in this case. Therefore, the import for the util package in the smart contract would be:
import "marbles/util"

After you have completed these steps, you need to repackage your smart contract using the process that is described in [Packaging smart contracts](https://cloud.ibm.com/docs/blockchain?topic=blockchain-develop-vscodepackaging-a-smart-contract).

Fabric-contract-api and fabric-shim node modules must be at v1.4.5 or greater to work with Node version 12. If you are using a smart contract that was originally written to work with Fabric 1.4, check the node modules before deploying your smart contract on a peer that runs a Fabric v2.x image.







 Step two: Install a smart contract 

Use your console to perform these steps:



1. Click the Smart contracts tab to install one or more smart contracts.
2. Click Install smart contract to upload the smart contract package file in [.cds format](https://hyperledger-fabric.readthedocs.io/en/release-1.4/chaincode4noah.htmlpackaging). The smart contract package file must be less than 25 MB in size. You can use the IBM Blockchain Visual Studio Code extension to [create a smart contract package](https://cloud.ibm.com/docs/blockchain?topic=blockchain-develop-vscodepackaging-a-smart-contract). When you install the package from the Smart contracts tab, you can select one or more peer nodes to install the smart contracts on.
If your smart contract uses the [fabric-chaincode-go](https://github.com/hyperledger/fabric-chaincode-go/tree/main/shim) shim or the [Go contract-api](https://github.com/hyperledger/fabric-contract-api-go) you need to repackage the smart contract before it can be installed on a peer that is running a Fabric v2.x image.

Why is vendoring the shim required?

In Fabric v1.4.x, the Go chaincode shim and protocol buffers (protos) were included with the Fabric distribution and were included in the Go chaincode runtime in the IBM Blockchain Platform. Starting with v2.0, Fabric now provides the chaincode [shim](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-shim) and protos as separate repositories that need to be imported or "vendored" in Go smart contracts before they can be installed on a peer that runs a Fabric v2.x image. To vendor the shim for your Go smart contract, navigate to your smart contract source folder and initialize the Go module by issuing the following command which creates a go.modfile:

go mod init

Add the required imports to go.mod by running the following command:

go test

The go.mod file will resemble:

module mysmartcontract

go 1.14

require (
github.com/hyperledger/fabric-chaincode-go v0.0.0-20200511190512-bcfeb58dd83a
github.com/hyperledger/fabric-protos-go v0.0.0-20200506201313-25f6564b9ac4
)

or if you are using the Go contract-api, it will resemble:

module github.com/hyperledger/fabric-samples/chaincode/fabcar/go

go 1.13